Possible race condition in signal handling

[kumaraditya303]

The following code segfaults the interpreter on Linux. Tested on current main.

import gc
import _thread

gc.set_threshold(1, 0, 0)

def cb(*args):
    _thread.interrupt_main()


gc.callbacks.append(cb)

def gen():
    yield 1

g = gen()
g.__next__()

Exception ignored in: <function cb at 0x7f7f4f6fe200>
Traceback (most recent call last):
  File "/workspaces/cpython/main.py", line 7, in cb
    _thread.interrupt_main()
KeyboardInterrupt: 
Exception ignored in: <function cb at 0x7f7f4f6fe200>
Traceback (most recent call last):
  File "/workspaces/cpython/main.py", line 7, in cb
    _thread.interrupt_main()
KeyboardInterrupt: 
Exception ignored in: <function cb at 0x7f7f4f6fe200>
Traceback (most recent call last):
  File "/workspaces/cpython/main.py", line 7, in cb
    _thread.interrupt_main()
KeyboardInterrupt: 
Exception ignored in: <function cb at 0x7f7f4f6fe200>
Traceback (most recent call last):
  File "/workspaces/cpython/main.py", line 7, in cb
    _thread.interrupt_main()
KeyboardInterrupt: 
Segmentation fault (core dumped)

Linked PRs

• GH-102397: Fix segfault from race condition in signal handling #102399
• [3.10] GH-102397: Fix segfault from race condition in signal handling (GH-102399) #102527
• [3.11] GH-102397: Fix segfault from race condition in signal handling (GH-102399) #102528

[chgnrdv]

Guess I found a minimal reproducer:

import _thread

class Foo():
    def __del__(self):
        _thread.interrupt_main()

x = Foo()

This, as well as original one, crashes on 3.10.8, 3.11.0 and current main under Linux.

[kumaraditya303]

Yeah, both of these crashes are basically the same, they both crash in compare_handler in signal handling, I am working on a fix.

[kumaraditya303]

Fixed in main and backported, closing.