git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH v4 04/16] index-helper: add --strict

From
David Turner <dturner@twopensource.com>
Date
Apr 13, 2016, 00:32 UTC
Message-ID
<1460507589-25525-5-git-send-email-dturner@twopensource.com>
In-Reply-To
<1460507589-25525-1-git-send-email-dturner@twopensource.com>
From: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>

There are "holes" in the index-helper approach because the shared memory is not verified again by git. If $USER is compromised, shared memory could be modified. But anyone who could do this could already modify $GIT_DIR/index. A more realistic risk is some bugs in index-helper that produce corrupt shared memory. --strict is added to avoid that.

Strictly speaking there's still a very small gap where corrupt shared memory could still be read by git: after we write the trailing SHA-1 in the shared memory (thus signaling "this shm is ready") and before verify_shm() detects an error.

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Signed-off-by: David Turner <dturner@twopensource.com>
---
 Documentation/git-index-helper.txt |  9 +++++++
 cache.h                            |  1 +
 index-helper.c                     | 48 ++++++++++++++++++++++++++++++++++++++
 read-cache.c                       |  9 ++++---
 4 files changed, 64 insertions(+), 3 deletions(-)
diff --git a/Documentation/git-index-helper.txt b/Documentation/git-index-helper.txt
index 90138ec..2382ba8 100644
--- a/Documentation/git-index-helper.txt
+++ b/Documentation/git-index-helper.txt
@@ -22,6 +22,15 @@ OPTIONS
 	Exit if the cached index is not accessed for `<n>`
 	seconds. Specify 0 to wait forever. Default is 600.
 
+--strict::
+--no-strict::
+	Strict mode makes index-helper verify the shared memory after
+	it's created. If the result does not match what's read from
+	$GIT_DIR/index, the shared memory is destroyed. This makes
+	index-helper take more than double the amount of time required
+	for reading an index, but because it will happen in the
+	background, it's not noticable. `--strict` is enabled by default.
+
 NOTES
 -----
 
diff --git a/cache.h b/cache.h
index 43fb314..4b678e9 100644
--- a/cache.h
+++ b/cache.h
@@ -336,6 +336,7 @@ struct index_state {
 		 keep_mmap : 1,
 		 from_shm : 1,
 		 to_shm : 1,
+		 always_verify_trailing_sha1 : 1,
 		 initialized : 1;
 	struct hashmap name_hash;
 	struct hashmap dir_hash;
diff --git a/index-helper.c b/index-helper.c
index b52e568..9a4278f 100644
--- a/index-helper.c
+++ b/index-helper.c
@@ -16,6 +16,7 @@ struct shm {
 
 static struct shm shm_index;
 static struct shm shm_base_index;
+static int to_verify = 1;
 
 static char *my_tmp_dir;
 
@@ -178,11 +179,56 @@ static void share_index(struct index_state *istate, struct shm *is)
 	hashcpy((unsigned char *)new_mmap + istate->mmap_size - 20, is->sha1);
 }
 
+static int verify_shm(void)
+{
+	int i;
+	struct index_state istate;
+	memset(&istate, 0, sizeof(istate));
+	istate.always_verify_trailing_sha1 = 1;
+	istate.to_shm = 1;
+	i = read_index(&istate);
+	if (i != the_index.cache_nr)
+		goto done;
+	for (; i < the_index.cache_nr; i++) {
+		struct cache_entry *base, *ce;
+		/* namelen is checked separately */
+		const unsigned int ondisk_flags =
+			CE_STAGEMASK | CE_VALID | CE_EXTENDED_FLAGS;
+		unsigned int ce_flags, base_flags, ret;
+		base = the_index.cache[i];
+		ce = istate.cache[i];
+		if (ce->ce_namelen != base->ce_namelen ||
+		    strcmp(ce->name, base->name)) {
+			warning("mismatch at entry %d", i);
+			break;
+		}
+		ce_flags = ce->ce_flags;
+		base_flags = base->ce_flags;
+		/* only on-disk flags matter */
+		ce->ce_flags   &= ondisk_flags;
+		base->ce_flags &= ondisk_flags;
+		ret = memcmp(&ce->ce_stat_data, &base->ce_stat_data,
+			     offsetof(struct cache_entry, name) -
+			     offsetof(struct cache_entry, ce_stat_data));
+		ce->ce_flags = ce_flags;
+		base->ce_flags = base_flags;
+		if (ret) {
+			warning("mismatch at entry %d", i);
+			break;
+		}
+	}
+done:
+	discard_index(&istate);
+	return i == the_index.cache_nr;
+}
+
 static void share_the_index(void)
 {
 	if (the_index.split_index && the_index.split_index->base)
 		share_index(the_index.split_index->base, &shm_base_index);
 	share_index(&the_index, &shm_index);
+	if (to_verify && !verify_shm())
+		cleanup_shm();
 	discard_index(&the_index);
 }
 
