如何洞察 .NET 程序非托管句柄泄露

作者：一線碼農(nóng)聊技術(shù) 2023-07-07 13:56:54

handle 泄露也是一個(gè)比較難搞的問(wèn)題，難點(diǎn)在于生產(chǎn)環(huán)境可能不讓你用 WinDbg 這種侵入方式，但問(wèn)題還得要解決，必須創(chuàng)造條件上，當(dāng)前除了 WinDbg 還沒(méi)有找到其他方式，有機(jī)會(huì)再研究下吧。

一、背景

1. 講故事

很多朋友可能會(huì)有疑問(wèn)，C# 是一門托管語(yǔ)言，怎么可能會(huì)有非托管句柄泄露呢？其實(shí)一旦 C# 程序與 C++ 語(yǔ)言交互之后，往往就會(huì)被后者拖入非托管泥潭，讓我們這些調(diào)試者被迫探究非托管領(lǐng)域問(wèn)題。

二、非托管句柄泄露

1. 測(cè)試案例

為了方便講述，我們上一個(gè) Event 泄露的案例，使用 C# 調(diào)用 C++ ，然后讓 C++ 產(chǎn)生 bug 導(dǎo)致句柄泄露。

先看一下 C++ 代碼

extern "C"
{
 _declspec(dllexport) void CSharpCreateEvent();
}

#include "iostream"
#include <Windows.h>

using namespace std;

void CSharpCreateEvent()
{
 HANDLE hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);

 printf("\nEvent句柄值: %#08x ", hEvent);

}

然后導(dǎo)出一個(gè) CSharpCreateEvent 方法給 C# 使用。

internal class Program
    {

        [DllImport("Example_20_1_5", CallingConvention = CallingConvention.Cdecl)]
        extern static void CSharpCreateEvent();

        static void Main(string[] args)
        {
            try
            {
                while (true)
                {
                    Task.Run(() =>
                    {
                        CSharpCreateEvent();
                    });

                    Thread.Sleep(10);
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex.Message);
            }

            Console.ReadLine();
        }
    }

程序跑起來(lái)后，在任務(wù)管理器中會(huì)發(fā)現(xiàn)這個(gè)句柄在不斷的上漲，截圖如下：

圖片

2. 到底是誰(shuí)在泄露

如果你的生產(chǎn)環(huán)境可以用 WinDbg 附加進(jìn)程，那用它就可以輕松解決，可以借助 !handle 命令看一下泄露的句柄類型。

0:004> !handle 
...
Handle 16fc
  Type          Event
1411 Handles
Type            Count
None            6
Event           1337
File            16
Directory       4
Mutant          3
WindowStation   2
Semaphore       5
Key             10
Thread          8
Desktop         1
IoCompletion    5
TpWorkerFactory 3
ALPC Port       1
WaitCompletionPacket 10

從統(tǒng)計(jì)信息看，當(dāng)前 Event 高達(dá) 1337 個(gè)，看樣子程序存在 Event 泄露，接下來(lái)我們就要洞察到底是誰(shuí)分配的 Event，如果能找到分配 Event 的線程棧，那這個(gè)問(wèn)題就會(huì)迎刃而解，對(duì)吧，有 WinDbg 在，方圓3公里的bug都要移民，追蹤調(diào)用棧可以使用 WinDbg 提供的 !htrace 命令。

它的原理很簡(jiǎn)單，一句話表示就是：挖出現(xiàn)在時(shí)間點(diǎn)和快照之間那些沒(méi)有被 free 處理的 handle 調(diào)用棧，結(jié)果一清二楚，參考代碼如下：

0:011> !htrace -enable
Handle tracing enabled.
Handle tracing information snapshot successfully taken.

0:011> g
(e14.90c0): Break instruction exception - code 80000003 (first chance)
eax=006f2000 ebx=00000000 ecx=7777dfe0 edx=10088020 esi=7777dfe0 edi=7777dfe0
eip=77744e50 esp=0811f97c ebp=0811f9a8 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!DbgBreakPoint:
77744e50 cc              int     3

0:007> !htrace -diff
Handle tracing information snapshot successfully taken.
0xad new stack traces since the previous snapshot.
Ignoring handles that were already closed...
Outstanding handles opened since the previous snapshot:
--------------------------------------
Handle = 0x0000199c - OPEN
Thread ID = 0x000017c8, Process ID = 0x00000e14

0x4ac3d761: +0x4ac3d761
0x4aa0d9f5: +0x4aa0d9f5
0x6674d9c4: +0x6674d9c4
0x66547f33: +0x66547f33
0x6654901a: +0x6654901a
0x776c17c3: +0x776c17c3
0x776c11b9: +0x776c11b9
0x665438c9: +0x665438c9
0x665432bd: +0x665432bd
0x66725089: +0x66725089
0x66724c73: +0x66724c73
0x66724c1e: +0x66724c1e
0x77742f7c: ntdll!NtCreateEvent+0x0000000c
0x770f5746: KERNELBASE!CreateEventExW+0x00000056
0x770e2b04: KERNELBASE!CreateEventW+0x00000024
*** WARNING: Unable to verify checksum for D:\skyfly\20.20230628\src\Example\Example_20_1_4\bin\x86\Debug\net6.0\Example_20_1_5.DLL
0x6ac91755: Example_20_1_5!CSharpCreateEvent+0x00000035
--------------------------------------
...

