-
-
Notifications
You must be signed in to change notification settings - Fork 32.2k
gh-92810: Reduce memory usage by ABCMeta.__subclasscheck__ #131914
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Modules/_abc.c
Outdated
if (scls == NULL) { | ||
goto end; | ||
} | ||
int r = PyObject_IsSubclass(subclass, scls); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we have a UAF here. PyObject_IsSubclass
can call __subclasscheck__
which can itseslf call arbitrary code so you might mutate subclasses
. The issue already exists with the existing code but can you confirm that we can indeed produce a UAF? (if you don't know how to do it, I'll try to investigate this separately tomorrow)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you confirm that we can indeed produce a UAF?
Sorry, my C knowledge is very minimal, I don't know anything about this yet
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
3 similar comments
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Signed-off-by: Martynov Maxim <[email protected]>
Signed-off-by: Martynov Maxim <[email protected]>
Signed-off-by: Martynov Maxim <[email protected]>
Signed-off-by: Martynov Maxim <[email protected]>
Signed-off-by: Martynov Maxim <[email protected]>
abf4bfe
to
b7603e0
Compare
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
I've added a simple recursion check to |
# Invalidate negative cache | ||
ABCMeta._abc_invalidation_counter += 1 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This change is not needed
@@ -137,11 +139,29 @@ def __subclasscheck__(cls, subclass): | |||
if issubclass(subclass, rcls): | |||
cls._abc_cache.add(subclass) | |||
return True | |||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The comment after serves as the separation.
# Check if it's a subclass of a subclass (recursive) | ||
for scls in cls.__subclasses__(): | ||
if issubclass(subclass, scls): | ||
cls._abc_cache.add(subclass) | ||
# If inside recursive issubclass check, avoid adding classes to any cache because this |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Reflow it under 80 chars.
if scls_is_abc: | ||
scls._abc_issubclasscheck_recursive = True | ||
|
||
try: | ||
result = issubclass(subclass, scls) | ||
finally: | ||
if scls_is_abc: | ||
scls._abc_issubclasscheck_recursive = False | ||
|
||
if result: | ||
if not cls._abc_issubclasscheck_recursive: | ||
cls._abc_cache.add(subclass) | ||
return True |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
if scls_is_abc: | |
scls._abc_issubclasscheck_recursive = True | |
try: | |
result = issubclass(subclass, scls) | |
finally: | |
if scls_is_abc: | |
scls._abc_issubclasscheck_recursive = False | |
if result: | |
if not cls._abc_issubclasscheck_recursive: | |
cls._abc_cache.add(subclass) | |
return True | |
if scls_is_abc: | |
scls._abc_issubclasscheck_recursive = True | |
try: | |
result = issubclass(subclass, scls) | |
finally: | |
if scls_is_abc: | |
scls._abc_issubclasscheck_recursive = False | |
if result: | |
if not cls._abc_issubclasscheck_recursive: | |
cls._abc_cache.add(subclass) | |
return True |
|
||
if not cls._abc_issubclasscheck_recursive: | ||
cls._abc_negative_cache.add(subclass) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
if not cls._abc_issubclasscheck_recursive: | |
cls._abc_negative_cache.add(subclass) | |
# No dice; update negative cache | |
if not cls._abc_issubclasscheck_recursive: | |
cls._abc_negative_cache.add(subclass) | |
pass | ||
a = A() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
pass | |
a = A() | |
pass | |
a = A() |
Reduce memory usage by :meth:`~type.__subclasscheck__` | ||
for :class:`abc.ABCMeta` and large class trees |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Reduce memory usage by :meth:`~type.__subclasscheck__` | |
for :class:`abc.ABCMeta` and large class trees | |
Reduce memory usage by :meth:`~type.__subclasscheck__` | |
for :class:`abc.ABCMeta` and large class trees. |
static inline bool | ||
is_issubclasscheck_recursive(_abc_data *impl) | ||
{ | ||
return impl->_abc_issubclasscheck_recursive; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This won't be safe on free-threaded builds. Atomic store/load are needed. And since we don't have atomic store/loads for bools, use an uint8/int here for the flag (and due to alignment constraints, using bool won't save memory)
@@ -814,23 +852,46 @@ _abc__abc_subclasscheck_impl(PyObject *module, PyObject *self, | |||
if (scls == NULL) { | |||
goto end; | |||
} | |||
|
|||
_abc_data *scls_impl = _get_impl_optional(module, scls); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This may raise so you need to check this.
@@ -177,6 +197,23 @@ _get_impl(PyObject *module, PyObject *self) | |||
return (_abc_data *)impl; | |||
} | |||
|
|||
static _abc_data * | |||
_get_impl_optional(PyObject *module, PyObject *self) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this can return NULL with or without an exception, I suggest changing it to:
static int
_get_impl_optional(_abc_data **res, PyObject *module, PyObject *self);
and return 0 if the attribute doesn't exist, -1 if there is an error and 1 if it succeeds. In the first two cases, set *res = NULL
.
_abc._abc_subclasscheck
has very poor performance and (I think) a memory leak #92810test_performance_abc.py
For 8k nested subclasses:
isinstance(cached class, parent)
isinstance(cached class, sibling)
isinstance(cached class, grandparent)
isinstance(cached class, cousin)
isinstance(cached class, parent via .register())
isinstance(cached class, sibling via .register())
isinstance(cached class, grandparent via .register())
isinstance(cached class, cousin via .register())
isinstance(cached class, parent via __subclasses__)
isinstance(cached class, sibling via __subclasses__)
isinstance(cached class, grandparent via __subclasses__)
isinstance(cached class, cousin via __subclasses__)
isinstance(new class, parent)
isinstance(new class, sibling)
isinstance(new class, grandparent)
isinstance(new class, cousin)
isinstance(new class, parent via .register())
isinstance(new class, sibling via .register())
isinstance(new class, grandparent via .register())
isinstance(new class, cousin via .register())
isinstance(new class, parent via __subclasses__)
isinstance(new class, sibling via __subclasses__)
isinstance(new class, grandparent via __subclasses__)
isinstance(new class, cousin via __subclasses__)