gh-125984: fix UAF on fut->fut_{callback,context}0 due to an evil loop.__getattribute__

[picnixz]

Minimal PoCs:

import asyncio

class EvilLoop:
	def call_soon(self, *args, **kwargs):
		print(1)  # crashes just after printing

    def get_debug(self):
        return False

    def __getattribute__(self, name):
        global tracker
        if name == "call_soon":
            fut.remove_done_callback(tracker)
            del tracker
        return object.__getattribute__(self, name)

fut = asyncio.Future(loop=EvilLoop())
tracker = lambda: ...
fut.add_done_callback(tracker)
fut.set_result("boom")

and

import asyncio

class EvilLoop:
	def call_soon(self, *args, **kwargs):
		raise Exception("unreachable")

    def get_debug(self):
        return False

    def __getattribute__(self, name):
        if name == "call_soon":
            x = lambda: ...
            x.get_debug = lambda: False
            fut.__init__(loop=x)
        return object.__getattribute__(self, name)

fut = asyncio.Future(loop=EvilLoop())
cb, ctx = lambda: ..., lambda: ...
fut.add_done_callback(cb, context=ctx)
del cb, ctx
fut.set_result("kaboom")

Note that depending on how the PoC is written, the crash may happen at interpreter shutdown instead. The above PoCs are a bit different from the original ones and from the ones in the tests though, but I've confirmed that without the ownership transfer, all PoCs crash.

cc @Nico-Posada

• Issue: UAF on fut->fut_{callback,context}0 with evil __getattribute__ in _asynciomodule.c #125984

[miss-islington-app]

Thanks @picnixz for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

[bedevere-app]

GH-126043 is a backport of this pull request to the 3.13 branch.

[bedevere-app]

GH-126044 is a backport of this pull request to the 3.12 branch.