Skip to content

gh-154523: Fix data-race in TextIOWrapper.detach() - #154565

Merged
kumaraditya303 merged 4 commits into
python:mainfrom
brijkapadia:textio-race
Aug 4, 2026
Merged

kumaraditya303 merged 4 commits into
python:mainfrom
brijkapadia:textio-race

Conversation

@brijkapadia

@brijkapadia brijkapadia commented Jul 23, 2026 •

Copy link
Copy Markdown
Contributor

@brijkapadia

Copy link
Copy Markdown
Contributor Author

@kumaraditya303, could you take a look whenever you have time?

@kumaraditya303
kumaraditya303 merged commit 8440a6a into python:main Aug 4, 2026
57 checks passed
@brijkapadia
brijkapadia deleted the textio-race branch August 4, 2026 13:37
mbeijen pushed a commit to mbeijen/cpython that referenced this pull request Aug 14, 2026
vstinner added a commit that referenced this pull request Oct 16, 2026
…rant detach (#159591)

* gh-143008: Fix Null pointer dereferences in TextIOWrapper underlying stream access (#145957)

TextIOWrapper keeps its underlying stream in a member called
`self->buffer`. That stream can be detached by user code, such as custom
`.flush` implementations resulting in `self->buffer` being set to NULL.
The implementation often checked at the start of functions if
`self->buffer` is in a good state, but did not always recheck after
other Python code was called which could modify `self->buffer`.

The cases which need to be re-checked are hard to spot so rather than
rely on reviewer effort create better safety by making all self->buffer
access go through helper functions.

Thank you yihong0618 for the test, NEWS and initial implementation in
gh-143041.

Co-authored-by: yihong0618 <zouzou0208@gmail.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit db4b194)

* gh-154523: Fix data-race in `TextIOWrapper.detach()` (#154565)

(cherry picked from commit 8440a6a)

* gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach (#157370)

Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit e19dc47)

---------

Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com>
Co-authored-by: yihong0618 <zouzou0208@gmail.com>
Co-authored-by: Brij Kapadia <97006829+brijkapadia@users.noreply.github.com>
Co-authored-by: Shamil <ashm.tech@proton.me>
vstinner added a commit that referenced this pull request Oct 16, 2026
…rant detach (#159600)

[3.15] gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach (#159591)

* gh-143008: Fix Null pointer dereferences in TextIOWrapper underlying stream access (#145957)

TextIOWrapper keeps its underlying stream in a member called
`self->buffer`. That stream can be detached by user code, such as custom
`.flush` implementations resulting in `self->buffer` being set to NULL.
The implementation often checked at the start of functions if
`self->buffer` is in a good state, but did not always recheck after
other Python code was called which could modify `self->buffer`.

The cases which need to be re-checked are hard to spot so rather than
rely on reviewer effort create better safety by making all self->buffer
access go through helper functions.

Thank you yihong0618 for the test, NEWS and initial implementation in
gh-143041.



(cherry picked from commit db4b194)

* gh-154523: Fix data-race in `TextIOWrapper.detach()` (#154565)

(cherry picked from commit 8440a6a)

* gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach (#157370)


(cherry picked from commit e19dc47)

---------





(cherry picked from commit ea1312b)

Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com>
Co-authored-by: yihong0618 <zouzou0208@gmail.com>
Co-authored-by: Brij Kapadia <97006829+brijkapadia@users.noreply.github.com>
Co-authored-by: Shamil <ashm.tech@proton.me>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants