@@ -5163,14 +5163,19 @@ is_dunder_name(PyObject *name)
5163
5163
static PyObject *
5164
5164
update_cache (struct type_cache_entry * entry , PyObject * name , unsigned int version_tag , PyObject * value )
5165
5165
{
5166
- _Py_atomic_store_uint32_relaxed (& entry -> version , version_tag );
5167
5166
_Py_atomic_store_ptr_relaxed (& entry -> value , value ); /* borrowed */
5168
5167
assert (_PyASCIIObject_CAST (name )-> hash != -1 );
5169
5168
OBJECT_STAT_INC_COND (type_cache_collisions , entry -> name != Py_None && entry -> name != name );
5170
5169
// We're releasing this under the lock for simplicity sake because it's always a
5171
5170
// exact unicode object or Py_None so it's safe to do so.
5172
5171
PyObject * old_name = entry -> name ;
5173
5172
_Py_atomic_store_ptr_relaxed (& entry -> name , Py_NewRef (name ));
5173
+ // We must write the version last to avoid _Py_TryXGetStackRef()
5174
+ // operating on an invalid (already deallocated) value inside
5175
+ // _PyType_LookupRefAndVersion(). If we write the version first then a
5176
+ // reader could pass the "entry_version == type_version" check but could
5177
+ // be using the old entry value.
5178
+ _Py_atomic_store_uint32_release (& entry -> version , version_tag );
5174
5179
return old_name ;
5175
5180
}
5176
5181
@@ -5234,7 +5239,7 @@ _PyType_LookupRef(PyTypeObject *type, PyObject *name)
5234
5239
// synchronize-with other writing threads by doing an acquire load on the sequence
5235
5240
while (1 ) {
5236
5241
uint32_t sequence = _PySeqLock_BeginRead (& entry -> sequence );
5237
- uint32_t entry_version = _Py_atomic_load_uint32_relaxed (& entry -> version );
5242
+ uint32_t entry_version = _Py_atomic_load_uint32_acquire (& entry -> version );
5238
5243
uint32_t type_version = _Py_atomic_load_uint32_acquire (& type -> tp_version_tag );
5239
5244
if (entry_version == type_version &&
5240
5245
_Py_atomic_load_ptr_relaxed (& entry -> name ) == name ) {
@@ -5280,11 +5285,14 @@ _PyType_LookupRef(PyTypeObject *type, PyObject *name)
5280
5285
int has_version = 0 ;
5281
5286
int version = 0 ;
5282
5287
BEGIN_TYPE_LOCK ();
5283
- res = find_name_in_mro (type , name , & error );
5288
+ // We must assign the version before doing the lookup. If
5289
+ // find_name_in_mro() blocks and releases the critical section
5290
+ // then the type version can change.
5284
5291
if (MCACHE_CACHEABLE_NAME (name )) {
5285
5292
has_version = assign_version_tag (interp , type );
5286
5293
version = type -> tp_version_tag ;
5287
5294
}
5295
+ res = find_name_in_mro (type , name , & error );
5288
5296
END_TYPE_LOCK ();
5289
5297
5290
5298
/* Only put NULL results into cache if there was no error. */
0 commit comments