René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Race in `type_set_qualname` leads to memory corruption under free-threading","articleBody":"# Crash report\n\n### What happened?\n\n`type_set_qualname` (`Objects/typeobject.c`) updates `ht_qualname` with `Py_SETREF(et-\u003eht_qualname, Py_NewRef(value))` and no synchronisation. `Py_SETREF` reads the old pointer, stores the new one, then decrefs the old, all three in a non-atomic way.\n\nhttps://github.com/python/cpython/blob/c5516e7e371f7b273eb37c7b65f14ef14ee81f11/Objects/typeobject.c#L1582-L1599\n\nIf two threads concurrently assign `MyClass.__qualname__`, they both capture the same old pointer, both store their own new value, and both decref the old one.  \nA concurrent reader in `type_qualname` loading the old pointer after the writer's store but before its decref, then calling `Py_INCREF` after the decref zeroes the refcount would increment the reference count of a freed `pymalloc` block which is a use after free.\n\n`type_set_name` has a stop-the-world fence (added in #137302 / #133467) which prevents this; `type_set_qualname` does not and is currently not protected.\n\n---\n\n**Reproducer**\n\nThe reproducer is caught as erroring by ASan and TSan, but the segmentation fault does not come from `setqualname` itself. I believe that is because the memory corruption happens in `setqualname` but only manifests later when memory is reused.\n\n```py\nimport threading\n\nclass Victim: pass\n\ndef _unique(prefix: str, i: int) -\u003e str:\n    return prefix + str(i)\n\ndef writer_a():\n    for i in range(500_000):\n        Victim.__qualname__ = _unique(\"A\", i)\n\ndef writer_b():\n    for i in range(500_000):\n        Victim.__qualname__ = _unique(\"B\", i)\n\ndef reader():\n    for _ in range(500_000):\n        _ = Victim.__qualname__\n\nthreads = [threading.Thread(target=f) for f in (writer_a, writer_b, reader)]\nfor t in threads: t.start()\nfor t in threads: t.join()\n```\n\nUnder ASAN, results in...\n\n```\n=================================================================\n==33670==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x0001260e0b39,0x0001260e0b3e) and [0x0001260e0b38, 0x0001260e0b3d) overlap\n    #0 0x000103c8d8e4 in __asan_memcpy\n    #1 0x0001027858cc in _copy_characters\n    #2 0x0001027c15d0 in PyUnicode_Concat\n    #3 0x0001028c7824 in _PyEval_EvalFrameDefault\n    ...\n    #13 0x000102b96214 in thread_run\n    #14 0x000102a53bac in pythread_wrapper\n\nAddress 0x0001260e0b39 is a wild pointer inside of access range of size 0x000000000005.\nSUMMARY: AddressSanitizer: memcpy-param-overlap in _copy_characters\n==33670==ABORTING\n```\n\nand with TSan\n\n```\n==================\nWARNING: ThreadSanitizer: data race (pid=86130)\n  Write of size 8 at 0x000308162258 by thread T2:\n    #0 Py_SET_TYPE object.h:207 (python.exe:arm64+0x1001d5024)\n    #1 _PyObject_Init pycore_object.h:488 (python.exe:arm64+0x1001d5024)\n    #2 PyUnicode_New unicodeobject.c:1330 (python.exe:arm64+0x1001d5024)\n    #3 PyUnicode_Concat unicodeobject.c:11337 (python.exe:arm64+0x1001f6da8)\n    #4 _PyEval_EvalFrameDefault generated_cases.c.h:292 (python.exe:arm64+0x100292c48)\n    #5 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028fe04)\n    #6 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028fe04)\n    #7 _PyFunction_Vectorcall call.c (python.exe:arm64+0x1000914bc)\n    #8 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100092c3c)\n    #9 _PyObject_VectorcallPrepend call.c:855 (python.exe:arm64+0x100092c3c)\n    #10 method_vectorcall classobject.c:55 (python.exe:arm64+0x100095fdc)\n    #11 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x1002dcde0)\n    #12 context_run context.c:728 (python.exe:arm64+0x1002dcde0)\n    #13 method_vectorcall_FASTCALL_KEYWORDS descrobject.c:421 (python.exe:arm64+0x1000a8644)\n    #14 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100090e80)\n    #15 PyObject_Vectorcall call.c:327 (python.exe:arm64+0x100090e80)\n    #16 _Py_VectorCallInstrumentation_StackRefSteal ceval.c:766 (python.exe:arm64+0x100290910)\n    #17 _PyEval_EvalFrameDefault generated_cases.c.h:1846 (python.exe:arm64+0x100295fa0)\n    #18 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028fe04)\n    #19 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028fe04)\n    #20 _PyFunction_Vectorcall call.c (python.exe:arm64+0x1000914bc)\n    #21 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100092c3c)\n    #22 _PyObject_VectorcallPrepend call.c:855 (python.exe:arm64+0x100092c3c)\n    #23 method_vectorcall classobject.c:55 (python.exe:arm64+0x100095fdc)\n    #24 _PyVectorcall_Call call.c:273 (python.exe:arm64+0x10009112c)\n    #25 _PyObject_Call call.c:348 (python.exe:arm64+0x10009112c)\n    #26 PyObject_Call call.c:373 (python.exe:arm64+0x1000911a4)\n    #27 thread_run _threadmodule.c:388 (python.exe:arm64+0x10044b6f4)\n    #28 pythread_wrapper thread_pthread.h:234 (python.exe:arm64+0x10038a0d4)\n\n  Previous read of size 8 at 0x000308162258 by thread T3:\n    #0 _Py_Dealloc object.c:3285 (python.exe:arm64+0x10013fcb8)\n    #1 _Py_DecRefSharedDebug object.c:426 (python.exe:arm64+0x10013ff34)\n    #2 _Py_DecRefShared object.c:433 (python.exe:arm64+0x10013ff34)\n    #3 Py_DECREF refcount.h:385 (python.exe:arm64+0x1002aa034)\n    #4 PyStackRef_XCLOSE pycore_stackref.h:726 (python.exe:arm64+0x1002aa034)\n    #5 _PyEval_EvalFrameDefault generated_cases.c.h:11850 (python.exe:arm64+0x1002aa034)\n    #6 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028fe04)\n    #7 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028fe04)\n    #8 _PyFunction_Vectorcall call.c (python.exe:arm64+0x1000914bc)\n    #9 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100092c3c)\n    #10 _PyObject_VectorcallPrepend call.c:855 (python.exe:arm64+0x100092c3c)\n    #11 method_vectorcall classobject.c:55 (python.exe:arm64+0x100095fdc)\n    #12 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x1002dcde0)\n    #13 context_run context.c:728 (python.exe:arm64+0x1002dcde0)\n    #14 method_vectorcall_FASTCALL_KEYWORDS descrobject.c:421 (python.exe:arm64+0x1000a8644)\n    #15 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100090e80)\n    #16 PyObject_Vectorcall call.c:327 (python.exe:arm64+0x100090e80)\n    #17 _Py_VectorCallInstrumentation_StackRefSteal ceval.c:766 (python.exe:arm64+0x100290910)\n    #18 _PyEval_EvalFrameDefault generated_cases.c.h:1846 (python.exe:arm64+0x100295fa0)\n    #19 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028fe04)\n    #20 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028fe04)\n    #21 _PyFunction_Vectorcall call.c (python.exe:arm64+0x1000914bc)\n    #22 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100092c3c)\n    #23 _PyObject_VectorcallPrepend call.c:855 (python.exe:arm64+0x100092c3c)\n    #24 method_vectorcall classobject.c:55 (python.exe:arm64+0x100095fdc)\n    #25 _PyVectorcall_Call call.c:273 (python.exe:arm64+0x10009112c)\n    #26 _PyObject_Call call.c:348 (python.exe:arm64+0x10009112c)\n    #27 PyObject_Call call.c:373 (python.exe:arm64+0x1000911a4)\n    #28 thread_run _threadmodule.c:388 (python.exe:arm64+0x10044b6f4)\n    #29 pythread_wrapper thread_pthread.h:234 (python.exe:arm64+0x10038a0d4)\n\n  Thread T2 (tid=5631578, running) created by main thread at:\n    #0 pthread_create \u003cnull\u003e (libclang_rt.tsan_osx_dynamic.dylib:arm64+0x31d84)\n    #1 do_start_joinable_thread thread_pthread.h:281 (python.exe:arm64+0x1003892a8)\n    #2 PyThread_start_joinable_thread thread_pthread.h:323 (python.exe:arm64+0x1003890e0)\n    #3 ThreadHandle_start _threadmodule.c:475 (python.exe:arm64+0x10044b500)\n    #4 do_start_new_thread _threadmodule.c:1919 (python.exe:arm64+0x10044afcc)\n    #5 thread_PyThread_start_joinable_thread _threadmodule.c:2042 (python.exe:arm64+0x10044a034)\n    #6 cfunction_call methodobject.c:564 (python.exe:arm64+0x100138744)\n    #7 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x10009030c)\n    #8 _PyObject_VectorcallTstate pycore_call.h:142 (python.exe:arm64+0x100090f14)\n    #9 PyObject_Vectorcall call.c:327 (python.exe:arm64+0x100090f14)\n    #10 _Py_VectorCall_StackRefSteal ceval.c:724 (python.exe:arm64+0x1002901d0)\n    #11 _PyEval_EvalFrameDefault generated_cases.c.h:3528 (python.exe:arm64+0x100299cc4)\n    #12 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028f9dc)\n    #13 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028f9dc)\n    #14 PyEval_EvalCode ceval.c:677 (python.exe:arm64+0x10028f9dc)\n    #15 builtin_exec_impl bltinmodule.c:1261 (python.exe:arm64+0x100289470)\n    #16 builtin_exec bltinmodule.c.h:676 (python.exe:arm64+0x100289470)\n    #17 _Py_BuiltinCallFastWithKeywords_StackRef ceval.c:839 (python.exe:arm64+0x100297b54)\n    #18 _PyEval_EvalFrameDefault generated_cases.c.h:2508 (python.exe:arm64+0x100297b54)\n    #19 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028fe04)\n    #20 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028fe04)\n    #21 _PyFunction_Vectorcall call.c (python.exe:arm64+0x1000914bc)\n    #22 _PyVectorcall_Call call.c:285 (python.exe:arm64+0x100091074)\n    #23 _PyObject_Call call.c:348 (python.exe:arm64+0x100091074)\n    #24 PyObject_Call call.c:373 (python.exe:arm64+0x1000911a4)\n    #25 pymain_start_pyrepl main.c:311 (python.exe:arm64+0x1003a3f58)\n    #26 pymain_run_stdin main.c:571 (python.exe:arm64+0x1003a3794)\n    #27 pymain_run_python main.c:718 (python.exe:arm64+0x1003a28c4)\n    #28 Py_RunMain main.c:796 (python.exe:arm64+0x1003a28c4)\n    #29 pymain_main main.c:826 (python.exe:arm64+0x1003a2b78)\n    #30 Py_BytesMain main.c:850 (python.exe:arm64+0x1003a2c78)\n    #31 main python.c:15 (python.exe:arm64+0x100000a78)\n\n  Thread T3 (tid=5631579, running) created by main thread at:\n    #0 pthread_create \u003cnull\u003e (libclang_rt.tsan_osx_dynamic.dylib:arm64+0x31d84)\n    #1 do_start_joinable_thread thread_pthread.h:281 (python.exe:arm64+0x1003892a8)\n    #2 PyThread_start_joinable_thread