gh-158200: Harden faulthandler code metadata reads

Author: Alishahryar1

Lib/test/test_faulthandler.py

@@ -707,6 +707,67 @@ def test_dump_traceback_later(self):
     def test_dump_traceback_later_repeat(self):
         self.check_dump_traceback_later(repeat=True)
 
+    @threading_helper.requires_working_threading()
+    def test_dump_traceback_later_concurrent_code_deallocation(self):
+        code = dedent("""
+            import faulthandler
+            import os
+            import threading
+            import time
+            import types
+
+            stop = threading.Event()
+            started = threading.Event()
+
+            def template():
+                return 1
+
+            def churn_frames():
+                started.set()
+                while not stop.is_set():
+                    code = template.__code__.replace()
+                    function = types.FunctionType(code, {})
+                    function()
+
+            worker = threading.Thread(target=churn_frames)
+            worker.start()
+            started.wait()
+
+            with open(os.devnull, "w") as output:
+                faulthandler.dump_traceback_later(
+                    1e-6, repeat=True, file=output)
+                try:
+                    time.sleep(0.1)
+                finally:
+                    faulthandler.cancel_dump_traceback_later()
+                    stop.set()
+                    worker.join()
+        """)
+        script_helper.assert_python_ok(
+            '-c', code, PYTHONMALLOC='debug')
+
+    @threading_helper.requires_working_threading()
+    @support.requires_gil_enabled()
+    def test_dump_traceback_later_does_not_wait_for_gil(self):
+        code = dedent("""
+            import faulthandler
+            import sys
+
+            sys.setswitchinterval(3600.0)
+            faulthandler.dump_traceback_later(0.05, exit=True)
+            while True:
+                pass
+        """)
+        with support.SuppressCrashReport():
+            process = subprocess.run(
+                [sys.executable, '-I', '-c', code],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                timeout=support.SHORT_TIMEOUT,
+            )
+        self.assertEqual(process.returncode, 1)
+        self.assertIn(b'Timeout', process.stderr)
+
     def test_dump_traceback_later_cancel(self):
         self.check_dump_traceback_later(cancel=True)
 

Misc/NEWS.d/next/Library/2026-09-25-19-00-00.gh-issue-158200.uaf.rst

@@ -0,0 +1,3 @@
+Improve :func:`faulthandler.dump_traceback_later` when another thread
+concurrently frees code metadata. The traceback walker now detects common
+freed-memory states instead of dereferencing them.

Objects/codeobject.c

@@ -10,6 +10,7 @@
 #include "pycore_interpframe.h"   // FRAME_SPECIALS_SIZE
 #include "pycore_opcode_metadata.h" // _PyOpcode_Caches
 #include "pycore_opcode_utils.h"  // RESUME_AT_FUNC_START
+#include "pycore_object.h"        // _PyObject_IsFreed()
 #include "pycore_optimizer.h"     // _Py_ExecutorDetach
 #include "pycore_pymem.h"         // _PyMem_FreeDelayed()
 #include "pycore_pystate.h"       // _PyInterpreterState_GET()
@@ -1035,17 +1036,53 @@ PyCode_Addr2Line(PyCodeObject *co, int addrq)
 int
 _PyCode_SafeAddr2Line(PyCodeObject *co, int addrq)
 {
+    if (_PyObject_IsFreed((PyObject *)co) || !PyCode_Check(co)) {
+        return -1;
+    }
     if (addrq < 0) {
         return co->co_firstlineno;
     }
-    if (co->_co_monitoring && co->_co_monitoring->lines) {
-        return _Py_Instrumentation_GetLine(co, co->_co_monitoring->lines, addrq/sizeof(_Py_CODEUNIT));
+
+    Py_ssize_t code_size = Py_SIZE(co);
+    if (code_size < 0 || addrq / (int)sizeof(_Py_CODEUNIT) >= code_size) {
+        return -1;
+    }
+
+    _PyCoMonitoringData *monitoring =
+        _Py_atomic_load_ptr_acquire(&co->_co_monitoring);
+    if (monitoring != NULL) {
+        if (_PyMem_IsPtrFreed(monitoring)) {
+            return -1;
+        }
+        _PyCoLineInstrumentationData *lines =
+            _Py_atomic_load_ptr_acquire(&monitoring->lines);
+        if (lines != NULL) {
+            if (_PyMem_IsPtrFreed(lines)
+                || _PyObject_IsFreed((PyObject *)co)
+                || !PyCode_Check(co))
+            {
+                return -1;
+            }
+            return _Py_Instrumentation_GetLine(
+                co, lines, addrq / sizeof(_Py_CODEUNIT));
+        }
+    }
+
+    if (_PyObject_IsFreed((PyObject *)co) || !PyCode_Check(co)) {
+        return -1;
     }
-    if (!(addrq >= 0 && addrq < _PyCode_NBYTES(co))) {
+    PyObject *linetable = co->co_linetable;
+    if (_PyObject_IsFreed(linetable) || !PyBytes_Check(linetable)) {
         return -1;
     }
+    int firstlineno = co->co_firstlineno;
+
     PyCodeAddressRange bounds;
-    _PyCode_InitAddressRange(co, &bounds);
+    _PyLineTable_InitAddressRange(
+        PyBytes_AS_STRING(linetable),
+        PyBytes_GET_SIZE(linetable),
+        firstlineno,
+        &bounds);
     return _PyCode_CheckLineNumber(addrq, &bounds);
 }
 

