René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"22 free-threading race conditions","articleBody":"# Bug report\n\n### Changes\n\n_2026-05-13_: Filed issue.\n_2026-06-08_: Added new findings (16) and (86).\n\n### Bug description\n\nI found 22 free-threading race conditions during a partial Xint Code scan of cpython. These only apply to the free-threaded build, and were all found and tested on commit 0534774a472424f6b9be2dc4ce9784384bc02401 built with `./configure --disable-gil --enable-asan` on an M3 Mac.\n\nI'm attaching a zip file with detailed writeups of each, as well as reproduction cases for 15 of the 22 issues. I don't have scripts reproducing the findings numbered 21, 36, 82, 94, 106, 115, or 124. Race conditions can be difficult to trigger, and even the scripts I provided are trying to win tight races and may not always work.\n\nI know this is a lot. @colesbury suggested I create a combined issue to make the triage discussion easier.\n\nLet me know if you have any questions or concerns. The issues were found and written up by an automated system, but I have put additional work into the validation and reporting. I do want to be respectful of everyone's time while helping to make Python better.\n\n### Writeups\n\n_2026-05-13_: Initial writeups and test scripts: [cpython-ft.zip](https://github.com/user-attachments/files/27737442/cpython-ft.zip)\n_2026-06-08_: New writeups and test scripts for (16) and (86): [cpython-ft-2026-06-08.zip](https://github.com/user-attachments/files/28698891/cpython-ft-2026-06-08.zip)\n\nMany of the scripts are expected to crash, however some of them only produce exceptions or corrupted output. You should be able to run any of the scripts with `PYTHON_GIL=1` set in your environment if you want to see a baseline without the race condition.\n\n### Finding List\n\n- [ ] (16) Cross-interpreter syslog race\n- [x] ([17](https://github.com/python/cpython/issues/149816)) Unlocked `__init__` races with PRNG state access in `Modules/_randommodule.c`\n- [ ] (21) Racy EVP_MD cache overwrite leaks references in `Modules/_hashopenssl.c`\n- [x] (36) Borrowed type lookup races to use-after-free in `Objects/typeobject.c`\n- [x] ([49](https://github.com/python/cpython/pull/150018)) SNI callback callable race use-after-free in `Modules/_ssl.c`\n- [ ] ([61](https://github.com/python/cpython/pull/150247)) Racy weakref head load before incref in `Objects/typeobject.c`\n- [ ] (62) Concurrent kwargs growth causes heap overwrite in `Objects/call.c`\n- [ ] (69) Unsynchronized extra pointer dereference in len in `Modules/_elementtree.c`\n- [x] ([82](https://github.com/python/cpython/pull/149936)) Non-atomic list slot memmove in shared list delete in `Objects/listobject.c`\n- [x] ([84](https://github.com/python/cpython/pull/150295)) Iterator path bypasses buffered object lock in `Modules/_io/bufferedio.c`\n- [ ] (86) Cross-interpreter XID registry race\n- [ ] (87) Unsynchronized Element.text borrowed-pointer race in `Modules/_elementtree.c`\n- [x] (89) Unsynchronized dict iteration causes borrowed-ref UAF in `Modules/_pickle.c`\n- [x] ([91](https://github.com/python/cpython/pull/150024)) Racy list item borrow causes UAF in `Modules/_pickle.c`\n- [ ] (94) Async-exception setter races thread-state free in `Python/pystate.c`\n- [ ] (96) Racy GC callback list iteration in `Python/gc_free_threading.c`\n- [ ] (106) Immediate decref races lock-free reader in `Modules/_ctypes/_ctypes.c`\n- [ ] (108) Borrowed dict used after lock release in `Objects/dictobject.c`\n- [x] ([115](https://github.com/python/cpython/pull/149914)) Split clear frees keys without QSBR in `Objects/dictobject.c`\n- [ ] (124) Stale keys race in attribute hint fastpath in `Python/bytecodes.c`\n- [x] (125 [wontfix](https://github.com/python/cpython/issues/149816#issuecomment-4446913117)) Struct reinit races with pack/unpack in `Modules/_struct.c`\n- [x] ([128](https://github.com/python/cpython/pull/149909)) Borrowed list item raced before incref in `Objects/bytesobject.c`\n- [ ] (129) Reentrant `__index__` causes released-buffer dereference in `Objects/memoryobject.c`\n- [x] ([132](https://github.com/python/cpython/pull/149858#issue-4452501611)) Non-atomic exports race in memoryview.hex in `Objects/memoryobject.c`\n\n### CPython versions tested on:\n\n3.14\n\n### Operating systems tested on:\n\nmacOS\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-149824\n* gh-149858\n* gh-149875\n* gh-149876\n* gh-149877\n* gh-149909\n* gh-149911\n* gh-149912\n* gh-149914\n* gh-149918\n* gh-149936\n* gh-149997\n* gh-149998\n* gh-150000\n* gh-150003\n* gh-150004\n* gh-150024\n* gh-150029\n* gh-150018\n* gh-150099\n* gh-150100\n* gh-150168\n* gh-150247\n* gh-150295\n* gh-150305\n* gh-150306\n* gh-152296\n* gh-153019\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/lunixbochs","@type":"Person","name":"lunixbochs"},"datePublished":"2026-05-14T01:02:42.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":18},"url":"https://github.com/149816/cpython/issues/149816"}