Fix: out of bound array access in filter code
[lttng-ust.git] / liblttng-ust / lttng-filter.c
CommitLineData
2d78951a
MD
1/*
2 * lttng-filter.c
3 *
4 * LTTng UST filter code.
5 *
7e50015d 6 * Copyright (C) 2010-2016 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
2d78951a 7 *
7e50015d
MD
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
2d78951a 14 *
7e50015d
MD
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
2d78951a 17 *
7e50015d
MD
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
24 * SOFTWARE.
2d78951a
MD
25 */
26
3fbec7dc 27#define _LGPL_SOURCE
f488575f 28#include <urcu/rculist.h>
97b58163 29#include "lttng-filter.h"
cd54f6d9
MD
30
31static const char *opnames[] = {
32 [ FILTER_OP_UNKNOWN ] = "UNKNOWN",
33
34 [ FILTER_OP_RETURN ] = "RETURN",
35
36 /* binary */
37 [ FILTER_OP_MUL ] = "MUL",
38 [ FILTER_OP_DIV ] = "DIV",
39 [ FILTER_OP_MOD ] = "MOD",
40 [ FILTER_OP_PLUS ] = "PLUS",
41 [ FILTER_OP_MINUS ] = "MINUS",
42 [ FILTER_OP_RSHIFT ] = "RSHIFT",
43 [ FILTER_OP_LSHIFT ] = "LSHIFT",
44 [ FILTER_OP_BIN_AND ] = "BIN_AND",
45 [ FILTER_OP_BIN_OR ] = "BIN_OR",
46 [ FILTER_OP_BIN_XOR ] = "BIN_XOR",
226106c0
MD
47
48 /* binary comparators */
cd54f6d9
MD
49 [ FILTER_OP_EQ ] = "EQ",
50 [ FILTER_OP_NE ] = "NE",
51 [ FILTER_OP_GT ] = "GT",
52 [ FILTER_OP_LT ] = "LT",
53 [ FILTER_OP_GE ] = "GE",
54 [ FILTER_OP_LE ] = "LE",
55
226106c0
MD
56 /* string binary comparators */
57 [ FILTER_OP_EQ_STRING ] = "EQ_STRING",
58 [ FILTER_OP_NE_STRING ] = "NE_STRING",
59 [ FILTER_OP_GT_STRING ] = "GT_STRING",
60 [ FILTER_OP_LT_STRING ] = "LT_STRING",
61 [ FILTER_OP_GE_STRING ] = "GE_STRING",
62 [ FILTER_OP_LE_STRING ] = "LE_STRING",
63
64 /* s64 binary comparators */
65 [ FILTER_OP_EQ_S64 ] = "EQ_S64",
66 [ FILTER_OP_NE_S64 ] = "NE_S64",
67 [ FILTER_OP_GT_S64 ] = "GT_S64",
68 [ FILTER_OP_LT_S64 ] = "LT_S64",
69 [ FILTER_OP_GE_S64 ] = "GE_S64",
70 [ FILTER_OP_LE_S64 ] = "LE_S64",
71
72 /* double binary comparators */
73 [ FILTER_OP_EQ_DOUBLE ] = "EQ_DOUBLE",
74 [ FILTER_OP_NE_DOUBLE ] = "NE_DOUBLE",
75 [ FILTER_OP_GT_DOUBLE ] = "GT_DOUBLE",
76 [ FILTER_OP_LT_DOUBLE ] = "LT_DOUBLE",
77 [ FILTER_OP_GE_DOUBLE ] = "GE_DOUBLE",
78 [ FILTER_OP_LE_DOUBLE ] = "LE_DOUBLE",
79
1e5f62b4
MD
80 /* Mixed S64-double binary comparators */
81 [ FILTER_OP_EQ_DOUBLE_S64 ] = "EQ_DOUBLE_S64",
82 [ FILTER_OP_NE_DOUBLE_S64 ] = "NE_DOUBLE_S64",
83 [ FILTER_OP_GT_DOUBLE_S64 ] = "GT_DOUBLE_S64",
