classification
Title: list_repr not safe against concurrent mutation
Type: crash Stage:
Components: Versions: Python 3.7, Python 3.6, Python 3.5, Python 2.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: pitrou, rhettinger, serhiy.storchaka, vstinner
Priority: normal Keywords:

Created on 2017-06-26 19:56 by pitrou, last changed 2018-07-11 06:37 by serhiy.storchaka.

Files
File name Uploaded Description Edit
siglist.py pitrou, 2017-06-26 20:06
Messages (3)
msg296936 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2017-06-26 19:56
list_repr() is careful to fetch the list size on each iteration.  However, it seems that the list size may be mutated just after by concurrent code, perhaps in _PyUnicodeWriter_WriteASCIIString() or Py_EnterRecursiveCall().

I witnessed this with a signal handler that shrank a list while printing a list from a loop in the main code path.

gdb excerpt:

Program received signal SIGSEGV, Segmentation fault.
0x00000000004a17d6 in PyObject_Repr (v=<unknown at remote 0x7ffff6044670>) at Objects/object.c:485
485	    res = (*v->ob_type->tp_repr)(v);

(gdb) bt
#0  0x00000000004a17d6 in PyObject_Repr (v=<unknown at remote 0x7ffff6044670>) at Objects/object.c:485
#1  0x000000000047eef3 in list_repr (v=0x7ffff68e1d08) at Objects/listobject.c:373
[...]

(gdb) frame 1
#1  0x000000000047eef3 in list_repr (v=0x7ffff68e1d08) at Objects/listobject.c:373
373	        s = PyObject_Repr(v->ob_item[i]);
(gdb) p v
$2 = (PyListObject *) 0x7ffff68e1d08
(gdb) p i
$3 = 19
(gdb) p v->ob_item[18]
$12 = <float at remote 0x7ffff6044628>
(gdb) p v->ob_item[19]
$13 = <unknown at remote 0x7ffff6044670>
(gdb) p ((PyVarObject*)(v))->ob_size
$14 = 19
msg296938 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2017-06-26 20:06
Attaching reproducer script.  I don't know if that is worth fixing.
msg321410 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2018-07-11 06:37
Is it possible to reproduce this issue without involving signal handlers?
History
Date User Action Args
2018-07-11 06:37:57serhiy.storchakasetmessages: + msg321410
2017-06-26 20:06:42pitrousetfiles: + siglist.py

messages: + msg296938
2017-06-26 19:57:05pitrousettype: crash
2017-06-26 19:56:59pitroucreate