git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH v4 23/32] lockfile: avoid transitory invalid states

From
Michael Haggerty <mhagger@alum.mit.edu>
Date
Sep 6, 2014, 07:50 UTC
Message-ID
<1409989846-22401-24-git-send-email-mhagger@alum.mit.edu>
In-Reply-To
<1409989846-22401-1-git-send-email-mhagger@alum.mit.edu>

Because remove_lock_file() can be called any time by the signal handler, it is important that any lock_file objects that are in the lock_file_list are always in a valid state. And since lock_file objects are often reused (but are never removed from lock_file_list), that means we have to be careful whenever mutating a lock_file object to always keep it in a well-defined state.

This was formerly not the case, because part of the state was encoded by setting lk->filename to the empty string vs. a valid filename. It is wrong to assume that this string can be updated atomically; for example, even

    strcpy(lk->filename, value)
is unsafe.  But the old code was even more reckless; for example,
    strcpy(lk->filename, path);
    if (!(flags & LOCK_NODEREF))
            resolve_symlink(lk->filename, max_path_len);
    strcat(lk->filename, ".lock");

During the call to resolve_symlink(), lk->filename contained the name of the file that was being locked, not the name of the lockfile. If a signal were raised during that interval, then the signal handler would have deleted the valuable file!

We could probably continue to use the filename field to encode the state by being careful to write characters 1..N-1 of the filename first, and then overwrite the NUL at filename[0] with the first character of the filename, but that would be awkward and error-prone.

So, instead of using the filename field to determine whether the lock_file object is active, add a new field "lock_file::active" for this purpose. Be careful to set this field only when filename really contains the name of a file that should be deleted on cleanup.

Helped-by: Johannes Sixt <j6t@kdbg.org>
Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu>
---
 cache.h      |  1 +
 lockfile.c   | 45 ++++++++++++++++++++++++++++++---------------
 read-cache.c |  1 +
 3 files changed, 32 insertions(+), 15 deletions(-)
diff --git a/cache.h b/cache.h
index 41d829b..e739482 100644
--- a/cache.h
+++ b/cache.h
@@ -575,6 +575,7 @@ extern int refresh_index(struct index_state *, unsigned int flags, const struct
 
 struct lock_file {
 	struct lock_file *next;
+	volatile sig_atomic_t active;
 	int fd;
 	pid_t owner;
 	char on_list;
diff --git a/lockfile.c b/lockfile.c
index a7cdb64..920585d 100644
--- a/lockfile.c
+++ b/lockfile.c
@@ -27,11 +27,14 @@
  * Instead of (3), the change can be rolled back by deleting lockfile.
  *
  * This module keeps track of all locked files in lock_file_list.
- * When the first file is locked, it registers an atexit(3) handler;
- * when the program exits, the handler rolls back any files that have
- * been locked but were never committed or rolled back.
+ * When the first file is locked, it registers an atexit(3) handler
+ * and a signal handler; when the program exits, the handler rolls
+ * back any files that have been locked but were never committed or
+ * rolled back.
  *
- * A lock_file object can be in several states:
+ * Because the signal handler can be called at any time, a lock_file
+ * object must always be in a well-defined state.  The possible states
+ * are as follows:
  *
  * - Uninitialized.  In this state the object's on_list field must be
  *   zero but the rest of its contents need not be initialized.  As
@@ -39,19 +42,25 @@
  *   registered in the lock_file_list, and on_list is set.
  *
  * - Locked, lockfile open (after hold_lock_file_for_update(),
- *   hold_lock_file_for_append(), or reopen_lock_file()). In this
- *   state, the lockfile exists, filename holds the filename of the
- *   lockfile, fd holds a file descriptor open for writing to the
- *   lockfile, and owner holds the PID of the process that locked the
- *   file.
+ *   hold_lock_file_for_append(), or reopen_lock_file()).  In this
+ *   state:
+ *   - the lockfile exists
+ *   - active is set
+ *   - filename holds the filename of the lockfile
+ *   - fd holds a file descriptor open for writing to the lockfile
+ *   - owner holds the PID of the process that locked the file
  *
  * - Locked, lockfile closed (after close_lock_file()).  Same as the
  *   previous state, except that the lockfile is closed and fd is -1.
  *
  * - Unlocked (after commit_lock_file(), rollback_lock_file(), or a
- *   failed attempt to lock).  In this state, filename[0] == '\0' and
- *   fd is -1.  The object is left registered in the lock_file_list,
- *   and on_list is set.
+ *   failed attempt to lock).  In this state:
+ *   - active is unset
+ *   - filename[0] == '\0' (usually, though there are transitory states
+ *     in which this condition doesn't hold)
+ *   - fd is -1
+ *   - the object is left registered in the lock_file_list, and
+ *     on_list is set.
  *
  * See Documentation/api-lockfile.txt for more information.
  */
@@ -184,9 +193,12 @@ static int lock_file(struct lock_file *lk, const char *path, int flags)
 		atexit(remove_lock_file);
 	}
 
