Skip to content

Commit a191f4d

Browse files
vseanreesermsftdotnet-botdipeshmsft
authored
Merging internal commits for release/6.0 (#9005)
* [internal/release/6.0] Update dependencies from dnceng/internal/dotnet-winforms * Fixes PenIMC UAF MSRC .NET 6 * Update dependencies from https://dev.azure.com/dnceng/internal/_git/dotnet-winforms build 20240311.13 Microsoft.Dotnet.WinForms.ProjectTemplates , Microsoft.Private.Winforms From Version 6.0.29-servicing.24158.7 -> To Version 6.0.29-servicing.24161.13 * Update dependencies from https://dev.azure.com/dnceng/internal/_git/dotnet-winforms build 20240312.6 Microsoft.Dotnet.WinForms.ProjectTemplates , Microsoft.Private.Winforms From Version 6.0.29-servicing.24158.7 -> To Version 6.0.29-servicing.24162.6 * Local dependencies updated based on build with BAR id 217668 (20240315.6 from https://dev.azure.com/dnceng/internal/_git/dotnet-winforms@refs/heads/internal/release/6.0) * Update dependencies from https://dev.azure.com/dnceng/internal/_git/dotnet-winforms build Microsoft.Dotnet.WinForms.ProjectTemplates , Microsoft.Private.Winforms From Version 6.0.29-servicing.24165.6 -> To Version 6.0.29-servicing.24169.15 Dependency coherency updates Microsoft.NETCore.Platforms,Microsoft.NETCore.ILDAsm,Microsoft.NETCore.ILAsm,Microsoft.NETCore.App.Ref,Microsoft.NETCore.App.Runtime.win-x64,VS.Redist.Common.NetCore.SharedFramework.x64.6.0 From Version 6.0.13 -> To Version 6.0.13 (parent: Microsoft.Private.Winforms * Merged PR 38439: [internal/release/6.0] Update dependencies from dnceng/internal/dotnet-winforms This pull request updates the following dependencies [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NETCore.Platforms**: from 6.0.13 to 6.0.13 (parent: Microsoft.Private.Winforms) - **Microsoft.NETCore.ILDAsm**: from 6.0.29-servicing.24169.13 to 6.0.29-servicing.24171.5 (parent: Microsoft.Private.Winforms) - **Microsoft.NETCore.ILAsm**: from 6.0.29-servicing.24169.13 to 6.0.29-servicing.24171.5 (parent: Microsoft.Private.Winforms) - **Microsoft.NETCore.App.Ref**: from 6.0.29 to 6.0.29 (parent: Microsoft.Private.Winforms) - **Microsoft.NETCore.App.Runtime.win-x64**: from 6.0.29 to 6.0.29 (parent: Microsoft.Private.Winforms) - **VS.Redist.Common.NetCore.SharedFramework.x64.6.0**: from 6.0.29-servicing.24169.13 to 6.0.29-servicing.24171.5 (parent: Microsoft.Private.Winforms) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:a88d6455-e128-4280-39b4-08d960f4ca81) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-winforms - **Subscription**: a88d6455-e128-4280-39b4-08d960f4ca81 - **Build**: - **Date Produced**: March 21, 2024 8:50:10 PM UTC - **Commit**: 6525c5174ef1b8ee5b29c397e8a4b76e76487927 - **Branch**: refs/heads/internal/release/6.0 [DependencyUpdate]: <> (Begin) - **Updates**: - **Microsoft.Dotnet.WinForms.ProjectTemplates**: [from 6.0.29-servicing.24169.15 to 6.0.29-servicing.24171.6][1] - **Microsoft.Private.Winforms**: [from 6.0.29-servicing.24169.15 to 6.0.29-servicing.24171.6][1] - **Microsoft.NETCore.Platforms**: [from 6.0.13 to 6.0.13][2] - **Microsoft.NETCore.ILDAsm**: [from 6.0.29-servicing.24169.13 to 6.0.29-servicing.24171.5][2] - **Microsoft.NETCore.ILAsm**: [from 6.0.29-servicing.24169.13 to 6.0.29-servicing.24171.5][2] - **Microsoft.NETCore.App.Ref**: [from 6.0.29 to 6.0.29][2] - **Microsoft.NETCore.App.Runtime.win-x64**: [from 6.0.29 to 6.0.29][2] - **VS.Redist.Common.NetCore.SharedFramework.x64.6.0**: [from 6.0.29-servicing.24169.13 to 6.0.29-servicing.24171.5][2] [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-winforms/branches?baseVersion=GC8b4de777b2ddf7e0f4a06dec30bbc152315fdef8&targetVersion=GC6525c5174ef1b8ee5b29c397e8a4b76e76487927&_a=files [2]: https://dev.azure.com/dnceng/internal/_git/dotnet-runtime/branches?baseVersion=GCc95b68327d40062beb0c9d4cd08295a85d86bd27&targetVersion=GC189fbbd88d97dd6d65515ba2da05b62eab4e5039&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:a88d6455-e128-4280-39b4-08d960f4ca81) * Merged PR 38452: [internal/release/6.0] Merge from public Merge from public release/6.0 to internal/release/6.0 and resolve conflicts if necessary --------- Co-authored-by: dotnet-bot <[email protected]> Co-authored-by: DotNet Bot <[email protected]> Co-authored-by: dipeshmsft <[email protected]>
1 parent 4345c0a commit a191f4d

File tree

5 files changed

+118
-23
lines changed

5 files changed

+118
-23
lines changed

‎NuGet.config‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
<clear />
66
<!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
77
<!-- Begin: Package sources from dotnet-runtime -->
8+
<add key="darc-int-dotnet-runtime-189fbbd" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-runtime-189fbbd8/nuget/v3/index.json" />
89
<!-- End: Package sources from dotnet-runtime -->
910
<!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
1011
<add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
@@ -18,6 +19,7 @@
1819
<disabledPackageSources>
1920
<!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
2021
<!-- Begin: Package sources from dotnet-runtime -->
22+
<add key="darc-int-dotnet-runtime-189fbbd" value="true" />
2123
<!-- End: Package sources from dotnet-runtime -->
2224
<!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
2325
</disabledPackageSources>

‎eng/Version.Details.xml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Dependencies>
33
<ProductDependencies>
4-
<Dependency Name="Microsoft.Private.Winforms" Version="6.0.28-servicing.24120.4">
4+
<Dependency Name="Microsoft.Private.Winforms" Version="6.0.29-servicing.24171.6">
55
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-winforms</Uri>
6-
<Sha>9de94bff9795bb0644835098b91e81edccfaa367</Sha>
6+
<Sha>6525c5174ef1b8ee5b29c397e8a4b76e76487927</Sha>
77
</Dependency>
8-
<Dependency Name="Microsoft.Dotnet.WinForms.ProjectTemplates" Version="6.0.28-servicing.24120.4">
8+
<Dependency Name="Microsoft.Dotnet.WinForms.ProjectTemplates" Version="6.0.29-servicing.24171.6">
99
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-winforms</Uri>
10-
<Sha>9de94bff9795bb0644835098b91e81edccfaa367</Sha>
10+
<Sha>6525c5174ef1b8ee5b29c397e8a4b76e76487927</Sha>
1111
</Dependency>
1212
<Dependency Name="System.CodeDom" Version="6.0.0" CoherentParentDependency="Microsoft.Private.Winforms">
1313
<Uri>https://github.com/dotnet/runtime</Uri>
@@ -45,9 +45,9 @@
4545
<Uri>https://github.com/dotnet/runtime</Uri>
4646
<Sha>4822e3c3aa77eb82b2fb33c9321f923cf11ddde6</Sha>
4747
</Dependency>
48-
<Dependency Name="Microsoft.NETCore.Platforms" Version="6.0.12" CoherentParentDependency="Microsoft.Private.Winforms">
48+
<Dependency Name="Microsoft.NETCore.Platforms" Version="6.0.13" CoherentParentDependency="Microsoft.Private.Winforms">
4949
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
50-
<Sha>34a109148c7d8a2c8e6431e83e4bce5712dd8083</Sha>
50+
<Sha>189fbbd88d97dd6d65515ba2da05b62eab4e5039</Sha>
5151
</Dependency>
5252
<Dependency Name="Microsoft.DotNet.Wpf.DncEng" Version="6.0.0-rtm.24171.2">
5353
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-wpf-int</Uri>
@@ -57,29 +57,29 @@
