uaf in aiter()

[djarfluka]

Bug report

Bug description:

stop = False

async def produce():
    return Result()

def f():
    if stop:
        raise StopAsyncIteration     # default stop_exception -> exhaust
    return produce()

class Sentinel:
    def __eq__(self, other):
        global stop
        stop = True
        aw = ait.__anext__()
        try:
            aw.__await__().send(None)   # -> acallawaitable_start -> acalliter_exhaust
        except StopAsyncIteration:
            pass
        return NotImplemented

class Result:
    def __eq__(self, other):
        print("reflected __eq__ got", type(other))
        return NotImplemented

ait = aiter(f, Sentinel())
try:
    ait.__anext__().__await__().send(None)
except StopIteration:
    pass

asan:

=================================================================
==48==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000015220 at pc 0xaaaad7558154 bp 0xffffebffac10 sp 0xffffebffac00
READ of size 4 at 0x513000015220 thread T0
    #0 0xaaaad7558150 in _Py_IsImmortal Include/refcount.h:132
    #1 0xaaaad7558150 in _PyStackRef_FromPyObjectNew Include/internal/pycore_stackref.h:602
    #2 0xaaaad7558150 in _PyEval_Vector Python/ceval.c:2158
    #3 0xaaaad72a8c24 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #4 0xaaaad72a8c24 in vectorcall_unbound Objects/typeobject.c:3032
    #5 0xaaaad72a8c24 in maybe_call_special_one_arg Objects/typeobject.c:3174
    #6 0xaaaad72a8c24 in _PyObject_MaybeCallSpecialOneArg Objects/typeobject.c:3189
    #7 0xaaaad72a8c24 in slot_tp_richcompare Objects/typeobject.c:11012
    #8 0xaaaad714ae40 in do_richcompare Objects/object.c:1071
    #9 0xaaaad714ae40 in PyObject_RichCompare Objects/object.c:1114
    #10 0xaaaad7150b54 in PyObject_RichCompareBool Objects/object.c:1136
    #11 0xaaaad703386c in acallawaitable_handle_error Objects/iterobject.c:644
    #12 0xaaaad6f572d0 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #13 0xaaaad6f572d0 in PyObject_Vectorcall Objects/call.c:327
    #14 0xaaaad7538248 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:770
    #15 0xaaaad6cbd368 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #16 0xaaaad755719c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #17 0xaaaad755719c in _PyEval_Vector Python/ceval.c:2176
    #18 0xaaaad755719c in PyEval_EvalCode Python/ceval.c:681
    #19 0xaaaad7757ac4 in run_mod Python/pythonrun.c:1509
    #20 0xaaaad7758948 in _PyRun_File Python/pythonrun.c:1332
    #21 0xaaaad775cc0c in _PyRun_SimpleFile Python/pythonrun.c:544
    #22 0xaaaad77609e0 in _PyRun_AnyFile Python/pythonrun.c:92
    #23 0xaaaad782bd8c in pymain_run_file_obj Modules/main.c:478
    #24 0xaaaad782bd8c in pymain_run_file Modules/main.c:494
    #25 0xaaaad782bd8c in pymain_run_python Modules/main.c:804
    #26 0xaaaad782bd8c in Py_RunMain Modules/main.c:891
    #27 0xaaaad782e0b8 in pymain_main Modules/main.c:921
    #28 0xaaaad782e0b8 in Py_BytesMain Modules/main.c:945
    #29 0xffffbc2584c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #30 0xffffbc258594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #31 0xaaaad6d2746c in _start (/src/cpython/python+0x17a746c) (BuildId: fa8e9c5023d067471f9646ceca1b9bc57d6cd116)

