signalmodule.c in free-threaded Python #161235

Activity

1. aisk

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   topic-free-threading

   on Nov 3, 2026
2. johng commented on Nov 3, 2026

   

   johng

   on Nov 3, 2026

   ContributorAuthor

   More actions

   One approach I've looked at for getsignal UAF is using _PyObject_XDecRefDelayed on the old handler which is also atomically swapped and relying on QSBR. It does not fully solve PyErr_SetInterruptEx since it can be called from C, although this might be a gap with GIL python too.

   swap_handler(int i, PyObject *func)
   {
       /* Store func with an atomic operation to ensure
          that PyErr_SetInterrupt is async-signal-safe. */
       PyObject *old = _Py_atomic_exchange_ptr(&Handlers[i].func,
                                               Py_XNewRef(func));
       PyObject *result = Py_XNewRef(old);
       _PyObject_XDecRefDelayed(old);
       return result;
   }