gh-153935: Fix data race on socket timeout in the free-threaded build

Include/internal/pycore_pyatomic_ft_wrappers.h

@@ -53,6 +53,10 @@ extern "C" {
     _Py_atomic_load_uint64_acquire(&value)
 #define FT_ATOMIC_LOAD_UINT64_RELAXED(value) \
     _Py_atomic_load_uint64_relaxed(&value)
+#define FT_ATOMIC_LOAD_INT64_RELAXED(value) \
+    _Py_atomic_load_int64_relaxed(&value)
+#define FT_ATOMIC_STORE_INT64_RELAXED(value, new_value) \
+    _Py_atomic_store_int64_relaxed(&value, new_value)
 #define FT_ATOMIC_LOAD_ULONG_RELAXED(value) \
     _Py_atomic_load_ulong_relaxed(&value)
 #define FT_ATOMIC_STORE_PTR_RELAXED(value, new_value) \
@@ -159,6 +163,8 @@ extern "C" {
 #define FT_ATOMIC_LOAD_UINT32_RELAXED(value) value
 #define FT_ATOMIC_LOAD_UINT64_ACQUIRE(value) value
 #define FT_ATOMIC_LOAD_UINT64_RELAXED(value) value
+#define FT_ATOMIC_LOAD_INT64_RELAXED(value) value
+#define FT_ATOMIC_STORE_INT64_RELAXED(value, new_value) value = new_value
 #define FT_ATOMIC_LOAD_ULONG_RELAXED(value) value
 #define FT_ATOMIC_STORE_PTR_RELAXED(value, new_value) value = new_value
 #define FT_ATOMIC_STORE_PTR_RELEASE(value, new_value) value = new_value

Lib/test/test_free_threading/test_socket.py

@@ -0,0 +1,84 @@
+import socket
+import unittest
+
+from test import support
+from test.support import threading_helper
+
+N = 200 if support.check_sanitizer(thread=True) else 1000
+
+
+@threading_helper.requires_working_threading()
+class TestSocketTimeoutRaces(unittest.TestCase):
+    # gh-153935: the socket timeout was read/written non-atomically, so reading
+    # it (gettimeout()/getblocking() or during a socket operation) raced with
+    # settimeout()/setblocking() on the same socket.
+
+    def new_socket(self):
+        s = socket.socket()
+        self.addCleanup(s.close)
+        return s
+
+    def check_race(self, read, write):
+        def reader():
+            for _ in range(N):
+                read()
+
+        def writer():
+            for _ in range(N):
+                write()
+
+        threading_helper.run_concurrently([reader, writer])
+
+    def test_gettimeout_vs_setblocking(self):
+        s = self.new_socket()
+        self.check_race(s.gettimeout, lambda: s.setblocking(False))
+
+    def test_gettimeout_vs_settimeout(self):
+        s = self.new_socket()
+        self.check_race(s.gettimeout, lambda: s.settimeout(1.0))
+
+    def test_getblocking_vs_settimeout(self):
+        s = self.new_socket()
+        self.check_race(s.getblocking, lambda: s.settimeout(0))
+
+    def test_operation_vs_settimeout(self):
+        a, b = socket.socketpair()
+        self.addCleanup(a.close)
+        self.addCleanup(b.close)
+        a.setblocking(False)
+
+        def recv():
+            try:
+                a.recv(64)
+            except OSError:
+                pass
+
+        self.check_race(recv, lambda: a.settimeout(0))
+
+    def test_sendall_vs_settimeout(self):
+        a, b = socket.socketpair()
+        self.addCleanup(a.close)
+        self.addCleanup(b.close)
+        a.setblocking(False)
+
+        def sendall():
+            try:
+                a.sendall(b"x" * 64)
+            except OSError:
+                pass
+
+        self.check_race(sendall, lambda: a.settimeout(0))
+
+    def test_connect_vs_settimeout(self):
+        lsock = socket.socket()
+        lsock.bind(("127.0.0.1", 0))
+        lsock.listen()
+        self.addCleanup(lsock.close)
+        addr = lsock.getsockname()
+        s = self.new_socket()
+
+        self.check_race(lambda: s.connect_ex(addr), lambda: s.settimeout(0))
+
+
+if __name__ == "__main__":
+    unittest.main()

Misc/NEWS.d/next/Library/2026-07-18-15-30-56.gh-issue-153935.xpkjEc.rst

@@ -0,0 +1 @@
+Fix a data race on a socket's timeout in the :term:`free-threaded build`.

Modules/socketmodule.c

@@ -110,6 +110,7 @@ Local naming conventions:
 #include "pycore_fileutils.h"     // _Py_set_inheritable()
 #include "pycore_moduleobject.h"  // _PyModule_GetState
 #include "pycore_object.h"        // _PyObject_VisitType()
+#include "pycore_pyatomic_ft_wrappers.h"  // FT_ATOMIC_LOAD_INT64_RELAXED()
 #include "pycore_time.h"          // _PyTime_AsMilliseconds()
 #include "pycore_tuple.h"         // _PyTuple_FromPairSteal
 #include "pycore_pystate.h"       // _Py_AssertHoldsTstate()
@@ -681,7 +682,7 @@ class _socket.socket "PySocketSockObject *" "clinic_state()->sock_type"
 #else
 /* If there's no timeout left, we don't have to call select, so it's a safe,
  * little white lie. */
-#define IS_SELECTABLE(s) (_PyIsSelectable_fd((s)->sock_fd) || (s)->sock_timeout <= 0)
+#define IS_SELECTABLE(s) (_PyIsSelectable_fd((s)->sock_fd) || FT_ATOMIC_LOAD_INT64_RELAXED((s)->sock_timeout) <= 0)
 #endif
 
 // SCM_RIGHTS, sendmsg(), recvmsg() and sethostname() don't work properly on
@@ -1068,7 +1069,7 @@ sock_call_ex(PySocketSockObject *s,
             /* retry sock_func() */
         }
 
-        if (s->sock_timeout > 0
+        if (FT_ATOMIC_LOAD_INT64_RELAXED(s->sock_timeout) > 0
             && (CHECK_ERRNO(EWOULDBLOCK) || CHECK_ERRNO(EAGAIN))) {
             /* False positive: sock_func() failed with EWOULDBLOCK or EAGAIN.
 
