git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/2] hooks: fix a TOCTOU in "did we run a hook?" heuristic

From
Taylor Blau <me@ttaylorr.com>
Date
Feb 19, 2022, 04:08 UTC
Message-ID
<YhBtI6PY5s/nC8og@nand.local>
In-Reply-To
<patch-2.2-d01d088073b-20220218T203834Z-avarab@gmail.com>
On Fri, Feb 18, 2022 at 09:43:52PM +0100, Ævar Arnfjörð Bjarmason wrote:
Show 33 quoted lines
> diff --git a/builtin/commit.c b/builtin/commit.c
> index b9ed0374e30..bc5d34bc31f 100644
> --- a/builtin/commit.c
> +++ b/builtin/commit.c
> @@ -725,11 +725,13 @@ static int prepare_to_commit(const char *index_file, const char *prefix,
>  	int clean_message_contents = (cleanup_mode != COMMIT_MSG_CLEANUP_NONE);
>  	int old_display_comment_prefix;
>  	int merge_contains_scissors = 0;
> +	int invoked_hook;
>
>  	/* This checks and barfs if author is badly specified */
>  	determine_author_info(author_ident);
>
> -	if (!no_verify && run_commit_hook(use_editor, index_file, "pre-commit", NULL))
> +	if (!no_verify && run_commit_hook(use_editor, index_file, &invoked_hook,
> +					  "pre-commit", NULL))
>  		return 0;
>
>  	if (squash_message) {
> @@ -1052,10 +1054,10 @@ static int prepare_to_commit(const char *index_file, const char *prefix,
>  		return 0;
>  	}
>
> -	if (!no_verify && hook_exists("pre-commit")) {
> +	if (!no_verify && invoked_hook) {
>  		/*
> -		 * Re-read the index as pre-commit hook could have updated it,
> -		 * and write it out as a tree.  We must do this before we invoke
> +		 * Re-read the index as the pre-commit-commit hook was invoked
> +		 * and could have updated it. We must do this before we invoke
>  		 * the editor and after we invoke run_status above.
>  		 */
>  		discard_cache();

Sanity checking my own understating of this race: if we ran the pre-commit hook and it modified the index, but hook_exists() returns false later on (e.g., because the hook itself went away, the directory became unreadable, etc.), then we won't call discard_cache() when we should have?

If so, OK. This definitely seems like a pretty niche race, but independent of that I think the change here is an improvement in readability, and makes it clearer that calling discard_cache() depends on whether or not we *ran* the pre-commit hook, not whether we (still) *have* a pre-commit hook.

Thanks, Taylor

Previous: Ævar Arnfjörð BjarmasonNext: Ævar Arnfjörð Bjarmason
Message 7 of 12 in “hooks: fix a race in hook execution”
  1. 0/2 hooks: fix a race in hook executionÆvar Arnfjörð Bjarmason, Feb 18, 2022
  2. 1/2 merge: don't run post-hook logic on --no-verifyÆvar Arnfjörð Bjarmason, Feb 18, 2022
  3. Junio C HamanoFeb 18, 2022
  4. 2/2 hooks: fix a TOCTOU in "did we run a hook?" heuristicÆvar Arnfjörð Bjarmason, Feb 18, 2022
  5. Junio C HamanoFeb 19, 2022
  6. Ævar Arnfjörð BjarmasonFeb 19, 2022
  7. Taylor BlauFeb 19, 2022
  8. Ævar Arnfjörð BjarmasonFeb 19, 2022
  9. 0/2 hooks: fix a race in hook executionÆvar Arnfjörð Bjarmason, Mar 7, 2022
  10. 1/2 merge: don't run post-hook logic on --no-verifyÆvar Arnfjörð Bjarmason, Mar 7, 2022
  11. 2/2 hooks: fix an obscure TOCTOU "did we just run a hook?" raceÆvar Arnfjörð Bjarmason, Mar 7, 2022
  12. Jonathan TanMar 21, 2022

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.