Fix race in on shared->array in qsbr code under free-threading.

hawkinsp · hawkinsp · commit 19a72e1097c2 · 2025-02-06T17:13:18.000Z
The read of shared->array should happen under the lock. Fixes python#129732
diff --git a/Python/qsbr.c b/Python/qsbr.c
@@ -205,15 +205,15 @@ _Py_qsbr_reserve(PyInterpreterState *interp)
         }
         _PyEval_StartTheWorld(interp);
     }
-    PyMutex_Unlock(&shared->mutex);
-
-    if (qsbr == NULL) {
-        return -1;
-    }
 
     // Return an index rather than the pointer because the array may be
     // resized and the pointer invalidated.
-    return (struct _qsbr_pad *)qsbr - shared->array;
+    Py_ssize_t index = -1;
+    if (qsbr != NULL) {
+      index = (struct _qsbr_pad *)qsbr - shared->array;
+    }
+    PyMutex_Unlock(&shared->mutex);
+    return index;
 }
 
 void
