Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

atexit.register with bad input segfaults on exit #47916

Closed
devdanzin mannequin opened this issue Aug 24, 2008 · 10 comments
Closed

atexit.register with bad input segfaults on exit #47916

devdanzin mannequin opened this issue Aug 24, 2008 · 10 comments
Assignees
Labels
release-blocker type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@devdanzin
Copy link
Mannequin

devdanzin mannequin commented Aug 24, 2008

BPO 3666
Nosy @smontanaro, @tiran, @devdanzin
Files
  • atexit.diff
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/smontanaro'
    closed_at = <Date 2008-09-23.00:53:09.287>
    created_at = <Date 2008-08-24.20:39:11.492>
    labels = ['type-crash', 'release-blocker']
    title = 'atexit.register with bad input segfaults on exit'
    updated_at = <Date 2008-09-23.00:53:09.286>
    user = 'https://github.com/devdanzin'

    bugs.python.org fields:

    activity = <Date 2008-09-23.00:53:09.286>
    actor = 'skip.montanaro'
    assignee = 'skip.montanaro'
    closed = True
    closed_date = <Date 2008-09-23.00:53:09.287>
    closer = 'skip.montanaro'
    components = []
    creation = <Date 2008-08-24.20:39:11.492>
    creator = 'ajaksu2'
    dependencies = []
    files = ['11519']
    hgrepos = []
    issue_num = 3666
    keywords = ['patch']
    message_count = 10.0
    messages = ['71862', '71866', '71872', '73376', '73378', '73381', '73384', '73590', '73591', '73610']
    nosy_count = 3.0
    nosy_names = ['skip.montanaro', 'christian.heimes', 'ajaksu2']
    pr_nums = []
    priority = 'release blocker'
    resolution = 'fixed'
    stage = None
    status = 'closed'
    superseder = None
    type = 'crash'
    url = 'https://bugs.python.org/issue3666'
    versions = ['Python 3.0']

    @devdanzin
    Copy link
    Mannequin Author

    devdanzin mannequin commented Aug 24, 2008

    The following crashes the interpreter on exit:

    import sys, atexit; atexit.register(lambda: 1, 0, 0, (x for x in (1,2)),
    0, 0); sys.exit()

    Found with Fusil.

    @devdanzin devdanzin mannequin added the type-crash A hard crash of the interpreter, possibly with a core dump label Aug 24, 2008
    @tiran
    Copy link
    Member

    tiran commented Aug 24, 2008

    I'm getting hundreds of lines

    Fatal Python error: PyThreadState_Get: no current thread

    The Python process segfaults in call_ll_exitfuncs -> atexit_cleanup() ->
    atexit_clear() -> atexit_delete_cb -> Py_DECREF(cb->args)

    @tiran
    Copy link
    Member

    tiran commented Aug 24, 2008

    I was able to trace the error to its apartment. During the cleanup
    gen_del calls PyErr_Fetch() which fails in PyThreadState_GET().

    Conclusion:
    The atexit cleanup method must be called much earlier.
    call_ll_exitfunc() is too late. I suggest a new function that calls
    atexit_cleanup() right after atexit_callfuncs().

    @smontanaro
    Copy link
    Contributor

    Why not just have atexit_callfuncs call atexit_cleanup at the end of its
    execution?

    @smontanaro
    Copy link
    Contributor

    The attached patch causes an exception to print
    at exit on my Mac:

    >>> import sys, atexit
    >>> atexit.register(lambda: 1, 0, 0, (x for x in (1,2)), 0, 0)
    <function <lambda> at 0x5c91e0>
    >>> sys.exit()
    Error in atexit._run_exitfuncs:
    TypeError: print_exception(): Exception expected for value, str found

    Without the patch I get the same TypeError but it's
    followed by a Bus error.

    I don't know if the patch is right or wrong, better or worse than the
    status quo, but I'll toss it out there for consideration. It
    certainly seems to subscribe to Christian's theme of calling
    atexit_cleanup() earlier.

    @tiran
    Copy link
    Member

    tiran commented Sep 18, 2008

    Skip:
    I suggest you move the cleanup call before PyErr_Restore(). The current
    code doesn't re-raise exception raised in the cleanup function.

    @smontanaro
    Copy link
    Contributor

    New patch. This also makes the various atexit_*
    functions static.

    @smontanaro
    Copy link
    Contributor

    I've taken this ticket. Can someone please review and give
    it a thumbs up or thumbs down?

    @smontanaro smontanaro self-assigned this Sep 22, 2008
    @tiran
    Copy link
    Member

    tiran commented Sep 22, 2008

    *thumbs up*

    @smontanaro
    Copy link
    Contributor

    Checked in as revision 66562.

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Labels
    release-blocker type-crash A hard crash of the interpreter, possibly with a core dump
    Projects
    None yet
    Development

    No branches or pull requests

    4 participants