Displayed 0xaa stack traces for outstanding handles opened since the previous snapshot.

從卦中短暫的時(shí)間內(nèi)快照之間有 170 個(gè)句柄沒(méi)有被釋放，而且從調(diào)用棧看是 Example_20_1_5!CSharpCreateEvent 方法所致，但這里有一個(gè)問(wèn)題，雖然有非托管棧，但沒(méi)有看到任何托管部分，那怎么辦呢？

3. 如何洞察到托管棧

其實(shí)這個(gè)問(wèn)題很簡(jiǎn)單，既然都 WinDbg 附加了，干脆用 bp 下斷點(diǎn)，后續(xù)泄露之時(shí)必然會(huì)被命中，然后通過(guò) !clrstack 或者 k 觀察線程棧即可，有了思路就開干。

:007> bp Example_20_1_5!CSharpCreateEvent "k; gc"
breakpoint 0 redefined
0:007> g
 # ChildEBP RetAddr      
00 0848f9e4 080674f3     Example_20_1_5!CSharpCreateEvent [D:\skyfly\20.20230628\src\Example\Example_20_1_5\Example_20_1_5.cpp @ 15] 
WARNING: Frame IP not in any known module. Following frames may be wrong.
01 0848f9e4 0806748b     0x80674f3
02 0848f9f0 0806e3dd     Example_20_1_4!Example_20_1_4.Program.<>c.<Main>b__1_0+0x1b
03 0848f9fc 0806e38d     System_Private_CoreLib!System.Threading.Tasks.Task.InnerInvoke+0x3d
04 0848fa04 0806e307     System_Private_CoreLib!System.Threading.Tasks.Task.<>c.<.cctor>b__272_0+0xd
05 0848fa2c 0806e072     System_Private_CoreLib!System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop+0x37
06 0848fa94 0806c49f     System_Private_CoreLib!System.Threading.Tasks.Task.ExecuteWithThreadLocal+0x82
07 0848faec 6b22f2bc     System_Private_CoreLib!System.Threading.ThreadPoolWorkQueue.Dispatch+0x1bf
08 0848fb88 6b216595     System_Private_CoreLib!System.Threading.PortableThreadPool.WorkerThread.WorkerThreadStart+0xdc [/_/src/libraries/System.Private.CoreLib/src/System/Threading/PortableThreadPool.WorkerThread.cs @ 63] 
09 0848fb98 6c00c30f     System_Private_CoreLib!System.Threading.Thread.StartCallback+0x35 [/_/src/coreclr/System.Private.CoreLib/src/System/Threading/Thread.CoreCLR.cs @ 106] 
0a 0848fba4 6bf5c07b     coreclr!CallDescrWorkerInternal+0x34
0b 0848fbd8 6bf6799a     coreclr!CallDescrWorkerWithHandler+0x66 [D:\a\_work\1\s\src\coreclr\vm\callhelpers.cpp @ 69] 
0c 0848fc20 6bff619b     coreclr!DispatchCallSimple+0x7f [D:\a\_work\1\s\src\coreclr\vm\callhelpers.cpp @ 220] 
0d 0848fc44 6bf7c7df     coreclr!ThreadNative::KickOffThread_Worker+0x4b [D:\a\_work\1\s\src\coreclr\vm\comsynchronizable.cpp @ 158] 
0e (Inline) --------     coreclr!ManagedThreadBase_DispatchInner+0x3d [D:\a\_work\1\s\src\coreclr\vm\threads.cpp @ 7321] 
0f 0848fcc8 6bf7c70f     coreclr!ManagedThreadBase_DispatchMiddle+0x8c [D:\a\_work\1\s\src\coreclr\vm\threads.cpp @ 7365] 
10 0848fd20 6bf1116f     coreclr!ManagedThreadBase_DispatchOuter+0x62 [D:\a\_work\1\s\src\coreclr\vm\threads.cpp @ 7543] 
11 (Inline) --------     coreclr!ManagedThreadBase_FullTransition+0x21 [D:\a\_work\1\s\src\coreclr\vm\threads.cpp @ 7569] 
12 (Inline) --------     coreclr!ManagedThreadBase::KickOff+0x21 [D:\a\_work\1\s\src\coreclr\vm\threads.cpp @ 7604] 
13 0848fd54 755b00f9     coreclr!ThreadNative::KickOffThread+0x7f [D:\a\_work\1\s\src\coreclr\vm\comsynchronizable.cpp @ 230] 
14 0848fd64 77737bbe     KERNEL32!BaseThreadInitThunk+0x19
15 0848fdc0 77737b8e     ntdll!__RtlUserThreadStart+0x2f
16 0848fdd0 00000000     ntdll!_RtlUserThreadStart+0x1b
...

從卦中看，一切都非常明白，這里再補(bǔ)充一點(diǎn)，如果想中途再產(chǎn)生快照，可以用 -snapshot 命令創(chuàng)建一個(gè)初始點(diǎn)，參考如下：

0:007> !htrace -snapshot
Handle tracing information snapshot successfully taken.

三、總結(jié)

責(zé)任編輯：武曉燕來(lái)源：一線碼農(nóng)聊技術(shù)