@matheusbsbs / matheus-bagliano / commits / 05d1ed6148

mingw: ensure temporary file handles are not inherited by child processes

When the index is locked and child processes inherit the handle to said lock and the parent process wants to remove the lock before the child process exits, on Windows there is a problem: it won't work because files cannot be deleted if a process holds a handle on them. The symptom: Rename from 'xxx/.git/index.lock' to 'xxx/.git/index' failed. Should I try again? (y/n) Spawning child processes with bInheritHandles==FALSE would not work because no file handles would be inherited, not even the hStdXxx handles in STARTUPINFO (stdin/stdout/stderr). Opening every file with O_NOINHERIT does not work, either, as e.g. git-upload-pack expects inherited file handles. This leaves us with the only way out: creating temp files with the O_NOINHERIT flag. This flag is Windows-specific, however. For our purposes, it is equivalent to O_CLOEXEC (which does not exist on Windows), so let's just open temporary files with the O_CLOEXEC flag and map that flag to O_NOINHERIT on Windows. As Eric Wong pointed out, we need to be careful to handle the case where the Linux headers used to compile Git support O_CLOEXEC but the Linux kernel used to run Git does not: it returns an EINVAL. This fixes the test that we just introduced to demonstrate the problem. Signed-off-by: Ben Wijen <ben@wijen.net> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ben Wijen committed Aug 22, 2016 at 14:47 UTC 05d1ed6148305d299693000856e4971e9f642662

6 files changed +23 -2

compat/mingw.h

@@ -67,6 +67,10 @@ typedef int pid_t;

67 #define F_SETFD 2

68 #define FD_CLOEXEC 0x1

70 +#if !defined O_CLOEXEC && defined O_NOINHERIT

71 +#define O_CLOEXEC O_NOINHERIT

72 +#endif

73 +

74 #ifndef EAFNOSUPPORT

75 #define EAFNOSUPPORT WSAEAFNOSUPPORT

76 #endif

git-compat-util.h

@@ -650,6 +650,10 @@ void *gitmemmem(const void *haystack, size_t haystacklen,

650 #define getpagesize() sysconf(_SC_PAGESIZE)

651 #endif

652

653 +#ifndef O_CLOEXEC

654 +#define O_CLOEXEC 0

655 +#endif

656 +

657 #ifdef FREAD_READS_DIRECTORIES

658 #ifdef fopen

659 #undef fopen

lockfile.h

@@ -55,6 +55,10 @@

55 * * calling `fdopen_lock_file()` to get a `FILE` pointer for the

56 * open file and writing to the file using stdio.

57 *

58 + * Note that the file descriptor returned by hold_lock_file_for_update()

59 + * is marked O_CLOEXEC, so the new contents must be written by the

60 + * current process, not a spawned one.

61 + *

62 * When finished writing, the caller can:

63 *

64 * * Close the file descriptor and rename the lockfile to its final

t/t6026-merge-attr.sh

+1 -1

@@ -181,7 +181,7 @@ test_expect_success 'up-to-date merge without common ancestor' '

181 )

182 '

183

184 -test_expect_success !MINGW 'custom merge does not lock index' '

184 +test_expect_success 'custom merge does not lock index' '

185 git reset --hard anchor &&

186 write_script sleep-one-second.sh <<-\EOF &&

187 sleep 1 &

tempfile.c

+6 -1

@@ -120,7 +120,12 @@ int create_tempfile(struct tempfile *tempfile, const char *path)

120 prepare_tempfile_object(tempfile);

121

122 strbuf_add_absolute_path(&tempfile->filename, path);

123 - tempfile->fd = open(tempfile->filename.buf, O_RDWR | O_CREAT | O_EXCL, 0666);

123 + tempfile->fd = open(tempfile->filename.buf,

124 + O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0666);

125 + if (O_CLOEXEC && tempfile->fd < 0 && errno == EINVAL)

126 + /* Try again w/o O_CLOEXEC: the kernel might not support it */

127 + tempfile->fd = open(tempfile->filename.buf,

128 + O_RDWR | O_CREAT | O_EXCL, 0666);

129 if (tempfile->fd < 0) {

130 strbuf_reset(&tempfile->filename);

131 return -1;

tempfile.h

@@ -33,6 +33,10 @@

33 * * calling `fdopen_tempfile()` to get a `FILE` pointer for the

34 * open file and writing to the file using stdio.

35 *

36 + * Note that the file descriptor returned by create_tempfile()

37 + * is marked O_CLOEXEC, so the new contents must be written by

38 + * the current process, not any spawned one.

39 + *

40 * When finished writing, the caller can:

41 *

42 * * Close the file descriptor and remove the temporary file by