thodg/got

diff --git a/got/got.c b/got/got.c
index 5d5cf04..bc14b93 100644
--- a/got/got.c
+++ b/got/got.c
@@ -261,7 +261,7 @@ check_ancestry(struct got_worktree *worktree, struct got_object_id *commit_id,
 	struct got_commit_graph *graph = NULL;
 
 	err = got_ref_open(&head_ref, repo,
-	    got_worktree_get_head_ref_name(worktree));
+	    got_worktree_get_head_ref_name(worktree), 0);
 	if (err)
 		return err;
 
@@ -407,7 +407,7 @@ cmd_checkout(int argc, char *argv[])
 	if (error)
 		goto done;
 
-	error = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+	error = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 	if (error != NULL)
 		goto done;
 
@@ -547,7 +547,7 @@ cmd_update(int argc, char *argv[])
 
 	if (commit_id_str == NULL) {
 		struct got_reference *head_ref;
-		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 		if (error != NULL)
 			goto done;
 		error = got_ref_resolve(&commit_id, repo, head_ref);
@@ -919,7 +919,7 @@ cmd_log(int argc, char *argv[])
 
 	if (start_commit == NULL) {
 		struct got_reference *head_ref;
-		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 		if (error != NULL)
 			return error;
 		error = got_ref_resolve(&id, repo, head_ref);
@@ -929,7 +929,7 @@ cmd_log(int argc, char *argv[])
 		error = got_object_open_as_commit(&commit, repo, id);
 	} else {
 		struct got_reference *ref;
-		error = got_ref_open(&ref, repo, start_commit);
+		error = got_ref_open(&ref, repo, start_commit, 0);
 		if (error == NULL) {
 			int obj_type;
 			error = got_ref_resolve(&id, repo, ref);
@@ -1360,7 +1360,7 @@ cmd_blame(int argc, char *argv[])
 
 	if (commit_id_str == NULL) {
 		struct got_reference *head_ref;
-		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 		if (error != NULL)
 			goto done;
 		error = got_ref_resolve(&commit_id, repo, head_ref);
@@ -1592,7 +1592,7 @@ cmd_tree(int argc, char *argv[])
 
 	if (commit_id_str == NULL) {
 		struct got_reference *head_ref;
-		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 		if (error != NULL)
 			goto done;
 		error = got_ref_resolve(&commit_id, repo, head_ref);
@@ -1744,7 +1744,7 @@ delete_ref(struct got_repository *repo, const char *refname)
 	const struct got_error *err = NULL;
 	struct got_reference *ref;
 
-	err = got_ref_open(&ref, repo, refname);
+	err = got_ref_open(&ref, repo, refname, 0);
 	if (err)
 		return err;
 
diff --git a/include/got_reference.h b/include/got_reference.h
index 5c3eed9..019df06 100644
--- a/include/got_reference.h
+++ b/include/got_reference.h
@@ -28,10 +28,13 @@ struct got_object_id;
 
 /*
  * Attempt to open the reference with the provided name in a repository.
- * The caller must dispose of it with got_ref_close().
+ * The caller must dispose of the reference with got_ref_close().
+ * Optionally, the underlying reference file can be locked before it is opened
+ * to prevent concurrent modification of the reference, in which case the file
+ * must be unlocked with got_ref_unlock() before got_ref_close() is called.
  */
 const struct got_error *got_ref_open(struct got_reference **,
-    struct got_repository *, const char *);
+    struct got_repository *, const char *, int);
 
 /*
  * Allocate a new reference for a given object ID.
@@ -96,3 +99,6 @@ const struct got_error *got_ref_write(struct got_reference *,
 /* Delete a reference from its on-disk path in the repository. */
 const struct got_error *got_ref_delete(struct got_reference *,
     struct got_repository *);
+
+/* Unlock a reference which was opened in locked state. */
+const struct got_error *got_ref_unlock(struct got_reference *);
diff --git a/lib/reference.c b/lib/reference.c
index d1b38a6..953af3c 100644
--- a/lib/reference.c
+++ b/lib/reference.c
@@ -80,6 +80,8 @@ struct got_reference {
 		struct got_ref ref;
 		struct got_symref symref;
 	} ref;
+
+	struct got_lockfile *lf;
 };
 
 static const struct got_error *
@@ -156,13 +158,20 @@ parse_ref_line(struct got_reference **ref, const char *name, const char *line)
 
 static const struct got_error *
 parse_ref_file(struct got_reference **ref, const char *name,
-    const char *abspath)
+    const char *abspath, int lock)
 {
 	const struct got_error *err = NULL;
 	FILE *f;
 	char *line;
 	size_t len;
 	const char delim[3] = {'\0', '\0', '\0'};
+	struct got_lockfile *lf = NULL;
+
+	if (lock) {
+		err = got_lockfile_lock(&lf, abspath);
+		if (err)
+			return (err);
+	}
 
 	f = fopen(abspath, "rb");
 	if (f == NULL)
@@ -175,10 +184,19 @@ parse_ref_file(struct got_reference **ref, const char *name,
 	}
 
 	err = parse_ref_line(ref, name, line);
+	if (err == NULL && lf)
+		(*ref)->lf = lf;
 done:
 	free(line);
-	if (fclose(f) != 0 && err == NULL)
+	if (fclose(f) != 0 && err == NULL) {
 		err = got_error_prefix_errno("fclose");
+		if (lf)
+			got_lockfile_unlock(lf);
+		if (*ref) {
+			got_ref_close(*ref);
+			*ref = NULL;
+		}
+	}
 	return err;
 }
 
@@ -334,7 +352,7 @@ open_packed_ref(struct got_reference **ref, FILE *f, const char **subdirs,
 
 static const struct got_error *
 open_ref(struct got_reference **ref, const char *path_refs, const char *subdir,
-    const char *name)
+    const char *name, int lock)
 {
 	const struct got_error *err = NULL;
 	char *path = NULL;
@@ -367,7 +385,7 @@ open_ref(struct got_reference **ref, const char *path_refs, const char *subdir,
 		goto done;
 	}
 
-	err = parse_ref_file(ref, absname, normpath);
+	err = parse_ref_file(ref, absname, normpath, lock);
 done:
 	if (!ref_is_absolute && !ref_is_well_known)
 		free(absname);
@@ -378,7 +396,7 @@ done:
 
 const struct got_error *
 got_ref_open(struct got_reference **ref, struct got_repository *repo,
-   const char *refname)
+   const char *refname, int lock)
 {
 	const struct got_error *err = NULL;
 	char *path_refs = NULL;
@@ -401,7 +419,8 @@ got_ref_open(struct got_reference **ref, struct got_repository *repo,
 
 		/* Search on-disk refs before packed refs! */
 		for (i = 0; i < nitems(subdirs); i++) {
-			err = open_ref(ref, path_refs, subdirs[i], refname);
+			err = open_ref(ref, path_refs, subdirs[i], refname,
+			    lock);
 			if (err || *ref)
 				goto done;
 		}
@@ -413,6 +432,11 @@ got_ref_open(struct got_reference **ref, struct got_repository *repo,
 			goto done;
 		}
 
+		if (lock) {
+			err = got_lockfile_lock(&(*ref)->lf, packed_refs_path);
+			if (err)
+				goto done;
+		}
 		f = fopen(packed_refs_path, "rb");
 		free(packed_refs_path);
 		if (f != NULL) {
@@ -425,7 +449,7 @@ got_ref_open(struct got_reference **ref, struct got_repository *repo,
 		}
 	}
 
-	err = open_ref(ref, path_refs, "", refname);
+	err = open_ref(ref, path_refs, "", refname, lock);
 	if (err)
 		goto done;
 done:
@@ -488,7 +512,7 @@ resolve_symbolic_ref(struct got_reference **resolved,
 	struct got_reference *nextref;
 	const struct got_error *err;
 
-	err = got_ref_open(&nextref, repo, ref->ref.symref.ref);
+	err = got_ref_open(&nextref, repo, ref->ref.symref.ref, 0);
 	if (err)
 		return err;
 
@@ -640,7 +664,8 @@ gather_on_disk_refs(struct got_reflist_head *refs, const char *path_refs,
 
 		switch (dent->d_type) {
 		case DT_REG:
-			err = open_ref(&ref, path_refs, subdir, dent->d_name);
+			err = open_ref(&ref, path_refs, subdir, dent->d_name,
+			    0);
 			if (err)
 				goto done;
 			if (ref) {
@@ -687,7 +712,7 @@ got_ref_list(struct got_reflist_head *refs, struct got_repository *repo)
 		err = got_error_prefix_errno("get_refs_dir_path");
 		goto done;
 	}
-	err = open_ref(&ref, path_refs, "", GOT_REF_HEAD);
+	err = open_ref(&ref, path_refs, "", GOT_REF_HEAD, 0);
 	if (err)
 		goto done;
 	err = insert_ref(&new, refs, ref, repo);
@@ -858,9 +883,11 @@ got_ref_write(struct got_reference *ref, struct got_repository *repo)
 		}
 	}
 
-	err = got_lockfile_lock(&lf, path);
-	if (err)
-		goto done;
+	if (ref->lf == NULL) {
+		err = got_lockfile_lock(&lf, path);
+		if (err)
+			goto done;
+	}
 
 	/* XXX: check if old content matches our expectations? */
 
@@ -884,7 +911,7 @@ got_ref_write(struct got_reference *ref, struct got_repository *repo)
 		goto done;
 	}
 done:
-	if (lf)
+	if (ref->lf == NULL && lf)
 		unlock_err = got_lockfile_unlock(lf);
 	if (f) {
 		if (fclose(f) != 0 && err == NULL)
@@ -924,9 +951,11 @@ delete_packed_ref(struct got_reference *delref, struct got_repository *repo)
 	if (err)
 		goto done;
 
-	err = got_lockfile_lock(&lf, packed_refs_path);
-	if (err)
-		goto done;
+	if (delref->lf == NULL) {
+		err = got_lockfile_lock(&lf, packed_refs_path);
+		if (err)
+			goto done;
+	}
 
 	f = fopen(packed_refs_path, "r");
 	if (f == NULL) {
@@ -1027,7 +1056,7 @@ delete_packed_ref(struct got_reference *delref, struct got_repository *repo)
 		}
 	}
 done:
-	if (lf)
+	if (delref->lf == NULL && lf)
 		unlock_err = got_lockfile_unlock(lf);
 	if (f) {
 		if (fclose(f) != 0 && err == NULL)
@@ -1066,19 +1095,30 @@ got_ref_delete(struct got_reference *ref, struct got_repository *repo)
 		goto done;
 	}
 
-	err = got_lockfile_lock(&lf, path);
-	if (err)
-		goto done;
+	if (ref->lf == NULL) {
+		err = got_lockfile_lock(&lf, path);
+		if (err)
+			goto done;
+	}
 
 	/* XXX: check if old content matches our expectations? */
 
 	if (unlink(path) != 0)
 		err = got_error_prefix_errno2("unlink", path);
 done:
-	if (lf)
+	if (ref->lf == NULL && lf)
 		unlock_err = got_lockfile_unlock(lf);
 
 	free(path_refs);
 	free(path);
 	return err ? err : unlock_err;
 }
+
+const struct got_error *
+got_ref_unlock(struct got_reference *ref)
+{
+	const struct got_error *err;
+	err = got_lockfile_unlock(ref->lf);
+	ref->lf = NULL;
+	return err;
+}
diff --git a/lib/repository.c b/lib/repository.c
index bb14921..ef82dcb 100644
--- a/lib/repository.c
+++ b/lib/repository.c
@@ -160,7 +160,7 @@ is_git_repo(struct got_repository *repo)
 		goto done;
 
 	/* Check if the HEAD reference can be opened. */
-	if (got_ref_open(&head_ref, repo, GOT_REF_HEAD) != NULL)
+	if (got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0) != NULL)
 		goto done;
 	got_ref_close(head_ref);
 
diff --git a/lib/worktree.c b/lib/worktree.c
index da771a2..ea806c3 100644
--- a/lib/worktree.c
+++ b/lib/worktree.c
@@ -2854,7 +2854,7 @@ got_worktree_commit(struct got_object_id **new_commit_id,
 	if (err)
 		goto done;
 
-	err = got_ref_open(&head_ref, repo, worktree->head_ref_name);
+	err = got_ref_open(&head_ref, repo, worktree->head_ref_name, 0);
 	if (err)
 		goto done;
 	err = got_ref_resolve(&head_commit_id, repo, head_ref);
@@ -2923,13 +2923,13 @@ got_worktree_commit(struct got_object_id **new_commit_id,
 		goto done;
 
