Skip to content

perf trampoline segfaults on UBSan builds #161288

Open

Description

@NekoAsakura

Crash report

Caught on #161278. On a UBSan build ./python -X perf -c pass segfaults at:

return f(ts, frame, throw, prev_eval_frame != NULL ? prev_eval_frame : _PyEval_EvalFrameDefault);

-fsanitize=function reads a type signature 8 bytes before the called function on every call through a function pointer. The trampoline is machine code copied into an mmap'd buffer and has none. It sits at the start of the buffer, so the 8 bytes before it are unmapped and the read segfaults.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

No response

Linked PRs

Activity

  1. added
    buildThe build process and cross-build
    type-crashA hard crash of the interpreter, possibly with a core dump
    interpreter-core(Objects, Python, Grammar, and Parser dirs)
    on Nov 4, 2026
  2. vstinner commented on Nov 4, 2026

    @vstinner
    Member

    test_perf_profiler is skipped on most sanitizers, and so it didn't catch this issue:

    if support.check_sanitizer(address=True, memory=True, ub=True, function=True):
        # gh-109580: Skip the test because it does crash randomly if Python is
        # built with ASAN.
        raise unittest.SkipTest("test crash randomly on ASAN/MSAN/UBSAN build")
  3. vstinner commented on Nov 4, 2026

    @vstinner
    Member

    I don't think that it's worth it to bother with testing perf support in test_embed, so I suggest to skip tests on perf_profiling:

    diff --git a/Lib/test/test_embed.py b/Lib/test/test_embed.py
    index 65feb162b0c..c8cfbcac0fd 100644
    --- a/Lib/test/test_embed.py
    +++ b/Lib/test/test_embed.py
    @@ -1224,7 +1224,6 @@ def test_init_compat_env(self):
                 'module_search_paths': self.IGNORE_CONFIG,
                 'safe_path': True,
                 'int_max_str_digits': 4567,
    -            'perf_profiling': 1,
             }
             if Py_STATS:
                 config['_pystats'] = 1
    @@ -1261,7 +1260,6 @@ def test_init_python_env(self):
                 'module_search_paths': self.IGNORE_CONFIG,
                 'safe_path': True,
                 'int_max_str_digits': 4567,
    -            'perf_profiling': 1,
             }
             if Py_STATS:
                 config['_pystats'] = True
    @@ -1965,7 +1963,6 @@ def test_initconfig_api(self):
                 'xoptions': {'faulthandler': True},
                 'hash_seed': 10,
                 'use_hash_seed': True,
    -            'perf_profiling': 2,
             }
             config_dev_mode(preconfig, config)
             # Temporarily enable ignore_stderr=True to ignore warnings on JIT builds
    diff --git a/Programs/_testembed.c b/Programs/_testembed.c
    index 08bbcd4cfec..8fcb4a92dcb 100644
    --- a/Programs/_testembed.c
    +++ b/Programs/_testembed.c
    @@ -845,7 +845,7 @@ static void set_most_env_vars(void)
     #ifdef Py_STATS
         putenv("PYTHONSTATS=1");
     #endif
    -    putenv("PYTHONPERFSUPPORT=1");
    +    // gh-161288: Do not set PYTHONPERFSUPPORT since it fails on UBSan builds
     }
     
     
    @@ -1724,9 +1724,7 @@ static int test_initconfig_api(void)
             goto error;
         }
     
    -    if (PyInitConfig_SetInt(config, "perf_profiling", 2) < 0) {
    -        goto error;
    -    }
    +    // gh-161288: Do not set "perf_profiling" since it fails on UBSan builds
     
         // Set a UTF-8 string (program_name)
         if (PyInitConfig_SetStr(config, "program_name", PROGRAM_NAME_UTF8) < 0) {
  4. NekoAsakura commented on Nov 4, 2026

    @NekoAsakura
    MemberAuthor

    The fix is not much bother, and we already have similar macros _Py_NO_SANITIZE_ADDRESS/THREAD/MEMORY.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    buildThe build process and cross-buildinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions