[GH-ISSUE #2136] A TOCTOU race in GetObjectWithGeneration (fs backend) #256

New issue

Open

opened 2026-03-03 12:09:27 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 12:09:27 +03:00

Owner

Originally created by @misha-drozd on GitHub (Feb 5, 2026).
Original GitHub issue: https://github.com/fsouza/fake-gcs-server/issues/2136

GetObjectWithGeneration may return the data from the wrong generation:

GetObjectWithGeneration takes a lock, retrieves object metadata, releases the lock.
Here another call might create new generation as no lock is held.
GetObjectWithGeneration checks the actual and expected generation
GetObjectWithGeneration opens the file (that was replaced on step 2) and returns it.

Originally found in https://github.com/fsouza/fake-gcs-server/pull/2117

Originally created by @misha-drozd on GitHub (Feb 5, 2026). Original GitHub issue: https://github.com/fsouza/fake-gcs-server/issues/2136 `GetObjectWithGeneration` may return the data from the wrong generation: 1. `GetObjectWithGeneration` takes a lock, retrieves object metadata, releases the lock. 2. Here another call might create new generation as no lock is held. 3. `GetObjectWithGeneration` checks the actual and expected generation 4. `GetObjectWithGeneration` opens the file (that was replaced on step 2) and returns it. Originally found in https://github.com/fsouza/fake-gcs-server/pull/2117