Re: [PATCH v3] merge: fix cache_entry use-after-free

2015-10-19 Thread Junio C Hamano
David Turner writes: > The problem is not the name_hash, but with the dir_hash. The dir_hash > is only even populated on case-insensitive filesystems (which is why you > and Linus don't see this bug). The dir_hash is not designed to catch > d/f conflicts, but rather case conflicts (one side of

Re: [PATCH v3] merge: fix cache_entry use-after-free

2015-10-19 Thread David Turner
On Fri, 2015-10-16 at 09:04 -0700, Junio C Hamano wrote: > David Turner writes: > > > We also do dozens or hundreds of merges per day and only saw this quite > > rarely. Interestingly, we could only trigger it with an alternate > > hashing function for git's hashmap implementation, and only once

Re: [PATCH v3] merge: fix cache_entry use-after-free

2015-10-16 Thread Junio C Hamano
David Turner writes: > We also do dozens or hundreds of merges per day and only saw this quite > rarely. Interestingly, we could only trigger it with an alternate > hashing function for git's hashmap implementation, and only once a > certain bug in that implementation was *fixed*. But that was

Re: [PATCH v3] merge: fix cache_entry use-after-free

2015-10-16 Thread David Turner
On Thu, 2015-10-15 at 13:51 -0700, Junio C Hamano wrote: > David Turner writes: > > >> > +static inline void drop_ce_ref(struct cache_entry *ce) > >> > +{ > >> > +if (ce != NULL) { > >> > +assert(ce->ref_count >= 0); > >> > >> Shouldn't this be "> 0" to prevent double fre

Re: [PATCH v3] merge: fix cache_entry use-after-free

2015-10-15 Thread Junio C Hamano
David Turner writes: >> > +static inline void drop_ce_ref(struct cache_entry *ce) >> > +{ >> > + if (ce != NULL) { >> > + assert(ce->ref_count >= 0); >> >> Shouldn't this be "> 0" to prevent double frees? > > No. If the ref_count is 1, then there is still some reference to the > ce.

Re: [PATCH v3] merge: fix cache_entry use-after-free

2015-10-15 Thread René Scharfe
Am 15.10.2015 um 21:02 schrieb David Turner: On Thu, 2015-10-15 at 05:35 +0200, René Scharfe wrote: Am 15.10.2015 um 00:07 schrieb David Turner: From: Keith McGuigan During merges, we would previously free entries that we no longer need in the destination index. But those entries might also

Re: [PATCH v3] merge: fix cache_entry use-after-free

2015-10-15 Thread David Turner
On Thu, 2015-10-15 at 05:35 +0200, René Scharfe wrote: > Am 15.10.2015 um 00:07 schrieb David Turner: > > From: Keith McGuigan > > > > During merges, we would previously free entries that we no longer need > > in the destination index. But those entries might also be stored in > > the dir_entry c

Re: [PATCH v3] merge: fix cache_entry use-after-free

2015-10-14 Thread René Scharfe
Am 15.10.2015 um 00:07 schrieb David Turner: From: Keith McGuigan During merges, we would previously free entries that we no longer need in the destination index. But those entries might also be stored in the dir_entry cache, and when a later call to add_to_index found them, they would be used

[PATCH v3] merge: fix cache_entry use-after-free

2015-10-14 Thread David Turner
From: Keith McGuigan During merges, we would previously free entries that we no longer need in the destination index. But those entries might also be stored in the dir_entry cache, and when a later call to add_to_index found them, they would be used after being freed. To prevent this, add a ref