threads / patch / 51944

patchshallow.c: Don't free unallocated slabs

Subject: [PATCH] shallow.c: Don't free unallocated slabs

## tl;dr

3 messages between Sep 30, 2019 and Oct 2, 2019. Diffs are folded; open one to read it.

replies: 2people: 3as markdown or json

Ali Utku Selen· Sep 30, 2019, 23:33 UTC · lore

Fix possible segfault when cloning a submodule shallow.

Signed-off-by: Ali Utku Selen <auselen@gmail.com>
---
It is possible to have unallocated slabs in shallow.c's commit_depth
for a shallow submodule with many commits.

Easiest way to reproduce this I found was changing COMMIT_SLAB_SIZE to 32 and run t7406-submodule-update.sh. Segfault happens in case 50: "submodule update clone shallow submodule outside of depth"

 shallow.c | 2 ++
 1 file changed, 2 insertions(+)

Show changes to shallow.c +2 −0

diff --git a/shallow.c b/shallow.c
index 5fa2b15d37..c33ab94bd7 100644
--- a/shallow.c
+++ b/shallow.c
@@ -156,6 +156,8 @@ struct commit_list *get_shallow_commits(struct object_array *heads, int depth,
 	for (i = 0; i < depths.slab_count; i++) {
 		int j;
 
+		if (!depths.slab[i])
+			continue;
 		for (j = 0; j < depths.slab_size; j++)
 			free(depths.slab[i][j]);
 	}

-- 
2.17.1

Jeff King· Oct 1, 2019, 15:07 UTC · re: Ali Utku Selen · lore

Re: [PATCH] shallow.c: Don't free unallocated slabs

On Tue, Oct 01, 2019 at 01:33:10AM +0200, Ali Utku Selen wrote:

> Fix possible segfault when cloning a submodule shallow.

Thanks. Just looking at the context, this is clearly the right thing to be doing.

> It is possible to have unallocated slabs in shallow.c's commit_depth
> for a shallow submodule with many commits.

Yeah, the trick here is that we may over-allocate the slab list but not fill all of the entries. This is really an internal implementation detail of how the slab code works. It would be nice if callers didn't have to care about it. Perhaps we ought to have a slab foreach() function that encapsulates this, which would let this caller do something like:

  commit_depth_foreach(&depths, free_commit_depth);
  commit_depth_clear(&depths);

But since this is the only place that looks into the slab in this way, I'm happy to take your much simpler fix in the meantime.

> Easiest way to reproduce this I found was changing COMMIT_SLAB_SIZE to
> 32 and run t7406-submodule-update.sh. Segfault happens in case 50:
> "submodule update clone shallow submodule outside of depth"

It would be nice to have a test, but I suspect it would be kind of expensive, since it requires 512kb+ of entries (and would obviously be depending on this arbitrary internal value). Given the simplicity of the fix, I think we can live without it.

-Peff

Junio C Hamano· Oct 2, 2019, 06:01 UTC · re: Jeff King · lore

Re: [PATCH] shallow.c: Don't free unallocated slabs

Jeff King <peff@peff.net> writes:

Show 11 quoted lines

> ... This is really an internal implementation
> detail of how the slab code works. It would be nice if callers didn't
> have to care about it. Perhaps we ought to have a slab foreach()
> function that encapsulates this, which would let this caller do
> something like:
>
>   commit_depth_foreach(&depths, free_commit_depth);
>   commit_depth_clear(&depths);
>
> But since this is the only place that looks into the slab in this way,
> I'm happy to take your much simpler fix in the meantime.

Likewise.  Thanks, both.