gh-157639: Fix use-after-free when an external timer re-enters the profiler (#157648)

* gh-157639: Fix use-after-free when an external timer re-enters the profiler

* Suppress the cProfile link in the NEWS entry

* Add braces around the external timer guards, per PEP 7

* Simplify the external timer test setup

* Do not call the external timer while deallocating the profiler

Author: lazerg

Lib/test/test_profiling/test_tracing_profiler.py

@@ -85,6 +85,27 @@ def __call__(self):
             profiler_with_evil_timer.clear()
             self.assertEqual(cm.unraisable.exc_type, RuntimeError)
 
+    def test_enable_in_external_timer(self):
+        # gh-157639: Enabling the profiler from an external timer should not crash
+        import _lsprof
+
+        # the timer re-arms monitoring from inside disable(), so the tool
+        # id stays claimed once the profiler is torn down
+        self.addCleanup(sys.monitoring.free_tool_id, sys.monitoring.PROFILER_ID)
+
+        def timer():
+            try:
+                profiler.enable()
+            except Exception:
+                pass
+            return 0
+
+        profiler = _lsprof.Profiler(timer=timer)
+        profiler.enable()
+        (lambda: None)()
+        profiler.disable()
+        profiler.clear()
+
     def test_profile_enable_disable(self):
         prof = self.profilerclass()
         # Make sure we clean ourselves up if the test fails for some reason.

Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst

@@ -0,0 +1,3 @@
+Fix a crash in :mod:`!cProfile` when an external timer re-enters the
+profiler. Profiling events raised while the external timer runs are now
+ignored.

Modules/_lsprof.c

@@ -363,6 +363,12 @@ ptrace_enter_call(PyObject *self, void *key, PyObject *userObj)
     ProfilerEntry *profEntry;
     ProfilerContext *pContext;
 
+    /* Events raised by the external timer must be ignored: it can run
+       arbitrary code while a context is still being unwound. */
+    if (pObj->flags & POF_EXT_TIMER) {
+        return;
+    }
+
     /* In the case of entering a generator expression frame via a
      * throw (gen_send_ex(.., 1)), we may already have an
      * Exception set here. We must not mess around with this
@@ -405,6 +411,10 @@ ptrace_leave_call(PyObject *self, void *key)
     ProfilerEntry *profEntry;
     ProfilerContext *pContext;
 
+    if (pObj->flags & POF_EXT_TIMER) {
+        return;
+    }
+
     pContext = pObj->currentProfilerContext;
     if (pContext == NULL)
         return;
@@ -980,10 +990,13 @@ profiler_dealloc(PyObject *op)
         }
     }
 
+    /* Drop the external timer before flushing: it is Python code, and the
+       profiler can be deallocated by the garbage collector. */
+    Py_CLEAR(self->externalTimer);
+
     flush_unmatched(self);
     clearEntries(self);
     Py_XDECREF(self->missing);
-    Py_XDECREF(self->externalTimer);
     PyTypeObject *tp = Py_TYPE(self);
     tp->tp_free(self);
     Py_DECREF(tp);