84 [ FILTER_OP_LT_DOUBLE_S64 ] = "LT_DOUBLE_S64",
85 [ FILTER_OP_GE_DOUBLE_S64 ] = "GE_DOUBLE_S64",
86 [ FILTER_OP_LE_DOUBLE_S64 ] = "LE_DOUBLE_S64",
87
88 [ FILTER_OP_EQ_S64_DOUBLE ] = "EQ_S64_DOUBLE",
89 [ FILTER_OP_NE_S64_DOUBLE ] = "NE_S64_DOUBLE",
90 [ FILTER_OP_GT_S64_DOUBLE ] = "GT_S64_DOUBLE",
91 [ FILTER_OP_LT_S64_DOUBLE ] = "LT_S64_DOUBLE",
92 [ FILTER_OP_GE_S64_DOUBLE ] = "GE_S64_DOUBLE",
93 [ FILTER_OP_LE_S64_DOUBLE ] = "LE_S64_DOUBLE",
226106c0 94
cd54f6d9
MD
95 /* unary */
96 [ FILTER_OP_UNARY_PLUS ] = "UNARY_PLUS",
97 [ FILTER_OP_UNARY_MINUS ] = "UNARY_MINUS",
98 [ FILTER_OP_UNARY_NOT ] = "UNARY_NOT",
226106c0
MD
99 [ FILTER_OP_UNARY_PLUS_S64 ] = "UNARY_PLUS_S64",
100 [ FILTER_OP_UNARY_MINUS_S64 ] = "UNARY_MINUS_S64",
101 [ FILTER_OP_UNARY_NOT_S64 ] = "UNARY_NOT_S64",
102 [ FILTER_OP_UNARY_PLUS_DOUBLE ] = "UNARY_PLUS_DOUBLE",
103 [ FILTER_OP_UNARY_MINUS_DOUBLE ] = "UNARY_MINUS_DOUBLE",
104 [ FILTER_OP_UNARY_NOT_DOUBLE ] = "UNARY_NOT_DOUBLE",
cd54f6d9
MD
105
106 /* logical */
107 [ FILTER_OP_AND ] = "AND",
108 [ FILTER_OP_OR ] = "OR",
109
77aa5901 110 /* load field ref */
cd54f6d9 111 [ FILTER_OP_LOAD_FIELD_REF ] = "LOAD_FIELD_REF",
2f0145d1
MD
112 [ FILTER_OP_LOAD_FIELD_REF_STRING ] = "LOAD_FIELD_REF_STRING",
113 [ FILTER_OP_LOAD_FIELD_REF_SEQUENCE ] = "LOAD_FIELD_REF_SEQUENCE",
114 [ FILTER_OP_LOAD_FIELD_REF_S64 ] = "LOAD_FIELD_REF_S64",
115 [ FILTER_OP_LOAD_FIELD_REF_DOUBLE ] = "LOAD_FIELD_REF_DOUBLE",
116
77aa5901 117 /* load from immediate operand */
cd54f6d9
MD
118 [ FILTER_OP_LOAD_STRING ] = "LOAD_STRING",
119 [ FILTER_OP_LOAD_S64 ] = "LOAD_S64",
da6eed25 120 [ FILTER_OP_LOAD_DOUBLE ] = "LOAD_DOUBLE",
49905038
MD
121
122 /* cast */
123 [ FILTER_OP_CAST_TO_S64 ] = "CAST_TO_S64",
124 [ FILTER_OP_CAST_DOUBLE_TO_S64 ] = "CAST_DOUBLE_TO_S64",
125 [ FILTER_OP_CAST_NOP ] = "CAST_NOP",
77aa5901
MD
126
127 /* get context ref */
128 [ FILTER_OP_GET_CONTEXT_REF ] = "GET_CONTEXT_REF",
129 [ FILTER_OP_GET_CONTEXT_REF_STRING ] = "GET_CONTEXT_REF_STRING",
130 [ FILTER_OP_GET_CONTEXT_REF_S64 ] = "GET_CONTEXT_REF_S64",
131 [ FILTER_OP_GET_CONTEXT_REF_DOUBLE ] = "GET_CONTEXT_REF_DOUBLE",
f6753f2d
MD
132
133 /* load userspace field ref */
134 [ FILTER_OP_LOAD_FIELD_REF_USER_STRING ] = "LOAD_FIELD_REF_USER_STRING",
135 [ FILTER_OP_LOAD_FIELD_REF_USER_SEQUENCE ] = "LOAD_FIELD_REF_USER_SEQUENCE",
136
137 /*
138 * load immediate star globbing pattern (literal string)
139 * from immediate.
