Segfault in contextvars HAMT during isolation_scope() / new_scope() with uvicorn multiprocessing workers
維護者通常 1 天內回覆
@sl0thentr0py 已經在處理了。
開始於 2025年12月10日。
評估
這個 Issue 還沒有評估資料。
描述
How do you use Sentry?
Self-hosted/on-premise
Version
2.45.0
Steps to Reproduce
Environment
- sentry-sdk version: 2.45.0
- Python version: 3.10.x
- OS: Linux (x86_64)
- Framework: FastAPI + uvicorn with --workers 10 (multiprocessing spawn)
- Event loop: uvloop 0.21.0
Problem
Workers crash with SIGSEGV when Sentry SDK calls _current_scope.set() inside isolation_scope() or new_scope(). The crash occurs in Python's HAMT (Hash Array Mapped Trie) implementation used by contextvars.
GDB analysis shows that the HAMT node pointer has been corrupted - it points to a PyFunctionObject (_safe_repr_wrapper from sentry_sdk/serializer.py) instead of a HAMT node. When Python tries to clone this "node", it reads the function's vectorcall field as if it were b_array, then crashes trying to Py_INCREF a C function pointer.
Stack trace:
#0 _Py_INCREF (op=0x7b4d9a872260 <_PyFunction_Vectorcall>) at ./Include/object.h:472
#1 _Py_XINCREF (op=0x7b4d9a872260 <_PyFunction_Vectorcall>) at ./Include/object.h:558
#2 hamt_node_bitmap_clone (node=0x7b4c301c7e20) at Python/hamt.c:583
#3 hamt_node_bitmap_assoc (...) at Python/hamt.c:771
#4 _PyHamt_Assoc (...) at Python/hamt.c:2308
#5 contextvar_set (var=0x7b4d9916a5c0, val=<Scope at remote 0x7b4c30d62b60>) at Python/context.c:738
#6 PyContextVar_Set (ovar=<_contextvars.ContextVar at remote 0x7b4d9916a5c0>, ...) at Python/context.c:285
...
#12 _PyEval_EvalFrame (...) for file sentry_sdk/scope.py, line 1785, in isolation_scope
Python stack trace
File "sentry_sdk/scope.py", line 1785, in isolation_scope
current_token = _current_scope.set(forked_current_scope)
File "contextlib.py", line 135, in __enter__
return next(self.gen)
File "sentry_sdk/integrations/asgi.py", line 198, in _run_app
with sentry_sdk.isolation_scope() as sentry_scope:
Corrupted HAMT node:
(gdb) p *node
$2 = {
ob_base = {ob_type = 0x7b4d9aa8a7a0 <PyFunction_Type>},
b_bitmap = 2587471808,
b_array = {'_safe_repr_wrapper'} # Does not look like HAMT data
}
(gdb) p node->b_array[0]
$5 = '_safe_repr_wrapper'
(gdb) x/20x 0x7b4d9a872260
0x7b4d9a872260 <_PyFunction_Vectorcall>: ....
Sentry configuration
sentry_sdk.init(
dsn=settings.SENTRY_DSN,
traces_sample_rate=1.0,
profiles_sample_rate=0.0,
enable_tracing=True,
send_default_pii=True,
integrations=[
FastApiIntegration(),
HttpxIntegration(),
AioHttpIntegration(),
RedisIntegration(),
],
)
How to reproduce
- FastAPI app with sentry-sdk 2.45.0
- Run with uvicorn app:app --workers 10 (multiprocessing spawn)
- Send concurrent HTTP requests
- Workers eventually crash with SIGSEGV
Observations
- Crash happens in spawned worker processes, not the main process
- The corrupted pointer always points to Sentry SDK's _safe_repr_wrapper function or _PyFunction_Vectorcall
- Workers that don't use Sentry SDK (different project, same infrastructure) don't crash
- Same codebase works fine in single-process mode
We tried setting OPENBLAS_NUM_THREADS=1 and it did not help.
It appears that a function object created during Sentry serialization (_safe_repr_wrapper) is somehow being written to a location that should contain a HAMT node pointer.
This could be:
- A use-after-free where HAMT memory is reused for function objects
- A buffer overflow in serialization code
- Race condition in scope/context handling with multiprocessing
Expected Result
No segfault
Actual Result
Eventual segfault
- 主要語言
- Python
- 星號
- 2.2k
- 分支
- 682
- 平均合併
- 1 天 7 小時
- 30 天內合併 PR
- 228
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
getsentry/sentry-python 的其他 Issue
-
Improvement Python Spans
難度 2/5 1-3 小時 新手友好度 78/100
getsentry/sentry-python#7876 · 2 則留言 ·
維護者通常 1 天內回覆
-
Bug Python Waiting for: Product Owner
難度 2/5 1-3 小時 新手友好度 76/100
getsentry/sentry-python#7870 · 3 則留言 ·
維護者通常 1 天內回覆
-
Python
難度 2/5 1-3 小時 新手友好度 68/100
getsentry/sentry-python#6992 · 1 則留言 ·
維護者通常 1 天內回覆
-
Improvement Python
難度 2/5 1-3 小時 新手友好度 65/100
getsentry/sentry-python#6970 · 1 則留言 ·
維護者通常 1 天內回覆
-
match_regex_list raises IndexError when a pattern list contains an empty string可能已有人在做 @wahajahmed010 於 107 天前認領。 未關閉Bug Python
難度 2/5 1-3 小時 新手友好度 74/100
getsentry/sentry-python#6504 · 1 則留言 ·
維護者通常 1 天內回覆
查看 getsentry/sentry-python 的全部 Issue
相似的 Issue
-
難度 1/5 1 小時以內 新手友好度 75/100
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 72/100
維護者通常 2 天內回覆
-
Status: Triage Type: Bug
難度 2/5 1-3 小時 新手友好度 86/100
-
Objects.List treats versions=false (and similar flags) as true可能已有人在做 @andaaron 今天認領。 未關閉priority: p2 type: bug
難度 2/5 1-3 小時 新手友好度 78/100
googleapis/storage-testbench#829 ·
維護者通常 2 天內回覆
-
[Bug]: memory provider treats 1:1 DMs as shared surfaces, so DM turns never receive reviewed records未關閉
難度 2/5 1-3 小時 新手友好度 79/100
rlaope/oh-my-hermes#2088 ·
維護者通常 1 天內回覆