Title: Fix race condition when closing jitdump file in perf JIT trampoline by rgfegegeegege · Pull Request #143965 · python/cpython · GitHub
Open Graph Title: Fix race condition when closing jitdump file in perf JIT trampoline by rgfegegeegege · Pull Request #143965 · python/cpython
X Title: Fix race condition when closing jitdump file in perf JIT trampoline by rgfegegeegege · Pull Request #143965 · python/cpython
Description: The perf JIT trampoline code writes to a shared FILE* from multiple threads (perf_map_jit_write_entry can be called concurrently when generating JIT code), but it does so without holding the map_lock. During interpreter shutdown, perf_map_jit_fini() closes the file while holding the lock, but sets perf_map to NULL only after releasing the lock. This opens a small race window where a concurrent write could: read a stale perf_map pointer after fclose(), or call fwrite() on a closed (or NULL) FILE*, leading to undefined behavior (likely a crash or corrupted jitdump file). Although the JIT perf support is experimental and the race is rare, it is a real thread-safety bug. This change fixes it by: Acquiring the map_lock around all writes in perf_map_jit_write_entry(). Adding a double-check after acquiring the lock (in case fini() ran while waiting for the lock). Moving the perf_map = NULL assignment inside the locked section in fini() for consistency. No functional changes in the single-threaded case, and no regression in jitdump file format or perf compatibility. Fixes a potential use-after-close (CWE-910).
Open Graph Description: The perf JIT trampoline code writes to a shared FILE* from multiple threads (perf_map_jit_write_entry can be called concurrently when generating JIT code), but it does so without holding the map_lo...
X Description: The perf JIT trampoline code writes to a shared FILE* from multiple threads (perf_map_jit_write_entry can be called concurrently when generating JIT code), but it does so without holding the map_lo...
Opengraph URL: https://github.com/python/cpython/pull/143965
X: @github
Domain: patch-diff.githubusercontent.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:d1e77629-1c17-0a0d-355c-ee60dd33f35b |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | D5A8:2C86E:6EEDF8:968286:696E7C0C |
| html-safe-nonce | ba1391a9dd61335518a25e76500aa7fb76d552c18136686a5fa99a1300054029 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJENUE4OjJDODZFOjZFRURGODo5NjgyODY6Njk2RTdDMEMiLCJ2aXNpdG9yX2lkIjoiNzMwOTM4MTU3MzI1MTMzMzEzMiIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 2e1f3e1173929edd2f7b48ffca69e5ad8883dae39a09bbc1066c7695bd2b50e5 |
| hovercard-subject-tag | pull_request:3184208225 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/python/cpython/pull/143965/files |
| twitter:image | https://avatars.githubusercontent.com/u/252909975?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/252909975?s=400&v=4 |
| og:image:alt | The perf JIT trampoline code writes to a shared FILE* from multiple threads (perf_map_jit_write_entry can be called concurrently when generating JIT code), but it does so without holding the map_lo... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | fdad15fd2ad43212aa8b8be5f2c2725550f8374ceeeb154a999ad9145b43f3f7 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/python/cpython git https://github.com/python/cpython.git |
| octolytics-dimension-user_id | 1525981 |
| octolytics-dimension-user_login | python |
| octolytics-dimension-repository_id | 81598961 |
| octolytics-dimension-repository_nwo | python/cpython |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 81598961 |
| octolytics-dimension-repository_network_root_nwo | python/cpython |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 27b23bc056eb973d350fc95afc848757edb9e7a9 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width