[Python-checkins] bpo-45262, asyncio: Fix cache of the running loop holder (GH-28796)
miss-islington
webhook-mailer at python.org
Thu Oct 7 19:14:12 EDT 2021
https://github.com/python/cpython/commit/87f0156a229e4cda92ad8e50645c5a71030caf7c
commit: 87f0156a229e4cda92ad8e50645c5a71030caf7c
branch: 3.9
author: Miss Islington (bot) <31488909+miss-islington at users.noreply.github.com>
committer: miss-islington <31488909+miss-islington at users.noreply.github.com>
date: 2021-10-07T16:14:04-07:00
summary:
bpo-45262, asyncio: Fix cache of the running loop holder (GH-28796)
Prevent use-after-free of running loop holder via cache.
(cherry picked from commit 392a89835371baa0fc4bf79ae479abb80661f57d)
Co-authored-by: Matthias Reichl <github at hias.horus.com>
files:
A Misc/NEWS.d/next/Library/2021-10-07-14-04-10.bpo-45262.HqF71Z.rst
M Modules/_asynciomodule.c
diff --git a/Misc/NEWS.d/next/Library/2021-10-07-14-04-10.bpo-45262.HqF71Z.rst b/Misc/NEWS.d/next/Library/2021-10-07-14-04-10.bpo-45262.HqF71Z.rst
new file mode 100644
index 0000000000000..4cd949fe1ed5d
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2021-10-07-14-04-10.bpo-45262.HqF71Z.rst
@@ -0,0 +1 @@
+Prevent use-after-free in asyncio. Make sure the cached running loop holder gets cleared on dealloc to prevent use-after-free in get_running_loop
\ No newline at end of file
diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c
index b615c48c43182..4457d7bd49e23 100644
--- a/Modules/_asynciomodule.c
+++ b/Modules/_asynciomodule.c
@@ -3258,6 +3258,9 @@ new_running_loop_holder(PyObject *loop)
static void
PyRunningLoopHolder_tp_dealloc(PyRunningLoopHolder *rl)
{
+ if (cached_running_holder == (PyObject *)rl) {
+ cached_running_holder = NULL;
+ }
Py_CLEAR(rl->rl_loop);
PyObject_Free(rl);
}
More information about the Python-checkins
mailing list