thread_pthread.h:323 (python.exe:arm64+0x1003890e0)\n    #3 ThreadHandle_start _threadmodule.c:475 (python.exe:arm64+0x10044b500)\n    #4 do_start_new_thread _threadmodule.c:1919 (python.exe:arm64+0x10044afcc)\n    #5 thread_PyThread_start_joinable_thread _threadmodule.c:2042 (python.exe:arm64+0x10044a034)\n    #6 cfunction_call methodobject.c:564 (python.exe:arm64+0x100138744)\n    #7 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x10009030c)\n    #8 _PyObject_VectorcallTstate pycore_call.h:142 (python.exe:arm64+0x100090f14)\n    #9 PyObject_Vectorcall call.c:327 (python.exe:arm64+0x100090f14)\n    #10 _Py_VectorCall_StackRefSteal ceval.c:724 (python.exe:arm64+0x1002901d0)\n    #11 _PyEval_EvalFrameDefault generated_cases.c.h:3528 (python.exe:arm64+0x100299cc4)\n    #12 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028f9dc)\n    #13 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028f9dc)\n    #14 PyEval_EvalCode ceval.c:677 (python.exe:arm64+0x10028f9dc)\n    #15 builtin_exec_impl bltinmodule.c:1261 (python.exe:arm64+0x100289470)\n    #16 builtin_exec bltinmodule.c.h:676 (python.exe:arm64+0x100289470)\n    #17 _Py_BuiltinCallFastWithKeywords_StackRef ceval.c:839 (python.exe:arm64+0x100297b54)\n    #18 _PyEval_EvalFrameDefault generated_cases.c.h:2508 (python.exe:arm64+0x100297b54)\n    #19 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028fe04)\n    #20 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028fe04)\n    #21 _PyFunction_Vectorcall call.c (python.exe:arm64+0x1000914bc)\n    #22 _PyVectorcall_Call call.c:285 (python.exe:arm64+0x100091074)\n    #23 _PyObject_Call call.c:348 (python.exe:arm64+0x100091074)\n    #24 PyObject_Call call.c:373 (python.exe:arm64+0x1000911a4)\n    #25 pymain_start_pyrepl main.c:311 (python.exe:arm64+0x1003a3f58)\n    #26 pymain_run_stdin main.c:571 (python.exe:arm64+0x1003a3794)\n    #27 pymain_run_python main.c:718 (python.exe:arm64+0x1003a28c4)\n    #28 Py_RunMain main.c:796 (python.exe:arm64+0x1003a28c4)\n    #29 pymain_main main.c:826 (python.exe:arm64+0x1003a2b78)\n    #30 Py_BytesMain main.c:850 (python.exe:arm64+0x1003a2c78)\n    #31 main python.c:15 (python.exe:arm64+0x100000a78)\n\nSUMMARY: ThreadSanitizer: data race object.h:207 in Py_SET_TYPE\n==================\nThreadSanitizer:DEADLYSIGNAL\n==86130==ERROR: ThreadSanitizer: SEGV on unknown address 0x606d13baabcbbf10 (pc 0x000105999350 bp 0x00016d481c70 sp 0x00016d481c30 T5631578)\n==86130==The signal is caused by a READ memory access.\n    #0 __tsan::MemoryAccess(__tsan::ThreadState*, unsigned long, unsigned long, unsigned long, unsigned long) \u003cnull\u003e (libclang_rt.tsan_osx_dynamic.dylib:arm64+0x71350)\n    #1 mi_block_nextx internal.h:640 (python.exe:arm64+0x10014bf40)\n    #2 mi_block_next internal.h:669 (python.exe:arm64+0x10014bf40)\n    #3 _mi_page_thread_free_collect page.c:200 (python.exe:arm64+0x10014bf40)\n    #4 _mi_page_free_collect page.c:230 (python.exe:arm64+0x10014bf40)\n    #5 _mi_free_delayed_block alloc.c:628 (python.exe:arm64+0x100158f78)\n    #6 _mi_heap_delayed_free_partial page.c:337 (python.exe:arm64+0x100158f78)\n    #7 _mi_malloc_generic page.c:947 (python.exe:arm64+0x10014a99c)\n    #8 _mi_heap_malloc_zero_ex alloc.c (python.exe:arm64+0x100166114)\n    #9 _mi_heap_malloc_zero alloc.c:179 (python.exe:arm64+0x100166114)\n    #10 mi_heap_malloc alloc.c:183 (python.exe:arm64+0x100166114)\n    #11 _PyObject_MiMalloc obmalloc.c:307 (python.exe:arm64+0x100166114)\n    #12 PyObject_Malloc obmalloc.c:1706 (python.exe:arm64+0x1001691cc)\n    #13 PyUnicode_New unicodeobject.c:1326 (python.exe:arm64+0x1001d5014)\n    #14 long_to_decimal_string_internal longobject.c:2233 (python.exe:arm64+0x1000f6e04)\n    #15 long_to_decimal_string longobject.c:2323 (python.exe:arm64+0x1000ffd18)\n    #16 object_str typeobject.c:7502 (python.exe:arm64+0x10019ee68)\n    #17 PyObject_Str object.c:826 (python.exe:arm64+0x10014102c)\n    #18 _PyEval_EvalFrameDefault generated_cases.c.h:4650 (python.exe:arm64+0x10029b8dc)\n    #19 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028fe04)\n    #20 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028fe04)\n    #21 _PyFunction_Vectorcall call.c (python.exe:arm64+0x1000914bc)\n    #22 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100092c3c)\n    #23 _PyObject_VectorcallPrepend call.c:855 (python.exe:arm64+0x100092c3c)\n    #24 method_vectorcall classobject.c:55 (python.exe:arm64+0x100095fdc)\n    #25 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x1002dcde0)\n    #26 context_run context.c:728 (python.exe:arm64+0x1002dcde0)\n    #27 method_vectorcall_FASTCALL_KEYWORDS descrobject.c:421 (python.exe:arm64+0x1000a8644)\n    #28 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100090e80)\n    #29 PyObject_Vectorcall call.c:327 (python.exe:arm64+0x100090e80)\n    #30 _Py_VectorCallInstrumentation_StackRefSteal ceval.c:766 (python.exe:arm64+0x100290910)\n    #31 _PyEval_EvalFrameDefault generated_cases.c.h:1846 (python.exe:arm64+0x100295fa0)\n    #32 _PyEval_EvalFrame pycore_ceval.h:122 (python.exe:arm64+0x10028fe04)\n    #33 _PyEval_Vector ceval.c:2134 (python.exe:arm64+0x10028fe04)\n    #34 _PyFunction_Vectorcall call.c (python.exe:arm64+0x1000914bc)\n    #35 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100092c3c)\n    #36 _PyObject_VectorcallPrepend call.c:855 (python.exe:arm64+0x100092c3c)\n    #37 method_vectorcall classobject.c:55 (python.exe:arm64+0x100095fdc)\n    #38 _PyVectorcall_Call call.c:273 (python.exe:arm64+0x10009112c)\n    #39 _PyObject_Call call.c:348 (python.exe:arm64+0x10009112c)\n    #40 PyObject_Call call.c:373 (python.exe:arm64+0x1000911a4)\n    #41 thread_run _threadmodule.c:388 (python.exe:arm64+0x10044b6f4)\n    #42 pythread_wrapper thread_pthread.h:234 (python.exe:arm64+0x10038a0d4)\n    #43 __tsan_thread_start_func \u003cnull\u003e (libclang_rt.tsan_osx_dynamic.dylib:arm64+0x31cf4)\n    #44 _pthread_start \u003cnull\u003e (libsystem_pthread.dylib:arm64e+0x6c54)\n    #45 thread_start \u003cnull\u003e (libsystem_pthread.dylib:arm64e+0x1c18)\n\nSUMMARY: ThreadSanitizer: SEGV internal.h:640 in mi_block_nextx\n==86130==ABORTING\nzsh: abort      ../cpython-nogil-tsan/python.exe\n```\n\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nmacOS\n\n### Output from running 'python -VV' on the command line:\n\n_No response_\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-150859\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/KowalskiThomas","@type":"Person","name":"KowalskiThomas"},"datePublished":"2026-06-03T14:26:34.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/150858/cpython/issues/150858"}