classification
Title: subclass of multiprocessing Connection segfault upon attribute acces
Type: crash Stage: needs patch
Components: Interpreter Core Versions: Python 2.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: Arfrever, davin, iritkatriel, neologix, pitrou, superluser
Priority: normal Keywords:

Created on 2015-06-10 19:26 by neologix, last changed 2020-09-28 10:06 by iritkatriel.

Messages (5)
msg245140 - (view) Author: Charles-Fran├žois Natali (neologix) * (Python committer) Date: 2015-06-10 19:26
The following segfaults in _PyObject_GenericGetAttrWithDict:

"""
from socket import socketpair
from _multiprocessing import Connection


class Crash(Connection):
    pass

_, w = socketpair()

Crash(w.fileno()).bar
"""

#0  _PyObject_GenericGetAttrWithDict (dict=0xa6b001c, name=0xb7281020, obj=0x8c12478) at Objects/object.c:1427
#1  PyObject_GenericGetAttr (obj=0x8c12478, name=0xb7281020) at Objects/object.c:1461

(gdb) p *(obj + obj->ob_type->tp_dictoffset)
$8 = {ob_refcnt = 0, ob_type = 0x0}

It's probably not specific to this example, but I'm not familiar enough with object construction/descriptors to know what's going on here.

Note that the following atch fixes the crash, but I don't know why:
"""
--- a/Modules/_multiprocessing/connection.h     Wed Apr 15 19:30:38 2015 +0100
+++ b/Modules/_multiprocessing/connection.h     Wed Jun 10 20:25:15 2015 +0100
@@ -58,7 +58,7 @@
         return NULL;
     }
 
-    self = PyObject_New(ConnectionObject, type);
+    self = type->tp_alloc(type, 0);
     if (self == NULL)
         return NULL;
 
@@ -86,7 +86,7 @@
         CLOSE(self->handle);
         Py_END_ALLOW_THREADS
     }
-    PyObject_Del(self);
+    Py_TYPE(self)->tp_free((PyObject*)self);
 }
 
 /*
"""
msg245356 - (view) Author: Rose Ames (superluser) * Date: 2015-06-15 00:32
Reproduced - the crash exists and the patch fixes it.
msg377574 - (view) Author: Irit Katriel (iritkatriel) * (Python triager) Date: 2020-09-27 16:52
I think this issue is out of date. 

1. I replaced the import statement in the script by "from multiprocessing.connection import Connection" and it gave "AttributeError: 'Crash' object has no attribute 'bar'" rather than a segfault. 

2.  I can't find "ConnectionObject" in the current codebase.
msg377584 - (view) Author: William Pickard (WildCard65) * Date: 2020-09-27 23:31
You did just necro a 5 year old bug report...
msg377591 - (view) Author: Irit Katriel (iritkatriel) * (Python triager) Date: 2020-09-28 10:06
The fact that a bug was discovered a long time ago doesn't say anything about its relevance (hence old issues are not automatically closed). 

In this case I believe the bug is no longer relevant and therefore the issue can be closed.
History
Date User Action Args
2020-09-28 10:06:59iritkatrielsetmessages: + msg377591
2020-09-27 23:31:56WildCard65setnosy: - WildCard65
2020-09-27 23:31:47WildCard65setnosy: + WildCard65
messages: + msg377584
2020-09-27 16:52:42iritkatrielsetnosy: + iritkatriel
messages: + msg377574

components: + Interpreter Core
type: crash
2015-09-21 03:11:26davinsetnosy: + davin
2015-06-15 06:17:57Arfreversetnosy: + Arfrever
2015-06-15 00:32:21superlusersetnosy: + superluser

messages: + msg245356
versions: + Python 2.7
2015-06-10 19:26:55neologixcreate