@@ -1094,7 +1095,8 @@ sock_call(PySocketSockObject *s,
           int (*func) (PySocketSockObject *s, void *data),
           void *data)
 {
-    return sock_call_ex(s, writing, func, data, 0, NULL, s->sock_timeout);
+    return sock_call_ex(s, writing, func, data, 0, NULL,
+                        FT_ATOMIC_LOAD_INT64_RELAXED(s->sock_timeout));
 }
 
 
@@ -3169,7 +3171,8 @@ sock_setblocking(PyObject *self, PyObject *arg)
         return NULL;
 
    PySocketSockObject *s = _PySocketSockObject_CAST(self);
-    s->sock_timeout = _PyTime_FromSeconds(block ? -1 : 0);
+    FT_ATOMIC_STORE_INT64_RELAXED(s->sock_timeout,
+                                   _PyTime_FromSeconds(block ? -1 : 0));
     if (internal_setblocking(s, block) == -1) {
         return NULL;
     }
@@ -3191,7 +3194,7 @@ static PyObject *
 sock_getblocking(PyObject *self, PyObject *Py_UNUSED(ignored))
 {
    PySocketSockObject *s = _PySocketSockObject_CAST(self);
-    if (s->sock_timeout) {
+    if (FT_ATOMIC_LOAD_INT64_RELAXED(s->sock_timeout)) {
         Py_RETURN_TRUE;
     }
     else {
@@ -3261,7 +3264,7 @@ sock_settimeout(PyObject *self, PyObject *arg)
         return NULL;
 
     PySocketSockObject *s = _PySocketSockObject_CAST(self);
-    s->sock_timeout = timeout;
+    FT_ATOMIC_STORE_INT64_RELAXED(s->sock_timeout, timeout);
 
     int block = timeout < 0;
     /* Blocking mode for a Python socket object means that operations
@@ -3305,11 +3308,12 @@ static PyObject *
 sock_gettimeout_impl(PyObject *self, void *Py_UNUSED(ignored))
 {
     PySocketSockObject *s = _PySocketSockObject_CAST(self);
-    if (s->sock_timeout < 0) {
+    PyTime_t sock_timeout = FT_ATOMIC_LOAD_INT64_RELAXED(s->sock_timeout);
+    if (sock_timeout < 0) {
         Py_RETURN_NONE;
     }
     else {
-        double seconds = PyTime_AsSecondsDouble(s->sock_timeout);
+        double seconds = PyTime_AsSecondsDouble(sock_timeout);
         return PyFloat_FromDouble(seconds);
     }
 }
@@ -3706,10 +3710,12 @@ internal_connect(PySocketSockObject *s, struct sockaddr *addr, int addrlen,
            If the socket is non-blocking, raise InterruptedError. The caller is
            responsible to wait until the connection completes, fails or timed
            out (it's the case in asyncio for example). */
-        wait_connect = (s->sock_timeout != 0 && IS_SELECTABLE(s));
+        wait_connect = (FT_ATOMIC_LOAD_INT64_RELAXED(s->sock_timeout) != 0
+                        && IS_SELECTABLE(s));
     }
     else {
-        wait_connect = (s->sock_timeout > 0 && err == SOCK_INPROGRESS_ERR
+        wait_connect = (FT_ATOMIC_LOAD_INT64_RELAXED(s->sock_timeout) > 0
+                        && err == SOCK_INPROGRESS_ERR
                         && IS_SELECTABLE(s));
     }
 
@@ -3727,13 +3733,15 @@ internal_connect(PySocketSockObject *s, struct sockaddr *addr, int addrlen,
     if (raise) {
         /* socket.connect() raises an exception on error */
         if (sock_call_ex(s, 1, sock_connect_impl, NULL,
-                         1, NULL, s->sock_timeout) < 0)
+                         1, NULL,
+                         FT_ATOMIC_LOAD_INT64_RELAXED(s->sock_timeout)) < 0)
             return -1;
     }
     else {
         /* socket.connect_ex() returns the error code on error */
         if (sock_call_ex(s, 1, sock_connect_impl, NULL,
-                         1, &err, s->sock_timeout) < 0)
+                         1, &err,
+                         FT_ATOMIC_LOAD_INT64_RELAXED(s->sock_timeout)) < 0)
             return err;
     }
     return 0;
@@ -4688,8 +4696,8 @@ _socket_socket_sendall_impl(PySocketSockObject *s, Py_buffer *pbuf,
     char *buf;
     Py_ssize_t len, n;
     struct sock_send ctx;
-    int has_timeout = (s->sock_timeout > 0);
-    PyTime_t timeout = s->sock_timeout;
+    PyTime_t timeout = FT_ATOMIC_LOAD_INT64_RELAXED(s->sock_timeout);
+    int has_timeout = (timeout > 0);
     PyTime_t deadline = 0;
     int deadline_initialized = 0;
     PyObject *res = NULL;