gh-157500: Serialize time.tzset() with localtime and strftime

`tzset()` mutates process-global libc timezone state (`tzname`, zoneinfo, `tm_zone` pointers). Concurrent `time.tzset()` and `time.localtime()` / `time.strftime('%Z')` is a TSan data race; `tm_zone` can point at storage the other thread just freed.

Hold a `PyMutex` on `time_module_state` around every `time` module path that calls `tzset()`, `localtime_r()`, or reads `tm_zone` / `tzname`. Copy `tm_zone` onto the stack before dropping the lock so `tmtotuple()` does not decode a pointer the next `tzset()` could free.

This only serializes CPython's `time` APIs with each other. Direct libc `tzset()` / `localtime()` from other C code in the process is unchanged.

Fixes #157500

Author: nouraellm

Lib/test/test_time.py

@@ -503,6 +503,44 @@ def test_tzset(self):
                 del environ['TZ']
             time.tzset()
 
+    @unittest.skipUnless(hasattr(time, "tzset"),
+                         "time module has no attribute tzset")
+    def test_tzset_race_with_localtime(self):
+        from os import environ
+        org_TZ = environ.get('TZ', None)
+        errors = []
+        barrier = threading.Barrier(4)
+
+        def setter():
+            barrier.wait()
+            for i in range(200):
+                environ['TZ'] = 'UTC0' if i & 1 else 'EST5EDT'
+                time.tzset()
+
+        def reader():
+            barrier.wait()
+            for _ in range(200):
+                try:
+                    time.localtime()
+                    time.strftime('%Z')
+                except Exception as e:
+                    errors.append(e)
+
+        threads = [threading.Thread(target=setter) for _ in range(2)]
+        threads += [threading.Thread(target=reader) for _ in range(2)]
+        try:
+            for t in threads:
+                t.start()
+            for t in threads:
+                t.join()
+            self.assertEqual(errors, [])
+        finally:
+            if org_TZ is not None:
+                environ['TZ'] = org_TZ
+            elif 'TZ' in environ:
+                del environ['TZ']
+            time.tzset()
+
     def test_insane_timestamps(self):
         # It's possible that some platform maps time_t to double,
         # and that this test will fail there.  This test should

Misc/NEWS.d/next/Library/2026-09-19-17-38-52.gh-issue-157500.tzset.rst

@@ -0,0 +1,2 @@
+Fix a data race between ``time.tzset()`` and concurrent
+``time.localtime()`` / ``time.strftime()`` calls.

Modules/timemodule.c

@@ -8,6 +8,9 @@
 #include "pycore_time.h"          // _PyTimeFraction
 
 #include <time.h>                 // clock()
+#include <string.h>               // strncpy()
+
+static PyMutex timezone_mutex = {0};
 #ifdef HAVE_SYS_TIMES_H
 #  include <sys/times.h>          // times()
 #endif
@@ -567,6 +570,21 @@ GMT).  When 'seconds' is not passed in, convert the current time instead.\n\
 If the platform supports the tm_gmtoff and tm_zone, they are available as\n\
 attributes only.");
 
+#ifdef HAVE_STRUCT_TM_TM_ZONE
+static void
+snapshot_tm_zone(struct tm *p, char *buf, size_t n)
+{
+    if (p->tm_zone != NULL) {
+        strncpy(buf, p->tm_zone, n - 1);
+        buf[n - 1] = '\0';
+    }
+    else {
+        buf[0] = '\0';
+    }
+    p->tm_zone = buf;
+}
+#endif
+
 static PyObject *
 time_localtime(PyObject *module, PyObject *args)
 {
@@ -575,11 +593,18 @@ time_localtime(PyObject *module, PyObject *args)
 
     if (!parse_time_t_args(args, "|O:localtime", &when))
         return NULL;
-    if (_PyTime_localtime(when, &buf) != 0)
+
+    PyMutex_Lock(&timezone_mutex);
+    if (_PyTime_localtime(when, &buf) != 0) {
+        PyMutex_Unlock(&timezone_mutex);
         return NULL;
+    }
 