0x513000015220 is located 32 bytes inside of 328-byte region [0x513000015200,0x513000015348)
freed by thread T0 here:
    #0 0xffffbcbf61b4 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0xaaaad72228ec in subtype_dealloc Objects/typeobject.c:2846
    #2 0xaaaad7149a20 in _Py_Dealloc Objects/object.c:3346
    #3 0xaaaad763bd8c in Py_DECREF_MORTAL Include/internal/pycore_object.h:449
    #4 0xaaaad763bd8c in PyStackRef_XCLOSE Include/internal/pycore_stackref.h:726
    #5 0xaaaad763bd8c in _PyFrame_ClearLocals Python/frame.c:108
    #6 0xaaaad763c8e0 in _PyFrame_ClearExceptCode Python/frame.c:133
    #7 0xaaaad753a4e4 in clear_thread_frame Python/ceval.c:1987
    #8 0xaaaad753a4e4 in _PyEval_FrameClearAndPop Python/ceval.c:2019
    #9 0xaaaad6cc1914 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:11557
    #10 0xaaaad7558080 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #11 0xaaaad7558080 in _PyEval_Vector Python/ceval.c:2176
    #12 0xaaaad72a8c24 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #13 0xaaaad72a8c24 in vectorcall_unbound Objects/typeobject.c:3032
    #14 0xaaaad72a8c24 in maybe_call_special_one_arg Objects/typeobject.c:3174
    #15 0xaaaad72a8c24 in _PyObject_MaybeCallSpecialOneArg Objects/typeobject.c:3189
    #16 0xaaaad72a8c24 in slot_tp_richcompare Objects/typeobject.c:11012
    #17 0xaaaad714ab14 in do_richcompare Objects/object.c:1065
    #18 0xaaaad714ab14 in PyObject_RichCompare Objects/object.c:1114
    #19 0xaaaad7150b54 in PyObject_RichCompareBool Objects/object.c:1136
    #20 0xaaaad703386c in acallawaitable_handle_error Objects/iterobject.c:644
    #21 0xaaaad6f572d0 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
    #22 0xaaaad6f572d0 in PyObject_Vectorcall Objects/call.c:327
    #23 0xaaaad7538248 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:770
    #24 0xaaaad6cbd368 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #25 0xaaaad755719c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #26 0xaaaad755719c in _PyEval_Vector Python/ceval.c:2176
    #27 0xaaaad755719c in PyEval_EvalCode Python/ceval.c:681
    #28 0xaaaad7757ac4 in run_mod Python/pythonrun.c:1509
    #29 0xaaaad7758948 in _PyRun_File Python/pythonrun.c:1332
    #30 0xaaaad775cc0c in _PyRun_SimpleFile Python/pythonrun.c:544
    #31 0xaaaad77609e0 in _PyRun_AnyFile Python/pythonrun.c:92
    #32 0xaaaad782bd8c in pymain_run_file_obj Modules/main.c:478
    #33 0xaaaad782bd8c in pymain_run_file Modules/main.c:494
    #34 0xaaaad782bd8c in pymain_run_python Modules/main.c:804
    #35 0xaaaad782bd8c in Py_RunMain Modules/main.c:891
    #36 0xaaaad782e0b8 in pymain_main Modules/main.c:921
    #37 0xaaaad782e0b8 in Py_BytesMain Modules/main.c:945
    #38 0xffffbc2584c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #39 0xffffbc258594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #40 0xaaaad6d2746c in _start (/src/cpython/python+0x17a746c) (BuildId: fa8e9c5023d067471f9646ceca1b9bc57d6cd116)

previously allocated by thread T0 here:
    #0 0xffffbcbf76d0 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0xaaaad7262a1c in _PyObject_MallocWithType Include/internal/pycore_object_alloc.h:46
    #2 0xaaaad7262a1c in _PyType_AllocNoTrack Objects/typeobject.c:2498
    #3 0xaaaad72630a0 in PyType_GenericAlloc Objects/typeobject.c:2529
    #4 0xaaaad7268aa8 in type_call Objects/typeobject.c:2442
    #5 0xaaaad6f55200 in _PyObject_MakeTpCall Objects/call.c:242
    #6 0xaaaad7538248 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:770
    #7 0xaaaad6cbd368 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
    #8 0xaaaad755719c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
    #9 0xaaaad755719c in _PyEval_Vector Python/ceval.c:2176
    #10 0xaaaad755719c in PyEval_EvalCode Python/ceval.c:681
    #11 0xaaaad7757ac4 in run_mod Python/pythonrun.c:1509
    #12 0xaaaad7758948 in _PyRun_File Python/pythonrun.c:1332
    #13 0xaaaad775cc0c in _PyRun_SimpleFile Python/pythonrun.c:544
    #14 0xaaaad77609e0 in _PyRun_AnyFile Python/pythonrun.c:92
    #15 0xaaaad782bd8c in pymain_run_file_obj Modules/main.c:478
    #16 0xaaaad782bd8c in pymain_run_file Modules/main.c:494
    #17 0xaaaad782bd8c in pymain_run_python Modules/main.c:804
    #18 0xaaaad782bd8c in Py_RunMain Modules/main.c:891
    #19 0xaaaad782e0b8 in pymain_main Modules/main.c:921
    #20 0xaaaad782e0b8 in Py_BytesMain Modules/main.c:945
    #21 0xffffbc2584c0  (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #22 0xffffbc258594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
    #23 0xaaaad6d2746c in _start (/src/cpython/python+0x17a746c) (BuildId: fa8e9c5023d067471f9646ceca1b9bc57d6cd116)

SUMMARY: AddressSanitizer: heap-use-after-free Include/refcount.h:132 in _Py_IsImmortal
Shadow bytes around the buggy address:
  0x513000014f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x513000015000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x513000015080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x513000015100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x513000015180: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
=>0x513000015200: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
  0x513000015280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x513000015300: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x513000015380: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x513000015400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x513000015480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==48==ABORTING
Aborted

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-158033: Keep the aiter sentinel alive during comparison #158043

[lul-cas]

Hi.
Openned a PR for this.

[picnixz]

We are reimplementing aiter in pure Python so I do not think it will matter for 3.16+. Thus let us first determine what to do flr 3.13-3.15.

cc @kumaraditya303