Unknown error with concurrent config read/write on Windows

On Windows, Git encounters fatal errors (that do not happen on Linux) when reading and writing the Git config in parallel processes.

I and some peers can relatively easily reproduce this by running in parallel (e.g., in two separate terminal/PowerShell windows):

for (;;) {git rev-parse HEAD} for (;;) {git config --local user.name foo}

The rev-parse "thread" will spew messages like:

f100762176b7b085e81cafe261a049d809772ace f100762176b7b085e81cafe261a049d809772ace f100762176b7b085e81cafe261a049d809772ace warning: unable to access '.git/config': Permission denied fatal: unknown error occurred while reading the configuration files f100762176b7b085e81cafe261a049d809772ace

This affects any command that reads the Git config (which is all/most of them); rev-parse is just a convenient stand-in.

I have seen the work to make lockfile renames (and thus config edits I believe) more atomic in https://lore.kernel.org/all/cover.1729695349.git.ps@pks.im/T/ which should be in 28.0 IIUC.

However, the above issue can still be reproduced with an RC build of 28.0 (of the Git for Windows distribution).

Based on where the unknown error text occurs in the code, I speculate that the "atomic rename" of config.lock to config is allowing subsequent readers to read an incomplete version of the config file, which means that the fix I referenced above may be deficient in some way.

I will omit the context around my problem, which can be summarized as "legacy infrastructure/scripts", but I'd like to frame this bug report as "this works on Linux, but not on Windows" in the hopes of getting some help, although I understand this may not be the highest priority.

(Apologies in advance for my ignorance with Windows and/or using this mailing list.)

On Thu, Feb 06, 2025 at 06:44:33PM -0800, Allen Li wrote:

I'm not quite sure which version you're referring to here. 28.0 is not a version released by either GIt nor Git for Windows. You probably meant to refer to v2.48.0?

In any case, it's not entirely surprising that this may still cause issues in some code paths. Support for POSIX-style renames requires two different bits:

  - The `rename()` implementation needs to know to allow POSIX-style
    renames even when the target file is currently held open.

  - All code paths that open a file need to be taught to open them with
    `FILE_SHARE_DELETE`. This flag allows the file to be deleted while
    the file handle remains open.

The first part has been implemented by the mentioned patch series, and some code paths have been adapted to also do the second part. But not all code paths do this yet, and those that don't will not be able to use atomic renames when the file is open.

One important omission in your context is that fopen(3p) does not yet know to set `FILE_SHARE_DELETE`. It uses `_wfopen()` right now, which does not set this flag. In the best case we'd convert the code to use `_wfsopen()` instead, which allows us to control the sharing mode. But unfortunately, it only allows us to control `FILe_SHARE_WRITE` as well as `FILE_SHARE_READ`, but not `FILE_SHARE_DELETE`.

So to the best of my knowledge, we'd have to reimplement the function on top of `CreateFileW()` so that we can fully control the file sharing mode.

Patrick

On Mon, Feb 24, 2025 at 4:53 AM Patrick Steinhardt <ps@pks.im> wrote:

Yes sorry, I meant v2.48.0

Thank you, that makes sense. We ended up committing to a different approach which sidesteps this problem, but I think there's enough context here for anyone else who may experience this problem to take a shot at fixing it (perhaps it will be future me).