Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit bd670ab

Browse files
ethomsonethomson
committed
Merge pull request libgit2#3226 from libgit2/cmn/racy-diff-again
racy-git, the missing link
2 parents 8351abc + bb4896f commit bd670ab

File tree

10 files changed

+229
-45
lines changed

10 files changed

+229
-45
lines changed

‎CHANGELOG.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,9 @@ support for HTTPS connections insead of OpenSSL.
6969
and `git_diff_buffers` now accept a new binary callback of type
7070
`git_diff_binary_cb` that includes the binary diff information.
7171

72+
* The race condition mitigations described in `racy-git.txt` have been
73+
implemented.
74+
7275
### API additions
7376

7477
* The `git_merge_options` gained a `file_flags` member.

‎src/diff.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -816,11 +816,11 @@ static int maybe_modified(
816816
} else if (git_oid_iszero(&nitem->id) && new_is_workdir) {
817817
bool use_ctime = ((diff->diffcaps & GIT_DIFFCAPS_TRUST_CTIME) != 0);
818818
bool use_nanos = ((diff->diffcaps & GIT_DIFFCAPS_TRUST_NANOSECS) != 0);
819+
git_index *index;
820+
git_iterator_index(&index, info->new_iter);
819821

820822
status = GIT_DELTA_UNMODIFIED;
821823

822-
/* TODO: add check against index file st_mtime to avoid racy-git */
823-
824824
if (S_ISGITLINK(nmode)) {
825825
if ((error = maybe_modified_submodule(&status, &noid, diff, info)) < 0)
826826
return error;
@@ -839,7 +839,8 @@ static int maybe_modified(
839839
!diff_time_eq(&oitem->ctime, &nitem->ctime, use_nanos)) ||
840840
oitem->ino != nitem->ino ||
841841
oitem->uid != nitem->uid ||
842-
oitem->gid != nitem->gid)
842+
oitem->gid != nitem->gid ||
843+
(index && nitem->mtime.seconds >= index->stamp.mtime))
843844
{
844845
status = GIT_DELTA_MODIFIED;
845846
modified_uncertain = true;

‎src/index.c

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -688,20 +688,59 @@ int git_index__changed_relative_to(
688688
return !!git_oid_cmp(&index->checksum, checksum);
689689
}
690690

691+
static bool is_racy_timestamp(git_time_t stamp, git_index_entry *entry)
692+
{
693+
/* Git special-cases submodules in the check */
694+
if (S_ISGITLINK(entry->mode))
695+
return false;
696+
697+
/* If we never read the index, we can't have this race either */
698+
if (stamp == 0)
699+
return false;
700+
701+
/* If the timestamp is the same or newer than the index, it's racy */
702+
return ((int32_t) stamp) <= entry->mtime.seconds;
703+
}
704+
691705
/*
692706
* Force the next diff to take a look at those entries which have the
693707
* same timestamp as the current index.
694708
*/
695-
static void truncate_racily_clean(git_index *index)
709+
static int truncate_racily_clean(git_index *index)
696710
{
697711
size_t i;
712+
int error;
698713
git_index_entry *entry;
699714
git_time_t ts = index->stamp.mtime;
715+
git_diff_options diff_opts = GIT_DIFF_OPTIONS_INIT;
716+
git_diff *diff;
700717

718+
/* Nothing to do if there's no repo to talk about */
719+
if (!INDEX_OWNER(index))
720+
return 0;
721+
722+
/* If there's no workdir, we can't know where to even check */
723+
if (!git_repository_workdir(INDEX_OWNER(index)))
724+
return 0;
725+
726+
diff_opts.flags |= GIT_DIFF_INCLUDE_TYPECHANGE | GIT_DIFF_IGNORE_SUBMODULES | GIT_DIFF_DISABLE_PATHSPEC_MATCH;
701727
git_vector_foreach(&index->entries, i, entry) {
702-
if (entry->mtime.seconds == ts || ts == 0)
728+
if (!is_racy_timestamp(ts, entry))
729+
continue;
730+
731+
diff_opts.pathspec.count = 1;
732+
diff_opts.pathspec.strings = (char **) &entry->path;
733+
734+
if ((error = git_diff_index_to_workdir(&diff, INDEX_OWNER(index), index, &diff_opts)) < 0)
735+
return error;
736+
737+
if (git_diff_num_deltas(diff) > 0)
703738
entry->file_size = 0;
739+
740+
git_diff_free(diff);
704741
}
742+
743+
return 0;
705744
}
706745

707746
int git_index_write(git_index *index)

‎src/iterator.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1762,6 +1762,18 @@ int git_iterator_current_workdir_path(git_buf **path, git_iterator *iter)
17621762
return 0;
17631763
}
17641764

