fix(profiling): never enable fast copy memory if interpreter is embedded

Fast memory copy (safe_memcpy) relies on installing SIGSEGV/SIGBUS signal
handlers to recover from faults. When Python is embedded in another
process (e.g. the Datadog Agent), those handlers can displace signal
handlers owned by the host process and cause crashes.

This change detects whether the interpreter is embedded (by checking
whether the process executable looks like a Python binary) and, if so,
skips installing the signal handlers and disables fast copy on both the
native (vm.cc) and Python config (profiling.py) sides.

Author: KowalskiThomas

ddtrace/internal/datadog/profiling/stack/src/echion/vm.cc

@@ -1,6 +1,12 @@
 #include <cstdio>
 #include <cstring>
 
+#include <climits>
+
+#if defined PL_DARWIN
+#include <mach-o/dyld.h>
+#endif
+
 #include <echion/vm.h>
 
 // Returns true when _DD_PROFILING_STACK_FAST_COPY is set to a falsy value.
@@ -15,6 +21,50 @@ fast_copy_env_disabled()
     return strcmp(val, "0") == 0 || strcmp(val, "false") == 0 || strcmp(val, "False") == 0;
 }
 
+// Checks whether Python is running as an embedded interpreter by checking
+// whether the process executable looks like a Python binary.
+//
+// When the executable path cannot be read (for example no procfs),
+// we report "embedded". This constructor is the only gate that runs
+// before the SIGSEGV/SIGBUS handlers are installed, so an indeterminate
+// process must not keep handlers that may belong to a host.
+static bool
+is_python_embedded()
+{
+    char exe_path[PATH_MAX] = { 0 };
+
+#if defined PL_LINUX
+    ssize_t len = readlink("/proc/self/exe", exe_path, sizeof(exe_path) - 1);
+    if (len <= 0) {
+        return true;
+    }
+    exe_path[len] = '\0';
+#elif defined PL_DARWIN
+    uint32_t bufsize = sizeof(exe_path);
+    if (_NSGetExecutablePath(exe_path, &bufsize) != 0) {
+        return true;
+    }
+#else
+    return true;
+#endif
+
+    const char* base = strrchr(exe_path, '/');
+    base = base ? base + 1 : exe_path;
+
+    // Case-insensitive substring search for "python" in the basename.
+    size_t base_len = strlen(base);
+    if (base_len >= 6) {
+        for (size_t i = 0; i <= base_len - 6; ++i) {
+            if ((base[i] | 0x20) == 'p' && (base[i + 1] | 0x20) == 'y' && (base[i + 2] | 0x20) == 't' &&
+                (base[i + 3] | 0x20) == 'h' && (base[i + 4] | 0x20) == 'o' && (base[i + 5] | 0x20) == 'n') {
+                return false;
+            }
+        }
+    }
+
+    return true;
+}
+
 #if defined PL_LINUX
 static bool
 probe_process_vm_readv()
@@ -38,9 +88,11 @@ init_safe_copy()
     // Always probe process_vm_readv so we know whether it is a valid fallback.
     process_vm_readv_available = probe_process_vm_readv();
 
-    // Honor the fast-copy opt-out: when disabled via env var, skip installing
-    // the SIGSEGV/SIGBUS handlers and alt stack entirely.
-    if (fast_copy_env_disabled()) {
+    // Honor the fast-copy opt-out: when disabled via env var or when Python is
+    // embedded, skip installing the SIGSEGV/SIGBUS handlers entirely.
+    // Embedded interpreters must never use safe_memcpy because the host process
+    // owns the signal handlers.
+    if (fast_copy_env_disabled() || is_python_embedded()) {
         fast_copy_user_disabled = true;
         if (process_vm_readv_available) {
             safe_copy = process_vm_readv;
@@ -72,8 +124,9 @@ init_safe_copy()
 __attribute__((constructor)) void
 init_safe_copy()
 {
-    // Honor the fast-copy opt-out: skip installing signal handlers when disabled.
-    if (fast_copy_env_disabled()) {
+    // Honor the fast-copy opt-out: skip installing signal handlers when
+    // disabled or when Python is embedded (host owns signal handlers).
+    if (fast_copy_env_disabled() || is_python_embedded()) {
         fast_copy_user_disabled = true;
         return;
     }

ddtrace/internal/datadog/profiling/stack/test/CMakeLists.txt

@@ -100,3 +100,8 @@ configure_stack_internal_test(test_sample_lifecycle)
 
 dd_wrapper_add_test(test_sampling_cycle_state test_sampling_cycle_state.cpp)
 configure_stack_internal_test(test_sampling_cycle_state)
+
+# vm.cc is compiled into the test binary: the fast-copy state lives in inline variables, so the copy in the test
+# executable is distinct from the one in the _stack library and only the constructor linked here initializes it.
+dd_wrapper_add_test(test_embedded_fast_copy test_embedded_fast_copy.cpp ../src/echion/vm.cc)
+configure_stack_internal_test(test_embedded_fast_copy)

ddtrace/internal/datadog/profiling/stack/test/test_embedded_fast_copy.cpp

@@ -0,0 +1,14 @@
+#include <echion/vm.h>
+#include <gtest/gtest.h>
+
+// Test that fast memory copy is disabled when Python runs as an embedded
+// interpreter.  This binary is not named "python*", so is_python_embedded()
+// returns true and init_safe_copy() never installs the SIGSEGV/SIGBUS
+// handlers.  vm.cc is compiled into this binary, so the constructor has
+// already fired on the state that the assertions below read.
+TEST(EmbeddedFastCopy, FastCopyDisabledWhenEmbedded)
+{
+    EXPECT_TRUE(fast_copy_user_disabled)
+      << "fast_copy_user_disabled must be true when the process exe is not a python binary";
+    EXPECT_FALSE(fast_copy_active) << "fast_copy_active must be false in an embedded interpreter";
+}

ddtrace/internal/settings/profiling.py

@@ -2,6 +2,8 @@
 
 import itertools
 import math
+import os
+import sys
 import typing as t
 
 from envier import Env
@@ -25,6 +27,19 @@
 logger = get_logger(__name__)
 
 
+def _is_python_embedded() -> bool:
+    try:
+        real_exe = os.readlink("/proc/self/exe") if sys.platform == "linux" else ""
+    except OSError:
+        real_exe = ""
+
+    exe = real_exe or (getattr(sys, "executable", "") or "")
+    if not exe:
+        return True
+
+    return "python" not in os.path.basename(exe).lower()
+
+
 def _derive_default_heap_sample_size(
     heap_config: Env,
     default_heap_sample_size: int = 1024 * 1024,
@@ -621,6 +636,13 @@ class ProfilingConfigException(DDConfig):
         )
     config.stack.enabled = False  # pyright: ignore[reportAttributeAccessIssue]
 
+# Fast memory copy is unsafe in embedded interpreters: the host process may
+# install its own signal handlers that conflict with the SIGSEGV/SIGBUS
+# recovery mechanism used by safe_memcpy.
+if config.stack.fast_copy and _is_python_embedded():
+    logger.debug("Python is running as an embedded interpreter; disabling fast memory copy for stack profiling")
+    config.stack.fast_copy = False  # pyright: ignore[reportAttributeAccessIssue]
+
 # Enrich tags with git metadata and DD_TAGS
 config.tags = _enrich_tags(config.tags)  # pyright: ignore[reportAttributeAccessIssue]
 

ddtrace/internal/settings/profiling.pyi

@@ -69,3 +69,4 @@ stack_v2_failure_msg: Optional[str]
 stack_v2_is_available: bool
 
 def config_str(config: ProfilingConfig) -> str: ...
+def _is_python_embedded() -> bool: ...

releasenotes/notes/profiling-embedded-interpreter-fast-copy-memory-48b01a71fc45447f.yaml

@@ -0,0 +1,4 @@
+fixes:
+  - |
+    Profiling: Fast memory copy is now automatically disabled when Python is running
+    as an embedded interpreter.

tests/profiling/test_profiling_config.py

@@ -119,6 +119,58 @@ def test_always_excluded_modules_contains_required_entries() -> None:
     assert "concurrent" in _ALWAYS_EXCLUDED_MODULES
 
 
+class TestEmbeddedInterpreterFastCopy:
+    def test_is_python_embedded_returns_false_for_python(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        from ddtrace.internal.settings.profiling import _is_python_embedded
+
+        monkeypatch.setattr("os.readlink", lambda _: "/usr/bin/python3.12")
+        monkeypatch.setattr("sys.platform", "linux")
+        assert _is_python_embedded() is False
+
+    def test_is_python_embedded_returns_true_for_non_python(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        from ddtrace.internal.settings.profiling import _is_python_embedded
+
+        monkeypatch.setattr("os.readlink", lambda _: "/ucsr/bin/nginx")
+        monkeypatch.setattr("sys.platform", "linux")
+        assert _is_python_embedded() is True
+
+    def test_is_python_embedded_fallback_to_sys_executable(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        from ddtrace.internal.settings.profiling import _is_python_embedded
+
+        def _raise_oserror(_: str) -> str:
+            raise OSError("no procfs")
+
+        monkeypatch.setattr("os.readlink", _raise_oserror)
+        monkeypatch.setattr("sys.platform", "linux")
+        monkeypatch.setattr("sys.executable", "/opt/myapp/bin/myapp")
+        assert _is_python_embedded() is True
+
+    def test_is_python_embedded_fallback_empty_executable(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        from ddtrace.internal.settings.profiling import _is_python_embedded
+
+        def _raise_oserror(_: str) -> str:
+            raise OSError("no procfs")
+
+        monkeypatch.setattr("os.readlink", _raise_oserror)
+        monkeypatch.setattr("sys.platform", "linux")
+        monkeypatch.setattr("sys.executable", "")
+        assert _is_python_embedded() is True
+
+    def test_non_linux_falls_back_to_sys_executable(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        from ddtrace.internal.settings.profiling import _is_python_embedded
+
+        monkeypatch.setattr("sys.platform", "darwin")
+        monkeypatch.setattr("sys.executable", "/usr/local/bin/python3")
+        assert _is_python_embedded() is False
+
+    def test_non_linux_embedded(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        from ddtrace.internal.settings.profiling import _is_python_embedded
+
+        monkeypatch.setattr("sys.platform", "darwin")
+        monkeypatch.setattr("sys.executable", "/Applications/MyGame.app/Contents/MacOS/mygame")
+        assert _is_python_embedded() is True
+
+
 class TestDumpSettings:
     """Tests for the profiler-settings serializer used in per-profile metadata."""