Skip to content

gh-156228: Use PyMem_Raw* allocators for OpenSSL in _ssl and _hashlib - #156229

Open
kumaraditya303 wants to merge 1 commit into
python:mainfrom
kumaraditya303:openssl-raw-allocators
Open

gh-156228: Use PyMem_Raw* allocators for OpenSSL in _ssl and _hashlib#156229
kumaraditya303 wants to merge 1 commit into
python:mainfrom
kumaraditya303:openssl-raw-allocators

Conversation

@kumaraditya303

@kumaraditya303 kumaraditya303 commented Aug 22, 2026

Copy link
Copy Markdown
Contributor
import tracemalloc, ssl, hashlib
tracemalloc.start()
ctx = ssl.create_default_context()      # heavy OpenSSL work
h = hashlib.new('sha3_512')             # one EVP context
traced by tracemalloc without PR with PR
ssl.create_default_context() 2.4 KB 1.27 MB
one sha3_512 context 48 B 624 B

…ashlib

Install OpenSSL memory hooks with CRYPTO_set_mem_functions() when _ssl or
_hashlib is loaded, routing OpenSSL allocations through the raw memory
allocators so they are visible to tracemalloc and custom allocators.
Installation fails benignly if another libcrypto user allocated first.
Comment thread Modules/_openssl_mem.h
@kumaraditya303
kumaraditya303 requested a review from picnixz August 23, 2026 04:57
@kumaraditya303

kumaraditya303 commented Aug 25, 2026

Copy link
Copy Markdown
Contributor Author

I'd like to merge this by weekend if there are no objections, I've posted the performance analysis on the issue.

Comment on lines +2 to +3
allocations through the Python raw memory allocators, making OpenSSL memory
usage visible to :mod:`tracemalloc` and to custom allocators installed with

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure we can do this safely. tracemalloc_alloc calls PyGILState_Ensure() within PyMem_Raw allocations, OpenSSL allocates memory with its own internal locks held, and we call into OpenSSL in many circumstances with the GIL released.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is ongoing discussion on tracemalloc regarding this in #155725 but I don't think it causes deadlocks, in worst case it causes contention but that is the cost of using tracemalloc.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we were always consistent about releasing the GIL when calling into openssl APIs across _ssl and _hashlib it should avoid deadlocks... but I don't think we are.

And other extension modules calling libssl APIs might not and we cannot control that. So I don't think we can do this at all.

I let Claude hunt for an example where we don't... its found one and written a deadlock reproducer when using our PyMem_Raw allocators with OpenSSL - deadlocks on regular and free-threaded builds. Reproducer with explanation gist.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants