Repository navigation
Fix use-after-free of pyState at process exit on Linux - #36
Open
SamiAGOURRAM wants to merge 1 commit into
Open
SamiAGOURRAM wants to merge 1 commit into
SamiAGOURRAM wants to merge 1 commit into
Conversation
At exit, glibc runs the C++ static destructors (__run_exit_handlers) before the libraries' destructor functions (_dl_fini). The namespace-scope shared_ptr pyState was therefore already destroyed when onLibraryUnload -> finalizePythonInterpreter assigned it nullptr, and that assignment decremented a reference count in freed memory, corrupting the heap (glibc could then abort in a later free). Keep the state and its mutex in objects that are allocated once and never destroyed, reached through function-local static pointers, so finalizePythonInterpreter always resets a live shared_ptr. It also takes the mutex, as instantiation does.
Owner
|
I'll look at this by tomorrow but thanks for reporting the issue and fixing it! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #35.
At process exit on Linux, glibc runs the C++ static destructors (
__run_exit_handlers) before the libraries' destructor functions (_dl_fini). The namespace-scopestd::shared_ptr<PyState> pyStateis therefore already destroyed whenonLibraryUnload→finalizePythonInterpreterassigns itnullptr, and that assignment decrements a reference count in freed memory.This change keeps the state and its mutex in objects that are allocated once and never destroyed (function-local static pointers), so
finalizePythonInterpreteralways resets a liveshared_ptr; it also takes the mutex, as instantiation does. Nothing else changes; the WindowsDllMainpath is untouched.Checked:
finalizePythonInterpreterresets ashared_ptralready destroyed by static destructors (heap corruption, "corrupted double-linked list") #35): 2 invalid reads infinalizePythonInterpreterwith 0.3.4's library, 0 with this change.master+ this commit),pythonfmu-exportbuilds on Linux (python:3.11-slim, g++ 14, cmake Release). Not built on Windows or macOS.