diff: read working directory files instead of mapping them - #7397

/*
 * libgit2 crashes with SIGBUS when a working-tree file is truncated while
 * libgit2 is diffing it.
 *
 * diff_file_content_load_workdir_file() (src/libgit2/diff_file.c) mmaps the
 * working-tree file when no filter applies. If another process truncates the
 * file before libgit2 has finished with the mapping, the next access to a
 * page past the new end of file raises SIGBUS and kills the process.
 *
 * This program commits a 4 MiB file, then forks a child that keeps truncating
 * the file to 0 bytes and writing 4 MiB back, as an editor that rewrites in
 * place does. The parent computes index->workdir patches in a loop.
 *
 * Usage: ./repro <empty-directory>
 * Expected: an error from git_patch_from_diff now and then.
 * Actual:   the parent dies with SIGBUS, usually within a second.
 */
#include <git2.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#define FILE_SIZE (4 * 1024 * 1024)

static void check(int error, const char *what)
{
	if (error < 0) {
		const git_error *e = git_error_last();
		fprintf(stderr, "%s: %s\n", what, e ? e->message : "?");
		exit(1);
	}
}

/* 64-byte lines, all distinct, so xdiff has real work to do. */
static void fill(char *buf, char c)
{
	for (size_t line = 0; line < FILE_SIZE / 64; line++)
		snprintf(buf + line * 64, 65, "%c line %08zu %*s\n", c, line, 47, "");
}

static void write_all(int fd, const char *buf, size_t len)
{
	while (len > 0) {
		ssize_t n = write(fd, buf, len);
		if (n < 0) { perror("write"); exit(1); }
		buf += n; len -= (size_t)n;
	}
}

int main(int argc, char **argv)
{
	git_repository *repo;
	git_index *index;
	git_oid tree_id, commit_id;
	git_tree *tree;
	git_signature *sig;
	char path[4096];
	char *contents = malloc(FILE_SIZE);
	int fd;

	if (argc != 2) {
		fprintf(stderr, "usage: %s <empty-directory>\n", argv[0]);
		return 2;
	}

	git_libgit2_init();
	check(git_repository_init(&repo, argv[1], 0), "init");

	/* Commit big.txt, then make the working copy differ from it. */
	snprintf(path, sizeof(path), "%s/big.txt", argv[1]);
	fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0644);
	fill(contents, 'a');
	write_all(fd, contents, FILE_SIZE);
	close(fd);

	check(git_repository_index(&index, repo), "index");
	check(git_index_add_bypath(index, "big.txt"), "add");
	check(git_index_write(index), "index write");
	check(git_index_write_tree(&tree_id, index), "write tree");
	check(git_tree_lookup(&tree, repo, &tree_id), "tree lookup");
	check(git_signature_now(&sig, "t", "t@t"), "signature");
	check(git_commit_create_v(&commit_id, repo, "HEAD", sig, sig, NULL,
		"init", tree, 0), "commit");

	fill(contents, 'b');

	pid_t writer = fork();
	if (writer == 0) {
		/* Another process rewriting the file in place, as editors do. */
		pid_t parent = getppid();
		fd = open(path, O_WRONLY);
		while (getppid() == parent) {
			ftruncate(fd, 0);
			lseek(fd, 0, SEEK_SET);
			write_all(fd, contents, FILE_SIZE);
			/* Rest at full size so the reader gets as far as mmap. */
			usleep(rand() % 5000);
		}
		_exit(0);
	}

	time_t deadline = time(NULL) + 10;
	unsigned long patches = 0, errors = 0;
	while (time(NULL) < deadline) {
		git_diff *diff;
		/* Hashing the file here uses read(); truncation is a clean error. */
		if (git_diff_index_to_workdir(&diff, repo, index, NULL) < 0) {
			errors++;
			continue;
		}
		for (size_t i = 0; i < git_diff_num_deltas(diff); i++) {
			git_patch *patch;
			/* Loads big.txt with mmap, then runs xdiff over the mapping. */
			if (git_patch_from_diff(&patch, diff, i) < 0)
				errors++;
			else {
				patches++;
				git_patch_free(patch);
			}
		}
		git_diff_free(diff);
	}

	kill(writer, SIGKILL);
	waitpid(writer, NULL, 0);
	printf("survived: %lu patches, %lu clean errors\n", patches, errors);
	return 0;
}