5757
<Uri>https://github.com/dotnet/runtime</Uri>
5858
<Sha>4822e3c3aa77eb82b2fb33c9321f923cf11ddde6</Sha>
5959
</Dependency>
60-
<Dependency Name="Microsoft.NETCore.ILDAsm" Version="6.0.28-servicing.24120.7" CoherentParentDependency="Microsoft.Private.Winforms">
60+
<Dependency Name="Microsoft.NETCore.ILDAsm" Version="6.0.29-servicing.24171.5" CoherentParentDependency="Microsoft.Private.Winforms">
6161
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
62-
<Sha>34a109148c7d8a2c8e6431e83e4bce5712dd8083</Sha>
62+
<Sha>189fbbd88d97dd6d65515ba2da05b62eab4e5039</Sha>
6363
</Dependency>
64-
<Dependency Name="Microsoft.NETCore.ILAsm" Version="6.0.28-servicing.24120.7" CoherentParentDependency="Microsoft.Private.Winforms">
64+
<Dependency Name="Microsoft.NETCore.ILAsm" Version="6.0.29-servicing.24171.5" CoherentParentDependency="Microsoft.Private.Winforms">
6565
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
66-
<Sha>34a109148c7d8a2c8e6431e83e4bce5712dd8083</Sha>
66+
<Sha>189fbbd88d97dd6d65515ba2da05b62eab4e5039</Sha>
6767
</Dependency>
6868
<Dependency Name="System.Resources.Extensions" Version="6.0.0" CoherentParentDependency="Microsoft.Private.Winforms">
6969
<Uri>https://github.com/dotnet/runtime</Uri>
7070
<Sha>4822e3c3aa77eb82b2fb33c9321f923cf11ddde6</Sha>
7171
</Dependency>
72-
<Dependency Name="Microsoft.NETCore.App.Ref" Version="6.0.28" CoherentParentDependency="Microsoft.Private.Winforms">
72+
<Dependency Name="Microsoft.NETCore.App.Ref" Version="6.0.29" CoherentParentDependency="Microsoft.Private.Winforms">
7373
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
74-
<Sha>34a109148c7d8a2c8e6431e83e4bce5712dd8083</Sha>
74+
<Sha>189fbbd88d97dd6d65515ba2da05b62eab4e5039</Sha>
7575
</Dependency>
76-
<Dependency Name="Microsoft.NETCore.App.Runtime.win-x64" Version="6.0.28" CoherentParentDependency="Microsoft.Private.Winforms">
76+
<Dependency Name="Microsoft.NETCore.App.Runtime.win-x64" Version="6.0.29" CoherentParentDependency="Microsoft.Private.Winforms">
7777
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
78-
<Sha>34a109148c7d8a2c8e6431e83e4bce5712dd8083</Sha>
78+
<Sha>189fbbd88d97dd6d65515ba2da05b62eab4e5039</Sha>
7979
</Dependency>
80-
<Dependency Name="VS.Redist.Common.NetCore.SharedFramework.x64.6.0" Version="6.0.28-servicing.24120.7" CoherentParentDependency="Microsoft.Private.Winforms">
80+
<Dependency Name="VS.Redist.Common.NetCore.SharedFramework.x64.6.0" Version="6.0.29-servicing.24171.5" CoherentParentDependency="Microsoft.Private.Winforms">
8181
<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
82-
<Sha>34a109148c7d8a2c8e6431e83e4bce5712dd8083</Sha>
82+
<Sha>189fbbd88d97dd6d65515ba2da05b62eab4e5039</Sha>
8383
</Dependency>
8484
</ProductDependencies>
8585
<ToolsetDependencies>

