-
Notifications
You must be signed in to change notification settings - Fork 5k
Support marshalling of null SafeHandle. #47944
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support marshalling of null SafeHandle. #47944
Conversation
@jkotas or @MichalStrehovsky I imagine CrossGen2 needs to be updated. But it isn't obvious to me where. I assume around the following. I don't see the expected helpers so I think I need to check for runtime/src/coreclr/tools/Common/TypeSystem/Interop/IL/Marshaller.cs Lines 1689 to 1836 in 525c43e
|
Yeah. The background of why this needs to be manual is that the helpers are not public API - and everything crossgen2-generated code calls into needs to be a public API or it becomes a R2R-breaking versioning risk that we're not willing to take. |
If memory serves, we have a few places where manual marshaling with DangerousAddRef/Release is being used to work around this. It's hard to search for, but I know of at least: runtime/src/libraries/System.Net.Sockets/src/System/Net/Sockets/SocketPal.Windows.cs Lines 1055 to 1076 in 4ca10ac
Could we fix that up as well? |
@stephentoub I can do that. I was planning on doing that in a follow up PR, but if we are okay with support and usage updates I can accommodate. |
Follow-up is fine. Thanks. |
@stephentoub I can update the one that originated this issue. There are many places (approx 250) where these APIs are used directly in the product. Most seem to be focusing on blittability and not the nullable aspect of the I think this change is going to require inspection of each use and then an update on an ad-hoc basis. If you know of another like the above I can change it but I don't really know the best way to see all the cases where |
Yes! Missed that specific request. |
Do we need to fix Mono too? Line 16 in 1d9e50c
|
@jkotas Good question. I finally get it drilled into my head to always consider CrossGen2, but now I need to also consider Mono. I will take a look. /cc @lambdageek |
@lambdageek or @CoffeeFlux I assume the correct location for addressing this is at: runtime/src/mono/mono/metadata/marshal-ilgen.c Lines 5326 to 5328 in 1d9e50c
and runtime/src/mono/mono/metadata/marshal-ilgen.c Lines 5361 to 5372 in 1d9e50c
|
The mono changes look ok to me. |
Android arm64 timeout is unrelated. @stephentoub or @jkotas any other concerns with this change? The Mono team appears to be satisfied with the changes on their side. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Thank you!
/azp list |
/azp run runtime-coreclr outerloop |
Azure Pipelines successfully started running 1 pipeline(s). |
@wfurt Okay. Seems like one of the P/Invokes I updated wasn't supposed to support a |
I think it is more likely that one of the PInvokes that you have not updated is affected by this. Before this change, it was throwing nice ArgumentNullException that was caught and handled gracefully. After this change, it is passing NULL into the unmanaged code that results into a fatal crash. If it is the case, it suggests that this change has breaking potential and it may be better to leave it for the source-generated interop plan. |
That would make sense. So users are relying on the IL Stub to check - boo.
Agree. @stephentoub Any thoughts on reverting this change? |
Before we back anything out, can we confirm this? Generally we don't consider removal of ANEs to be a breaking change, even though obviously it's possible someone is depending on it. If we're relying on catching an ANE for our own code to be correct, that's something I'd like to fix, anyway. |
Ah. Didn't realize that. Okay. @ManickaP Do you happen to know which test this is failing on? It isn't very clear from the logs. |
There are no logs, the test process crashed with segfault. Anyway, I'm no expert on this, but I assume we can catch and handle managed exception in managed code, but we cannot catch SIGSEGV in |
BTW, it would be handled here in runtime/src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/Http2Connection.cs Lines 970 to 975 in 515bfaf
|
I don't think it is a particular test @AaronRobinsonMSFT. The general sequence is like this: runtime/src/libraries/System.Net.Security/src/System/Net/Security/SecureChannel.cs Lines 173 to 184 in acdb869
That sets the pointer to null: runtime/src/libraries/Common/src/System/Net/Security/Unix/SafeDeleteSslContext.cs Lines 58 to 70 in a9c5ead
There is pending encrypt/decrypt operation on another thread. In the past I think the p/invoke would fail and I think we would eventually wrap that in ObjectDisposed exception (or pass the raw error about closed safe handle. The safe handle was sufficient to guard agains passing garbage/null to OS call. |
BTW while @ManickaP beat me with response. I think the issue is between SslStream and SafeHandles. While HTTP probably should not try to write to disposed stream, I feel it should not crash the process. We could perhaps find different mechanism instead of depending on null. But I'm also not sure if SslStream is only one case. |
Could the As far as the scope, this goes beyond runtime, right @AaronRobinsonMSFT? If I understand it right, this impacts anybody who inherits and extend from SafeHandle, right? |
@wfurt I don't fully understand this statement.
Yes, I suppose. The change was only for P/Invokes marshalling a type derived from This PR simply says that a P/Invoke signature with a |
It is not necessarily what one would expect for SafeHandles where 0 is valid value. For example, |
Seems like there's enough of a possible issue here that we should both revert the SafeHandle change and also continue to explore why exactly this is causing SslStream problems, as it suggests there's a deeper issue there. |
SslStream has dangling #46770 to investigate. That one seems to fail only on Windows and may be different. And pre-dates this PR -> something fishy with SslStream. |
Oh dear. That is a great point @jkotas. I truthfully hadn't considered those scenarios. This makes |
This reverts commit c3ae456.
Fixes #42550
Context: #42535 (comment)
/cc @stephentoub @elinor-fung @jkoritzinsky