data race in PyCode_Addr2Line

[kumaraditya303]

The following code leads to data races under TSAN and crashes the interpreter:

import threading

def errback(*args, **kw):
    raise ValueError('error')

for x in range(200):
    threading._start_joinable_thread(errback)
    try:
        threading.setprofile_all_threads("")
    except:
        pass

Data race:

❯ lldb -- ./python.exe main.py
(lldb) target create "./python.exe"
Current executable set to '/Users/kumaraditya/work/cpython/python.exe' (arm64).
(lldb) settings set -- target.run-args  "main.py"
(lldb) r
Process 22774 launched: '/Users/kumaraditya/work/cpython/python.exe' (arm64)
Exception ignored in thread started by <function errback at 0x10881d750>:
Traceback (most recent call last):
  File "/Users/kumaraditya/work/cpython/main.py", line 4, in errback
==================
WARNING: ThreadSanitizer: data race (pid=22774)
  Write of size 8 at 0x0001084e4450 by thread T2:
    #0 allocate_instrumentation_data instrumentation.c:1658 (python.exe:arm64+0x1003f7388)
    #1 force_instrument_lock_held instrumentation.c:1797 (python.exe:arm64+0x1003f76ac)
    #2 instrument_lock_held instrumentation.c:1922 (python.exe:arm64+0x1003f67b0)
    #3 _Py_Instrument instrumentation.c:1930 (python.exe:arm64+0x1003f6588)
    #4 _PyEval_EvalFrameDefault pycore_interpframe.h (python.exe:arm64+0x1003315bc)
    #5 _PyEval_Vector ceval.c:1989 (python.exe:arm64+0x10031f2f8)
    #6 _PyFunction_Vectorcall call.c (python.exe:arm64+0x1000d9b5c)
    #7 _PyVectorcall_Call call.c:273 (python.exe:arm64+0x1000d9550)
    #8 _PyObject_Call call.c:348 (python.exe:arm64+0x1000d9744)
    #9 PyObject_Call call.c:373 (python.exe:arm64+0x1000d9948)
    #10 thread_run _threadmodule.c:387 (python.exe:arm64+0x1005596a0)
    #11 pythread_wrapper thread_pthread.h:234 (python.exe:arm64+0x10046fc60)

  Previous read of size 8 at 0x0001084e4450 by thread T1:
    #0 PyCode_Addr2Line codeobject.c:1014 (python.exe:arm64+0x1000e2c58)
    #1 tb_get_lineno traceback.c:152 (python.exe:arm64+0x100474850)
    #2 _PyTraceBack_Print traceback.c:799 (python.exe:arm64+0x100472348)
    #3 PyTraceBack_Print traceback.c:810 (python.exe:arm64+0x1004727b0)
    #4 write_unraisable_exc errors.c:1605 (python.exe:arm64+0x1003a56ec)
    #5 _PyErr_WriteUnraisableDefaultHook errors.c:1632 (python.exe:arm64+0x1003a517c)
    #6 sys_unraisablehook sysmodule.c:896 (python.exe:arm64+0x10046cb1c)
    #7 cfunction_vectorcall_O methodobject.c:536 (python.exe:arm64+0x100199c1c)
    #8 _PyObject_VectorcallTstate pycore_call.h:169 (python.exe:arm64+0x1000d7d48)
    #9 PyObject_CallOneArg call.c:395 (python.exe:arm64+0x1000d9a48)
    #10 format_unraisable_v errors.c:1729 (python.exe:arm64+0x1003a6638)
    #11 PyErr_FormatUnraisable errors.c:1769 (python.exe:arm64+0x1003a5e24)
    #12 thread_run _threadmodule.c:393 (python.exe:arm64+0x100559778)
    #13 pythread_wrapper thread_pthread.h:234 (python.exe:arm64+0x10046fc60)