‎eng/Versions.props‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,20 +26,20 @@
2626
</PropertyGroup>
2727
<!-- NuGet Package Versions -->
2828
<PropertyGroup>
29-
<MicrosoftPrivateWinformsVersion>6.0.28-servicing.24120.4</MicrosoftPrivateWinformsVersion>
29+
<MicrosoftPrivateWinformsVersion>6.0.29-servicing.24171.6</MicrosoftPrivateWinformsVersion>
3030
</PropertyGroup>
3131
<!-- Packages that come from https://github.com/dotnet/coreclr -->
3232
<PropertyGroup>
3333
<MicrosoftNETCoreRuntimeCoreCLRVersion>5.0.0-alpha1.19562.1</MicrosoftNETCoreRuntimeCoreCLRVersion>
34-
<MicrosoftNETCoreILDAsmVersion>6.0.28-servicing.24120.7</MicrosoftNETCoreILDAsmVersion>
35-
<MicrosoftNETCoreILAsmVersion>6.0.28-servicing.24120.7</MicrosoftNETCoreILAsmVersion>
34+
<MicrosoftNETCoreILDAsmVersion>6.0.29-servicing.24171.5</MicrosoftNETCoreILDAsmVersion>
35+
<MicrosoftNETCoreILAsmVersion>6.0.29-servicing.24171.5</MicrosoftNETCoreILAsmVersion>
3636
</PropertyGroup>
3737
<!-- Packages that come from https://github.com/dotnet/core-setup -->
3838
<PropertyGroup>
39-
<VSRedistCommonNetCoreSharedFrameworkx6460PackageVersion>6.0.28-servicing.24120.7</VSRedistCommonNetCoreSharedFrameworkx6460PackageVersion>
40-
<MicrosoftNETCoreAppRefVersion>6.0.28</MicrosoftNETCoreAppRefVersion>
41-
<MicrosoftNETCoreAppRuntimewinx64Version>6.0.28</MicrosoftNETCoreAppRuntimewinx64Version>
42-
<MicrosoftNETCorePlatformsVersion>6.0.12</MicrosoftNETCorePlatformsVersion>
39+
<VSRedistCommonNetCoreSharedFrameworkx6460PackageVersion>6.0.29-servicing.24171.5</VSRedistCommonNetCoreSharedFrameworkx6460PackageVersion>
40+
<MicrosoftNETCoreAppRefVersion>6.0.29</MicrosoftNETCoreAppRefVersion>
41+
<MicrosoftNETCoreAppRuntimewinx64Version>6.0.29</MicrosoftNETCoreAppRuntimewinx64Version>
42+
<MicrosoftNETCorePlatformsVersion>6.0.13</MicrosoftNETCorePlatformsVersion>
4343
<SystemDrawingCommonVersion>6.0.0</SystemDrawingCommonVersion>
4444
<SystemDirectoryServicesVersion>6.0.1</SystemDirectoryServicesVersion>
4545
<SystemReflectionMetadataLoadContextVersion>6.0.0</SystemReflectionMetadataLoadContextVersion>

‎src/Microsoft.DotNet.Wpf/src/PenImc/dll/ComLockableWrapper.hpp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,11 @@ namespace ComUtils
4040
// The apartment is verified during this call.
4141
HRESULT Unlock();
4242

43+
// Unlocking a wrapper permanently nulls out the server object pointer, so a
44+
// wrapper contains a non-null server object pointer if and only if it is
45+
// bound to a server object which has never been unlocked.
46+
bool HasNotBeenUnlocked() { return (m_serverObject != nullptr); }
47+
4348
private:
4449

