tree-walk causes sigsegv

[WingT]

the following go code can cause error:

import (
	"fmt"
	cGit "gopkg.in/libgit2/git2go.v27"
	"log"
	"path"
	"regexp"
)

type Repo struct {
	cRepo *cGit.Repository
}

func (r *Repo) LsTree(revision string, pattern string) ([]string, error) {
	revSpec, err := r.cRepo.Revparse(revision)
	if err != nil {
		return nil, err
	}
	from := revSpec.From()
	if from == nil {
		return nil, fmt.Errorf("revspec error")
	}
	commit, err := from.AsCommit()
	if err != nil {
		return nil, fmt.Errorf("revspec is not a commit")
	}
	tree, err := commit.Tree()
	if err != nil {
		return nil, fmt.Errorf("get tree failed")
	}
	var result []string
	reg := regexp.MustCompile(pattern)
	err = tree.Walk(func(name string, entry *cGit.TreeEntry) int {
		if entry.Type != cGit.ObjectBlob {
			return 0
		}
		fName := path.Join(name, entry.Name)
		if reg.MatchString(fName) {
			result = append(result, fName)
		}
		return 0
	})
	return result, err
}

func main() {
	i := 1
	for {
		cRepo, err := cGit.OpenRepository("path/to/repo")
		if err != nil {
			log.Fatal(err)
		}
		r := Repo{cRepo: cRepo}
		result, err := r.LsTree("master", `.+\.thrift`)
		if err != nil {
			log.Fatal(err)
		}
		fmt.Println(i, len(result))
		cRepo = nil
		i ++
	}
}

after some output, the error stack is as follow:

fatal error: unexpected signal during runtime execution
[signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x7fb8f6e450e1]

runtime stack:
runtime.throw(0x592b6d, 0x2a)
        /usr/local/go/src/runtime/panic.go:617 +0x72
runtime.sigpanic()
        /usr/local/go/src/runtime/signal_unix.go:374 +0x4a9

