[3.13] gh-157639: Fix use-after-free when an external timer re-enters the profiler (GH-157648) (#158118)

(cherry picked from commit a6fa91c)

Co-authored-by: Lazizbek Ergashev <lazerg2@gmail.com>

Author: pablogsal

Lib/test/test_cprofile.py

@@ -83,6 +83,32 @@ def __call__(self):
             profiler_with_evil_timer.clear()
             self.assertEqual(cm.unraisable.exc_type, RuntimeError)
 
+    def test_enable_in_external_timer(self):
+        # gh-157639: Enabling the profiler from an external timer should not crash
+        import _lsprof
+
+        # the timer re-arms monitoring from inside disable(), so the tool
+        # id stays claimed once the profiler is torn down
+        self.addCleanup(sys.monitoring.free_tool_id, sys.monitoring.PROFILER_ID)
+
+        reenter = True
+
+        def timer():
+            nonlocal reenter
+            if reenter:
+                reenter = False
+                try:
+                    profiler.enable()
+                except Exception:
+                    pass
+            return 0
+
+        profiler = _lsprof.Profiler(timer=timer)
+        profiler.enable()
+        (lambda: None)()
+        profiler.disable()
+        profiler.clear()
+
     def test_profile_enable_disable(self):
         prof = self.profilerclass()
         # Make sure we clean ourselves up if the test fails for some reason.

Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst

@@ -0,0 +1,3 @@
+Fix a crash in :mod:`!cProfile` when an external timer re-enters the
+profiler. Profiling events raised while the external timer runs are now
+ignored.

Modules/_lsprof.c

@@ -356,6 +356,12 @@ ptrace_enter_call(PyObject *self, void *key, PyObject *userObj)
     ProfilerEntry *profEntry;
     ProfilerContext *pContext;
 
+    /* Events raised by the external timer must be ignored: it can run
+       arbitrary code while a context is still being unwound. */
+    if (pObj->flags & POF_EXT_TIMER) {
+        return;
+    }
+
     /* In the case of entering a generator expression frame via a
      * throw (gen_send_ex(.., 1)), we may already have an
      * Exception set here. We must not mess around with this
@@ -398,6 +404,10 @@ ptrace_leave_call(PyObject *self, void *key)
     ProfilerEntry *profEntry;
     ProfilerContext *pContext;
 
+    if (pObj->flags & POF_EXT_TIMER) {
+        return;
+    }
+
     pContext = pObj->currentProfilerContext;
     if (pContext == NULL)
         return;
@@ -908,9 +918,12 @@ profiler_dealloc(ProfilerObject *op)
         }
     }
 
+    /* Drop the external timer before flushing: it is Python code, and the
+       profiler can be deallocated by the garbage collector. */
+    Py_CLEAR(op->externalTimer);
+
     flush_unmatched(op);
     clearEntries(op);
-    Py_XDECREF(op->externalTimer);
     PyTypeObject *tp = Py_TYPE(op);
     tp->tp_free(op);
     Py_DECREF(tp);