Skip to content

Race in git_packfile_unpack #2906

@jasonhaslam

Description

@jasonhaslam

I'm trying to generate a bunch of diffs in parallel with git_diff_tree_to_tree. When I run it on a largish repo (like git.git) it crashes after a while. Address sanitizer points to a sort of race condition in git_packfile_unpack related to caching. I'll include the address sanitizer output below.

As far as I can tell, the problem starts at the call to cache_add around line 702 in pack.c. A cache entry gets added without incrementing its refcount. Then the underlying data gets used in the subsequent call to git__delta_apply. The issue is that another thread can come along and evict that cache entry if the cache is full. The underlying data gets destroyed since the refcount is zero.

I have a fairly trivial patch to increment the refcount on cache add. I'll got ahead and submit it for review unless someone more familiar with that code wants to look at it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions