UAF on `fut->fut_callback0` with evil `__eq__` in `_asynciomodule.c`

[picnixz]

Crash report

Bug description:

This is an issue just to track the progress of fixing the UAF on fut->fut_callback0 (see #125833 (comment)).

The UAF that could be exploited by clearing fut._callbacks won't be triggered anymore since after #125922, we will not mutate the internal list itself anymore but it is still be possilbe to mutate fut->fut_callback0 directly: #125833 (comment).

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

• gh-125966: fix UAF on fut->fut_callback0 due to an evil callback's __eq__ #125967
• [3.13] gh-125966: fix use-after-free on fut->fut_callback0 due to an evil callback's __eq__ in asyncio (GH-125967) #126047
• [3.12] gh-125966: fix use-after-free on fut->fut_callback0 due to an evil callback's __eq__ in asyncio (GH-125967) #126048