git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH v3 1/7] banned-die: create header for banning of functions

From
Derrick Stolee via GitGitGadget <gitgitgadget@gmail.com>
Date
Aug 31, 2026, 17:25 UTC
Message-ID
<c483a4bf764c47ee2c7f715ff8143196cac73b9b.1788197143.git.gitgitgadget@gmail.com>
In-Reply-To
<pull.2178.v3.git.1788197143.gitgitgadget@gmail.com>
From: Derrick Stolee <stolee@gmail.com>

We have universally-banned functions listed in banned.h since c8af66ab8ad (automatically ban strcpy(), 2018-07-26), but some layers of the code should be more strict than others.

One such example is the trace2 API which runs during atexit() and can prove to cause die()-handler recursion problems if it calls die().

Create a new banned-die.h header file that will ban some Git methods that call die(). Include that in all trace2 API implementation files. This currently only bans die() itself, and that was already not used.

It would be reasonable to name this file trace2/tr2_banned.h to be specific to the trace2 API, but it seems like such a restriction would be valuable to put in some other areas of the code, so adding it at the root of the tree seems like a good long-term approach.

Signed-off-by: Derrick Stolee <stolee@gmail.com>
---
 banned-die.h            | 14 ++++++++++++++
 trace2.c                |  2 ++
 trace2/tr2_cfg.c        |  2 ++
 trace2/tr2_cmd_name.c   |  2 ++
 trace2/tr2_ctr.c        |  2 ++
 trace2/tr2_dst.c        |  2 ++
 trace2/tr2_sid.c        |  2 ++
 trace2/tr2_sysenv.c     |  2 ++
 trace2/tr2_tbuf.c       |  2 ++
 trace2/tr2_tgt_event.c  |  2 ++
 trace2/tr2_tgt_normal.c |  2 ++
 trace2/tr2_tgt_perf.c   |  2 ++
 trace2/tr2_tls.c        |  2 ++
 trace2/tr2_tmr.c        |  2 ++
 14 files changed, 40 insertions(+)
 create mode 100644 banned-die.h
diff --git a/banned-die.h b/banned-die.h
new file mode 100644
index 0000000000..1cde4035c1
--- /dev/null
+++ b/banned-die.h
@@ -0,0 +1,14 @@
+#ifndef BANNED_DIE_H
+#define BANNED_DIE_H
+
+#include "banned.h"
+
+/*
+ * This header lists functions that must not be used by low-level APIs
+ * because they can cause Git to terminate.
+ */
+
+#undef die
+#define die BANNED(die)
+
+#endif /* BANNED_DIE_H */
diff --git a/trace2.c b/trace2.c
index c23c0a227b..8c974dee87 100644
--- a/trace2.c
+++ b/trace2.c
@@ -17,6 +17,8 @@
 #include "trace2/tr2_tgt.h"
 #include "trace2/tr2_tls.h"
 #include "trace2/tr2_tmr.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 static int trace2_enabled;
 static int trace2_redact = 1;
diff --git a/trace2/tr2_cfg.c b/trace2/tr2_cfg.c
index bbcfeda60a..757dfeae8d 100644
--- a/trace2/tr2_cfg.c
+++ b/trace2/tr2_cfg.c
@@ -7,6 +7,8 @@
 #include "trace2/tr2_cfg.h"
 #include "trace2/tr2_sysenv.h"
 #include "wildmatch.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 static struct string_list tr2_cfg_patterns = STRING_LIST_INIT_DUP;
 static int tr2_cfg_loaded;
diff --git a/trace2/tr2_cmd_name.c b/trace2/tr2_cmd_name.c
index b7b5a869b7..f378bef4cf 100644
--- a/trace2/tr2_cmd_name.c
+++ b/trace2/tr2_cmd_name.c
@@ -1,6 +1,8 @@
 #include "git-compat-util.h"
 #include "strbuf.h"
 #include "trace2/tr2_cmd_name.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 #define TR2_ENVVAR_PARENT_NAME "GIT_TRACE2_PARENT_NAME"
 
