gh-92036: Fix gc_fini_untrack() (GH-92037)

miss-islington · vstinner · web-flow · commit 178a238f25ab · 2022-05-04T03:23:29.000-07:00
Fix a crash in subinterpreters related to the garbage collector. When a subinterpreter is deleted, untrack all objects tracked by its GC. To prevent a crash in deallocator functions expecting objects to be tracked by the GC, leak a strong reference to these objects on purpose, so they are never deleted and their deallocator functions are not called. (cherry picked from commit 1424336) Co-authored-by: Victor Stinner <vstinner@python.org>
diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-04-28-23-37-30.gh-issue-92036.GZJAC9.rst b/Misc/NEWS.d/next/Core and Builtins/2022-04-28-23-37-30.gh-issue-92036.GZJAC9.rst
@@ -0,0 +1,5 @@
+Fix a crash in subinterpreters related to the garbage collector. When a
+subinterpreter is deleted, untrack all objects tracked by its GC. To prevent a
+crash in deallocator functions expecting objects to be tracked by the GC, leak
+a strong reference to these objects on purpose, so they are never deleted and
+their deallocator functions are not called. Patch by Victor Stinner.
diff --git a/Modules/gcmodule.c b/Modules/gcmodule.c
@@ -2170,6 +2170,12 @@ gc_fini_untrack(PyGC_Head *list)
     for (gc = GC_NEXT(list); gc != list; gc = GC_NEXT(list)) {
         PyObject *op = FROM_GC(gc);
         _PyObject_GC_UNTRACK(op);
+        // gh-92036: If a deallocator function expect the object to be tracked
+        // by the GC (ex: func_dealloc()), it can crash if called on an object
+        // which is no longer tracked by the GC. Leak one strong reference on
+        // purpose so the object is never deleted and its deallocator is not
+        // called.
+        Py_INCREF(op);
     }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -2170,6 +2170,12 @@ gc_fini_untrack(PyGC_Head *list)`
`2170`	`2170`	`for (gc = GC_NEXT(list); gc != list; gc = GC_NEXT(list)) {`
`2171`	`2171`	`PyObject *op = FROM_GC(gc);`
`2172`	`2172`	`_PyObject_GC_UNTRACK(op);`
	`2173`	`+ // gh-92036: If a deallocator function expect the object to be tracked`
	`2174`	`+ // by the GC (ex: func_dealloc()), it can crash if called on an object`
	`2175`	`+ // which is no longer tracked by the GC. Leak one strong reference on`
	`2176`	`+ // purpose so the object is never deleted and its deallocator is not`
	`2177`	`+ // called.`
	`2178`	`+ Py_INCREF(op);`
`2173`	`2179`	`}`
`2174`	`2180`	`}`
`2175`	`2181`