IOCompletionCallback of ThreadPoolBoundHandle causes the app to crash

[xljiulang]

I'm using pinvoke to wrap windivert into dotnet library with a prototype method like this:

[DllImport(library, CallingConvention = CallingConvention.Cdecl, SetLastError = true)]
public static extern bool WinDivertRecvEx(
    WinDivertHandle handle,
    SafeHandle pPacket,
    int packetLen,
    ref int pRecvLen,
    ulong flags,
    ref WinDivertAddress pAddr,
    int* pAddrLen,
    NativeOverlapped* lpOverlapped); 

My csharp code is as follows：
https://github.com/xljiulang/WindivertDotnet/blob/async-task/WindivertDotnet/WindivertOperation.cs
https://github.com/xljiulang/WindivertDotnet/blob/async-task/WindivertDotnet/WindivertRecvOperation.cs

After the application has been running for a few minutes, the program throws a crash exception:

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
   at System.Runtime.CompilerServices.TaskAwaiter`1[[System.Int32, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].GetResult()
   at App.Program+<Main>d__0.MoveNext()
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   at System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1+AsyncStateMachineBox`1[[System.Threading.Tasks.VoidTaskResult, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].MoveNext(System.Threading.Thread)
   at System.Runtime.CompilerServices.TaskAwaiter+<>c.<OutputWaitEtwEvents>b__12_0(System.Action, System.Threading.Tasks.Task)
   at System.Threading.Tasks.AwaitTaskContinuation.RunOrScheduleAction(System.Action, Boolean)
   at System.Threading.Tasks.Task.RunContinuations(System.Object)
   at System.Threading.Tasks.Task`1[[System.Int32, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].TrySetResult(Int32)
   at System.Threading.Tasks.TaskCompletionSource`1[[System.Int32, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].TrySetResult(Int32)
   at System.Threading.Tasks.TaskCompletionSource`1[[System.Int32, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].SetResult(Int32)
   at WindivertDotnet.WindivertOperation.SetResult(Int32)
   at WindivertDotnet.WindivertRecvOperation.SetResult(Int32)
   at WindivertDotnet.WindivertOperation.IOCompletionCallback(UInt32, UInt32, System.Threading.NativeOverlapped*)
   at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32, UInt32, System.Threading.NativeOverlapped*)

Before the process disappeared, I dump the process down as dump file, can anyone help me? Thanks a lot.

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

Tagging subscribers to this area: @mangod9
See info in area-owners.md if you want to be subscribed.

Issue Details

---

I'm using pinvoke to wrap windivert into dotnet library with a prototype method like this:

[DllImport(library, CallingConvention = CallingConvention.Cdecl, SetLastError = true)]
public static extern bool WinDivertRecvEx(
    WinDivertHandle handle,
    SafeHandle pPacket,
    int packetLen,
    ref int pRecvLen,
    ulong flags,
    ref WinDivertAddress pAddr,
    int* pAddrLen,
    NativeOverlapped* lpOverlapped); 

My csharp code is as follows：
https://github.com/xljiulang/WindivertDotnet/blob/async-task/WindivertDotnet/WindivertOperation.cs
https://github.com/xljiulang/WindivertDotnet/blob/async-task/WindivertDotnet/WindivertRecvOperation.cs

After the application has been running for a few minutes, the program throws a crash exception:

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
   at System.Runtime.CompilerServices.TaskAwaiter`1[[System.Int32, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].GetResult()
   at App.Program+<Main>d__0.MoveNext()
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   at System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1+AsyncStateMachineBox`1[[System.Threading.Tasks.VoidTaskResult, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].MoveNext(System.Threading.Thread)
   at System.Runtime.CompilerServices.TaskAwaiter+<>c.<OutputWaitEtwEvents>b__12_0(System.Action, System.Threading.Tasks.Task)
   at System.Threading.Tasks.AwaitTaskContinuation.RunOrScheduleAction(System.Action, Boolean)
   at System.Threading.Tasks.Task.RunContinuations(System.Object)
   at System.Threading.Tasks.Task`1[[System.Int32, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].TrySetResult(Int32)
   at System.Threading.Tasks.TaskCompletionSource`1[[System.Int32, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].TrySetResult(Int32)
   at System.Threading.Tasks.TaskCompletionSource`1[[System.Int32, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].SetResult(Int32)
   at WindivertDotnet.WindivertOperation.SetResult(Int32)
   at WindivertDotnet.WindivertRecvOperation.SetResult(Int32)
   at WindivertDotnet.WindivertOperation.IOCompletionCallback(UInt32, UInt32, System.Threading.NativeOverlapped*)
   at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32, UInt32, System.Threading.NativeOverlapped*)

Before the process disappeared, I dump the process down as dump file, can anyone help me? Thanks a lot.

Author:	xljiulang
Assignees:	-
Labels:	area-System.Threading, untriaged
Milestone:	-

[mangod9]

@AaronRobinsonMSFT could you please take an initial look if this is interop related?

