Skip to content

gh-151633: avoid use-after-free in Counter.update - #151634

Open
KowalskiThomas wants to merge 15 commits into
python:mainfrom
KowalskiThomas:kowalski/fix-avoid-use-after-free-in-counter-update
Open

gh-151633: avoid use-after-free in Counter.update#151634
KowalskiThomas wants to merge 15 commits into
python:mainfrom
KowalskiThomas:kowalski/fix-avoid-use-after-free-in-counter-update

Conversation

@KowalskiThomas

@KowalskiThomas KowalskiThomas commented Jun 18, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

@bedevere-app bedevere-app Bot mentioned this pull request Jun 18, 2026
Open
eendebakpt
eendebakpt reviewed Jun 18, 2026
View reviewed changes
Comment thread Modules/_collectionsmodule.c Outdated
@KowalskiThomas
KowalskiThomas marked this pull request as ready for review June 18, 2026 12:56
@pedramkarimii pedramkarimii mentioned this pull request Jun 19, 2026
Merged
eendebakpt
eendebakpt reviewed Jul 7, 2026
View reviewed changes
Comment thread Lib/test/test_free_threading/test_collections.py Outdated
Comment thread Lib/test/test_free_threading/test_collections.py Outdated
Comment thread Lib/test/test_free_threading/test_collections.py Outdated
Comment thread Modules/_collectionsmodule.c Outdated
@KowalskiThomas

KowalskiThomas commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Thanks for the review, I'll take a look ASAP.

eendebakpt
eendebakpt reviewed Jul 10, 2026
View reviewed changes
Comment thread Modules/_collectionsmodule.c Outdated
int found;
int cs_err = 0;
PyObject *newval = NULL;
Py_BEGIN_CRITICAL_SECTION(mapping);

@eendebakpt eendebakpt Jul 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The current PR looks good, but I think we can improve a bit more. The locking via the critical section now happens on each iteration, which seems a bit of a waste.

Can we place the critical section outside the while loop and then extract most (all?) of the code into a method _count_elements_dict_lock_held?

@KowalskiThomas KowalskiThomas Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll look into this as soon as possible, thanks for reporting.

@KowalskiThomas KowalskiThomas Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@eendebakpt Sorry, I completely forgot about that for some reason... I just changed it to do what you proposed, let me know how that looks!

@KowalskiThomas
KowalskiThomas force-pushed the kowalski/fix-avoid-use-after-free-in-counter-update branch from 192fc9f to c34c4a2 Compare July 14, 2026 09:16
@KowalskiThomas

KowalskiThomas commented Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Sorry in advance, I had to rebase on main (instead of merge) because Git wouldn't let me "merge unrelated histories"... Not sure what happened there...

@KowalskiThomas

KowalskiThomas commented Aug 23, 2026

Copy link
Copy Markdown
Contributor Author

Just merged main into the branch because there was a conflict!

eendebakpt
eendebakpt reviewed Oct 27, 2026
View reviewed changes
Comment thread Modules/_collectionsmodule.c Outdated
eendebakpt
eendebakpt approved these changes Oct 27, 2026
View reviewed changes

@eendebakpt eendebakpt left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @KowalskiThomas. I added one minor change (also to retrigger the CI), but looks good. Performance for large updates is also improved with these changes, which is a nice side effect.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eendebakpt eendebakpt eendebakpt approved these changes
@rhettinger rhettinger Awaiting requested review from rhettinger rhettinger is a code owner

Assignees

No one assigned

Labels

awaiting merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Concurrent calls to Counter.update can cause a use after free

2 participants

@KowalskiThomas @eendebakpt