Release the GVL lock when hashing and verifying

To align with the bcrypt gem, release Ruby's Global VM Lock when
performing the intentionally slow computations for hashing and verifying
passwords. To do this, we effectively serialise the required arguments
into a struct and invoke rb_thread_call_without_gvl. Note we don't pass
an unblocking function when we do so because Argon2 provides no API to
cancel a hash mid-computation so the only safe thing to do is to let it
complete (this matches bcrypt).

To prevent memory leaks if encoding raises (which would longjmp before
the encoded string is freed), we wrap it in an ensure block.

Note we defensively use ARGON2_MISSING_ARGS as a sentinel result value
in case the rb_thread_call_without_gvl call ever returns without running
our nogvl function.

With this change, mark the extension as safe to use with Ractors.

Author: mudge

ext/argon2id/argon2id.c

@@ -1,4 +1,5 @@
 #include <ruby.h>
+#include <ruby/thread.h>
 #include <stdint.h>
 
 #include "argon2.h"
@@ -8,15 +9,87 @@
 VALUE mArgon2id, cArgon2idError, cArgon2idPassword;
 ID id_encoded;
 
+struct hash_encoded_args {
+  uint32_t t_cost;
+  uint32_t m_cost;
+  uint32_t parallelism;
+  const char *pwd;
+  size_t pwdlen;
+  const char *salt;
+  size_t saltlen;
+  uint32_t outlen;
+  char *encoded;
+  size_t encodedlen;
+  int result;
+};
+
+static void *
+nogvl_hash_encoded(void *data)
+{
+  struct hash_encoded_args *args = data;
+  args->result = argon2id_hash_encoded(args->t_cost, args->m_cost,
+    args->parallelism, args->pwd, args->pwdlen, args->salt, args->saltlen,
+    args->outlen, args->encoded, args->encodedlen);
+
+  return NULL;
+}
+
+struct verify_args {
+  const char *encoded;
+  const char *pwd;
+  size_t pwdlen;
+  int result;
+};
+
+static void *
+nogvl_verify(void *data)
+{
+  struct verify_args *args = data;
+  args->result = argon2id_verify(args->encoded, args->pwd, args->pwdlen);
+
+  return NULL;
+}
+
+struct hash_encoded_data {
+  char *encoded;
+  VALUE pwd;
+  VALUE salt;
+  struct hash_encoded_args args;
+};
+
+static VALUE
+hash_encoded_body(VALUE arg)
+{
+  struct hash_encoded_data *data = (struct hash_encoded_data *)arg;
+
+  rb_thread_call_without_gvl(nogvl_hash_encoded, &data->args, NULL, NULL);
+
+  if (data->args.result != ARGON2_OK) {
+    rb_raise(cArgon2idError, "%s", argon2_error_message(data->args.result));
+  }
+
+  return rb_str_new_cstr(data->encoded);
+}
+
+static VALUE
+hash_encoded_finalize(VALUE arg)
+{
+  struct hash_encoded_data *data = (struct hash_encoded_data *)arg;
+
+  RB_GC_GUARD(data->pwd);
+  RB_GC_GUARD(data->salt);
+  free(data->encoded);
+
+  return Qnil;
+}
+
 static VALUE
 rb_argon2id_hash_encoded(VALUE klass, VALUE iterations, VALUE memory, VALUE threads, VALUE pwd, VALUE salt, VALUE hashlen)
 {
   uint32_t t_cost, m_cost, parallelism, outlen;
   size_t encodedlen;
   long saltlen;
-  char * encoded;
-  int result;
-  VALUE hash;
+  struct hash_encoded_data data;
 
   UNUSED(klass);
 
@@ -41,55 +114,71 @@ rb_argon2id_hash_encoded(VALUE klass, VALUE iterations, VALUE memory, VALUE thre
   }
 
   encodedlen = argon2_encodedlen(t_cost, m_cost, parallelism, (uint32_t)saltlen, outlen, Argon2_id);
-  encoded = malloc(encodedlen);
-  if (!encoded) {
+  data.encoded = malloc(encodedlen);
+  if (!data.encoded) {
     rb_raise(rb_eNoMemError, "not enough memory to allocate for encoded password");
   }
 
