| Message ID | 20190930220355.108394-1-emilyshaffer@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v4] promisor-remote: skip move_to_tail when no-op | expand |
On Tue, Oct 1, 2019 at 12:03 AM Emily Shaffer <emilyshaffer@google.com> wrote: > > Previously, when promisor_remote_move_to_tail() is called for a > promisor_remote which is currently the final element in promisors, a > cycle is created in the promisors linked list. This cycle leads to a > double free later on in promisor_remote_clear() when the final element > of the promisors list is removed: promisors is set to promisors->next (a > no-op, as promisors->next == promisors); the previous value of promisors > is free()'d; then the new value of promisors (which is equal to the > previous value of promisors) is also free()'d. This double-free error > was unrecoverable for the user without removing the filter or re-cloning > the repo and hoping to miss this edge case. > > Now, when promisor_remote_move_to_tail() would be a no-op, just do a > no-op. In cases of promisor_remote_move_to_tail() where r is not already > at the tail of the list, it works as before. Yeah, thank you Emily and Peff for finding and fixing this! The fix and the test look good to me.
diff --git a/promisor-remote.c b/promisor-remote.c index 9bc296cdde..9bd5b79d59 100644 --- a/promisor-remote.c +++ b/promisor-remote.c @@ -89,6 +89,9 @@ static struct promisor_remote *promisor_remote_lookup(const char *remote_name, static void promisor_remote_move_to_tail(struct promisor_remote *r, struct promisor_remote *previous) { + if (r->next == NULL) + return; + if (previous) previous->next = r->next; else diff --git a/t/t0410-partial-clone.sh b/t/t0410-partial-clone.sh index d4b7e535ea..5c676c71a5 100755 --- a/t/t0410-partial-clone.sh +++ b/t/t0410-partial-clone.sh @@ -429,6 +429,19 @@ test_expect_success 'rev-list dies for missing objects on cmd line' ' done ' +test_expect_success 'single promisor remote can be re-initialized gracefully' ' + # ensure one promisor is in the promisors list + rm -rf repo && + test_create_repo repo && + test_create_repo other && + git -C repo remote add foo "file://$(pwd)/other" && + git -C repo config remote.foo.promisor true && + git -C repo config extensions.partialclone foo && + + # reinitialize the promisors list + git -C repo fetch --filter=blob:none foo +' + test_expect_success 'gc repacks promisor objects separately from non-promisor objects' ' rm -rf repo && test_create_repo repo &&
Previously, when promisor_remote_move_to_tail() is called for a promisor_remote which is currently the final element in promisors, a cycle is created in the promisors linked list. This cycle leads to a double free later on in promisor_remote_clear() when the final element of the promisors list is removed: promisors is set to promisors->next (a no-op, as promisors->next == promisors); the previous value of promisors is free()'d; then the new value of promisors (which is equal to the previous value of promisors) is also free()'d. This double-free error was unrecoverable for the user without removing the filter or re-cloning the repo and hoping to miss this edge case. Now, when promisor_remote_move_to_tail() would be a no-op, just do a no-op. In cases of promisor_remote_move_to_tail() where r is not already at the tail of the list, it works as before. Helped-by: Jeff King <peff@peff.net> Signed-off-by: Emily Shaffer <emilyshaffer@google.com> --- Since v3 missed a small comment change. promisor-remote.c | 3 +++ t/t0410-partial-clone.sh | 13 +++++++++++++ 2 files changed, 16 insertions(+)