From 50b1aca3b8318c58f7073fe11911f1f0d52c651d Mon Sep 17 00:00:00 2001 From: Andrew Clayton Date: Thu, 12 Sep 2024 16:48:10 +0100 Subject: [PATCH] python: Don't decrement a reference to a borrowed object On some Python 3.11 systems, 3.11.9 & 3.11.10, we were seeing a crash triggered by Py_Finalize() in nxt_python_atexit() when running one of our pytests, namely test/test_python_factory.py::test_python_factory_invalid_callable_value 2024/09/12 15:07:29 [alert] 5452#5452 factory "wsgi_invalid_callable" in module "wsgi" can not be called to fetch callable Fatal Python error: none_dealloc: deallocating None: bug likely caused by a refcount error in a C extension Python runtime state: finalizing (tstate=0x00007f560b88a718) Current thread 0x00007f560bde7ad0 (most recent call first): 2024/09/12 15:07:29 [alert] 5451#5451 app process 5452 exited on signal 6 (core dumped) This was due to obj = PyDict_GetItemString(PyModule_GetDict(module), callable); in nxt_python_set_target() which returns a *borrowed* reference, then due to the test meaning this is a `None` object we `goto fail` and call Py_DECREF(obj); which then causes `Py_Finalize()` to blow up. The simple fix is to just increment its reference count before the `goto fail`. Note: This problem only showed up under (the various versions of Python we test on); 3.11.9 & 3.11.10. It doesn't show up under; 3.6, 3.7, 3.9, 3.10, 3.12 Cc: Konstantin Pavlov Closes: https://github.com/nginx/unit/issues/1413 Fixes: a9aa9e76d ("python: Support application factories") Signed-off-by: Andrew Clayton --- src/python/nxt_python.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/python/nxt_python.c b/src/python/nxt_python.c index 7bbf3d493..143d8d5dc 100644 --- a/src/python/nxt_python.c +++ b/src/python/nxt_python.c @@ -462,6 +462,7 @@ nxt_python_set_target(nxt_task_t *task, nxt_python_target_t *target, "factory \"%s\" in module \"%s\" " "can not be called to fetch callable", callable, module_name); + Py_INCREF(obj); /* borrowed reference */ goto fail; }