+	assert(!lk->active);
+
 	if (!lk->on_list) {
 		/* Initialize *lk and add it to lock_file_list: */
 		lk->fd = -1;
+		lk->active = 0;
 		lk->owner = 0;
 		lk->on_list = 1;
 		lk->filename[0] = 0;
@@ -208,6 +220,7 @@ static int lock_file(struct lock_file *lk, const char *path, int flags)
 		return -1;
 	}
 	lk->owner = getpid();
+	lk->active = 1;
 	if (adjust_shared_perm(lk->filename)) {
 		int save_errno = errno;
 		error("cannot fix permission bits on %s", lk->filename);
@@ -297,7 +310,7 @@ int reopen_lock_file(struct lock_file *lk)
 {
 	if (0 <= lk->fd)
 		die(_("BUG: reopen a lockfile that is still open"));
-	if (!lk->filename[0])
+	if (!lk->active)
 		die(_("BUG: reopen a lockfile that has been committed"));
 	lk->fd = open(lk->filename, O_WRONLY);
 	return lk->fd;
@@ -308,7 +321,7 @@ int commit_lock_file(struct lock_file *lk)
 	char result_file[PATH_MAX];
 	int save_errno;
 
-	if (!lk->filename[0])
+	if (!lk->active)
 		die("BUG: attempt to commit unlocked object");
 
 	if (lk->fd >= 0 && close_lock_file(lk))
@@ -321,6 +334,7 @@ int commit_lock_file(struct lock_file *lk)
 	if (rename(lk->filename, result_file))
 		goto rollback;
 
+	lk->active = 0;
 	lk->filename[0] = 0;
 	return 0;
 
@@ -341,11 +355,12 @@ int hold_locked_index(struct lock_file *lk, int die_on_error)
 
 void rollback_lock_file(struct lock_file *lk)
 {
-	if (!lk->filename[0])
+	if (!lk->active)
 		return;
 
 	if (lk->fd >= 0)
 		close_lock_file(lk);
 	unlink_or_warn(lk->filename);
+	lk->active = 0;
 	lk->filename[0] = 0;
 }
diff --git a/read-cache.c b/read-cache.c
index 5d3c8bd..3d43dda 100644
--- a/read-cache.c
+++ b/read-cache.c
@@ -2028,6 +2028,7 @@ static int commit_locked_index(struct lock_file *lk)
 			return -1;
 		if (rename(lk->filename, alternate_index_output))
 			return -1;
+		lk->active = 0;
 		lk->filename[0] = 0;
 		return 0;
 	} else {

