faulthandler.dump_traceback_later() can segfault while another thread frees code metadata

[Alishahryar1]

What happened?

faulthandler.dump_traceback_later() can segfault while another thread rapidly creates and frees code objects.

Reproducer:

import faulthandler
import os
import threading
import time
import types


stop = threading.Event()


def template():
    return 1


def churn_frames():
    while not stop.is_set():
        code = template.__code__.replace()
        function = types.FunctionType(code, {})
        function()
        function = None
        code = None


worker = threading.Thread(target=churn_frames)
worker.start()

with open(os.devnull, "w") as output:
    faulthandler.dump_traceback_later(1e-6, repeat=True, file=output)
    try:
        time.sleep(1)
    finally:
        faulthandler.cancel_dump_traceback_later()
        stop.set()
        worker.join()

print("completed")

Tested on CPython main at a000129df30819c3b762592d7586de4d2536f92b, built with --with-pydebug on Linux x86-64.

GDB shows the faulthandler watchdog passing a freed pointer to _Py_DumpASCII():

Thread 3 "python" received signal SIGSEGV, Segmentation fault.
_Py_DumpASCII (fd=3, text=0xdddddddddddddddd)
    at Python/traceback.c:901

#0  _Py_DumpASCII (fd=3, text=0xdddddddddddddddd)
    at Python/traceback.c:901
#1  dump_frame (fd=3, frame=0x7ffff7e26228)
    at Python/traceback.c:1050
#2  dump_traceback (fd=3, tstate=0x555555dcaaa0, write_header=0)
    at Python/traceback.c:1144
#3  PyUnstable_DumpTracebackThreads (fd=3, current_tstate=0x0,
    max_threads=100) at Python/traceback.c:1332
#4  faulthandler_thread (unused=0x0)
    at Modules/faulthandler.c:715

This looks related to #140815 and #116008, but the crash still occurs on current main.

CPython versions tested on:

• CPython main branch
• 3.16

Operating systems tested on:

• Linux

Linked PRs

• gh-158200: Harden faulthandler against freed code metadata #158202

[picnixz]

@ZeroIntensity