-  result = argon2id_hash_encoded(t_cost, m_cost, parallelism, RSTRING_PTR(pwd), RSTRING_LEN(pwd), RSTRING_PTR(salt), RSTRING_LEN(salt), outlen, encoded, encodedlen);
-
-  if (result != ARGON2_OK) {
-    free(encoded);
-    rb_raise(cArgon2idError, "%s", argon2_error_message(result));
-  }
-
-  hash = rb_str_new_cstr(encoded);
-  free(encoded);
-
-  return hash;
+  data.pwd = pwd;
+  data.salt = salt;
+  data.args.result = ARGON2_MISSING_ARGS;
+  data.args.t_cost = t_cost;
+  data.args.m_cost = m_cost;
+  data.args.parallelism = parallelism;
+  data.args.pwd = RSTRING_PTR(pwd);
+  data.args.pwdlen = RSTRING_LEN(pwd);
+  data.args.salt = RSTRING_PTR(salt);
+  data.args.saltlen = RSTRING_LEN(salt);
+  data.args.outlen = outlen;
+  data.args.encoded = data.encoded;
+  data.args.encodedlen = encodedlen;
+
+  return rb_ensure(hash_encoded_body, (VALUE)&data, hash_encoded_finalize, (VALUE)&data);
 }
 
 static VALUE
 rb_argon2id_verify(VALUE self, VALUE pwd) {
-  int result;
   VALUE encoded;
+  struct verify_args args;
 
   encoded = rb_ivar_get(self, id_encoded);
 
-  /* Coerce encoded and freeze it before coercing pwd: StringValue(pwd) may
-   * call #to_str which can execute arbitrary Ruby and mutate the original
-   * @encoded string via a held reference, bypassing verification. */
+  /* Coerce encoded and freeze it before doing the same to pwd. The order here
+   * is important to prevent pwd#to_str mutating encoded.
+   */
   StringValueCStr(encoded);
   encoded = rb_str_new_frozen(encoded);
   StringValue(pwd);
+  pwd = rb_str_new_frozen(pwd);
 
-  result = argon2id_verify(RSTRING_PTR(encoded), RSTRING_PTR(pwd), RSTRING_LEN(pwd));
-  if (result == ARGON2_OK) {
+  args.result = ARGON2_MISSING_ARGS;
+  args.encoded = RSTRING_PTR(encoded);
+  args.pwd = RSTRING_PTR(pwd);
+  args.pwdlen = RSTRING_LEN(pwd);
+
+  rb_thread_call_without_gvl(nogvl_verify, &args, NULL, NULL);
+
+  RB_GC_GUARD(encoded);
+  RB_GC_GUARD(pwd);
+
+  if (args.result == ARGON2_OK) {
     return Qtrue;
   }
-  if (result == ARGON2_VERIFY_MISMATCH) {
+  if (args.result == ARGON2_VERIFY_MISMATCH) {
     return Qfalse;
   }
-  if (result == ARGON2_DECODING_FAIL || result == ARGON2_DECODING_LENGTH_FAIL) {
-    rb_raise(rb_eArgError, "%s", argon2_error_message(result));
+  if (args.result == ARGON2_DECODING_FAIL || args.result == ARGON2_DECODING_LENGTH_FAIL) {
+    rb_raise(rb_eArgError, "%s", argon2_error_message(args.result));
   }
 
-  rb_raise(cArgon2idError, "%s", argon2_error_message(result));
+  rb_raise(cArgon2idError, "%s", argon2_error_message(args.result));
 }
 
 void
 Init_argon2id(void)
 {
+  rb_ext_ractor_safe(true);
+
   id_encoded = rb_intern("@encoded");
 
   mArgon2id = rb_define_module("Argon2id");

test/argon2id/test_password.rb

@@ -580,6 +580,31 @@ def test_create_password_does_not_equal_incorrect_password
     refute password == "differentpassword"
   end
 
+  def test_create_is_thread_safe
+    threads = 10.times.map do |i|
+      Thread.new(i) do |n|
+        password = Argon2id::Password.create("password-#{n}", t_cost: 2, m_cost: 256, parallelism: 1)
+        assert password == "password-#{n}"
+      end
+    end
+
+    threads.each(&:value)
+  end
+
+  def test_verify_is_thread_safe
+    hash = Argon2id::Password.create("password", t_cost: 2, m_cost: 256, parallelism: 1).to_s
+
+    threads = 10.times.map do |i|
+      Thread.new do
+        password = Argon2id::Password.new(hash)
+        assert password == "password"
+        refute password == "wrong"
+      end
+    end
+
+    threads.each(&:value)
+  end
+
   def test_hashing_password_verifies_correct_password
     hash = Argon2id::Password.create("password").to_s
     password = Argon2id::Password.new(hash)