Fix: check reference counts for overflow

[lttng-modules.git] / lttng-abi.c

diff --git a/lttng-abi.c b/lttng-abi.c
index 8f63ad94c8fb053d9178aa91aa71d14d317f4e1b..54988b79d0821da9ef71d02f845c2345b1ea730f 100644 (file)
--- a/lttng-abi.c
+++ b/lttng-abi.c
@@ -50,6 +50,7 @@
 #include "wrapper/ringbuffer/frontend.h"
 #include "wrapper/poll.h"
 #include "wrapper/file.h"
+#include "wrapper/kref.h"
 #include "lttng-abi.h"
 #include "lttng-abi-old.h"
 #include "lttng-events.h"
@@ -69,6 +70,8 @@ static const struct file_operations lttng_metadata_fops;
 static const struct file_operations lttng_event_fops;
 static struct file_operations lttng_stream_ring_buffer_file_operations;
 
+static int put_u64(uint64_t val, unsigned long arg);
+
 /*
  * Teardown management: opened file descriptors keep a refcount on the module,
  * so it can only exit when all file descriptors are closed.
@@ -130,10 +133,6 @@ int lttng_abi_tracepoint_list(void)
        if (ret < 0)
                goto open_error;
        fd_install(file_fd, tracepoint_list_file);
-       if (file_fd < 0) {
-               ret = file_fd;
-               goto fd_error;
-       }
        return file_fd;
 
 open_error:
@@ -174,10 +173,6 @@ int lttng_abi_syscall_list(void)
        if (ret < 0)
                goto open_error;
        fd_install(file_fd, syscall_list_file);
-       if (file_fd < 0) {
-               ret = file_fd;
-               goto fd_error;
-       }
        return file_fd;
 
 open_error:
@@ -242,6 +237,14 @@ long lttng_abi_add_context(struct file *file,
                return lttng_add_hostname_to_ctx(ctx);
        case LTTNG_KERNEL_CONTEXT_CPU_ID:
                return lttng_add_cpu_id_to_ctx(ctx);
+       case LTTNG_KERNEL_CONTEXT_INTERRUPTIBLE:
+               return lttng_add_interruptible_to_ctx(ctx);
+       case LTTNG_KERNEL_CONTEXT_NEED_RESCHEDULE:
+               return lttng_add_need_reschedule_to_ctx(ctx);
+       case LTTNG_KERNEL_CONTEXT_PREEMPTIBLE:
+               return lttng_add_preemptible_to_ctx(ctx);
+       case LTTNG_KERNEL_CONTEXT_MIGRATABLE:
+               return lttng_add_migratable_to_ctx(ctx);
        default:
                return -EINVAL;
        }
@@ -425,6 +428,10 @@ int lttng_abi_create_channel(struct file *session_file,
                transport_name = "<unknown>";
                break;
        }
+       if (atomic_long_add_unless(&session_file->f_count,
+               1, INT_MAX) == INT_MAX) {
+               goto refcount_error;
+       }
        /*
         * We tolerate no failure path after channel creation. It will stay
         * invariant for the rest of the session.
@@ -442,11 +449,12 @@ int lttng_abi_create_channel(struct file *session_file,
        chan->file = chan_file;
        chan_file->private_data = chan;
        fd_install(chan_fd, chan_file);
-       atomic_long_inc(&session_file->f_count);
 
        return chan_fd;
 
 chan_error:
+       atomic_long_dec(&session_file->f_count);
+refcount_error:
        fput(chan_file);
 file_error:
        put_unused_fd(chan_fd);
@@ -559,6 +567,8 @@ long lttng_session_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                return lttng_session_untrack_pid(session, (int) arg);
        case LTTNG_KERNEL_SESSION_LIST_TRACKER_PIDS:
                return lttng_session_list_tracker_pids(session);
+       case LTTNG_KERNEL_SESSION_METADATA_REGEN:
+               return lttng_session_metadata_regenerate(session);
        default:
                return -ENOIOCTLCMD;
        }
@@ -686,6 +696,12 @@ long lttng_metadata_ring_buffer_ioctl(struct file *filp,
                        goto err;
                break;
        }
+       case RING_BUFFER_GET_METADATA_VERSION:
+       {
+               struct lttng_metadata_stream *stream = filp->private_data;
+
+               return put_u64(stream->version, arg);
+       }
        default:
                break;
        }
@@ -758,6 +774,12 @@ long lttng_metadata_ring_buffer_compat_ioctl(struct file *filp,
                                cmd, arg);
                break;
        }
+       case RING_BUFFER_GET_METADATA_VERSION:
+       {
+               struct lttng_metadata_stream *stream = filp->private_data;
+
+               return put_u64(stream->version, arg);
+       }
        default:
                break;
        }
@@ -935,17 +957,20 @@ int lttng_abi_open_metadata_stream(struct file *channel_file)
                goto notransport;
        }
 