Python/traceback.c

@@ -7,6 +7,7 @@
 #include "pycore_frame.h"         // PyFrameObject
 #include "pycore_interp.h"        // PyInterpreterState.gc
 #include "pycore_interpframe.h"   // _PyFrame_GetCode()
+#include "pycore_object.h"        // _PyObject_IsFreed()
 #include "pycore_pyerrors.h"      // _PyErr_GetRaisedException()
 #include "pycore_pystate.h"       // _PyThreadState_GET()
 #include "pycore_traceback.h"     // EXCEPTION_TB_HEADER
@@ -898,15 +899,17 @@ dump_char(int fd, char ch)
 void
 _Py_DumpASCII(int fd, PyObject *text)
 {
-    PyASCIIObject *ascii = _PyASCIIObject_CAST(text);
     Py_ssize_t i, size;
     int truncated;
     int kind;
     void *data = NULL;
     Py_UCS4 ch;
 
-    if (!PyUnicode_Check(text))
+    if (_PyObject_IsFreed(text) || !PyUnicode_Check(text)) {
         return;
+    }
+
+    PyASCIIObject *ascii = _PyASCIIObject_CAST(text);
 
     size = ascii->length;
     kind = ascii->state.kind;
@@ -1041,21 +1044,25 @@ dump_frame(int fd, _PyInterpreterFrame *frame)
         return -1;
     }
 
-    int res = 0;
     PUTS(fd, "  File ");
-    if (code->co_filename != NULL
-        && PyUnicode_Check(code->co_filename))
-    {
-        PUTS(fd, "\"");
-        _Py_DumpASCII(fd, code->co_filename);
-        PUTS(fd, "\"");
+    if (_PyObject_IsFreed((PyObject *)code) || !PyCode_Check(code)) {
+        PUTS(fd, "???, line ??? in ???\n");
+        return -1;
     }
-    else {
-        PUTS(fd, "???");
-        res = -1;
+    PyObject *filename = code->co_filename;
+    if (_PyObject_IsFreed(filename) || !PyUnicode_Check(filename)) {
+        PUTS(fd, "???, line ??? in ???\n");
+        return -1;
     }
+    PUTS(fd, "\"");
+    _Py_DumpASCII(fd, filename);
+    PUTS(fd, "\"");
 
     PUTS(fd, ", line ");
+    if (_PyObject_IsFreed((PyObject *)code) || !PyCode_Check(code)) {
+        PUTS(fd, "??? in ???\n");
+        return -1;
+    }
     int lasti = _PyFrame_SafeGetLasti(frame);
     int lineno = -1;
     if (lasti >= 0) {
@@ -1065,20 +1072,23 @@ dump_frame(int fd, _PyInterpreterFrame *frame)
         _Py_DumpDecimal(fd, (size_t)lineno);
     }
     else {
-        PUTS(fd, "???");
-        res = -1;
+        PUTS(fd, "??? in ???\n");
+        return -1;
     }
 
     PUTS(fd, " in ");
-    if (code->co_name != NULL && PyUnicode_Check(code->co_name)) {
-        _Py_DumpASCII(fd, code->co_name);
+    if (_PyObject_IsFreed((PyObject *)code) || !PyCode_Check(code)) {
+        PUTS(fd, "???\n");
+        return -1;
     }
-    else {
-        PUTS(fd, "???");
-        res = -1;
+    PyObject *name = code->co_name;
+    if (_PyObject_IsFreed(name) || !PyUnicode_Check(name)) {
+        PUTS(fd, "???\n");
+        return -1;
     }
+    _Py_DumpASCII(fd, name);
     PUTS(fd, "\n");
-    return res;
+    return 0;
 }
 
 static int _Py_NO_SANITIZE_THREAD