140 */
141 [ FILTER_OP_LOAD_STAR_GLOB_STRING ] = "LOAD_STAR_GLOB_STRING",
142
143 /* globbing pattern binary operator: apply to */
144 [ FILTER_OP_EQ_STAR_GLOB_STRING ] = "EQ_STAR_GLOB_STRING",
145 [ FILTER_OP_NE_STAR_GLOB_STRING ] = "NE_STAR_GLOB_STRING",
cd54f6d9
MD
146};
147
cd54f6d9
MD
148const char *print_op(enum filter_op op)
149{
150 if (op >= NR_FILTER_OPS)
151 return "UNKNOWN";
152 else
153 return opnames[op];
154}
155
cd54f6d9 156static
7dd08bec 157int apply_field_reloc(struct lttng_event *event,
cd54f6d9
MD
158 struct bytecode_runtime *runtime,
159 uint32_t runtime_len,
160 uint32_t reloc_offset,
161 const char *field_name)
162{
163 const struct lttng_event_desc *desc;
164 const struct lttng_event_field *fields, *field = NULL;
165 unsigned int nr_fields, i;
166 struct field_ref *field_ref;
2f0145d1 167 struct load_op *op;
cd54f6d9
MD
168 uint32_t field_offset = 0;
169
77aa5901 170 dbg_printf("Apply field reloc: %u %s\n", reloc_offset, field_name);
cd54f6d9
MD
171
172 /* Lookup event by name */
173 desc = event->desc;
174 if (!desc)
175 return -EINVAL;
176 fields = desc->fields;
177 if (!fields)
178 return -EINVAL;
179 nr_fields = desc->nr_fields;
180 for (i = 0; i < nr_fields; i++) {
181 if (!strcmp(fields[i].name, field_name)) {
182 field = &fields[i];
183 break;
184 }
185 /* compute field offset */
186 switch (fields[i].type.atype) {
187 case atype_integer:
188 case atype_enum:
189 field_offset += sizeof(int64_t);
190 break;
191 case atype_array:
192 case atype_sequence:
193 field_offset += sizeof(unsigned long);
194 field_offset += sizeof(void *);
195 break;
196 case atype_string:
197 field_offset += sizeof(void *);
198 break;
199 case atype_float:
200 field_offset += sizeof(double);
da6eed25 201 break;
cd54f6d9
MD
202 default:
203 return -EINVAL;
204 }
205 }
206 if (!field)
207 return -EINVAL;
208
209 /* Check if field offset is too large for 16-bit offset */
5b4839a8 210 if (field_offset > FILTER_BYTECODE_MAX_LEN - 1)
cd54f6d9
MD
211 return -EINVAL;
212
213 /* set type */
2f0145d1
MD
214 op = (struct load_op *) &runtime->data[reloc_offset];
215 field_ref = (struct field_ref *) op->data;
cd54f6d9
MD
216 switch (field->type.atype) {
217 case atype_integer:
218 case atype_enum:
2f0145d1 219 op->op = FILTER_OP_LOAD_FIELD_REF_S64;
cd54f6d9
MD
220 break;
221 case atype_array:
222 case atype_sequence:
2f0145d1 223 op->op = FILTER_OP_LOAD_FIELD_REF_SEQUENCE;
cd54f6d9
MD
224 break;
225 case atype_string:
2f0145d1 226 op->op = FILTER_OP_LOAD_FIELD_REF_STRING;
cd54f6d9
MD
227 break;
228 case atype_float:
2f0145d1 229 op->op = FILTER_OP_LOAD_FIELD_REF_DOUBLE;
da6eed25 230 break;
cd54f6d9
MD
231 default:
232 return -EINVAL;
233 }
234 /* set offset */
235 field_ref->offset = (uint16_t) field_offset;
2d78951a
MD
236 return 0;
