◐ Shell
clean mode source ↗

Issue 40415: _asyncio extensions crashes if initialized multiple times in same process

Issue40415

Created on 2020-04-28 02:27 by indygreg, last changed 2022-04-11 14:59 by admin. This issue is now closed.

Messages (2)
msg367483 - (view) Author: Gregory Szorc (indygreg) * Date: 2020-04-28 02:27
Most of CPython's extensions can be initialized and freed multiple times in the same process. However, _asyncio crashes on at least CPython 3.8.2 when this is done.

STR:

1. Create a new Python interpreter
2. Have it import _asyncio
3. Finalize that interpreter.
4. Create a new Python interpreter
5. Have it import _asyncio

There are probably STR in pure Python by forcing _imp.create_dynamic() to run multiple times after the module is unloaded.

The crash occurs due to unchecked NULL access in `Py_INCREF(all_tasks);` in `PyInit__asyncio()`.

I think the underlying problem is module_init() is short-circuiting because `module_initialized` is set. And `module_initialized` is set on subsequent module loads because `module_free()` isn't clearing it.
msg367484 - (view) Author: Gregory Szorc (indygreg) * Date: 2020-04-28 02:30
Oh, I just went to patch this and it is a dupe of 40294, which has already been fixed and backported.
History
Date User Action Args
2022-04-11 14:59:30adminsetgithub: 84595
2020-04-28 12:44:07vstinnersetsuperseder: Use-after-free crash if multiple interpreters import asyncio module
2020-04-28 02:30:45indygregsetstatus: open -> closed
resolution: duplicate
messages: + msg367484

stage: resolved

2020-04-28 02:27:39indygregsetnosy: + vstinner
2020-04-28 02:27:25indygregcreate