gh-143545: Fix UAF in lsprof via re-entrant external timer #143550
Conversation
|
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
|
The following commit authors need to sign the Contributor License Agreement: |
| ProfilerEntry *ctxEntry; | ||
| } ProfilerContext; | ||
|
|
||
|
|
There was a problem hiding this comment.
Please avoid changing the formatting of code that you do not touch, as this makes review and backporting more difficult.
| pObj->inCallback = 1; | ||
| self->t0 = call_timer(pObj); | ||
| pObj->inCallback = 0; |
There was a problem hiding this comment.
The indentation is inaccurate.
| @@ -0,0 +1 @@ | |||
| Fix use-after-free in the ``_lsprof`` module when external timer's ``__index__`` method clears the profiler during callback. | |||
There was a problem hiding this comment.
| Fix use-after-free in the ``_lsprof`` module when external timer's ``__index__`` method clears the profiler during callback. | |
| Fix use-after-free in the :mod:`_lsprof` module when external timer's ``__index__`` method clears the profiler during callback. |
There was a problem hiding this comment.
I'm not sure whether we should mention _lsprof here, because it's a private module that users should not use directly. Users interact with it via profile and cProfile, so I think we should describe the news entry in terms of those two modules instead.
| @@ -0,0 +1,37 @@ | |||
| """Test for gh-143545: UAF in lsprof via re-entrant external timer.""" | |||
There was a problem hiding this comment.
Although this happens in the _lsprof module, the user interface and the test code are related to cProfile (and profile), so I think we should move the test case to the test files for those modules.
| double externalTimerUnit; | ||
| int tool_id; | ||
| PyObject* missing; | ||
| int inCallback; |
There was a problem hiding this comment.
Since we are using C11, we can use bool in <stdbool.h> for boolean values.
| try: | ||
| prof._pystart_callback(victim.__code__, 0) | ||
| except (RuntimeError, ValueError): | ||
| pass # Expected if we block the operation |
There was a problem hiding this comment.
If this is expected - maybe we should use with self.assertRaisesRegex?
3 participants
Fix use-after-free in
_lsprofmodule when external timer's__index__method clears the profiler during callback.Problem
prof._pystart_callbackinstalls a newProfilerContextand calls the external timer. If the timer's__index__clears the profiler, it freescurrentProfilerContextwhileinitContextorStopstill writes to it, causing heap-use-after-free.Solution
Added
inCallbackflag toProfilerObjectto preventclearEntriesfrom freeing memory while timer callback is executing.Changes
int inCallbackfield toProfilerObjectstructcall_timer()ininitContextandStopclearEntriesto prevent freeing during callbacktest_lsprof_uaf.pyCloses #143545
initContextvia re-entrant external timer__index__#143545