Re: Unknown error with concurrent config read/write on Windows

From: Patrick Steinhardt <ps@pks.im>
Date: Feb 24, 2025, 12:53 UTC
Message-ID: <Z7xrr-O1QdhXWftj@pks.im>
In-Reply-To: <CADbSrJzNCOP0t=Vsdopa2+GFth_J84E8SEvpRJYfg8uxYnH3ng@mail.gmail.com>

On Thu, Feb 06, 2025 at 06:44:33PM -0800, Allen Li wrote:

Show 28 quoted lines

> On Windows, Git encounters fatal errors (that do not happen on Linux)
> when reading and writing the Git config in parallel processes.
> 
> I and some peers can relatively easily reproduce this by running in
> parallel (e.g., in two separate terminal/PowerShell windows):
> 
> for (;;) {git rev-parse HEAD}
> for (;;) {git config --local user.name foo}
> 
> The rev-parse "thread" will spew messages like:
> 
> f100762176b7b085e81cafe261a049d809772ace
> f100762176b7b085e81cafe261a049d809772ace
> f100762176b7b085e81cafe261a049d809772ace
> warning: unable to access '.git/config': Permission denied
> fatal: unknown error occurred while reading the configuration files
> f100762176b7b085e81cafe261a049d809772ace
> 
> This affects any command that reads the Git config (which is all/most
> of them); rev-parse is just a convenient stand-in.
> 
> I have seen the work to make lockfile renames (and thus config edits I
> believe) more atomic in
> https://lore.kernel.org/all/cover.1729695349.git.ps@pks.im/T/ which
> should be in 28.0 IIUC.
> 
> However, the above issue can still be reproduced with an RC build of
> 28.0 (of the Git for Windows distribution).

I'm not quite sure which version you're referring to here. 28.0 is not a version released by either GIt nor Git for Windows. You probably meant to refer to v2.48.0?

In any case, it's not entirely surprising that this may still cause issues in some code paths. Support for POSIX-style renames requires two different bits:

  - The `rename()` implementation needs to know to allow POSIX-style
    renames even when the target file is currently held open.

  - All code paths that open a file need to be taught to open them with
    `FILE_SHARE_DELETE`. This flag allows the file to be deleted while
    the file handle remains open.

The first part has been implemented by the mentioned patch series, and some code paths have been adapted to also do the second part. But not all code paths do this yet, and those that don't will not be able to use atomic renames when the file is open.

One important omission in your context is that fopen(3p) does not yet know to set `FILE_SHARE_DELETE`. It uses `_wfopen()` right now, which does not set this flag. In the best case we'd convert the code to use `_wfsopen()` instead, which allows us to control the sharing mode. But unfortunately, it only allows us to control `FILe_SHARE_WRITE` as well as `FILE_SHARE_READ`, but not `FILE_SHARE_DELETE`.

So to the best of my knowledge, we'd have to reimplement the function on top of `CreateFileW()` so that we can fully control the file sharing mode.

Patrick