4550
IUnknown *m_serverObject;

‎src/Microsoft.DotNet.Wpf/src/PenImc/dll/PimcManager.cpp‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -396,6 +396,94 @@ void CPimcManager::TerminateHookThread(__inout CHookThreadItem * pThread)
396396
void CPimcManager::FinalRelease()
397397
{
398398
m_wispManagerLock.RevokeIfValid();
399+
400+
//
401+
// The CComObject<CPimcManager> destructor is the only function which calls into this
402+
// FinalRelease code.
403+
//
404+
// In all successful usage of CPimcManager: 1) Managed WPF code uses CoCreateInstance
405+
// to acquire an IPimcManager2 interface to a brand-new CPimcManager instance (created by
406+
// the ATL CComCreator<T>::CreateInstance machinery), meaning FinalConstruct by-definition
407+
// completes successfully, meaning "m_managerLock" is therefore guaranteed to be locked;
408+
// 2) Managed WPF code then runs through its full end-to-end usage of the CPimcManager
409+
// object (generally managed by the code in PenThreadWorker.cs); 3) When/if the managed WPF
410+
// code determines that the CPimcManager object is no longer needed, it sends a
411+
// RELEASE_MANAGER_EXT message (see UnsafeNativeMethods.ReleaseManagerExternalLock()) which
412+
// unlocks "m_managerLock"; 4) Now that it is unlocked, the CComObject<CPimcManager> object
413+
// can be destroyed when/if its refcount drops to zero, and this FinalRelease function will
414+
// run at that time.
415+
//
416+
// So in all successful usage cases, it is guaranteed that "m_managerLock" is already
417+
// unlocked when this code runs (because if it was still locked, the lock itself would have
418+
// prevented the refcount from reaching zero, and would have prevented this function from
419+
// ever running).
420+
//
421+
// That said, in unsuccessful usage cases, the ATL CComCreator<T>::CreateInstance machinery
422+
// can fail, meaning it will destroy the brand-new CPimcManager instance before returning
423+
// an error back to the CreateInstance caller. Destroying the brand-new instance triggers
424+
// the CComObject<CPimcManager> destructor and therefore calls into this function during
425+
// the CComCreator<T>::CreateInstance operation itself.
426+
//
427+
// The final step in CComCreator<T>::CreateInstance is a QI which queries the newly-created
428+
// object for whatever interface has been requested by the caller. This operation is the
429+
// main way that CComCreator<T>::CreateInstance can fail. For example, this QI is
430+
// guaranteed to fail whenever the CoCreateInstance caller targets the CPimcManager CLSID
431+
// but passes in a "random" IID that has nothing to do with IPimcManager2 or anything else
432+
// that CPimcManager implements.
433+
//
434+
// (In CPimcManager construction, outside of pathological cases (e.g., where a small heap
435+
// allocation in OS code fails due to out-of-memory), there are no other known ways that
436+
// the CComCreator<T>::CreateInstance sequence can fail; so the QI failure is the only
437+
// failure mode that is known to be of general interest.)
438+
//
439+
// The QI failure can only occur after the preceding FinalConstruct call has completed
440+
// successfully (since any FinalConstruct failure would have caused
441+
// CComCreator<T>::CreateInstance to abort without ever trying the QI); since
442+
// CPimcManager::FinalConstruct always locks the "m_managerLock", this implies that the
443+
// "m_managerLock" is guaranteed to be locked when this code runs (which is exactly
444+
// opposite to what happens in all successful usage cases as discussed above).
445+
//
446+
// In this case, it is crucial to unlock "m_managerLock" before allowing this CPimcManager
447+
// object to be destroyed. Without the unlock, this CPimcManager object would be destroyed
448+
// while the associated CStdIdentity in the OS code still holds a reference to it; during
449+
// any future apartment unload, the OS code would release this reference, and the release
450+
// would be a use-after-free at that point.
451+
//
452+
// Note that the crucial unlock causes overactive ATL debug asserts to fire if a chk build
453+
// of this DLL is used; specifically:
454+
//
455+
// - The code in the CComObject<CPimcManager> destructor always stomps the refcount to
456+
// 0xc0000001 (i.e., "-(LONG_MAX/2)"), meaning this CPimcManager object's refcount is
457+
// always 0xc0000001 when this code runs; unlocking "m_managerLock" will cause the refcount
458+
// to drop by one (because, as discussed above, the crucial operation which prevents
459+
// use-after-free problems will release the associated CStdIdentity's reference to this
460+
// CPimcManager object, and in this way releases the reference that was added when
461+
// "managerLock" was locked during FinalConstruct); as a result, unlocking "m_managerLock"
462+
// will move this CPimcManager object's refcount through a "0xc0000001 -> 0xc0000000"
463+
// transition.
464+
//
465+
// - Both of the CComObjectRootEx<T>::InternalRelease specializations contain debug asserts
466+
// which will fire whenever the refcount drops below 0xc0000001, so this transition always
467+
// triggers a debug assert when using a chk build of this DLL.
468+
//
469+
// - That said, all evidence strongly suggests that this is just an overactive assert in
470+
// the ATL code (probably just indicating that it is rare for FinalConstruct to add
471+
// "self-references" like it does for CPimcManager (since these self-references generally
472+
// prevent the server object from being destroyed unless a manual action like the
473+
// RELEASE_MANAGER_EXT message is taken later on), meaning it is rare to have a situation
474+
// where FinalRelease needs to release self-references that were acquired in
475+
// FinalConstruct, meaning this is a rare enough case that the ATL authors either didn't
476+
// test it or didn't think it was common enough to warrant adjusting the assert).
477+
//
478+
// Since this change is being made in servicing, attempt to change behavior as little as
479+
// possible in the "successful usage" cases where "m_managerLock" is already unlocked,
480+
// while still ensuring that FinalRelease will always run the crucial unlock in all
481+
// "unsuccessful usage" cases.
482+
//
483+
if (m_managerLock.HasNotBeenUnlocked())
484+
{
485+
m_managerLock.Unlock();
486+
}
399487
}
400488

401489
/////////////////////////////////////////////////////////////////////////////

0 commit comments

Comments
 (0)