-- 
2.1.0
Previous: Michael HaggertyNext: Michael Haggerty
Message 45 of 66 in “Lockfile correctness and refactoring”
  1. 00/32 Lockfile correctness and refactoringMichael Haggerty, Sep 6, 2014
  2. 01/32 unable_to_lock_die(): rename function from unable_to_lock_index_die()Michael Haggerty, Sep 6, 2014
  3. 02/32 api-lockfile: expand the documentationMichael Haggerty, Sep 6, 2014
  4. Junio C HamanoSep 9, 2014
  5. 03/32 rollback_lock_file(): do not clear filename redundantlyMichael Haggerty, Sep 6, 2014
  6. Ronnie SahlbergSep 11, 2014
  7. 04/32 rollback_lock_file(): exit early if lock is not activeMichael Haggerty, Sep 6, 2014
  8. Ronnie SahlbergSep 11, 2014
  9. 05/32 rollback_lock_file(): set fd to -1Michael Haggerty, Sep 6, 2014
  10. 06/32 lockfile: unlock file if lockfile permissions cannot be adjustedMichael Haggerty, Sep 6, 2014
  11. Junio C HamanoSep 9, 2014
  12. Michael HaggertySep 12, 2014
  13. 07/32 hold_lock_file_for_append(): release lock on errorsMichael Haggerty, Sep 6, 2014
  14. Junio C HamanoSep 9, 2014
  15. Michael HaggertySep 12, 2014
  16. 08/32 lock_file(): always add lock_file object to lock_file_listMichael Haggerty, Sep 6, 2014
  17. 09/32 lockfile.c: document the various states of lock_file objectsMichael Haggerty, Sep 6, 2014
  18. Ronnie SahlbergSep 11, 2014
  19. 10/32 cache.h: define constants LOCK_SUFFIX and LOCK_SUFFIX_LENMichael Haggerty, Sep 6, 2014
  20. Ronnie SahlbergSep 11, 2014
  21. Michael HaggertySep 12, 2014
  22. Ronnie SahlbergSep 11, 2014
  23. Michael HaggertySep 12, 2014
  24. Ronnie SahlbergSep 12, 2014
  25. 11/32 delete_ref_loose(): don't muck around in the lock_file's filenameMichael Haggerty, Sep 6, 2014
  26. Johannes SixtSep 13, 2014
  27. Michael HaggertySep 14, 2014
  28. Michael HaggertySep 14, 2014
  29. Johannes SixtSep 14, 2014
  30. 12/32 prepare_index(): declare return value to be (const char *)Michael Haggerty, Sep 6, 2014
  31. 13/32 write_packed_entry_fn(): convert cb_data into a (const int *)Michael Haggerty, Sep 6, 2014
  32. Ronnie SahlbergSep 11, 2014
  33. 14/32 lock_file(): exit early if lockfile cannot be openedMichael Haggerty, Sep 6, 2014
  34. Ronnie SahlbergSep 11, 2014
  35. 15/32 remove_lock_file(): call rollback_lock_file()Michael Haggerty, Sep 6, 2014
  36. 16/32 commit_lock_file(): inline temporary variableMichael Haggerty, Sep 6, 2014
  37. 17/32 commit_lock_file(): die() if called for unlocked lockfile objectMichael Haggerty, Sep 6, 2014
  38. 18/32 commit_lock_file(): if close fails, roll backMichael Haggerty, Sep 6, 2014
  39. 19/32 commit_lock_file(): rollback lock file on failure to renameMichael Haggerty, Sep 6, 2014
  40. Jeff KingSep 10, 2014
  41. Duy NguyenSep 10, 2014
  42. 20/32 api-lockfile: document edge casesMichael Haggerty, Sep 6, 2014
  43. 21/32 dump_marks(): remove a redundant call to rollback_lock_file()Michael Haggerty, Sep 6, 2014
  44. 22/32 git_config_set_multivar_in_file(): avoid call to rollback_lock_file()Michael Haggerty, Sep 6, 2014
  45. 23/32 lockfile: avoid transitory invalid statesMichael Haggerty, Sep 6, 2014
  46. 24/32 struct lock_file: declare some fields volatileMichael Haggerty, Sep 6, 2014
  47. 25/32 try_merge_strategy(): remove redundant lock_file allocationMichael Haggerty, Sep 6, 2014
  48. 26/32 try_merge_strategy(): use a statically-allocated lock_file objectMichael Haggerty, Sep 6, 2014
  49. 27/32 commit_lock_file(): use a strbuf to manage temporary spaceMichael Haggerty, Sep 6, 2014
  50. 28/32 Change lock_file::filename into a strbufMichael Haggerty, Sep 6, 2014
  51. 29/32 resolve_symlink(): use a strbuf for internal scratch spaceMichael Haggerty, Sep 6, 2014
  52. 30/32 resolve_symlink(): take a strbuf parameterMichael Haggerty, Sep 6, 2014
  53. 31/32 trim_last_path_elm(): replace last_path_elm()Michael Haggerty, Sep 6, 2014
  54. 32/32 Extract a function commit_lock_file_to()Michael Haggerty, Sep 6, 2014
  55. Torsten BögershausenSep 7, 2014
  56. Michael HaggertySep 12, 2014
  57. Junio C HamanoSep 8, 2014
  58. Jeff KingSep 10, 2014
  59. Duy NguyenSep 10, 2014
  60. Jeff KingSep 10, 2014
  61. Junio C HamanoSep 10, 2014
  62. Jeff KingSep 10, 2014
  63. Michael HaggertySep 12, 2014
  64. Michael HaggertySep 12, 2014
  65. Michael HaggertySep 12, 2014
  66. Jeff KingSep 13, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.