diff options
author | Andrew Clayton <a.clayton@nginx.com> | 2024-09-12 16:48:10 +0100 |
---|---|---|
committer | Andrew Clayton <a.clayton@nginx.com> | 2024-09-13 17:12:39 +0100 |
commit | 50b1aca3b8318c58f7073fe11911f1f0d52c651d (patch) | |
tree | a059fa298379bc2db589dd903d8ed88b6fd3e372 /src/nxt_status.h | |
parent | 5fde2ff79c92e2bb2ff67e4537640af7d06e73b6 (diff) | |
download | unit-50b1aca3b8318c58f7073fe11911f1f0d52c651d.tar.gz unit-50b1aca3b8318c58f7073fe11911f1f0d52c651d.tar.bz2 |
python: Don't decrement a reference to a borrowed object
On some Python 3.11 systems, 3.11.9 & 3.11.10, we were seeing a crash
triggered by Py_Finalize() in nxt_python_atexit() when running one of
our pytests, namely
test/test_python_factory.py::test_python_factory_invalid_callable_value
2024/09/12 15:07:29 [alert] 5452#5452 factory "wsgi_invalid_callable" in module "wsgi" can not be called to fetch callable
Fatal Python error: none_dealloc: deallocating None: bug likely caused by a refcount error in a C extension
Python runtime state: finalizing (tstate=0x00007f560b88a718)
Current thread 0x00007f560bde7ad0 (most recent call first):
<no Python frame>
2024/09/12 15:07:29 [alert] 5451#5451 app process 5452 exited on signal 6 (core dumped)
This was due to
obj = PyDict_GetItemString(PyModule_GetDict(module), callable);
in nxt_python_set_target() which returns a *borrowed* reference, then
due to the test meaning this is a `None` object we `goto fail` and call
Py_DECREF(obj);
which then causes `Py_Finalize()` to blow up.
The simple fix is to just increment its reference count before the `goto
fail`.
Note: This problem only showed up under (the various versions of Python
we test on); 3.11.9 & 3.11.10. It doesn't show up under; 3.6, 3.7, 3.9,
3.10, 3.12
Cc: Konstantin Pavlov <thresh@nginx.com>
Closes: https://github.com/nginx/unit/issues/1413
Fixes: a9aa9e76d ("python: Support application factories")
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
Diffstat (limited to 'src/nxt_status.h')
0 files changed, 0 insertions, 0 deletions