From: Gregory P. Smith <greg@mad-scientist.com>
Date: Mon, 21 Jan 2008 07:11:11 +0000 (+0000)
Subject: Provide a sanity check during PyThreadState_DeleteCurrent() and
X-Git-Tag: v2.6a1~494
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2778c999e39142b6e2f092028e0b05ef29bdb901;p=python

Provide a sanity check during PyThreadState_DeleteCurrent() and
PyThreadState_Delete() to avoid an infinite loop when the tstate list
is messed up and has somehow becomes circular and does not contain the
current thread.

I don't know how this happens but it does, *very* rarely.  On more than
one hardware platform.  I have not been able to reproduce it manually.

Attaching to a process where its happening: it has always been in an
infinite loop over a single element tstate list that is not the tstate
we're looking to delete.  It has been in t_bootstrap()'s call to
PyThreadState_DeleteCurrent() as a pthread is exiting.
---

diff --git a/Python/pystate.c b/Python/pystate.c
index 086789d355..36b06d67af 100644
--- a/Python/pystate.c
+++ b/Python/pystate.c
@@ -240,6 +240,7 @@ tstate_delete_common(PyThreadState *tstate)
 {
 	PyInterpreterState *interp;
 	PyThreadState **p;
+	PyThreadState *prev_p = NULL;
 	if (tstate == NULL)
 		Py_FatalError("PyThreadState_Delete: NULL tstate");
 	interp = tstate->interp;
@@ -252,6 +253,15 @@ tstate_delete_common(PyThreadState *tstate)
 				"PyThreadState_Delete: invalid tstate");
 		if (*p == tstate)
 			break;
+		if (*p == prev_p)
+			Py_FatalError(
+				"PyThreadState_Delete: small circular list(!)"
+                                " and tstate not found.");
+		prev_p = *p;
+		if ((*p)->next == interp->tstate_head)
+			Py_FatalError(
+				"PyThreadState_Delete: circular list(!) and"
+                                " tstate not found.");
 	}
 	*p = tstate->next;
 	HEAD_UNLOCK();