ctypes.Pointer.get_contents doesn't hold the object's lock for long enough

@kumaraditya303

Bug report

Bug description:

As @kumaraditya303 mentioned, ctypes.Pointer.get_contents has a thread safety bug that I missed when I originally fixed it.

cpython/Modules/_ctypes/_ctypes.c

Lines 5413 to 5430 in 3b3720f

    
           Pointer_get_contents(PyObject *self, void *closure) 
        
           { 
        
               void *deref = locked_deref(_CDataObject_CAST(self)); 
        
               if (deref == NULL) { 
        
                   PyErr_SetString(PyExc_ValueError, 
        
                                   "NULL pointer access"); 
        
                   return NULL; 
        
               } 
        
               ctypes_state *st = get_module_state_by_def(Py_TYPE(Py_TYPE(self))); 
        
               StgInfo *stginfo; 
        
               if (PyStgInfo_FromObject(st, self, &stginfo) < 0) { 
        
                   return NULL; 
        
               } 
        
               assert(stginfo); /* Cannot be NULL for pointer instances */ 
        
               return PyCData_FromBaseObj(st, stginfo->proto, self, 0, deref); 
        
           }

Dereferencing the pointer is locked, but it's unsafe to call PyCData_FromBaseObj without holding the lock, because the pointer might be invalidated concurrently. I suspect this kind of bug exists with other uses of locked_deref too.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

gh-131974: Fix usages of locked_deref in ctypes #131975

gh-131974: Fix usages of `locked_deref` in `ctypes` (#131975)

Navigation Menu

Repository navigation

`ctypes.Pointer.get_contents` doesn't hold the object's lock for long enough #131974

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	Pointer_get_contents(PyObject self, void closure)
	{
	void *deref = locked_deref(_CDataObject_CAST(self));
	if (deref == NULL) {
	PyErr_SetString(PyExc_ValueError,
	"NULL pointer access");
	return NULL;
	}

	ctypes_state *st = get_module_state_by_def(Py_TYPE(Py_TYPE(self)));
	StgInfo *stginfo;
	if (PyStgInfo_FromObject(st, self, &stginfo) < 0) {
	return NULL;
	}
	assert(stginfo); /* Cannot be NULL for pointer instances */

	return PyCData_FromBaseObj(st, stginfo->proto, self, 0, deref);
	}

ctypes.Pointer.get_contents doesn't hold the object's lock for long enough #131974

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

`ctypes.Pointer.get_contents` doesn't hold the object's lock for long enough #131974