1765+
int git_iterator_index(git_index **out, git_iterator *iter)
1766+
{
1767+
workdir_iterator *wi = (workdir_iterator *)iter;
1768+
1769+
if (iter->type != GIT_ITERATOR_TYPE_WORKDIR)
1770+
*out = NULL;
1771+
1772+
*out = wi->index;
1773+
1774+
return 0;
1775+
}
1776+
17651777
int git_iterator_advance_over_with_status(
17661778
const git_index_entry **entryptr,
17671779
git_iterator_status_t *status,

‎src/iterator.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
#include "git2/index.h"
1212
#include "vector.h"
1313
#include "buffer.h"
14+
#include "ignore.h"
1415

1516
typedef struct git_iterator git_iterator;
1617

@@ -286,4 +287,11 @@ typedef enum {
286287
extern int git_iterator_advance_over_with_status(
287288
const git_index_entry **entry, git_iterator_status_t *status, git_iterator *iter);
288289

290+
/**
291+
* Retrieve the index stored in the iterator.
292+
*
293+
* Only implemented for the workdir iterator
294+
*/
295+
extern int git_iterator_index(git_index **out, git_iterator *iter);
296+
289297
#endif

‎tests/diff/racy.c

Lines changed: 0 additions & 39 deletions
This file was deleted.

‎tests/diff/workdir.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1623,6 +1623,8 @@ void test_diff_workdir__can_update_index(void)
16231623

16241624
/* now if we do it again, we should see fewer OID calculations */
16251625

1626+
/* tick again as the index updating from the previous diff might have reset the timestamp */
1627+
tick_index(index);
16261628
basic_diff_status(&diff, &opts);
16271629

16281630
cl_git_pass(git_diff_get_perfdata(&perf, diff));

‎tests/index/racy.c

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
#include "clar_libgit2.h"
2+
#include "../checkout/checkout_helpers.h"
3+
4+
#include "buffer.h"
5+
#include "index.h"
6+
7+
static git_repository *g_repo;
8+
9+
void test_index_racy__initialize(void)
10+
{
11+
cl_git_pass(git_repository_init(&g_repo, "diff_racy", false));
12+
}
13+
14+
void test_index_racy__cleanup(void)
15+
{
16+
git_repository_free(g_repo);
17+
g_repo = NULL;
18+
19+
cl_fixture_cleanup("diff_racy");
20+
}
21+
22+
void test_index_racy__diff(void)
23+
{
24+
git_index *index;
25+
git_diff *diff;
26+
git_buf path = GIT_BUF_INIT;
27+
28+
cl_git_pass(git_buf_joinpath(&path, git_repository_workdir(g_repo), "A"));
29+
cl_git_mkfile(path.ptr, "A");
30+
31+
/* Put 'A' into the index */
32+
cl_git_pass(git_repository_index(&index, g_repo));
33+
cl_git_pass(git_index_add_bypath(index, "A"));
34+
cl_git_pass(git_index_write(index));
35+
36+
cl_git_pass(git_diff_index_to_workdir(&diff, g_repo, index, NULL));
37+
cl_assert_equal_i(0, git_diff_num_deltas(diff));
38+
git_diff_free(diff);
39+
40+
/* Change its contents quickly, so we get the same timestamp */
41+
cl_git_mkfile(path.ptr, "B");
42+
43+
cl_git_pass(git_diff_index_to_workdir(&diff, g_repo, index, NULL));
44+
cl_assert_equal_i(1, git_diff_num_deltas(diff));
45+
46+
git_index_free(index);
47+
git_diff_free(diff);
48+
git_buf_free(&path);
49+
}
50+
51+
void test_index_racy__write_index_just_after_file(void)
52+
{
53+
git_index *index;
54+
git_diff *diff;
55+
git_buf path = GIT_BUF_INIT;
56+
struct timeval times[2];
57+
58+
/* Make sure we do have a timestamp */
59+
cl_git_pass(git_repository_index(&index, g_repo));
60+
cl_git_pass(git_index_write(index));
61+
62+
cl_git_pass(git_buf_joinpath(&path, git_repository_workdir(g_repo), "A"));
63+
cl_git_mkfile(path.ptr, "A");
64+
/* Force the file's timestamp to be a second after we wrote the index */
65+
times[0].tv_sec = index->stamp.mtime + 1;
66+
times[0].tv_usec = 0;
67+
times[1].tv_sec = index->stamp.mtime + 1;
68+
times[1].tv_usec = 0;
69+
cl_git_pass(p_utimes(path.ptr, times));
70+
71+
/*
72+
* Put 'A' into the index, the size field will be filled,
73+
* because the index' on-disk timestamp does not match the
74+
* file's timestamp.
75+
*/
76+
cl_git_pass(git_index_add_bypath(index, "A"));
77+
cl_git_pass(git_index_write(index));
78+
79+
cl_git_mkfile(path.ptr, "B");
80+
/*
81+
* Pretend this index' modification happend a second after the
82+
* file update, and rewrite the file in that same second.
83+
*/
84+
times[0].tv_sec = index->stamp.mtime + 2;
85+
times[0].tv_usec = 0;
86+
times[1].tv_sec = index->stamp.mtime + 2;
87+
times[0].tv_usec = 0;
88+
89+
cl_git_pass(p_utimes(git_index_path(index), times));
90+
cl_git_pass(p_utimes(path.ptr, times));
91+
92+
cl_git_pass(git_index_read(index, true));
93+
94+
cl_git_pass(git_diff_index_to_workdir(&diff, g_repo, index, NULL));
95+
cl_assert_equal_i(1, git_diff_num_deltas(diff));
96+
97+
git_buf_free(&path);
98+
git_diff_free(diff);
99+
git_index_free(index);
100+
}
101+
102+
void test_index_racy__empty_file_after_smudge(void)
103+
{
104+
git_index *index;
105+
git_diff *diff;
106+
git_buf path = GIT_BUF_INIT;
107+
int i, found_race = 0;
108+
const git_index_entry *entry;
109+
110+
/* Make sure we do have a timestamp */
111+
cl_git_pass(git_repository_index(&index, g_repo));
112+
cl_git_pass(git_index_write(index));
113+
114+
cl_git_pass(git_buf_joinpath(&path, git_repository_workdir(g_repo), "A"));
115+
116+
/* Make sure writing the file, adding and rewriting happen in the same second */
117+
for (i = 0; i < 10; i++) {
118+
struct stat st;
119+
cl_git_mkfile(path.ptr, "A");
120+
121+
cl_git_pass(git_index_add_bypath(index, "A"));
122+
cl_git_mkfile(path.ptr, "B");
123+
cl_git_pass(git_index_write(index));
124+
125+
cl_git_mkfile(path.ptr, "");
126+
127+
cl_git_pass(p_stat(path.ptr, &st));
128+
cl_assert(entry = git_index_get_bypath(index, "A", 0));
129+
if (entry->mtime.seconds == (int32_t) st.st_mtime) {
130+
found_race = 1;
131+
break;
132+
}
133+
134+
}
135+
136+
if (!found_race)
137+
cl_fail("failed to find race after 10 attempts");
138+
139+
cl_assert_equal_i(0, entry->file_size);
140+
141+
cl_git_pass(git_diff_index_to_workdir(&diff, g_repo, index, NULL));
142+
cl_assert_equal_i(1, git_diff_num_deltas(diff));
143+
}

‎tests/merge/workdir/dirty.c

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,19 +133,33 @@ static void hack_index(char *files[])
133133
struct stat statbuf;
134134
git_buf path = GIT_BUF_INIT;
135135
git_index_entry *entry;
136+
struct timeval times[2];
137+
time_t now;
136138
size_t i;
137139

138140
/* Update the index to suggest that checkout placed these files on
139141
* disk, keeping the object id but updating the cache, which will
140142
* emulate a Git implementation's different filter.
143+
*
144+
* We set the file's timestamp to before now to pretend that
145+
* it was an old checkout so we don't trigger the racy
146+
* protections would would check the content.
141147
*/
148+
149+
now = time(NULL);
150+
times[0].tv_sec = now - 5;
151+
times[0].tv_usec = 0;
152+
times[1].tv_sec = now - 5;
153+
times[1].tv_usec = 0;
154+
142155
for (i = 0, filename = files[i]; filename; filename = files[++i]) {
143156
git_buf_clear(&path);
144157

145158
cl_assert(entry = (git_index_entry *)
146159
git_index_get_bypath(repo_index, filename, 0));
147160

148161
cl_git_pass(git_buf_printf(&path, "%s/%s", TEST_REPO_PATH, filename));
162+
cl_git_pass(p_utimes(path.ptr, times));
149163
cl_git_pass(p_stat(path.ptr, &statbuf));
150164

151165
entry->ctime.seconds = (git_time_t)statbuf.st_ctime;
@@ -245,7 +259,6 @@ static int merge_differently_filtered_files(char *files[])
245259
write_files(files);
246260
hack_index(files);
247261

248-
repo_index->stamp.mtime = time(NULL) + 1;
249262
cl_git_pass(git_index_write(repo_index));
250263

251264
error = merge_branch();

‎tests/status/worktree.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -985,6 +985,8 @@ void test_status_worktree__update_stat_cache_0(void)
985985

986986
opts.flags &= ~GIT_STATUS_OPT_UPDATE_INDEX;
987987

988+
/* tick again as the index updating from the previous diff might have reset the timestamp */
989+
tick_index(index);
988990
cl_git_pass(git_status_list_new(&status, repo, &opts));
989991
check_status0(status);
990992
cl_git_pass(git_status_list_get_perfdata(&perf, status));

0 commit comments

Comments
 (0)