Skip to content

gh-142829: Fix use-after-free in Context.__eq__ via re-entrant ContextVar.set#142905

Merged
kumaraditya303 merged 3 commits intopython:mainfrom
abdoulrasheed:fix-gh-142829-context-uaf
Jan 9, 2026
Merged

gh-142829: Fix use-after-free in Context.__eq__ via re-entrant ContextVar.set#142905
kumaraditya303 merged 3 commits intopython:mainfrom
abdoulrasheed:fix-gh-142829-context-uaf

Conversation

@abdoulrasheed
Copy link
Contributor

@abdoulrasheed abdoulrasheed commented Dec 17, 2025 •
edited by bedevere-app bot
Loading

This fix holds strong references to the HAMT objects and their keys/values during comparison in _PyHamt_Eq, preventing premature deallocation.

@abdoulrasheed abdoulrasheed requested a review from 1st1 as a code owner December 17, 2025 20:02
@bedevere-app bedevere-app bot mentioned this pull request Dec 17, 2025
Closed
sobolevn
sobolevn approved these changes Dec 20, 2025
View reviewed changes
Copy link
Member

@sobolevn sobolevn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is what we commonly do to solve such issues.

@kumaraditya303
Copy link
Contributor

kumaraditya303 commented Dec 20, 2025

Can you add a test which does the same but with __hash__? I suspect that has the same issue.

@abdoulrasheed
Copy link
Contributor Author

abdoulrasheed commented Dec 20, 2025

Can you add a test which does the same but with __hash__? I suspect that has the same issue.

@kumaraditya303 I think __hash__ on values isn't called during Context comparison. only keys are hashed, and ContextVar uses a pre-computed hash. But I've added a test for it just to be safe.

@abdoulrasheed
Copy link
Contributor Author

abdoulrasheed commented Jan 8, 2026

commented

@kumaraditya303 Gentle reminder on this.

@kumaraditya303 kumaraditya303 merged commit a4086d7 into python:main Jan 9, 2026
46 checks passed
@serhiy-storchaka serhiy-storchaka added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jan 9, 2026
@miss-islington-app
Copy link

miss-islington-app bot commented Jan 9, 2026

Thanks @abdoulrasheed for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

@miss-islington-app
Copy link

miss-islington-app bot commented Jan 9, 2026

Thanks @abdoulrasheed for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

@miss-islington-app
Copy link

miss-islington-app bot commented Jan 9, 2026

Sorry, @abdoulrasheed and @kumaraditya303, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker a4086d7f89e5d388e4ffcdb13e4fba0255234286 3.13

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jan 9, 2026
@abdoulrasheed @miss-islington
pythongh-142829: Fix use-after-free in Context.__eq__ via re-entran…
579dafa 
…t `ContextVar.set` (pythonGH-142905)

(cherry picked from commit a4086d7)

Co-authored-by: A.Ibrahim <abdulrasheedibrahim47@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Jan 9, 2026

GH-143627 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Jan 9, 2026
kumaraditya303 pushed a commit that referenced this pull request Jan 10, 2026
@miss-islington @abdoulrasheed
[3.14] gh-142829: Fix use-after-free in Context.__eq__ via re-entra…
16efe85 
…nt `ContextVar.set` (GH-142905) (#143627)

gh-142829: Fix use-after-free in `Context.__eq__` via re-entrant `ContextVar.set` (GH-142905)
(cherry picked from commit a4086d7)

Co-authored-by: A.Ibrahim <abdulrasheedibrahim47@gmail.com>
@picnixz
Copy link
Member

picnixz commented Jan 10, 2026

Looks like backport to 3.13 failed. @kumaraditya303

reidenong pushed a commit to reidenong/cpython that referenced this pull request Jan 12, 2026
@abdoulrasheed @reidenong
pythongh-142829: Fix use-after-free in Context.__eq__ via re-entran…
c2f5b93 
…t `ContextVar.set` (python#142905)
serhiy-storchaka pushed a commit to serhiy-storchaka/cpython that referenced this pull request Jan 15, 2026
@abdoulrasheed @serhiy-storchaka
[3.13] pythongh-142829: Fix use-after-free in Context.__eq__ via re…
ac7af34 
…-entrant `ContextVar.set` (pythonGH-142905)

(cherry picked from commit a4086d7)

Co-authored-by: A.Ibrahim <abdulrasheedibrahim47@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Jan 15, 2026

GH-143871 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Jan 15, 2026
serhiy-storchaka added a commit that referenced this pull request Jan 15, 2026
@serhiy-storchaka @abdoulrasheed
[3.13] gh-142829: Fix use-after-free in Context.__eq__ via re-entra…
149ecbb 
…nt `ContextVar.set` (GH-142905) (GH-143871)

(cherry picked from commit a4086d7)

Co-authored-by: A.Ibrahim <abdulrasheedibrahim47@gmail.com>
thunder-coding pushed a commit to thunder-coding/cpython that referenced this pull request Feb 15, 2026
@abdoulrasheed @thunder-coding
pythongh-142829: Fix use-after-free in Context.__eq__ via re-entran…
49ee64a 
…t `ContextVar.set` (python#142905)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sobolevn sobolevn sobolevn approved these changes

@kumaraditya303 kumaraditya303 kumaraditya303 approved these changes

@1st1 1st1 Awaiting requested review from 1st1 1st1 is a code owner

Assignees

@kumaraditya303 kumaraditya303

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@abdoulrasheed @kumaraditya303 @picnixz @sobolevn @serhiy-storchaka