Re: Unknown error with concurrent config read/write on Windows

[Patrick Steinhardt <ps@pks.im>]

On Thu, Feb 06, 2025 at 06:44:33PM -0800, Allen Li wrote:
> On Windows, Git encounters fatal errors (that do not happen on Linux)
> when reading and writing the Git config in parallel processes.
> 
> I and some peers can relatively easily reproduce this by running in
> parallel (e.g., in two separate terminal/PowerShell windows):
> 
> for (;;) {git rev-parse HEAD}
> for (;;) {git config --local user.name foo}
> 
> The rev-parse "thread" will spew messages like:
> 
> f100762176b7b085e81cafe261a049d809772ace
> f100762176b7b085e81cafe261a049d809772ace
> f100762176b7b085e81cafe261a049d809772ace
> warning: unable to access '.git/config': Permission denied
> fatal: unknown error occurred while reading the configuration files
> f100762176b7b085e81cafe261a049d809772ace
> 
> This affects any command that reads the Git config (which is all/most
> of them); rev-parse is just a convenient stand-in.
> 
> I have seen the work to make lockfile renames (and thus config edits I
> believe) more atomic in
> https://lore.kernel.org/all/cover.1729695349.git.ps@pks.im/T/ which
> should be in 28.0 IIUC.
> 
> However, the above issue can still be reproduced with an RC build of
> 28.0 (of the Git for Windows distribution).

I'm not quite sure which version you're referring to here. 28.0 is not a
version released by either GIt nor Git for Windows. You probably meant
to refer to v2.48.0?

In any case, it's not entirely surprising that this may still cause
issues in some code paths. Support for POSIX-style renames requires two
different bits:

  - The `rename()` implementation needs to know to allow POSIX-style
    renames even when the target file is currently held open.

  - All code paths that open a file need to be taught to open them with
    `FILE_SHARE_DELETE`. This flag allows the file to be deleted while
    the file handle remains open.

The first part has been implemented by the mentioned patch series, and
some code paths have been adapted to also do the second part. But not
all code paths do this yet, and those that don't will not be able to use
atomic renames when the file is open.

One important omission in your context is that fopen(3p) does not yet
know to set `FILE_SHARE_DELETE`. It uses `_wfopen()` right now, which
does not set this flag. In the best case we'd convert the code to use
`_wfsopen()` instead, which allows us to control the sharing mode. But
unfortunately, it only allows us to control `FILe_SHARE_WRITE` as well
as `FILE_SHARE_READ`, but not `FILE_SHARE_DELETE`.

So to the best of my knowledge, we'd have to reimplement the function on
top of `CreateFileW()` so that we can fully control the file sharing
mode.

Patrick