diff --git a/trace2/tr2_ctr.c b/trace2/tr2_ctr.c
index ee17bfa86b..20618a65b2 100644
--- a/trace2/tr2_ctr.c
+++ b/trace2/tr2_ctr.c
@@ -2,6 +2,8 @@
 #include "trace2/tr2_tgt.h"
 #include "trace2/tr2_tls.h"
 #include "trace2/tr2_ctr.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 /*
  * A global counter block to aggregate values from the partial sums
diff --git a/trace2/tr2_dst.c b/trace2/tr2_dst.c
index 5be892cd5c..555ac7cb9e 100644
--- a/trace2/tr2_dst.c
+++ b/trace2/tr2_dst.c
@@ -5,6 +5,8 @@
 #include "trace2/tr2_dst.h"
 #include "trace2/tr2_sid.h"
 #include "trace2/tr2_sysenv.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 /*
  * How many attempts we will make at creating an automatically-named trace file.
diff --git a/trace2/tr2_sid.c b/trace2/tr2_sid.c
index 131b4f5a62..1d4f018f66 100644
--- a/trace2/tr2_sid.c
+++ b/trace2/tr2_sid.c
@@ -3,6 +3,8 @@
 #include "strbuf.h"
 #include "trace2/tr2_tbuf.h"
 #include "trace2/tr2_sid.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 #define TR2_ENVVAR_PARENT_SID "GIT_TRACE2_PARENT_SID"
 
diff --git a/trace2/tr2_sysenv.c b/trace2/tr2_sysenv.c
index 4abc218514..7fa58eba91 100644
--- a/trace2/tr2_sysenv.c
+++ b/trace2/tr2_sysenv.c
@@ -4,6 +4,8 @@
 #include "config.h"
 #include "dir.h"
 #include "tr2_sysenv.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 /*
  * Each entry represents a trace2 setting.
diff --git a/trace2/tr2_tbuf.c b/trace2/tr2_tbuf.c
index c3b3822ed7..d623e55a81 100644
--- a/trace2/tr2_tbuf.c
+++ b/trace2/tr2_tbuf.c
@@ -1,5 +1,7 @@
 #include "git-compat-util.h"
 #include "tr2_tbuf.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 void tr2_tbuf_local_time(struct tr2_tbuf *tb)
 {
diff --git a/trace2/tr2_tgt_event.c b/trace2/tr2_tgt_event.c
index 5a0381791f..36a746cc10 100644
--- a/trace2/tr2_tgt_event.c
+++ b/trace2/tr2_tgt_event.c
@@ -13,6 +13,8 @@
 #include "trace2/tr2_tgt.h"
 #include "trace2/tr2_tls.h"
 #include "trace2/tr2_tmr.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 static struct tr2_dst tr2dst_event = {
 	.sysenv_var = TR2_SYSENV_EVENT,
diff --git a/trace2/tr2_tgt_normal.c b/trace2/tr2_tgt_normal.c
index 924736ab36..82995e510f 100644
--- a/trace2/tr2_tgt_normal.c
+++ b/trace2/tr2_tgt_normal.c
@@ -11,6 +11,8 @@
 #include "trace2/tr2_tgt.h"
 #include "trace2/tr2_tls.h"
 #include "trace2/tr2_tmr.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 static struct tr2_dst tr2dst_normal = {
 	.sysenv_var = TR2_SYSENV_NORMAL,
diff --git a/trace2/tr2_tgt_perf.c b/trace2/tr2_tgt_perf.c
index 4eb9289f95..96a5bc7f10 100644
--- a/trace2/tr2_tgt_perf.c
+++ b/trace2/tr2_tgt_perf.c
@@ -14,6 +14,8 @@
 #include "trace2/tr2_tgt.h"
 #include "trace2/tr2_tls.h"
 #include "trace2/tr2_tmr.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 static struct tr2_dst tr2dst_perf = {
 	.sysenv_var = TR2_SYSENV_PERF,
diff --git a/trace2/tr2_tls.c b/trace2/tr2_tls.c
index 7b023c1bfc..49bd505d62 100644
--- a/trace2/tr2_tls.c
+++ b/trace2/tr2_tls.c
@@ -3,6 +3,8 @@
 #include "thread-utils.h"
 #include "trace.h"
 #include "trace2/tr2_tls.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 /*
  * Initialize size of the thread stack for nested regions.
diff --git a/trace2/tr2_tmr.c b/trace2/tr2_tmr.c
index 038181ad9b..275091c693 100644
--- a/trace2/tr2_tmr.c
+++ b/trace2/tr2_tmr.c
@@ -3,6 +3,8 @@
 #include "trace2/tr2_tls.h"
 #include "trace2/tr2_tmr.h"
 #include "trace.h"
+/* banned-die must be last. */
+#include "banned-die.h"
 
