Skip to content

gh-159041: Fix use-after-free in asyncio task tracking during thread state cleanup - #159073

Merged
kumaraditya303 merged 9 commits into
python:mainfrom
ngoldbaum:fix-asyncio-ts-clear
Oct 19, 2026
Merged

kumaraditya303 merged 9 commits into
python:mainfrom
ngoldbaum:fix-asyncio-ts-clear

Conversation

@ngoldbaum

@ngoldbaum ngoldbaum commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor

Centralize transfer of remaining tasks to the interpreter in free_threadstate(), before normal thread-state unlinking and GIL release. Keep memory deallocation separate for initialization failures and deferred daemon-thread cleanup.

Add regression tests for both thread-state and interpreter cleanup paths.

Move lingering asyncio tasks to the interpreter only after all
finalizer-capable thread-state cleanup has completed. Also transfer tasks
created by finalizers during interpreter shutdown.

Add regression tests for both thread-state and interpreter cleanup paths.
@ngoldbaum

Copy link
Copy Markdown
Contributor Author

Ping @colesbury @msullivan since you two have been reviewing asyncio changes recently and Kumar is busy.

@ngoldbaum ngoldbaum changed the title gh-159041: Fix asyncio task tracking during thread state cleanup gh-159041: Fix use-after-free in asyncio task tracking during thread state cleanup Oct 16, 2026
Comment thread Python/pystate.c Outdated
@kumaraditya303
kumaraditya303 merged commit 999855b into python:main Oct 19, 2026
60 checks passed
@kumaraditya303

Copy link
Copy Markdown
Contributor

Thanks.

@kumaraditya303 kumaraditya303 added needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Oct 19, 2026
@miss-islington-app

Copy link
Copy Markdown

Thanks @ngoldbaum for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

@miss-islington-app

Copy link
Copy Markdown

Thanks @ngoldbaum for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

@miss-islington-app

Copy link
Copy Markdown

Sorry, @ngoldbaum and @kumaraditya303, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 999855b07f9b795ca88ac3349060a06c116a1037 3.14

@bedevere-app

bedevere-app Bot commented Oct 19, 2026

Copy link
Copy Markdown

GH-159694 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Oct 19, 2026
kumaraditya303 pushed a commit that referenced this pull request Oct 19, 2026
…thread state cleanup (GH-159073) (#159694)

gh-159041: Fix use-after-free in asyncio task tracking during thread state cleanup (GH-159073)
(cherry picked from commit 999855b)

Co-authored-by: Nathan Goldbaum <nathan.goldbaum@gmail.com>
@bedevere-app

bedevere-app Bot commented Oct 19, 2026

Copy link
Copy Markdown

GH-159695 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Oct 19, 2026
kumaraditya303 added a commit that referenced this pull request Oct 19, 2026
…thread state cleanup (#159073) (#159695)

(cherry picked from commit 999855b)

Co-authored-by: Nathan Goldbaum <nathan.goldbaum@gmail.com>
@bedevere-bot

Copy link
Copy Markdown

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 CentOS9 Refleaks 3.x (tier-1) has failed when building commit 999855b.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/853/builds/4406) and take a look at the build logs.
  4. Check if the failure is related to this commit (999855b) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/853/builds/4406

Failed tests:

  • test_profiling

Failed subtests:

  • test_calling_conventions - test.test_profile.ProfileTest.test_calling_conventions

Summary of the results of the build (if available):

==

Click to see traceback logs
Traceback (most recent call last):
  File "/var/lib/buildbot/worker/cstratak-CentOS9-x86_64/3.x.cstratak-CentOS9-x86_64.refleak/build/Lib/test/test_profile.py", line 90, in test_calling_conventions
    self.assertIn(self.expected_max_output, res,
    ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        "Profiling {0!r} didn't report max:\n{1}".format(stmt, res))
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: ':0(max)' not found in '         2 function calls in -0.001 seconds\n\n   Random listing order was used\n\n   ncalls  tottime  percall  cumtime  percall filename:lineno(function)\n        0    0.000             0.000          profile:0(profiler)\n        1   -0.001   -0.001   -0.001   -0.001 profile:0(max(*([0],), **dict(key=int)))\n        1    0.000    0.000    0.000    0.000 :0(exec)\n\n\n' : Profiling 'max(*([0],), **dict(key=int))' didn't report max:
         2 function calls in -0.001 seconds

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants