A repository whose path is not a valid git directory crashes cgit on
every page instead of producing the "config error" page that
prepare_repo_cmd() already has for exactly this case. The crash is a NULL
dereference of the_repository->hash_algo from the notes system, which
prepare_repo_env() invokes without checking whether the repository was
opened at all.
The call has been unguarded since 2013, but it only became fatal with git
v2.46, which stopped defaulting the hash algorithm outside a repository so
that unconverted callers would be found. This is one of them.
Reaching it does not take a hand-written cgitrc. With scan-path, cgit
caches the discovered repolist in an "rc-" file below cache-root, and that
cache is parsed before its age is even looked at, so a repository that has
been removed keeps handing out its repo.path until the cache is refreshed.
The refresh in turn serializes on a lockfile created with O_EXCL, which a
dying cgit leaves behind for good, and from then on the expired repolist is
never replaced. The two faults sustain each other: the crash tears down the
refresh child along with it, and the lockfile that child leaves guarantees
the next request reads the same removed path again.
On git.kernel.org this kept one deleted repository segfaulting cgit on
every request for three days, until the cache was cleared by hand. The
first patch stops the crash; the second lets the repolist cache recover on
its own, including from a lockfile left behind by an older cgit. The third
is an unrelated cosmetic fix to the cache filename, noticed while reading
the same function, and can be dropped without affecting the other two.
---
Konstantin Ryabitsev (3):
cgit: skip the notes system when the repository failed to open
cgit: do not let a stale lockfile pin the cached repolist
cgit: zero-pad the cached repolist filename
cgit.c | 54 ++++++++++++++++++++++------
tests/t0023-invalid-repo-path.sh | 51 ++++++++++++++++++++++++++
tests/t0024-repolist-cache.sh | 78 ++++++++++++++++++++++++++++++++++++++++
3 files changed, 173 insertions(+), 10 deletions(-)
---
base-commit: 044821677c774cd24f25f1818ea51d09cc64b006
change-id: 20260825-fix-invalid-repo-crash-7530f413c5bd
Best regards,
--
Konstantin Ryabitsev <[email protected]>