 	/* Check if a concurrent commit to our branch has occurred. */
-	/* XXX ideally we'd lock the reference file here to avoid a race */
 	head_ref_name = got_worktree_get_head_ref_name(worktree);
 	if (head_ref_name == NULL) {
 		err = got_error_prefix_errno("got_worktree_get_head_ref_name");
 		goto done;
 	}
-	err = got_ref_open(&head_ref2, repo, head_ref_name);
+	/* Lock the reference here to prevent concurrent modification. */
+	err = got_ref_open(&head_ref2, repo, head_ref_name, 1);
 	if (err)
 		goto done;
 	err = got_ref_resolve(&head_commit_id2, repo, head_ref2);
@@ -2940,13 +2940,12 @@ got_worktree_commit(struct got_object_id **new_commit_id,
 		goto done;
 	}
 	/* Update branch head in repository. */
-	err = got_ref_change_ref(head_ref, *new_commit_id);
+	err = got_ref_change_ref(head_ref2, *new_commit_id);
 	if (err)
 		goto done;
-	err = got_ref_write(head_ref, repo);
+	err = got_ref_write(head_ref2, repo);
 	if (err)
 		goto done;
-	/* XXX race has ended here */
 
 	err = got_worktree_set_base_commit_id(worktree, repo, *new_commit_id);
 	if (err)
@@ -2978,7 +2977,11 @@ done:
 	free(head_commit_id2);
 	if (head_ref)
 		got_ref_close(head_ref);
-	if (head_ref2)
+	if (head_ref2) {
+		unlockerr = got_ref_unlock(head_ref2);
+		if (unlockerr && err == NULL)
+			err = unlockerr;
 		got_ref_close(head_ref2);
+	}
 	return err;
 }
diff --git a/regress/repository/repository_test.c b/regress/repository/repository_test.c
index 780e093..1c8251f 100644
--- a/regress/repository/repository_test.c
+++ b/regress/repository/repository_test.c
@@ -187,7 +187,7 @@ repo_read_log(const char *repo_path)
 	err = got_repo_open(&repo, repo_path);
 	if (err != NULL || repo == NULL)
 		return 0;
-	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 	if (err != NULL || head_ref == NULL)
 		return 0;
 	err = got_ref_resolve(&id, repo, head_ref);
diff --git a/regress/worktree/worktree_test.c b/regress/worktree/worktree_test.c
index df3b5be..3165949 100644
--- a/regress/worktree/worktree_test.c
+++ b/regress/worktree/worktree_test.c
@@ -99,7 +99,7 @@ remove_worktree_base_ref(struct got_worktree *worktree,
 		err = got_error_prefix_errno("asprintf");
 		goto done;
 	}
-	err = got_ref_open(&base_ref, repo, absrefname);
+	err = got_ref_open(&base_ref, repo, absrefname, 0);
 	if (err)
 		goto done;
 
@@ -194,7 +194,7 @@ worktree_init(const char *repo_path)
 	err = got_repo_open(&repo, repo_path);
 	if (err != NULL || repo == NULL)
 		goto done;
-	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 	if (err != NULL || head_ref == NULL)
 		goto done;
 
@@ -271,7 +271,7 @@ obstruct_meta_file_and_init(int *ok, struct got_repository *repo,
 	if (!obstruct_meta_file(&path, worktree_path, GOT_WORKTREE_FILE_INDEX))
 		return 0;
 
-	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 	if (err != NULL || head_ref == NULL)
 		return 0;
 
@@ -362,7 +362,7 @@ worktree_checkout(const char *repo_path)
 	err = got_repo_open(&repo, repo_path);
 	if (err != NULL || repo == NULL)
 		goto done;
-	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 	if (err != NULL || head_ref == NULL)
 		goto done;
 
diff --git a/tog/tog.c b/tog/tog.c
index c3da2f3..6513988 100644
--- a/tog/tog.c
+++ b/tog/tog.c
@@ -1123,7 +1123,7 @@ get_head_commit_id(struct got_object_id **head_id, struct got_repository *repo)
 
 	*head_id = NULL;
 
-	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+	err = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 	if (err)
 		return err;
 
@@ -3285,7 +3285,7 @@ cmd_blame(int argc, char *argv[])
 
 	if (commit_id_str == NULL) {
 		struct got_reference *head_ref;
-		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD);
+		error = got_ref_open(&head_ref, repo, GOT_REF_HEAD, 0);
 		if (error != NULL)
 			goto done;
 		error = got_ref_resolve(&commit_id, repo, head_ref);