@matheusbsbs / matheus-bagliano / commits / d5b0bac528
Fork 0

grep: fix racy calls in grep_objects()

deref_tag() calls is_promisor_object() and parse_object(), both of which perform lazy initializations and other thread-unsafe operations. If it was only called by grep_objects() this wouldn't be a problem as the latter is only executed by the main thread. However, deref_tag() is also present in read_object_file()'s call stack. So calling deref_tag() in grep_objects() without acquiring the grep_read_mutex may incur in a race condition with object reading operations (such as the ones internally performed by fill_textconv(), called at fill_textconv_grep()). The same problem happens with the call to gitmodules_config_oid() which also has parse_object() in its call stack. Fix that protecting both calls with the said grep_read_mutex. Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Matheus Tavares committed Jan 15, 2020 at 23:39 UTC d5b0bac52841857b5ba197ca931ecf729fdbc63e
1 file changed +5
builtin/grep.c
+5
@@ -658,13 +658,18 @@ static int grep_objects(struct grep_opt *opt, const struct pathspec *pathspec,
658
659 for (i = 0; i < nr; i++) {
660 struct object *real_obj;
661 +
662 + grep_read_lock();
663 real_obj = deref_tag(opt->repo, list->objects[i].item,
664 NULL, 0);
665 + grep_read_unlock();
666
667 /* load the gitmodules file for this rev */
668 if (recurse_submodules) {
669 submodule_free(opt->repo);
670 + grep_read_lock();
671 gitmodules_config_oid(&real_obj->oid);
672 + grep_read_unlock();
673 }
674 if (grep_object(opt, pathspec, real_obj, list->objects[i].name,
675 list->objects[i].path)) {