Skip to content

VectorExceptionHandler can StackOverflow due to uninitialized TLS #12072

Closed

Description

Our exception handler can be called on threads that have not had thread local storage initialized. In this case, a thread that the Windows OS loader is faulting on. This eventually causes a null ref here while trying to save off the current exception info for the thread. This in turn leads to the exception handling code to be called by the OS etc etc. The cascade of faults eventually leads to stack overflow.

The likely fix is to do a null check. There's a similar treatment in the debugger here.

There may be other globals that need similar treatment but I haven't done any real analysis.

Here's the last set of frames from a user provided dump:

c6c (Inline Function) --------`-------- coreclr!CExecutionEngine::GetTlsData+0x15 [f:\vsagent\3\s\src\vm\corhost.cpp @ 2715] 
c6d (Inline Function) --------`-------- coreclr!CExecutionEngine::CheckThreadStateNoCreate+0x15 [f:\vsagent\3\s\src\vm\corhost.cpp @ 2827] 
c6e 000000ea`312fd020 00007ffd`3cf4e989 coreclr!SaveCurrentExceptionInfo+0x2b [f:\vsagent\3\s\src\vm\excep.cpp @ 8338] 
c6f 000000ea`312fd050 00007ffd`69985e90 coreclr!CLRVectoredExceptionHandlerShim+0x99 [f:\vsagent\3\s\src\vm\excep.cpp @ 8069] 
c70 000000ea`312fd0a0 00007ffd`6995fa1b ntdll!RtlpCallVectoredHandlers+0x104 

And trying to access the uninitialized global:

0:295> dt coreclr!gCurrentThreadInfo
   +0x000 m_pThread        : ???? 
   +0x008 m_pAppDomain     : ???? 
   +0x010 m_EETlsData      : ???? 
Memory read error 0000000000000018
0:295> x coreclr!gCurrentThreadInfo
<Addr: Memory access error> coreclr!gCurrentThreadInfo = struct ThreadLocalInfo

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions