[PATCH v2 0/2] Do not lock temporary files via child processes on Windows

[Johannes Schindelin <johannes.schindelin@gmx.de>]

This issue was originally reported and fixed in
https://github.com/git-for-windows/git/pull/755

The problem is that file handles to temporary files (such as
index.lock) were inherited by spawned processes. If those spawned
processes do not exit before the parent process wants to delete or
rename them, we are in big trouble.

The original use case triggering the bug is a merge driver that does
not quit, but listen to subsequent merge requests.

However, the same issue turned up in Lars Schneider's work on making
clean/smudge filters batchable (i.e. more efficient by avoiding
possibly thousands of child processes, one per file).

Changes since v1:

- the two commit messages have been corrected, as per Junio's and Eric's
  suggestion,
- lockfile.h and tempfile.h now sport explicit documentation that the
  current process needs to write to the files, no spawned processes.


Ben Wijen (2):
  t6026-merge-attr: child processes must not inherit index.lock handles
  mingw: ensure temporary file handles are not inherited by child
    processes

 compat/mingw.h        |  4 ++++
 lockfile.h            |  4 ++++
 t/t6026-merge-attr.sh | 13 +++++++++++++
 tempfile.c            |  2 +-
 tempfile.h            |  4 ++++
 5 files changed, 26 insertions(+), 1 deletion(-)

Published-As: https://github.com/dscho/git/releases/tag/mingw-index-lock-v2
Fetch-It-Via: git fetch https://github.com/dscho/git mingw-index-lock-v2

Interdiff vs v1:

 diff --git a/lockfile.h b/lockfile.h
 index 3d30193..d26ad27 100644
 --- a/lockfile.h
 +++ b/lockfile.h
 @@ -55,6 +55,10 @@
   *   * calling `fdopen_lock_file()` to get a `FILE` pointer for the
   *     open file and writing to the file using stdio.
   *
 + *   Note that the file descriptor returned by hold_lock_file_for_update()
 + *   is marked O_CLOEXEC, so the new contents must be written by the
 + *   current process, not a spawned one.
 + *
   * When finished writing, the caller can:
   *
   * * Close the file descriptor and rename the lockfile to its final
 diff --git a/tempfile.h b/tempfile.h
 index 4219fe4..2f0038d 100644
 --- a/tempfile.h
 +++ b/tempfile.h
 @@ -33,6 +33,10 @@
   *   * calling `fdopen_tempfile()` to get a `FILE` pointer for the
   *     open file and writing to the file using stdio.
   *
 + *   Note that the file descriptor returned by create_tempfile()
 + *   is marked O_CLOEXEC, so the new contents must be written by
 + *   the current process, not any spawned one.
 + *
   * When finished writing, the caller can:
   *
   * * Close the file descriptor and remove the temporary file by

-- 
2.9.2.691.g78954f3

base-commit: d63263a4dee8fc7da9b97bbdedf9c0d1f33024d4