crash in asyncio if finalizer doesn't calls superclass finalizer

[kumaraditya303]

Crash report

The following code crashes the interpreter by reading into freed memory.

import asyncio

class MyTask(asyncio.Task):
    def __del__(self):
        print("MyTask.__del__")


async def main():
    task = MyTask(asyncio.sleep(1))
    await task

asyncio.run(main())

Output:

✦ ❯ ./python main.py
MyTask.__del__
fish: Job 2, './python main.py' terminated by signal SIGSEGV (Address boundary error)

Supporting subclasses seems tricky with it, I propose to use fast implementation only with exact types.

Linked PRs

• gh-129289: fix subclass of asyncio.Task not propagating __del__() cau… #129804
• gh-129289: fix crash when task finalizer is not called in asyncio #129840

[AbduazizZiyodov]

Interesting, which version of Python do you have?

[Eclips4]

which version of Python do you have?

Looks like a current main branch.

[tom-pytel]

TaskObj_finalize() is not getting called and deallocated task is not being removed from linked list of tasks. Fixed in py by adding super().__del__(), but still it shouldn't segfault obviously. Calling PyTask_finalize() in TaskObj_dealloc() when condition detected fixes it, maybe add warning or error in this case?

Simple fix:

static void
TaskObj_dealloc(PyObject *self)
{
    TaskObj *task = (TaskObj *)self;

    if (PyObject_CallFinalizerFromDealloc(self) < 0) {
        // resurrected.
        return;
    }
    if (task->task_node.next != NULL) {
        if (PyErr_WarnEx(PyExc_Warning, "subclasses of asyncio.Task must propagate __del__()", 1) < 0) {
            PyErr_Clear();
        }
        _PyObject_ResurrectStart(self);
        TaskObj_finalize(task);
        if (_PyObject_ResurrectEnd(self)) {
            return;
        }
    }
    ...