Fix: double-free on error sending fields

[lttng-ust.git] / liblttng-ust-comm / lttng-ust-comm.c

diff --git a/liblttng-ust-comm/lttng-ust-comm.c b/liblttng-ust-comm/lttng-ust-comm.c
index a31786ac52000994feec90a754b5f9ba9701c16c..cee1b694333c8a264955c079692908ff6b49d792 100644 (file)
--- a/liblttng-ust-comm/lttng-ust-comm.c
+++ b/liblttng-ust-comm/lttng-ust-comm.c
@@ -265,7 +265,8 @@ ssize_t ustcomm_recv_unix_sock(int sock, void *buf, size_t len)
 {
        struct msghdr msg;
        struct iovec iov[1];
-       ssize_t ret;
+       ssize_t ret = -1;
+       size_t len_last;
 
        memset(&msg, 0, sizeof(msg));
 
@@ -275,8 +276,14 @@ ssize_t ustcomm_recv_unix_sock(int sock, void *buf, size_t len)
        msg.msg_iovlen = 1;
 
        do {
+               len_last = iov[0].iov_len;
                ret = recvmsg(sock, &msg, 0);
-       } while (ret < 0 && errno == EINTR);
+               if (ret > 0) {
+                       iov[0].iov_base += ret;
+                       iov[0].iov_len -= ret;
+                       assert(ret <= len_last);
+               }
+       } while ((ret > 0 && ret < len_last) || (ret < 0 && errno == EINTR));
 
        if (ret < 0) {
                int shutret;
@@ -290,7 +297,10 @@ ssize_t ustcomm_recv_unix_sock(int sock, void *buf, size_t len)
                shutret = shutdown(sock, SHUT_RDWR);
                if (shutret)
                        ERR("Socket shutdown error");
+       } else if (ret > 0) {
+               ret = len;
        }
+       /* ret = 0 means an orderly shutdown. */
 
        return ret;
 }
@@ -367,6 +377,8 @@ ssize_t ustcomm_send_fds_unix_sock(int sock, int *fds, size_t nb_fd)
        msg.msg_controllen = CMSG_LEN(sizeof_fds);
 
        cmptr = CMSG_FIRSTHDR(&msg);
+       if (!cmptr)
+               return -EINVAL;
        cmptr->cmsg_level = SOL_SOCKET;
        cmptr->cmsg_type = SCM_RIGHTS;
        cmptr->cmsg_len = CMSG_LEN(sizeof_fds);
@@ -380,7 +392,7 @@ ssize_t ustcomm_send_fds_unix_sock(int sock, int *fds, size_t nb_fd)
        msg.msg_iovlen = 1;
 
        do {
-               ret = sendmsg(sock, &msg, 0);
+               ret = sendmsg(sock, &msg, MSG_NOSIGNAL);
        } while (ret < 0 && errno == EINTR);
        if (ret < 0) {
                /*
@@ -505,19 +517,27 @@ int ustcomm_recv_app_reply(int sock, struct ustcomm_ust_reply *lur,
        case 0: /* orderly shutdown */
                return -EPIPE;
        case sizeof(*lur):
+       {
+               int err = 0;
+
                if (lur->handle != expected_handle) {
                        ERR("Unexpected result message handle: "
                                "expected: %u vs received: %u\n",
                                expected_handle, lur->handle);
-                       return -EINVAL;
+                       err = 1;
                }
                if (lur->cmd != expected_cmd) {
                        ERR("Unexpected result message command "
                                "expected: %u vs received: %u\n",
                                expected_cmd, lur->cmd);
+                       err = 1;
+               }
+               if (err) {
                        return -EINVAL;
+               } else {
+                       return lur->ret_code;
                }
-               return lur->ret_code;
+       }
        default:
                if (len >= 0) {
                        ERR("incorrect message size: %zd\n", len);
@@ -927,47 +947,49 @@ int ustcomm_register_event(int sock,
        msg.m.model_emf_uri_len = model_emf_uri_len;
        len = ustcomm_send_unix_sock(sock, &msg, sizeof(msg));
        if (len > 0 && len != sizeof(msg)) {
-               free(fields);
-               return -EIO;
+               ret = -EIO;
+               goto error_fields;
        }
        if (len < 0) {
-               free(fields);
-               return len;
+               ret = len;
+               goto error_fields;
        }
 
        /* send signature */
        len = ustcomm_send_unix_sock(sock, signature, signature_len);
        if (len > 0 && len != signature_len) {
-               free(fields);
-               return -EIO;
+               ret = -EIO;
+               goto error_fields;
        }
        if (len < 0) {
-               free(fields);
-               return len;
+               ret = len;
+               goto error_fields;
        }
 
        /* send fields */
        if (fields_len > 0) {
                len = ustcomm_send_unix_sock(sock, fields, fields_len);
-               free(fields);
                if (len > 0 && len != fields_len) {
-                       return -EIO;
+                       ret = -EIO;
+                       goto error_fields;
                }
                if (len < 0) {
-                       return len;
+                       ret = len;
+                       goto error_fields;
                }
-       } else {
-               free(fields);
        }
+       free(fields);
 
        if (model_emf_uri_len) {
                /* send model_emf_uri */
                len = ustcomm_send_unix_sock(sock, model_emf_uri,
                                model_emf_uri_len);
-               if (len > 0 && len != model_emf_uri_len)
+               if (len > 0 && len != model_emf_uri_len) {
                        return -EIO;
-               if (len < 0)
+               }
+               if (len < 0) {
                        return len;
+               }
        }
 
        /* receive reply */
@@ -1001,6 +1023,12 @@ int ustcomm_register_event(int sock,
                        return len;
                }
        }
+       /* Unreached. */
+
+       /* Error path only. */
+error_fields:
+       free(fields);
+       return ret;
 }
 
 /*