git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 3/7] avoid "write_in_full(fd, buf, len) != len" pattern

From
Jonathan Nieder <jrnieder@gmail.com>
Date
Sep 13, 2017, 21:14 UTC
Message-ID
<20170913211430.GK27425@aiede.mtv.corp.google.com>
In-Reply-To
<20170913171603.3whuql7l5da3ynrn@sigill.intra.peff.net>
Jeff King wrote:
Show 11 quoted lines
> The return value of write_in_full() is either "-1", or the
> requested number of bytes[1]. If we make a partial write
> before seeing an error, we still return -1, not a partial
> value. This goes back to f6aa66cb95 (write_in_full: really
> write in full or return error on disk full., 2007-01-11).
>
> So checking anything except "was the return value negative"
> is pointless. And there are a couple of reasons not to do
> so:
>
>   1. It can do a funny signed/unsigned comparison. If your
[...]
Show 10 quoted lines
>   2. Checking for a negative value is shorter to type,
>      especially when the length is an expression.
>
>   3. Linus says so. In d34cf19b89 (Clean up write_in_full()
>      users, 2007-01-11), right after the write_in_full()
>      semantics were changed, he wrote:
>
>        I really wish every "write_in_full()" user would just
>        check against "<0" now, but this fixes the nasty and
>        stupid ones.
Ok, you convinced me.
Should we add a comment to cache.h as well encouraging this?
[...]
Show 11 quoted lines
> [1] A careful reader may notice there is one way that
>     write_in_full() can return a different value. If we ask
>     write() to write N bytes and get a return value that is
>     _larger_ than N, we could return a larger total. But
>     besides the fact that this would imply a totally broken
>     version of write(), it would already invoke undefined
>     behavior. Our internal remaining counter is an unsigned
>     size_t, which means that subtracting too many byte will
>     wrap it around to a very large number. So we'll instantly
>     begin reading off the end of the buffer, trying to write
>     gigabytes (or petabytes) of data.

This footnote just leaves me more confused, since as you mention, write() never would return a value greater than N. Are you saying we need to defend against a broken platform where that isn't true?

Show 19 quoted lines
> Signed-off-by: Jeff King <peff@peff.net>
> ---
>  builtin/receive-pack.c | 2 +-
>  builtin/rerere.c       | 2 +-
>  builtin/unpack-file.c  | 2 +-
>  config.c               | 4 ++--
>  diff.c                 | 2 +-
>  fast-import.c          | 2 +-
>  http-backend.c         | 4 ++--
>  ll-merge.c             | 2 +-
>  read-cache.c           | 6 +++---
>  refs.c                 | 2 +-
>  refs/files-backend.c   | 8 ++++----
>  rerere.c               | 2 +-
>  shallow.c              | 6 +++---
>  t/helper/test-delta.c  | 2 +-
>  transport-helper.c     | 5 ++---
>  wrapper.c              | 2 +-
>  16 files changed, 26 insertions(+), 27 deletions(-)
All of these look correctly done.
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Previous: Jeff KingNext: Jeff King
Message 33 of 46 in “Bug: git branch --unset-upstream command can nuke config when disk is full.”
  1. demerphqSep 13, 2017
  2. Jeff KingSep 13, 2017
  3. demerphqSep 13, 2017
  4. Jeff KingSep 13, 2017
  5. demerphqSep 13, 2017
  6. Jeff KingSep 13, 2017
  7. demerphqSep 13, 2017
  8. Jeff KingSep 13, 2017
  9. demerphqSep 13, 2017
  10. 0/7 config.c may fail to notice some write() failuresJeff King, Sep 13, 2017
  11. 1/7 config: avoid "write_in_full(fd, buf, len) < len" patternJeff King, Sep 13, 2017
  12. Jonathan NiederSep 13, 2017
  13. Jeff KingSep 13, 2017
  14. Jonathan NiederSep 13, 2017
  15. Jeff KingSep 13, 2017
  16. config: avoid "write_in_full(fd, buf, len) < len" patternJeff King, Sep 13, 2017
  17. Jonathan NiederSep 13, 2017
  18. Jeff KingSep 13, 2017
  19. Jonathan NiederSep 13, 2017
  20. Jonathan NiederSep 13, 2017
  21. Ramsay JonesSep 13, 2017
  22. Ramsay JonesSep 13, 2017
  23. Jeff KingSep 15, 2017
  24. Ramsay JonesSep 15, 2017
  25. Junio C HamanoSep 13, 2017
  26. 2/7 get-tar-commit-id: check write_in_full() return against 0Jeff King, Sep 13, 2017
  27. Jonathan NiederSep 13, 2017
  28. Jeff KingSep 13, 2017
  29. Jeff KingSep 13, 2017
  30. Jonathan NiederSep 13, 2017
  31. Jeff KingSep 15, 2017
  32. 3/7 avoid "write_in_full(fd, buf, len) != len" patternJeff King, Sep 13, 2017
  33. Jonathan NiederSep 13, 2017
  34. Jeff KingSep 15, 2017
  35. 4/7 convert less-trivial versions of "write_in_full() != len"Jeff King, Sep 13, 2017
  36. Jonathan NiederSep 13, 2017
  37. 5/7 pkt-line: check write_in_full() errors against "< 0"Jeff King, Sep 13, 2017
  38. Jonathan NiederSep 13, 2017
  39. 6/7 notes-merge: use ssize_t for write_in_full() return valueJeff King, Sep 13, 2017
  40. Jonathan NiederSep 13, 2017
  41. Jeff KingSep 15, 2017
  42. 7/7 config: flip return value of store_write_*()Jeff King, Sep 13, 2017
  43. Jonathan NiederSep 13, 2017
  44. Jeff KingSep 15, 2017
  45. 8/7 read_pack_header: handle signed/unsigned comparison in read resultJeff King, Sep 13, 2017
  46. Jonathan NiederSep 13, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.