gh-127879: Fix data race in `_PyFreeList_Push` (#127880)

Writes to the `ob_tid` field need to use atomics because it may be
concurrently read by a non-locking dictionary, list, or structmember
read.

diff --git a/Include/internal/pycore_freelist.h b/Include/internal/pycore_freelist.h
index da2d7bf6ae13939b23c8d512f2017c6e530ed4a6..84a5ab30f3eeeab294378127ab2a878d42962255 100644 (file)
--- a/Include/internal/pycore_freelist.h
+++ b/Include/internal/pycore_freelist.h
@@ -51,7 +51,7 @@ static inline int
 _PyFreeList_Push(struct _Py_freelist *fl, void *obj, Py_ssize_t maxsize)
 {
     if (fl->size < maxsize && fl->size >= 0) {
-        *(void **)obj = fl->freelist;
+        FT_ATOMIC_STORE_PTR_RELAXED(*(void **)obj, fl->freelist);
         fl->freelist = obj;
         fl->size++;
         OBJECT_STAT_INC(to_freelist);