Fix: use after free in channel release

[lttng-modules.git] / lttng-abi.c

diff --git a/lttng-abi.c b/lttng-abi.c
index beaad907d072ca5db410d8fc2a23e1feb0d17a25..3c7cd5b4fd9f0c936a6e4b59504e7bfb724cc3a2 100644 (file)
--- a/lttng-abi.c
+++ b/lttng-abi.c
@@ -144,6 +144,51 @@ fd_error:
        return ret;
 }
 
+#ifndef CONFIG_HAVE_SYSCALL_TRACEPOINTS
+static inline
+int lttng_abi_syscall_list(void)
+{
+       return -ENOSYS;
+}
+#else
+static
+int lttng_abi_syscall_list(void)
+{
+       struct file *syscall_list_file;
+       int file_fd, ret;
+
+       file_fd = lttng_get_unused_fd();
+       if (file_fd < 0) {
+               ret = file_fd;
+               goto fd_error;
+       }
+
+       syscall_list_file = anon_inode_getfile("[lttng_syscall_list]",
+                                         &lttng_syscall_list_fops,
+                                         NULL, O_RDWR);
+       if (IS_ERR(syscall_list_file)) {
+               ret = PTR_ERR(syscall_list_file);
+               goto file_error;
+       }
+       ret = lttng_syscall_list_fops.open(NULL, syscall_list_file);
+       if (ret < 0)
+               goto open_error;
+       fd_install(file_fd, syscall_list_file);
+       if (file_fd < 0) {
+               ret = file_fd;
+               goto fd_error;
+       }
+       return file_fd;
+
+open_error:
+       fput(syscall_list_file);
+file_error:
+       put_unused_fd(file_fd);
+fd_error:
+       return ret;
+}
+#endif
+
 static
 void lttng_abi_tracer_version(struct lttng_kernel_tracer_version *v)
 {
@@ -195,6 +240,8 @@ long lttng_abi_add_context(struct file *file,
                return lttng_add_procname_to_ctx(ctx);
        case LTTNG_KERNEL_CONTEXT_HOSTNAME:
                return lttng_add_hostname_to_ctx(ctx);
+       case LTTNG_KERNEL_CONTEXT_CPU_ID:
+               return lttng_add_cpu_id_to_ctx(ctx);
        default:
                return -EINVAL;
        }
@@ -575,9 +622,11 @@ unsigned int lttng_metadata_ring_buffer_poll(struct file *filp,
                if (finalized)
                        mask |= POLLHUP;
 
+               mutex_lock(&stream->metadata_cache->lock);
                if (stream->metadata_cache->metadata_written >
                                stream->metadata_out)
                        mask |= POLLIN;
+               mutex_unlock(&stream->metadata_cache->lock);
        }
 
        return mask;
@@ -875,7 +924,6 @@ int lttng_abi_open_metadata_stream(struct file *channel_file)
        metadata_stream->priv = buf;
        stream_priv = metadata_stream;
        metadata_stream->transport = channel->transport;
-       mutex_init(&metadata_stream->lock);
 
        /*
         * Since life-time of metadata cache differs from that of
@@ -1238,8 +1286,8 @@ int lttng_metadata_channel_release(struct inode *inode, struct file *file)
        struct lttng_channel *channel = file->private_data;
 
        if (channel) {
-               lttng_metadata_channel_destroy(channel);
                fput(channel->session->file);
+               lttng_metadata_channel_destroy(channel);
        }
 
        return 0;
@@ -1460,6 +1508,24 @@ static long lttng_stream_ring_buffer_ioctl(struct file *filp,
                        goto error;
                return put_u64(ts, arg);
        }
+       case LTTNG_RING_BUFFER_GET_SEQ_NUM:
+       {
+               uint64_t seq;
+
+               ret = ops->sequence_number(config, buf, &seq);
+               if (ret < 0)
+                       goto error;
+               return put_u64(seq, arg);
+       }
+       case LTTNG_RING_BUFFER_INSTANCE_ID:
+       {
+               uint64_t id;
+
+               ret = ops->instance_id(config, buf, &id);
+               if (ret < 0)
+                       goto error;
+               return put_u64(id, arg);
+       }
        default:
                return lib_ring_buffer_file_operations.unlocked_ioctl(filp,
                                cmd, arg);
@@ -1546,6 +1612,24 @@ static long lttng_stream_ring_buffer_compat_ioctl(struct file *filp,
                        goto error;
                return put_u64(ts, arg);
        }
+       case LTTNG_RING_BUFFER_COMPAT_GET_SEQ_NUM:
+       {
+               uint64_t seq;
+
+               ret = ops->sequence_number(config, buf, &seq);
+               if (ret < 0)
+                       goto error;
+               return put_u64(seq, arg);
+       }
+       case LTTNG_RING_BUFFER_COMPAT_INSTANCE_ID:
+       {
+               uint64_t id;
+
+               ret = ops->instance_id(config, buf, &id);
+               if (ret < 0)
+                       goto error;
+               return put_u64(id, arg);
+       }
        default:
                return lib_ring_buffer_file_operations.compat_ioctl(filp,
                                cmd, arg);