Unknown error with concurrent config read/write on Windows

Unknown error with concurrent config read/write on Windows

[Allen Li]

On Windows, Git encounters fatal errors (that do not happen on Linux)
when reading and writing the Git config in parallel processes.

I and some peers can relatively easily reproduce this by running in
parallel (e.g., in two separate terminal/PowerShell windows):

for (;;) {git rev-parse HEAD}
for (;;) {git config --local user.name foo}

The rev-parse "thread" will spew messages like:

f100762176b7b085e81cafe261a049d809772ace
f100762176b7b085e81cafe261a049d809772ace
f100762176b7b085e81cafe261a049d809772ace
warning: unable to access '.git/config': Permission denied
fatal: unknown error occurred while reading the configuration files
f100762176b7b085e81cafe261a049d809772ace

This affects any command that reads the Git config (which is all/most
of them); rev-parse is just a convenient stand-in.

I have seen the work to make lockfile renames (and thus config edits I
believe) more atomic in
https://lore.kernel.org/all/cover.1729695349.git.ps@pks.im/T/ which
should be in 28.0 IIUC.

However, the above issue can still be reproduced with an RC build of
28.0 (of the Git for Windows distribution).

Based on where the unknown error text occurs in the code, I speculate
that the "atomic rename" of config.lock to config is allowing
subsequent readers to read an incomplete version of the config file,
which means that the fix I referenced above may be deficient in some
way.

I will omit the context around my problem, which can be summarized as
"legacy infrastructure/scripts", but I'd like to frame this bug report
as "this works on Linux, but not on Windows" in the hopes of getting
some help, although I understand this may not be the highest priority.

(Apologies in advance for my ignorance with Windows and/or using this
mailing list.)

Re: Unknown error with concurrent config read/write on Windows

[Patrick Steinhardt]

On Thu, Feb 06, 2025 at 06:44:33PM -0800, Allen Li wrote:
> On Windows, Git encounters fatal errors (that do not happen on Linux)
> when reading and writing the Git config in parallel processes.
> 
> I and some peers can relatively easily reproduce this by running in
> parallel (e.g., in two separate terminal/PowerShell windows):
> 
> for (;;) {git rev-parse HEAD}
> for (;;) {git config --local user.name foo}
> 
> The rev-parse "thread" will spew messages like:
> 
> f100762176b7b085e81cafe261a049d809772ace
> f100762176b7b085e81cafe261a049d809772ace
> f100762176b7b085e81cafe261a049d809772ace
> warning: unable to access '.git/config': Permission denied
> fatal: unknown error occurred while reading the configuration files
> f100762176b7b085e81cafe261a049d809772ace
> 
> This affects any command that reads the Git config (which is all/most
> of them); rev-parse is just a convenient stand-in.
> 
> I have seen the work to make lockfile renames (and thus config edits I
> believe) more atomic in
> https://lore.kernel.org/all/cover.1729695349.git.ps@pks.im/T/ which
> should be in 28.0 IIUC.
> 
> However, the above issue can still be reproduced with an RC build of
> 28.0 (of the Git for Windows distribution).

I'm not quite sure which version you're referring to here. 28.0 is not a
version released by either GIt nor Git for Windows. You probably meant
to refer to v2.48.0?

In any case, it's not entirely surprising that this may still cause
issues in some code paths. Support for POSIX-style renames requires two
different bits:

  - The `rename()` implementation needs to know to allow POSIX-style
    renames even when the target file is currently held open.

  - All code paths that open a file need to be taught to open them with
    `FILE_SHARE_DELETE`. This flag allows the file to be deleted while
    the file handle remains open.

The first part has been implemented by the mentioned patch series, and
some code paths have been adapted to also do the second part. But not
all code paths do this yet, and those that don't will not be able to use
atomic renames when the file is open.

One important omission in your context is that fopen(3p) does not yet
know to set `FILE_SHARE_DELETE`. It uses `_wfopen()` right now, which
does not set this flag. In the best case we'd convert the code to use
`_wfsopen()` instead, which allows us to control the sharing mode. But
unfortunately, it only allows us to control `FILe_SHARE_WRITE` as well
as `FILE_SHARE_READ`, but not `FILE_SHARE_DELETE`.

So to the best of my knowledge, we'd have to reimplement the function on
top of `CreateFileW()` so that we can fully control the file sharing
mode.

Patrick

Re: Unknown error with concurrent config read/write on Windows

[Allen Li]

On Mon, Feb 24, 2025 at 4:53 AM Patrick Steinhardt <ps@pks.im> wrote:
> I'm not quite sure which version you're referring to here. 28.0 is not a
> version released by either GIt nor Git for Windows. You probably meant
> to refer to v2.48.0?

Yes sorry, I meant v2.48.0

> In any case, it's not entirely surprising that this may still cause
> issues in some code paths. Support for POSIX-style renames requires two
> different bits:
>
>   - The `rename()` implementation needs to know to allow POSIX-style
>     renames even when the target file is currently held open.
>
>   - All code paths that open a file need to be taught to open them with
>     `FILE_SHARE_DELETE`. This flag allows the file to be deleted while
>     the file handle remains open.
>
> The first part has been implemented by the mentioned patch series, and
> some code paths have been adapted to also do the second part. But not
> all code paths do this yet, and those that don't will not be able to use
> atomic renames when the file is open.
>
> One important omission in your context is that fopen(3p) does not yet
> know to set `FILE_SHARE_DELETE`. It uses `_wfopen()` right now, which
> does not set this flag. In the best case we'd convert the code to use
> `_wfsopen()` instead, which allows us to control the sharing mode. But
> unfortunately, it only allows us to control `FILe_SHARE_WRITE` as well
> as `FILE_SHARE_READ`, but not `FILE_SHARE_DELETE`.
>
> So to the best of my knowledge, we'd have to reimplement the function on
> top of `CreateFileW()` so that we can fully control the file sharing
> mode.

Thank you, that makes sense.  We ended up committing to a different
approach which
sidesteps this problem, but I think there's enough context here for
anyone else who
may experience this problem to take a shot at fixing it (perhaps it
will be future me).

> Patrick