@@ -314,6 +360,8 @@ int main(int argc, char **argv)
 	struct option options[] = {
 		OPT_INTEGER(0, "exit-after", &idle_in_seconds,
 			    N_("exit if not used after some seconds")),
+		OPT_BOOL(0, "strict", &to_verify,
+			 "verify shared memory after creating"),
 		OPT_END()
 	};
 
diff --git a/read-cache.c b/read-cache.c
index 5b351c5..e7d2688 100644
--- a/read-cache.c
+++ b/read-cache.c
@@ -1721,9 +1721,12 @@ int do_read_index(struct index_state *istate, const char *path, int must_exist)
 
 	istate->mmap = mmap;
 	istate->mmap_size = mmap_size;
-	if (try_shm(istate) &&
-	    verify_hdr(istate->mmap, istate->mmap_size) < 0)
-		goto unmap;
+	if (try_shm(istate)) {
+		if (verify_hdr(istate->mmap, istate->mmap_size) < 0)
+			goto unmap;
+	} else if (istate->always_verify_trailing_sha1 &&
+		   verify_hdr(istate->mmap, istate->mmap_size) < 0)
+			goto unmap;
 	hdr = mmap = istate->mmap;
 	mmap_size = istate->mmap_size;
 	if (!istate->keep_mmap)

-- 
2.4.2.767.g62658d5-twtrsrc
Previous: David TurnerNext: David Turner
Message 20 of 39 in “index-helper, watchman”
  1. 00/16 index-helper, watchmanDavid Turner, Apr 13, 2016
  2. 01/16 read-cache.c: fix constness of verify_hdr()David Turner, Apr 13, 2016
  3. 02/16 read-cache: allow to keep mmap'd memory after readingDavid Turner, Apr 13, 2016
  4. 03/16 index-helper: new daemon for caching index and related stuffDavid Turner, Apr 13, 2016
  5. Duy NguyenApr 13, 2016
  6. David TurnerApr 13, 2016
  7. Duy NguyenApr 14, 2016
  8. David TurnerApr 15, 2016
  9. Duy NguyenApr 15, 2016
  10. David TurnerApr 15, 2016
  11. Duy NguyenApr 16, 2016
  12. Ramsay JonesApr 13, 2016
  13. David TurnerApr 13, 2016
  14. Junio C HamanoApr 14, 2016
  15. David TurnerApr 14, 2016
  16. Duy NguyenApr 15, 2016
  17. Stefan BellerApr 16, 2016
  18. David TurnerApr 19, 2016
  19. David TurnerApr 19, 2016
  20. 04/16 index-helper: add --strictDavid Turner, Apr 13, 2016
  21. 05/16 daemonize(): set a flag before exiting the main processDavid Turner, Apr 13, 2016
  22. 06/16 index-helper: add --detachDavid Turner, Apr 13, 2016
  23. 07/16 read-cache: add watchman 'WAMA' extensionDavid Turner, Apr 13, 2016
  24. 08/16 Add watchman support to reduce index refresh costDavid Turner, Apr 13, 2016
  25. Duy NguyenApr 17, 2016
  26. 09/16 index-helper: use watchman to avoid refreshing index with lstat()David Turner, Apr 13, 2016
  27. Stefan BellerApr 16, 2016
  28. David TurnerApr 19, 2016
  29. 10/16 update-index: enable/disable watchman supportDavid Turner, Apr 13, 2016
  30. 11/16 unpack-trees: preserve index extensionsDavid Turner, Apr 13, 2016
  31. 12/16 index-helper: kill modeDavid Turner, Apr 13, 2016
  32. Ævar Arnfjörð BjarmasonApr 16, 2016
  33. David TurnerApr 19, 2016
  34. 13/16 index-helper: don't run if already runningDavid Turner, Apr 13, 2016
  35. 14/16 index-helper: autorun modeDavid Turner, Apr 13, 2016
  36. 15/16 index-helper: optionally automatically runDavid Turner, Apr 13, 2016
  37. Duy NguyenApr 17, 2016
  38. David TurnerApr 19, 2016
  39. 16/16 read-cache: config for waiting for index-helperDavid Turner, Apr 13, 2016

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.