+       if (!lttng_kref_get(&session->metadata_cache->refcount))
+               goto kref_error;
        ret = lttng_abi_create_stream_fd(channel_file, stream_priv,
                        &lttng_metadata_ring_buffer_file_operations);
        if (ret < 0)
                goto fd_error;
 
-       kref_get(&session->metadata_cache->refcount);
        list_add(&metadata_stream->list,
                &session->metadata_cache->metadata_stream);
        return ret;
 
 fd_error:
+       kref_put(&session->metadata_cache->refcount, metadata_cache_destroy);
+kref_error:
        module_put(metadata_stream->transport->owner);
 notransport:
        kfree(metadata_stream);
@@ -989,6 +1014,11 @@ int lttng_abi_create_event(struct file *channel_file,
                ret = PTR_ERR(event_file);
                goto file_error;
        }
+       /* The event holds a reference on the channel */
+       if (atomic_long_add_unless(&channel_file->f_count,
+               1, INT_MAX) == INT_MAX) {
+               goto refcount_error;
+       }
        if (event_param->instrumentation == LTTNG_KERNEL_TRACEPOINT
                        || event_param->instrumentation == LTTNG_KERNEL_SYSCALL) {
                struct lttng_enabler *enabler;
@@ -1020,11 +1050,11 @@ int lttng_abi_create_event(struct file *channel_file,
        }
        event_file->private_data = priv;
        fd_install(event_fd, event_file);
-       /* The event holds a reference on the channel */
-       atomic_long_inc(&channel_file->f_count);
        return event_fd;
 
 event_error:
+       atomic_long_dec(&channel_file->f_count);
+refcount_error:
        fput(event_file);
 file_error:
        put_unused_fd(event_fd);
@@ -1286,8 +1316,8 @@ int lttng_metadata_channel_release(struct inode *inode, struct file *file)
        struct lttng_channel *channel = file->private_data;
 
        if (channel) {
-               lttng_metadata_channel_destroy(channel);
                fput(channel->session->file);
+               lttng_metadata_channel_destroy(channel);
        }
 
        return 0;
@@ -1508,6 +1538,24 @@ static long lttng_stream_ring_buffer_ioctl(struct file *filp,
                        goto error;
                return put_u64(ts, arg);
        }
+       case LTTNG_RING_BUFFER_GET_SEQ_NUM:
+       {
+               uint64_t seq;
+
+               ret = ops->sequence_number(config, buf, &seq);
+               if (ret < 0)
+                       goto error;
+               return put_u64(seq, arg);
+       }
+       case LTTNG_RING_BUFFER_INSTANCE_ID:
+       {
+               uint64_t id;
+
+               ret = ops->instance_id(config, buf, &id);
+               if (ret < 0)
+                       goto error;
+               return put_u64(id, arg);
+       }
        default:
                return lib_ring_buffer_file_operations.unlocked_ioctl(filp,
                                cmd, arg);
@@ -1594,6 +1642,24 @@ static long lttng_stream_ring_buffer_compat_ioctl(struct file *filp,
                        goto error;
                return put_u64(ts, arg);
        }
+       case LTTNG_RING_BUFFER_COMPAT_GET_SEQ_NUM:
+       {
+               uint64_t seq;
+
+               ret = ops->sequence_number(config, buf, &seq);
+               if (ret < 0)
+                       goto error;
+               return put_u64(seq, arg);
+       }
+       case LTTNG_RING_BUFFER_COMPAT_INSTANCE_ID:
+       {
+               uint64_t id;
+
+               ret = ops->instance_id(config, buf, &id);
+               if (ret < 0)
+                       goto error;
+               return put_u64(id, arg);
+       }
        default:
                return lib_ring_buffer_file_operations.compat_ioctl(filp,
                                cmd, arg);
@@ -1632,6 +1698,7 @@ int __init lttng_abi_init(void)
        int ret = 0;
 
        wrapper_vmalloc_sync_all();
+       lttng_clock_ref();
        lttng_proc_dentry = proc_create_data("lttng", S_IRUSR | S_IWUSR, NULL,
                                        &lttng_fops, NULL);
        
@@ -1641,14 +1708,17 @@ int __init lttng_abi_init(void)
                goto error;
        }
        lttng_stream_override_ring_buffer_fops();
+       return 0;
 
 error:
+       lttng_clock_unref();
        return ret;
 }
 
 /* No __exit annotation because used by init error path too. */
 void lttng_abi_exit(void)
 {
+       lttng_clock_unref();
        if (lttng_proc_dentry)
                remove_proc_entry("lttng", NULL);
 }