gh-130019: Fix data race in _PyType_AllocNoTrack (gh-130058)

colesbury · web-flow · commit 0559339ccdc7 · 2025-02-13T11:50:45.000-05:00
The reference count fields, such as `ob_tid` and `ob_ref_shared`, may be
accessed concurrently in the free threading build by a `_Py_TryXGetRef`
or similar operation. The PyObject header fields will be initialized by
`_PyObject_Init`, so only call `memset()` to zero-initialize the remainder
of the allocation.
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
@@ -2251,7 +2251,9 @@ _PyType_AllocNoTrack(PyTypeObject *type, Py_ssize_t nitems)
     if (PyType_IS_GC(type)) {
         _PyObject_GC_Link(obj);
     }
-    memset(obj, '\0', size);
+    // Zero out the object after the PyObject header. The header fields are
+    // initialized by _PyObject_Init[Var]().
+    memset((char *)obj + sizeof(PyObject), 0, size - sizeof(PyObject));
 
     if (type->tp_itemsize == 0) {
         _PyObject_Init(obj, type);
diff --git a/Python/gc.c b/Python/gc.c
@@ -2310,11 +2310,12 @@ PyObject *
 PyUnstable_Object_GC_NewWithExtraData(PyTypeObject *tp, size_t extra_size)
 {
     size_t presize = _PyType_PreHeaderSize(tp);
-    PyObject *op = gc_alloc(tp, _PyObject_SIZE(tp) + extra_size, presize);
+    size_t size = _PyObject_SIZE(tp) + extra_size;
+    PyObject *op = gc_alloc(tp, size, presize);
     if (op == NULL) {
         return NULL;
     }
-    memset(op, 0, _PyObject_SIZE(tp) + extra_size);
+    memset((char *)op + sizeof(PyObject), 0, size - sizeof(PyObject));
     _PyObject_Init(op, tp);
     return op;
 }
diff --git a/Python/gc_free_threading.c b/Python/gc_free_threading.c
@@ -2595,11 +2595,12 @@ PyObject *
 PyUnstable_Object_GC_NewWithExtraData(PyTypeObject *tp, size_t extra_size)
 {
     size_t presize = _PyType_PreHeaderSize(tp);
-    PyObject *op = gc_alloc(tp, _PyObject_SIZE(tp) + extra_size, presize);
+    size_t size = _PyObject_SIZE(tp) + extra_size;
+    PyObject *op = gc_alloc(tp, size, presize);
     if (op == NULL) {
         return NULL;
     }
-    memset(op, 0, _PyObject_SIZE(tp) + extra_size);
+    memset((char *)op + sizeof(PyObject), 0, size - sizeof(PyObject));
     _PyObject_Init(op, tp);
     return op;
 }

Original file line number	Diff line number	Diff line change
`@@ -2310,11 +2310,12 @@ PyObject *`
`2310`	`2310`	`PyUnstable_Object_GC_NewWithExtraData(PyTypeObject *tp, size_t extra_size)`
`2311`	`2311`	`{`
`2312`	`2312`	`size_t presize = _PyType_PreHeaderSize(tp);`
`2313`		`- PyObject *op = gc_alloc(tp, _PyObject_SIZE(tp) + extra_size, presize);`
	`2313`	`+ size_t size = _PyObject_SIZE(tp) + extra_size;`
	`2314`	`+ PyObject *op = gc_alloc(tp, size, presize);`
`2314`	`2315`	`if (op == NULL) {`
`2315`	`2316`	`return NULL;`
`2316`	`2317`	`}`
`2317`		`- memset(op, 0, _PyObject_SIZE(tp) + extra_size);`
	`2318`	`+ memset((char *)op + sizeof(PyObject), 0, size - sizeof(PyObject));`
`2318`	`2319`	`_PyObject_Init(op, tp);`
`2319`	`2320`	`return op;`
`2320`	`2321`	`}`
Original file line number	Diff line number	Diff line change
`@@ -2595,11 +2595,12 @@ PyObject *`
`2595`	`2595`	`PyUnstable_Object_GC_NewWithExtraData(PyTypeObject *tp, size_t extra_size)`
`2596`	`2596`	`{`
`2597`	`2597`	`size_t presize = _PyType_PreHeaderSize(tp);`
`2598`		`- PyObject *op = gc_alloc(tp, _PyObject_SIZE(tp) + extra_size, presize);`
	`2598`	`+ size_t size = _PyObject_SIZE(tp) + extra_size;`
	`2599`	`+ PyObject *op = gc_alloc(tp, size, presize);`
`2599`	`2600`	`if (op == NULL) {`
`2600`	`2601`	`return NULL;`
`2601`	`2602`	`}`
`2602`		`- memset(op, 0, _PyObject_SIZE(tp) + extra_size);`
	`2603`	`+ memset((char *)op + sizeof(PyObject), 0, size - sizeof(PyObject));`
`2603`	`2604`	`_PyObject_Init(op, tp);`
`2604`	`2605`	`return op;`
`2605`	`2606`	`}`