Abort in _PyEval_EvalFrameDefault originating on calling fcntl.ioctl

@vstinner

Crash report

What happened?

There are two ways to get aborts starting from fcntl.ioctl: one happens in _PyEval_EvalFrameDefault, the other results in a Fatal Python error. Not sure this is a single issue, so reporting both ways.

Here's a MRE for the first abort:

from pathlib._os import _ficlone

try:
    _ficlone(None, None)
except:
    _ficlone("A" * 2048, True)

It results in this backtrace:

/home/danzin/projects/main_gilful_debug/Lib/pathlib/_os.py:50: RuntimeWarning: bool is used as a file descriptor
  fcntl.ioctl(target_fd, fcntl.FICLONE, source_fd)
python: Python/generated_cases.c.h:2269: _PyEval_EvalFrameDefault: Assertion `(res_o != NULL) ^ (_PyErr_Occurred(tstate) != NULL)' failed.

Program received signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737340064384) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=140737340064384) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=140737340064384, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff72f7476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff72dd7f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff72dd71b in __assert_fail_base (fmt=0x7ffff7492130 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=0x5555561ea6e0 "(res_o != NULL) ^ (_PyErr_Occurred(tstate) != NULL)", file=0x5555561e9c80 "Python/generated_cases.c.h", line=2269,
    function=<optimized out>) at ./assert/assert.c:94
#6  0x00007ffff72eee96 in __GI___assert_fail (assertion=assertion@entry=0x5555561ea6e0 "(res_o != NULL) ^ (_PyErr_Occurred(tstate) != NULL)",
    file=file@entry=0x5555561e9c80 "Python/generated_cases.c.h", line=line@entry=2269,
    function=function@entry=0x5555561eeee0 <__PRETTY_FUNCTION__.84> "_PyEval_EvalFrameDefault") at ./assert/assert.c:103
#7  0x0000555555d3e31d in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x555556681960 <_PyRuntime+331232>, frame=0x629000005298,
    frame@entry=0x629000005220, throwflag=throwflag@entry=0) at Python/generated_cases.c.h:2269
#8  0x0000555555d926ac in _PyEval_EvalFrame (throwflag=0, frame=0x629000005220, tstate=0x555556681960 <_PyRuntime+331232>)
    at ./Include/internal/pycore_ceval.h:119
#9  _PyEval_Vector (tstate=tstate@entry=0x555556681960 <_PyRuntime+331232>, func=func@entry=0x610000040560, locals=locals@entry=0x60800009e5c0,
    args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:1961
#10 0x0000555555d929b0 in PyEval_EvalCode (co=co@entry=0x614000036a50, globals=globals@entry=0x60800009e5c0, locals=locals@entry=0x60800009e5c0)
    at Python/ceval.c:853

Here's a MRE for the second abort:

import fcntl

try:
    fcntl.ioctl(None, fcntl.FICLONE, None)
except:
    pass
fcntl.ioctl(True, fcntl.FICLONE,"A" * 2048)

It results in this backtrace:

/mnt/c/Users/ddini/crashers/main/pathlib__os-cpu_load-assertion/source2.py:13: RuntimeWarning: bool is used as a file descriptor
  fcntl.ioctl(True, fcntl.FICLONE,"A" * 2048)
Fatal Python error: _Py_CheckFunctionResult: a function returned NULL without setting an exception
Python runtime state: initialized
SystemError: <built-in function ioctl> returned NULL without setting an exception

Current thread 0x00007ffff7294280 [python] (most recent call first):
  File "/mnt/c/Users/ddini/crashers/main/pathlib__os-cpu_load-assertion/source2.py", line 13 in <module>

Program received signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737340064384) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=140737340064384) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=140737340064384, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff72f7476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff72dd7f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x0000555555ea92d7 in fatal_error_exit (status=<optimized out>) at Python/pylifecycle.c:3150
#6  0x0000555555ebfc0e in fatal_error (fd=fd@entry=2, header=header@entry=1,
    prefix=prefix@entry=0x5555560fdc60 <__func__.23> "_Py_CheckFunctionResult",
    msg=msg@entry=0x5555560fc9c0 "a function returned NULL without setting an exception", status=status@entry=-1) at Python/pylifecycle.c:3366
#7  0x0000555555ebfcc5 in _Py_FatalErrorFunc (func=func@entry=0x5555560fdc60 <__func__.23> "_Py_CheckFunctionResult",
    msg=msg@entry=0x5555560fc9c0 "a function returned NULL without setting an exception") at Python/pylifecycle.c:3382
#8  0x000055555598ceaf in _Py_CheckFunctionResult (tstate=tstate@entry=0x555556681960 <_PyRuntime+331232>, callable=callable@entry=0x6080000cbac0,
    result=<optimized out>, where=where@entry=0x0) at Objects/call.c:43
#9  0x000055555598ddf5 in _PyObject_VectorcallTstate (tstate=0x555556681960 <_PyRuntime+331232>, callable=0x6080000cbac0, args=0x7fffffffcdc8,
    nargsf=9223372036854775811, kwnames=0x0) at ./Include/internal/pycore_call.h:170
#10 0x000055555598df3c in PyObject_Vectorcall (callable=callable@entry=0x6080000cbac0, args=args@entry=0x7fffffffcdc8, nargsf=<optimized out>,
    kwnames=kwnames@entry=0x0) at Objects/call.c:327
#11 0x0000555555d38dbe in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x555556681960 <_PyRuntime+331232>, frame=frame@entry=0x629000005220,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:1619
#12 0x0000555555d926ac in _PyEval_EvalFrame (throwflag=0, frame=0x629000005220, tstate=0x555556681960 <_PyRuntime+331232>)
    at ./Include/internal/pycore_ceval.h:119
#13 _PyEval_Vector (tstate=tstate@entry=0x555556681960 <_PyRuntime+331232>, func=func@entry=0x610000040560, locals=locals@entry=0x60800009e5c0,
    args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:1961
#14 0x0000555555d929b0 in PyEval_EvalCode (co=co@entry=0x613000026150, globals=globals@entry=0x60800009e5c0, locals=locals@entry=0x60800009e5c0)
    at Python/ceval.c:853
#15 0x0000555555ecdfc1 in run_eval_code_obj (tstate=tstate@entry=0x555556681960 <_PyRuntime+331232>, co=co@entry=0x613000026150,
    globals=globals@entry=0x60800009e5c0, locals=locals@entry=0x60800009e5c0) at Python/pythonrun.c:1365

Found using fusil by @vstinner.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.15.0a0 (heads/main:56743afe879, May 26 2025, 15:23:40) [GCC 11.4.0]

Linked PRs

pythongh-134744: Fix fcntl error handling

I propose #134748 to fix the regression.

gh-134744: Fix fcntl error handling (#134748)

pythongh-134744: Fix fcntl error handling (python#134748)

[3.14] gh-134744: Fix fcntl error handling (#134748) (#134795)

[3.14] pythongh-134744: Fix fcntl error handling (pythonGH-134748) (p…

[3.13] gh-134744: Fix fcntl error handling (GH-134748) (GH-134795) (#…

pythongh-134744: Fix fcntl error handling (python#134748)

Navigation Menu

Repository navigation

Abort in `_PyEval_EvalFrameDefault` originating on calling `fcntl.ioctl` #134744

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Abort in _PyEval_EvalFrameDefault originating on calling fcntl.ioctl #134744

Description

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Activity

vstinner commented on May 26, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

Abort in `_PyEval_EvalFrameDefault` originating on calling `fcntl.ioctl` #134744