 #define MY_MAX(a, b) ((a) > (b) ? (a) : (b))
 #define MY_MIN(a, b) ((a) < (b) ? (a) : (b))

-- 
gitgitgadget
Previous: Derrick Stolee via GitGitGadgetNext: Derrick Stolee via GitGitGadget
Message 36 of 43 in “trace2: tolerate failed timestamp formatting”
  1. trace2: tolerate failed timestamp formattingDerrick Stolee via GitGitGadget, Jul 15, 2026
  2. Taylor BlauJul 17, 2026
  3. Derrick StoleeJul 18, 2026
  4. Junio C HamanoJul 20, 2026
  5. Taylor BlauJul 20, 2026
  6. Junio C HamanoJul 29, 2026
  7. Derrick StoleeJul 31, 2026
  8. Junio C HamanoJul 31, 2026
  9. 0/7 trace2: stop allowing die()Derrick Stolee via GitGitGadget, Aug 25, 2026
  10. 1/7 banned-die: create header for banning of functionsDerrick Stolee via GitGitGadget, Aug 25, 2026
  11. Junio C HamanoAug 25, 2026
  12. Derrick StoleeAug 31, 2026
  13. Patrick SteinhardtAug 31, 2026
  14. Elijah NewrenAug 25, 2026
  15. Derrick StoleeAug 31, 2026
  16. Jeff KingAug 27, 2026
  17. Derrick StoleeAug 31, 2026
  18. 2/7 trace2: tolerate failed timestamp formattingDerrick Stolee via GitGitGadget, Aug 25, 2026
  19. 3/7 trace2: remove use of xstrdup()Derrick Stolee via GitGitGadget, Aug 25, 2026
  20. Elijah NewrenAug 25, 2026
  21. Derrick StoleeAug 31, 2026
  22. 4/7 trace2: remove use of ALLOC_ARRAY()Derrick Stolee via GitGitGadget, Aug 25, 2026
  23. 5/7 trace2: remove use of xstrfmt()Derrick Stolee via GitGitGadget, Aug 25, 2026
  24. Elijah NewrenAug 25, 2026
  25. Junio C HamanoAug 25, 2026
  26. Derrick StoleeAug 31, 2026
  27. 6/7 trace2: remove use of ALLOC_GROW()Derrick Stolee via GitGitGadget, Aug 25, 2026
  28. Elijah NewrenAug 25, 2026
  29. 7/7 trace2: remove use of xcalloc()Derrick Stolee via GitGitGadget, Aug 25, 2026
  30. Jeff KingAug 27, 2026
  31. Derrick StoleeAug 31, 2026
  32. Jeff KingSep 1, 2026
  33. Jeff KingSep 1, 2026
  34. Derrick StoleeSep 1, 2026
  35. 0/7 trace2: stop allowing die()Derrick Stolee via GitGitGadget, Aug 31, 2026
  36. 1/7 banned-die: create header for banning of functionsDerrick Stolee via GitGitGadget, Aug 31, 2026
  37. 2/7 trace2: tolerate failed timestamp formattingDerrick Stolee via GitGitGadget, Aug 31, 2026
  38. 3/7 trace2: remove use of xstrdup()Derrick Stolee via GitGitGadget, Aug 31, 2026
  39. 4/7 trace2: remove use of ALLOC_ARRAY()Derrick Stolee via GitGitGadget, Aug 31, 2026
  40. 5/7 trace2: remove use of xstrfmt()Derrick Stolee via GitGitGadget, Aug 31, 2026
  41. 6/7 trace2: remove use of ALLOC_GROW()Derrick Stolee via GitGitGadget, Aug 31, 2026
  42. 7/7 trace2: remove use of xcalloc()Derrick Stolee via GitGitGadget, Aug 31, 2026
  43. Derrick StoleeOct 6, 2026

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.