goroutine 1 [syscall, locked to thread]:
runtime.cgocall(0x539b60, 0xc0000b3b20, 0x43a371)
        /usr/local/go/src/runtime/cgocall.go:128 +0x5b fp=0xc0000b3af0 sp=0xc0000b3ab8 pc=0x413eab
gopkg.in/libgit2/git2go%2ev27._Cfunc_git_tree_entry_name(0xaa736f566fdea668, 0x0)
        _cgo_gotypes.go:7312 +0x4a fp=0xc0000b3b20 sp=0xc0000b3af0 pc=0x50d96a
gopkg.in/libgit2/git2go%2ev27.newTreeEntry.func1(0xaa736f566fdea668, 0x15152c0)
        /root/go/pkg/mod/gopkg.in/libgit2/git2go.v27@v27.0.0-20190104134018-ecaeb7a21d47/tree.go:43 +0x56 fp=0xc0000b3b58 sp=0xc0000b3b20 pc=0x514196
gopkg.in/libgit2/git2go%2ev27.newTreeEntry(0xaa736f566fdea668, 0x15152c0)
        /root/go/pkg/mod/gopkg.in/libgit2/git2go.v27@v27.0.0-20190104134018-ecaeb7a21d47/tree.go:43 +0x2f fp=0xc0000b3ba8 sp=0xc0000b3b58 pc=0x512d4f
gopkg.in/libgit2/git2go%2ev27.CallbackGitTreeWalk(0x15a1560, 0xaa736f566fdea668, 0x15152c0, 0x595438)
        /root/go/pkg/mod/gopkg.in/libgit2/git2go.v27@v27.0.0-20190104134018-ecaeb7a21d47/tree.go:130 +0x89 fp=0xc0000b3bf0 sp=0xc0000b3ba8 pc=0x512ed9
gopkg.in/libgit2/git2go%2ev27._cgoexpwrap_b67d0ead0026_CallbackGitTreeWalk(0x15a1560, 0xaa736f566fdea668, 0x15152c0, 0x15f8cb0)
        _cgo_gotypes.go:7781 +0x3f fp=0xc0000b3c20 sp=0xc0000b3bf0 pc=0x50eeef
runtime.call32(0x0, 0x7fff825e0980, 0x7fff825e0a10, 0x20)
        /usr/local/go/src/runtime/asm_amd64.s:519 +0x3b fp=0xc0000b3c50 sp=0xc0000b3c20 pc=0x462d9b
runtime.cgocallbackg1(0x0)
        /usr/local/go/src/runtime/cgocall.go:314 +0x177 fp=0xc0000b3cc8 sp=0xc0000b3c50 pc=0x414217
runtime.cgocallbackg(0x0)
        /usr/local/go/src/runtime/cgocall.go:191 +0xc5 fp=0xc0000b3d30 sp=0xc0000b3cc8 pc=0x414005
runtime.cgocallback_gofunc(0x413ecf, 0x5399e0, 0xc0000b3dc0, 0xc0000b3db0)
        /usr/local/go/src/runtime/asm_amd64.s:773 +0x9b fp=0xc0000b3d50 sp=0xc0000b3d30 pc=0x46436b
runtime.asmcgocall(0x5399e0, 0xc0000b3dc0)
        /usr/local/go/src/runtime/asm_amd64.s:620 +0x42 fp=0xc0000b3d58 sp=0xc0000b3d50 pc=0x464202
runtime.cgocall(0x5399e0, 0xc0000b3dc0, 0xf9737137)
        /usr/local/go/src/runtime/cgocall.go:131 +0x7f fp=0xc0000b3d90 sp=0xc0000b3d58 pc=0x413ecf
gopkg.in/libgit2/git2go%2ev27._Cfunc__go_git_treewalk(0x16584f0, 0x0, 0x15152c0, 0x0)
        _cgo_gotypes.go:1892 +0x4d fp=0xc0000b3dc0 sp=0xc0000b3d90 pc=0x50d05d
gopkg.in/libgit2/git2go%2ev27.Tree.Walk.func1(0x16584f0, 0xc000094380, 0x16584f0, 0x15152c0, 0x41ca88)
        /root/go/pkg/mod/gopkg.in/libgit2/git2go.v27@v27.0.0-20190104134018-ecaeb7a21d47/tree.go:146 +0x97 fp=0xc0000b3df8 sp=0xc0000b3dc0 pc=0x5143b7
gopkg.in/libgit2/git2go%2ev27.Tree.Walk(0x16584f0, 0xc000094380, 0x16584f0, 0xc0000844e0, 0x0, 0x0)
        /root/go/pkg/mod/gopkg.in/libgit2/git2go.v27@v27.0.0-20190104134018-ecaeb7a21d47/tree.go:146 +0xd6 fp=0xc0000b3e50 sp=0xc0000b3df8 pc=0x513026
main.(*Repo).LsTree(0xc0000b3f40, 0x58b37e, 0x6, 0x58bd99, 0xa, 0x8, 0x0, 0x0, 0x0, 0x0)
        /go/src/git.byted.org/ee/madeira/idlmgr/data/test.go:34 +0x2d6 fp=0xc0000b3ee0 sp=0xc0000b3e50 pc=0x533cd6
main.main()
        /go/src/git.byted.org/ee/madeira/idlmgr/data/test.go:55 +0x1a4 fp=0xc0000b3f98 sp=0xc0000b3ee0 pc=0x533ff4
runtime.main()
        /usr/local/go/src/runtime/proc.go:200 +0x20c fp=0xc0000b3fe0 sp=0xc0000b3f98 pc=0x43c6bc
runtime.goexit()
        /usr/local/go/src/runtime/asm_amd64.s:1337 +0x1 fp=0xc0000b3fe8 sp=0xc0000b3fe0 pc=0x464ab1
exit status 2

it always fail on _Cfunc_git_tree_entry_name, however the round count can vary.
i'm using libgit2 v0.27.8 and git2go.v27

[WingT]

the test repository contains more than 4000 files, don't know whether it matters

[dbolkensteyn]

I am also encountering this same problem:

runtime stack:
runtime.throw(0xa605d7, 0x2a)
	/usr/local/go/src/runtime/panic.go:617 +0x72
runtime.sigpanic()
	/usr/local/go/src/runtime/signal_unix.go:374 +0x4a9

goroutine 86820 [syscall, locked to thread]:
runtime.cgocall(0x88aaa0, 0xc0000c74b8, 0x44e361)
	/usr/local/go/src/runtime/cgocall.go:128 +0x5b fp=0xc0000c7488 sp=0xc0000c7450 pc=0x425eeb
github.com/libgit2/git2go._Cfunc_git_tree_entry_name(0xfd, 0x0)
	_cgo_gotypes.go:7328 +0x4a fp=0xc0000c74b8 sp=0xc0000c7488 pc=0x83a74a
github.com/libgit2/git2go.newTreeEntry.func1(0xfd, 0x7fbffc005d20)

[dbolkensteyn]

I can systematically reproduce this with aws/aws-sdk-java@9a1a918

[dbolkensteyn]

The pointer _entry that CallbackGitTreeWalk gets already has a very unusual value for the one that causes the crash: 0x6176616a2e72674c, whereas all previous entries are around 0x7fd7d8009de0 and all start with 0x7fd7d8009....

I will try to see if this error can be reproduced with libgit2 only, excluding the Go wrapper.

[WingT]

thanks for your update😊

[dbolkensteyn]

The following C libgit2 client code walks the same repository also in pre-order but does not segfault. I guess this means that the issue is most likely within git2go itself.

// gcc -I/go/pkg/mod/github.com/libgit2/git2go\@v0.0.0-20190104134018-ecaeb7a21d47/vendor/libgit2/install/include -o test test.c /go/pkg/mod/github.com/libgit2/git2go\@v0.0.0-20190104134018-ecaeb7a21d47/vendor/libgit2/install/lib/libgit2.a -lrt -lpthread -lssl -lcrypto

#include <stdio.h>
#include <git2.h>

static int walk_cb(const char *root,
            const git_tree_entry *entry,
            void *payload)
{
  printf("root: %s at %p\n", root, entry);
  printf("  name: %s\n", git_tree_entry_name(entry));
  return 0;
}

static void check_error(int error) {
  if (error < 0) {
    const git_error *e = giterr_last();
    printf("Error %d/%d: %s\n", error, e->klass, e->message);
    exit(error);
  }
}

int main(int argc, char* argv[]) {
  git_libgit2_init();

  git_repository *repo = NULL;
  int error = git_repository_open_bare(&repo, "aws-sdk-java.git");
  check_error(error);

  git_object *obj = NULL;
  error = git_revparse_single(&obj, repo, "9a1a9189b6292545f98a74a3ce80a0ba2040f3bd^{tree}");
  check_error(error);
  git_tree *tree = (git_tree *)obj;

  error = git_tree_walk(tree, GIT_TREEWALK_PRE, walk_cb, NULL);
  check_error(error);

  git_object_free(obj);
  git_repository_free(repo);

  return 0;
}

[dbolkensteyn]

Here is the Go equivalent of the same C code:

package main

import (
	"fmt"
	"log"

	git "github.com/libgit2/git2go"
)

func main() {
	repo, err := git.OpenRepositoryExtended("aws-sdk-java.git", git.RepositoryOpenBare|git.RepositoryOpenNoSearch|git.RepositoryOpenNoDotGit, "")
	if err != nil {
		log.Fatal(err)
	}

	treeObj, err := repo.RevparseSingle("9a1a9189b6292545f98a74a3ce80a0ba2040f3bd^{tree}")
	if err != nil {
		log.Fatal(err)
	}
	tree, err := treeObj.AsTree()
	if err != nil {
		log.Fatal(err)
	}

	err = tree.Walk(func(p string, e *git.TreeEntry) int {
		fmt.Println(p, e.Name)
		return 0
	})
	if err != nil {
		log.Fatal(err)
	}

}

Depending on the invalid memory address, it crashes with either:

1. The segfault
2. or object hash mismatch - expected 0000000000000000000000000000000000000000 but got 5cc7508cd3b4b5419bdf80cdf231408d16309d09

[dbolkensteyn]

FYI, adding runtime.KeepAlive(tree) after the Walk() call seems to resolve the issue:

	err = tree.Walk(func(p string, e *git.TreeEntry) int {
		/* ... */
	})
	if err != nil {
		log.Fatal(err)
	}

	runtime.KeepAlive(tree)

I'll have a deeper look to better understand why and if successful open a PR for this issue.

[dbolkensteyn]

The fix is probably as easy as replacing:

func (t Tree) Walk(callback TreeWalkCallback) error { /* ... */ runtime.KeepAlive(t) }

with:

func (t *Tree) Walk(callback TreeWalkCallback) error { /* ... */ runtime.KeepAlive(t) }

Otherwise a copy of the Tree gets kept alive, but my outer one gets finalized and so the underlying C pointer (which both copies share) gets freed. I'll test this tomorrow before opening the PR.

[dbolkensteyn]

I am no longer able to reproduce this issue with the change contained in the pull requests.