  Thread T2 (tid=112313, running) created by main thread at:
    #0 pthread_create <null> (libclang_rt.tsan_osx_dynamic.dylib:arm64e+0x32b00)
    #1 do_start_joinable_thread thread_pthread.h:281 (python.exe:arm64+0x10046ec94)
    #2 PyThread_start_joinable_thread thread_pthread.h:323 (python.exe:arm64+0x10046eadc)
    #3 do_start_new_thread _threadmodule.c:1916 (python.exe:arm64+0x1005591e4)
    #4 thread_PyThread_start_joinable_thread _threadmodule.c:2039 (python.exe:arm64+0x1005577fc)
    #5 cfunction_call methodobject.c:564 (python.exe:arm64+0x10019aafc)
    #6 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x1000d8414)
    #7 _PyObject_VectorcallTstate pycore_call.h:167 (python.exe:arm64+0x1000d7dac)
    #8 PyObject_Vectorcall call.c:327 (python.exe:arm64+0x1000d965c)
    #9 _PyEval_EvalFrameDefault generated_cases.c.h:1620 (python.exe:arm64+0x1003490ec)
    #10 _PyEval_Vector ceval.c:1989 (python.exe:arm64+0x10031f2f8)
    #11 PyEval_EvalCode ceval.c:873 (python.exe:arm64+0x10031ec24)
    #12 run_mod pythonrun.c:1459 (python.exe:arm64+0x1004494d8)
    #13 _PyRun_SimpleFileObject pythonrun.c:521 (python.exe:arm64+0x100443b70)
    #14 _PyRun_AnyFileObject pythonrun.c:81 (python.exe:arm64+0x100443288)
    #15 pymain_run_file main.c:429 (python.exe:arm64+0x10048d7f8)
    #16 Py_RunMain main.c:772 (python.exe:arm64+0x10048c9e0)
    #17 pymain_main main.c:802 (python.exe:arm64+0x10048cf8c)
    #18 Py_BytesMain main.c:826 (python.exe:arm64+0x10048d008)
    #19 main python.c:15 (python.exe:arm64+0x100000a04)

  Thread T1 (tid=112312, running) created by main thread at:
    #0 pthread_create <null> (libclang_rt.tsan_osx_dynamic.dylib:arm64e+0x32b00)
    #1 do_start_joinable_thread thread_pthread.h:281 (python.exe:arm64+0x10046ec94)
    #2 PyThread_start_joinable_thread thread_pthread.h:323 (python.exe:arm64+0x10046eadc)
    #3 do_start_new_thread _threadmodule.c:1916 (python.exe:arm64+0x1005591e4)
    #4 thread_PyThread_start_joinable_thread _threadmodule.c:2039 (python.exe:arm64+0x1005577fc)
    #5 cfunction_call methodobject.c:564 (python.exe:arm64+0x10019aafc)
    #6 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x1000d8414)
    #7 _PyObject_VectorcallTstate pycore_call.h:167 (python.exe:arm64+0x1000d7dac)
    #8 PyObject_Vectorcall call.c:327 (python.exe:arm64+0x1000d965c)
    #9 _PyEval_EvalFrameDefault generated_cases.c.h:1620 (python.exe:arm64+0x1003490ec)
    #10 _PyEval_Vector ceval.c:1989 (python.exe:arm64+0x10031f2f8)
    #11 PyEval_EvalCode ceval.c:873 (python.exe:arm64+0x10031ec24)
    #12 run_mod pythonrun.c:1459 (python.exe:arm64+0x1004494d8)
    #13 _PyRun_SimpleFileObject pythonrun.c:521 (python.exe:arm64+0x100443b70)
    #14 _PyRun_AnyFileObject pythonrun.c:81 (python.exe:arm64+0x100443288)
    #15 pymain_run_file main.c:429 (python.exe:arm64+0x10048d7f8)
    #16 Py_RunMain main.c:772 (python.exe:arm64+0x10048c9e0)
    #17 pymain_main main.c:802 (python.exe:arm64+0x10048cf8c)
    #18 Py_BytesMain main.c:826 (python.exe:arm64+0x10048d008)
    #19 main python.c:15 (python.exe:arm64+0x100000a04)

SUMMARY: ThreadSanitizer: data race instrumentation.c:1658 in allocate_instrumentation_data
==================
(lldb) ThreadSanitizer report breakpoint hit. Use 'thread info -s' to get extended information about the report.
Process 22774 stopped
* thread #4, stop reason = Data race detected
    frame #0: 0x0000000100fb43b0 libclang_rt.tsan_osx_dynamic.dylib`__tsan_on_report
libclang_rt.tsan_osx_dynamic.dylib`__tsan_on_report:
->  0x100fb43b0 <+0>: ret    

libclang_rt.tsan_osx_dynamic.dylib`__tsan::SymbolizeStackId:
    0x100fb43b4 <+0>: cbz    w0, 0x100fb43e4 ; <+48>
    0x100fb43b8 <+4>: pacibsp 
    0x100fb43bc <+8>: stp    x29, x30, [sp, #-0x10]!
Target 0: (python.exe) stopped.

The data race is because while accessing the line no, it is possible that some other thread is modifying the monitoring data, the fix is to acquire critical section on code object so that it doesn't races with allocate_instrumentation_data

Linked PRs

• gh-138661: fix data race in PyCode_Addr2Line #138664
• [3.14] gh-138661: fix data race in PyCode_Addr2Line (GH-138664) #138834