     time_module_state *state = get_time_state(module);
 #ifdef HAVE_STRUCT_TM_TM_ZONE
+    char zone_buf[64];
+    snapshot_tm_zone(&buf, zone_buf, sizeof(zone_buf));
+    PyMutex_Unlock(&timezone_mutex);
     return tmtotuple(state, &buf);
 #else
     {
@@ -588,6 +613,7 @@ time_localtime(PyObject *module, PyObject *args)
         time_t gmtoff;
         strftime(zone, sizeof(zone), "%Z", &buf);
         gmtoff = timegm(&buf) - when;
+        PyMutex_Unlock(&timezone_mutex);
         return tmtotuple(state, &local, zone, gmtoff);
     }
 #endif
@@ -884,8 +910,12 @@ time_strftime(PyObject *module, PyObject *args)
     time_module_state *state = get_time_state(module);
     if (tup == NULL) {
         time_t tt = time(NULL);
-        if (_PyTime_localtime(tt, &buf) != 0)
+        PyMutex_Lock(&timezone_mutex);
+        if (_PyTime_localtime(tt, &buf) != 0) {
+            PyMutex_Unlock(&timezone_mutex);
             return NULL;
+        }
+        PyMutex_Unlock(&timezone_mutex);
     }
     else if (!gettmarg(state, tup, &buf,
                        "iiiiiiiii;strftime(): illegal time tuple argument") ||
@@ -941,8 +971,10 @@ time_strftime(PyObject *module, PyObject *args)
         }
         if (fmtlen) {
             format[fmtlen] = 0;
+            PyMutex_Lock(&timezone_mutex);
             PyObject *unicode = time_strftime1(&outbuf, &bufsize,
                                                format, fmtlen, &buf);
+            PyMutex_Unlock(&timezone_mutex);
             if (unicode == NULL) {
                 goto error;
             }
@@ -1043,8 +1075,12 @@ time_asctime(PyObject *module, PyObject *args)
     time_module_state *state = get_time_state(module);
     if (tup == NULL) {
         time_t tt = time(NULL);
-        if (_PyTime_localtime(tt, &buf) != 0)
+        PyMutex_Lock(&timezone_mutex);
+        if (_PyTime_localtime(tt, &buf) != 0) {
+            PyMutex_Unlock(&timezone_mutex);
             return NULL;
+        }
+        PyMutex_Unlock(&timezone_mutex);
     }
     else if (!gettmarg(state, tup, &buf,
                        "iiiiiiiii;asctime(): illegal time tuple argument") ||
@@ -1069,8 +1105,12 @@ time_ctime(PyObject *self, PyObject *args)
     struct tm buf;
     if (!parse_time_t_args(args, "|O:ctime", &tt))
         return NULL;
-    if (_PyTime_localtime(tt, &buf) != 0)
+    PyMutex_Lock(&timezone_mutex);
+    if (_PyTime_localtime(tt, &buf) != 0) {
+        PyMutex_Unlock(&timezone_mutex);
         return NULL;
+    }
+    PyMutex_Unlock(&timezone_mutex);
     return _asctime(&buf);
 }
 
@@ -1174,15 +1214,18 @@ time_tzset(PyObject *self, PyObject *unused)
         return NULL;
     }
 
+    PyMutex_Lock(&timezone_mutex);
 #if !defined(MS_WINDOWS) || defined(MS_WINDOWS_DESKTOP) || defined(MS_WINDOWS_SYSTEM)
     tzset();
 #endif
 
     /* Reset timezone, altzone, daylight and tzname */
     if (init_timezone(m) < 0) {
+        PyMutex_Unlock(&timezone_mutex);
         Py_DECREF(m);
         return NULL;
     }
+    PyMutex_Unlock(&timezone_mutex);
     Py_DECREF(m);
     if (PyErr_Occurred())
         return NULL;