Skip to content

gh-142829: Fix use-after-free in Context.__eq__ via re-entrant ContextVar.set #142905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
kumaraditya303 merged 3 commits into from
Jan 9, 2026
Merged

gh-142829: Fix use-after-free in Context.__eq__ via re-entrant ContextVar.set #142905

kumaraditya303 merged 3 commits into from
Jan 9, 2026
+55 −5

Conversation

@Abdoulrasheed
Copy link
Contributor

@Abdoulrasheed Abdoulrasheed commented Dec 17, 2025 •
edited by bedevere-app bot
Loading

This fix holds strong references to the HAMT objects and their keys/values during comparison in _PyHamt_Eq, preventing premature deallocation.

@Abdoulrasheed Abdoulrasheed requested a review from 1st1 as a code owner December 17, 2025 20:02
@bedevere-app bedevere-app bot mentioned this pull request Dec 17, 2025
Open
sobolevn
sobolevn approved these changes Dec 20, 2025
View reviewed changes
Copy link
Member

@sobolevn sobolevn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is what we commonly do to solve such issues.

@kumaraditya303
Copy link
Contributor

kumaraditya303 commented Dec 20, 2025

Can you add a test which does the same but with __hash__? I suspect that has the same issue.

@Abdoulrasheed
Copy link
Contributor Author

Abdoulrasheed commented Dec 20, 2025

Can you add a test which does the same but with __hash__? I suspect that has the same issue.

@kumaraditya303 I think __hash__ on values isn't called during Context comparison. only keys are hashed, and ContextVar uses a pre-computed hash. But I've added a test for it just to be safe.

@Abdoulrasheed
Copy link
Contributor Author

Abdoulrasheed commented Jan 8, 2026

commented

@kumaraditya303 Gentle reminder on this.

@kumaraditya303 kumaraditya303 merged commit a4086d7 into python:main Jan 9, 2026
46 checks passed
@serhiy-storchaka serhiy-storchaka added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jan 9, 2026
@miss-islington-app
Copy link

miss-islington-app bot commented Jan 9, 2026

Thanks @Abdoulrasheed for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

@miss-islington-app
Copy link

miss-islington-app bot commented Jan 9, 2026

Thanks @Abdoulrasheed for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

@miss-islington-app
Copy link

miss-islington-app bot commented Jan 9, 2026

Sorry, @Abdoulrasheed and @kumaraditya303, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker a4086d7f89e5d388e4ffcdb13e4fba0255234286 3.13

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jan 9, 2026
@Abdoulrasheed @miss-islington
pythongh-142829: Fix use-after-free in Context.__eq__ via re-entran…
579dafa 
…t `ContextVar.set` (pythonGH-142905)

(cherry picked from commit a4086d7)

Co-authored-by: A.Ibrahim <abdulrasheedibrahim47@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Jan 9, 2026

GH-143627 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Jan 9, 2026
kumaraditya303 pushed a commit that referenced this pull request Jan 10, 2026
@miss-islington @Abdoulrasheed
[3.14] gh-142829: Fix use-after-free in Context.__eq__ via re-entra…
16efe85 
…nt `ContextVar.set` (GH-142905) (#143627)

gh-142829: Fix use-after-free in `Context.__eq__` via re-entrant `ContextVar.set` (GH-142905)
(cherry picked from commit a4086d7)

Co-authored-by: A.Ibrahim <abdulrasheedibrahim47@gmail.com>
@picnixz
Copy link
Member

picnixz commented Jan 10, 2026

Looks like backport to 3.13 failed. @kumaraditya303

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sobolevn sobolevn sobolevn approved these changes

@kumaraditya303 kumaraditya303 kumaraditya303 approved these changes

@1st1 1st1 Awaiting requested review from 1st1 1st1 is a code owner

Assignees

@kumaraditya303 kumaraditya303

Labels

needs backport to 3.13 bugs and security fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Abdoulrasheed @kumaraditya303 @picnixz @sobolevn @serhiy-storchaka