Skip to content

Signal handlers don't skip incomplete frames #96754

Closed

Description

@kumaraditya303

Currently signal handlers don't skip incomplete frames and this leads to crash when creating frame object. Incomplete frames should be skipped in _PyErr_CheckSignalsTstate.

Activity

  1. added
    type-bugAn unexpected behavior, bug, or error
    interpreter-core(Objects, Python, Grammar, and Parser dirs)
    3.11only security fixes
    type-crashA hard crash of the interpreter, possibly with a core dump
    3.12only security fixes
    on Sep 11, 2022
  2. mdboom commented on Sep 11, 2022

    @mdboom
    Contributor

    To make sure we aren't playing "whac-a-mole", is there a way to find all of these cases and/or improve the internal API?

  3. kumaraditya303 commented on Sep 12, 2022

    @kumaraditya303
    ContributorAuthor

    It depends upon if the function calls back into python with a frame reference. I don't think these can be found all at once, it requires following the entire call chain and if the callback can be overridden.

  4. mdboom commented on Sep 12, 2022

    @mdboom
    Contributor

    Ok, thanks for the clarification, @kumaraditya303.

  5. markshannon commented on Sep 12, 2022

    @markshannon
    Member

    This looks possible, but extremely unlikely, as AFAICT it can only happen in a C extension called during GC or from a finalizer, which then calls Py_MakePendingCalls

    There may be other cases, but I suspect they are just as obscure.
    We should fix this, and backport it. But I don't think we need worry about it too much.

    @mdboom Looking through the code, there are two other places we don't check whether the frame is valid.
    There aren't that many calls to _PyFrame_GetFrameObject so it easy to check them all.

    @pablogsal Want the fix in 3.11.0 or is 3.11.1 OK?

  6. pablogsal commented on Sep 12, 2022

    @pablogsal
    Member

    3.11.1 unless you think it absolutely needs to go on 3.11.0

  7. kumaraditya303 commented on Sep 12, 2022

    @kumaraditya303
    ContributorAuthor

    To be clear I was only able to reproduce this once, so yeah extremely unlikely but can be hit in pure python but I have no small reproducer.

  8. added a commit that references this issue on Sep 13, 2022
  9. added a commit that references this issue on Sep 13, 2022
  10. added a commit that references this issue on Sep 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.11only security fixes3.12only security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions