pull: avoid segfault when commit lookup fails - #2223
jirikuncar wants to merge 1 commit into
Conversation
Welcome to GitGitGadgetHi @jirikuncar, and welcome to GitGitGadget, the GitHub App to send patch series to the Git mailing list from GitHub Pull Requests. Please make sure that either:
You can CC potential reviewers by adding a footer to the PR description with the following syntax: NOTE: DO NOT copy/paste your CC list from a previous GGG PR's description, Also, it is a good idea to review the commit messages one last time, as the Git project expects them in a quite specific form:
It is in general a good idea to await the automated test ("Checks") in this Pull Request before contributing the patches, e.g. to avoid trivial issues such as unportable code. Contributing the patchesBefore you can contribute the patches, your GitHub username needs to be added to the list of permitted users. Any already-permitted user can do that, by adding a comment to your PR of the form Both the person who commented An alternative is the channel Once on the list of permitted usernames, you can contribute the patches to the Git mailing list by adding a PR comment If you want to see what email(s) would be sent for a After you submit, GitGitGadget will respond with another comment that contains the link to the cover letter mail in the Git mailing list archive. Please make sure to monitor the discussion in that thread and to address comments and suggestions (while the comments and suggestions will be mirrored into the PR by GitGitGadget, you will still want to reply via mail). If you do not want to subscribe to the Git mailing list just to be able to respond to a mail, you can download the mbox from the Git mailing list archive (click the curl -g --user "<EMailAddress>:<Password>" \
--url "imaps://imap.gmail.com/INBOX" -T /path/to/raw.txtTo iterate on your change, i.e. send a revised patch or patch series, you will first want to (force-)push to the same branch. You probably also want to modify your Pull Request description (or title). It is a good idea to summarize the revision by adding something like this to the cover letter (read: by editing the first comment on the PR, i.e. the PR description): To send a new iteration, just add another PR comment with the contents: Need help?New contributors who want advice are encouraged to join git-mentoring@googlegroups.com, where volunteers who regularly contribute to Git are willing to answer newbie questions, give advice, or otherwise provide mentoring to interested contributors. You must join in order to post or view messages, but anyone can join. You may also be able to find help in real time in the developer IRC channel, |
|
/allow |
|
User jirikuncar is now allowed to use GitGitGadget. |
|
/preview |
|
Preview email sent as pull.2223.git.1789139103583.gitgitgadget@gmail.com |
|
/submit |
|
Submitted as pull.2223.git.1789252459520.gitgitgadget@gmail.com To fetch this version into To fetch this version to local tag |
get_can_ff() and already_up_to_date() pass the result of lookup_commit_reference() straight to commit_list_insert() and repo_is_descendant_of() without checking it. When the object behind HEAD or one of the merge heads cannot be parsed, e.g. because a loose object was left truncated by a fetch or gc racing on the same repository, lookup_commit_reference() returns NULL and "git pull" segfaults instead of reporting the corruption. Treat a failed lookup as "cannot fast-forward" and "not up to date", so that the caller falls through to the normal merge path, which already diagnoses the broken object and fails cleanly. An alternative would be to report the breakage at each lookup site, which could give a more precise diagnosis. The minimal guards are preferred because they do no more than is needed to avoid the crash, and will be easy to drop once "git pull" is reworked to resolve object names into commit objects early and pass those around, at which point there will not be multiple lookups of the same object name to guard in the first place. The test corrupts the loose object in place rather than removing it: a missing object that is still recorded in the commit-graph is caught by the consistency check in fetch-pack before "git pull" reaches the fast-forward check, so removing it would not exercise the crash. Signed-off-by: Jiri Kuncar <jiri.kuncar@gmail.com>
|
Junio C Hamano wrote on the Git mailing list (how to reply to this email): "Jiri Kuncar via GitGitGadget" <gitgitgadget@gmail.com> writes:
> From: Jiri Kuncar <jiri.kuncar@gmail.com>
>
> Adds NULL guards for lookup_commit_reference() to avoid segfaults.
>
> Those invalid references are possibly caused by parallel fetches or
> gc racing on the same repository.
>
> This effectively treats failed lookup as "not up to date" so caller
> falls to a normal merge, which reports the broken object instead of
> crashing.
>
> Signed-off-by: Jiri Kuncar <jiri.kuncar@gmail.com>
> ---
> pull: avoid crash of invalid merge head
The log message sounds a bit unusual from our norm (see
Documentation/SubmittingPatches).
It is of course good to deal with a corrupt state more gracefully
rather than crashing. From a cursory look, the particular solution
chosen, to drive the caller to perform a merge and have it fail, may
smell a bit like cheating, in that we could diagnose the breakage
better by reporting what was broken at each place, but it probably
is a good choice.
If we really want to improve the situation for 'orig_head', for
example, we would probably want to turn it into a commit object
instance a lot earlier and pass the commit object instance around in
the call chain. Passing around many struct object_id instances
instead of object instances is an unnatural consequence of how this
program evolved. It was originally written as a shell script, and
of course passing hexadecimal object names was the only way the
script could drive 'git merge-base' and other programs to see if the
commit recorded as the current 'HEAD' will fast-forward to the
commit that is fetched from the remote to be merged in, for example.
Once we go that route to resolve object names early to object
instances, we will not have multiple lookup_commit_reference() calls
on the same object name (which require us to watch out for failures)
to begin with.
The above is a long-winded way to say that it is a good improvement
that does not do more than it needs to do and we will not have to
spend too much effort to undo when we revamp the internals to do
"the right thing" later.
> diff --git a/t/t5520-pull.sh b/t/t5520-pull.sh
> index 27f38ab3c8..7a3eadddd3 100755
> --- a/t/t5520-pull.sh
> +++ b/t/t5520-pull.sh
> @@ -888,4 +888,30 @@ test_expect_success 'git pull --rebase against local branch' '
> test_cmp expect file2
> '
>
> +test_expect_success 'pull does not crash when a merge head does not resolve' '
> + test_when_finished "rm -rf up dn" &&
> + git init up &&
> + (
> + cd up &&
> + test_commit base &&
> + git switch -c sideA &&
> + test_commit a &&
> + git switch -c sideB base &&
> + test_commit b
> + ) &&
> + git clone up dn &&
> + (
> + cd dn &&
> + git -c fetch.unpackLimit=1000 fetch origin \
> + "+refs/heads/*:refs/remotes/origin/*" &&
> + git commit-graph write --reachable &&
> + oid=$(git rev-parse refs/remotes/origin/sideA) &&
> + obj=.git/objects/$(test_oid_to_path "$oid") &&
> + test -f "$obj" &&
> + chmod u+w "$obj" &&
> + >"$obj" &&
> + test_must_fail git pull --no-rebase origin sideA sideB
> + )
> +'
The "test -f" there smells more like a debugging aid for this test
than making sure the fixed program works as expected. I wonder if
it is simpler (and more portable to non-POSIX environments) if we
replace the "corrupt $obj" step with 'rm -f "$obj"'.
Thanks. |
db6ecf6 to
c00ae9d
Compare
jirikuncar
changed the title
|
/preview |
|
Preview email sent as pull.2223.v2.git.1790000726914.gitgitgadget@gmail.com |
|
/submit |
|
Submitted as pull.2223.v2.git.1790001166646.gitgitgadget@gmail.com To fetch this version into To fetch this version to local tag |
2 participants
Changes since v1:
present-tense problem statement, alternatives considered), as pointed
out by Junio.
"rm -f && echo garbage >", the idiom already used in t1450. Plain
"rm -f" alone does not reproduce the crash: a missing object that is
still in the commit-graph is caught by fetch-pack's consistency check
before "git pull" reaches get_can_ff(), so the object has to remain
present but unparseable. Documented this in a test comment and in
the log message.
populates refs/remotes/origin/*.