[AaronRobinsonMSFT]

@xljiulang I see the exception in the DMP and have inspected the interop transition. The generated interop transition doesn't seem to be wrong. The following is the stack I am looking at, which appears to be an exception coming from a cancellation pattern, but I think that is due to the A/V. The A/V address 00007ff800000050 is a bit odd. Notice the lower 32-bits are 00000050, but the upper are some high address 00007ff8. My quick guess is there is something incorrectly defined in the admittedly very complicated WinDivertAddress type. I recommend stepping through the native library and ensuring the WinDivertAddress is properly defined. I typically create a C++ application and inspect the type in its defined environment and then transcribe it while inspecting the type under a debugger.

Also, this application seems to be running on .NET 5, which is out of support. Would it be possible for you to move up to .NET 6+? I don't think it will solve the issue but it is easier for us to help in some cases.

000000D1B7BFF1D0 00007ff800000050 00007ff800000050 ====> Exception Code c0000005 cxr@000000D1B7BFEA40 exr@000000D1B7BFEF30
000000D1B7BFED00 00007ff9524c8eb0 coreclr!Thread::ReadyForAsyncException + 0x24 [D:\a\_work\1\s\src\coreclr\src\vm\threadsuspend.cpp:981], calling coreclr!__chkstk [d:\a01\_work\12\s\src\vctools\crt\vcstartup\src\misc\amd64\chkstk.asm:67]
000000D1B7BFED30 00007ff9524c87dd coreclr!Thread::HandleThreadAbort + 0x6d [D:\a\_work\1\s\src\coreclr\src\vm\threadsuspend.cpp:2503], calling coreclr!Thread::ReadyForAsyncException [D:\a\_work\1\s\src\coreclr\src\vm\threadsuspend.cpp:981]
000000D1B7BFED60 00007ff9524c8eb0 coreclr!Thread::ReadyForAsyncException + 0x24 [D:\a\_work\1\s\src\coreclr\src\vm\threadsuspend.cpp:981], calling coreclr!__chkstk [d:\a01\_work\12\s\src\vctools\crt\vcstartup\src\misc\amd64\chkstk.asm:67]
000000D1B7BFED70 00007ffa2588d83a ntdll!RtlpLowFragHeapAllocFromContext + 0x1ba [minkernel\ntos\rtl\heaplowf.c:4532], calling ntdll!RtlpLfhFindClearBitAndSet [minkernel\ntos\rtl\heaplfhcommon.c:270]
000000D1B7BFEE30 00007ff9524c8eb0 coreclr!Thread::ReadyForAsyncException + 0x24 [D:\a\_work\1\s\src\coreclr\src\vm\threadsuspend.cpp:981], calling coreclr!__chkstk [d:\a01\_work\12\s\src\vctools\crt\vcstartup\src\misc\amd64\chkstk.asm:67]
000000D1B7BFEE60 00007ff9524c87dd coreclr!Thread::HandleThreadAbort + 0x6d [D:\a\_work\1\s\src\coreclr\src\vm\threadsuspend.cpp:2503], calling coreclr!Thread::ReadyForAsyncException [D:\a\_work\1\s\src\coreclr\src\vm\threadsuspend.cpp:981]
000000D1B7BFEE80 00007ffa258a39b0 ntdll!RtlSetLastWin32Error + 0x40 [minkernel\ntos\rtl\error.c:316], calling ntdll!__security_check_cookie [onecore\private\minwin\priv_sdk\inc\gs\crt_amdsecgs.asm:54]
000000D1B7BFEEA0 00007ffa22ffc26d KERNELBASE!BaseSetLastNTError + 0x1d [minkernel\kernelbase\error.c:302], calling ntdll!RtlSetLastWin32Error [minkernel\ntos\rtl\error.c:274]
000000D1B7BFEED0 00007ff95249cbb1 coreclr!JIT_RareDisableHelperWorker + 0xf1 [D:\a\_work\1\s\src\coreclr\src\vm\jithelpers.cpp:4892], calling coreclr!__security_check_cookie [d:\a01\_work\12\s\src\vctools\crt\vcstartup\src\gs\amd64\amdsecgs.asm:45]
000000D1B7BFEFE8 00007ff95249cb46 coreclr!JIT_RareDisableHelperWorker + 0x86 [D:\a\_work\1\s\src\coreclr\src\vm\jithelpers.cpp:4886], calling coreclr!LazyMachStateCaptureState [D:\a\_work\1\s\src\coreclr\src\vm\amd64\getstate.asm:61]
000000D1B7BFF050 00007ff8f27f892c (MethodDesc 00007ff8f29a2148 + 0x13c ILStubClass.IL_STUB_PInvoke(WindivertDotnet.WinDivertHandle, System.Runtime.InteropServices.SafeHandle, Int32, Int32 ByRef, UInt64, WindivertDotnet.WinDivertAddress ByRef, Int32*, System.Threading.NativeOverlapped*)), calling (MethodDesc 00007ff8f28b01a8 + 0 System.StubHelpers.StubHelpers.SafeHandleRelease(System.Runtime.InteropServices.SafeHandle))

This issue has been marked needs-author-action and may be missing some important information.

[xljiulang]

@AaronRobinsonMSFT
Thank you for your help. The same problem was encountered when running in donet6, although 6 and 5 use different thread pool implementations.App-dotnet6.zip

If I call it using the synchronous Recv method, I will not encounter this exception. This exception only occurs when the asynchronous RecvEx method is called.