237}
238
77aa5901
MD
239static
240int apply_context_reloc(struct lttng_event *event,
241 struct bytecode_runtime *runtime,
242 uint32_t runtime_len,
243 uint32_t reloc_offset,
244 const char *context_name)
245{
246 struct field_ref *field_ref;
247 struct load_op *op;
248 struct lttng_ctx_field *ctx_field;
249 int idx;
53569322 250 struct lttng_session *session = runtime->p.session;
77aa5901
MD
251
252 dbg_printf("Apply context reloc: %u %s\n", reloc_offset, context_name);
253
254 /* Get context index */
53569322
MD
255 idx = lttng_get_context_index(session->ctx, context_name);
256 if (idx < 0) {
257 if (lttng_context_is_app(context_name)) {
258 int ret;
259
260 ret = lttng_ust_add_app_context_to_ctx_rcu(context_name,
261 &session->ctx);
262 if (ret)
263 return ret;
264 idx = lttng_get_context_index(session->ctx,
265 context_name);
266 if (idx < 0)
267 return -ENOENT;
268 } else {
269 return -ENOENT;
270 }
271 }
77aa5901
MD
272 /* Check if idx is too large for 16-bit offset */
273 if (idx > FILTER_BYTECODE_MAX_LEN - 1)
274 return -EINVAL;
275
276 /* Get context return type */
53569322 277 ctx_field = &session->ctx->fields[idx];
77aa5901
MD
278 op = (struct load_op *) &runtime->data[reloc_offset];
279 field_ref = (struct field_ref *) op->data;
280 switch (ctx_field->event_field.type.atype) {
281 case atype_integer:
282 case atype_enum:
283 op->op = FILTER_OP_GET_CONTEXT_REF_S64;
284 break;
285 /* Sequence and array supported as string */
286 case atype_string:
287 case atype_array:
288 case atype_sequence:
289 op->op = FILTER_OP_GET_CONTEXT_REF_STRING;
290 break;
291 case atype_float:
292 op->op = FILTER_OP_GET_CONTEXT_REF_DOUBLE;
293 break;
53569322
MD
294 case atype_dynamic:
295 op->op = FILTER_OP_GET_CONTEXT_REF;
296 break;
77aa5901
MD
297 default:
298 return -EINVAL;
299 }
300 /* set offset to context index within channel contexts */
301 field_ref->offset = (uint16_t) idx;
302 return 0;
303}
304
305static
306int apply_reloc(struct lttng_event *event,
307 struct bytecode_runtime *runtime,
308 uint32_t runtime_len,
309 uint32_t reloc_offset,
310 const char *name)
311{
312 struct load_op *op;
313
314 dbg_printf("Apply reloc: %u %s\n", reloc_offset, name);
315
316 /* Ensure that the reloc is within the code */
317 if (runtime_len - reloc_offset < sizeof(uint16_t))
318 return -EINVAL;
319
320 op = (struct load_op *) &runtime->data[reloc_offset];
321 switch (op->op) {
322 case FILTER_OP_LOAD_FIELD_REF:
323 return apply_field_reloc(event, runtime, runtime_len,
324 reloc_offset, name);
325 case FILTER_OP_GET_CONTEXT_REF:
326 return apply_context_reloc(event, runtime, runtime_len,
327 reloc_offset, name);
328 default:
329 ERR("Unknown reloc op type %u\n", op->op);
330 return -EINVAL;
331 }
332 return 0;
333}
334
f488575f
MD
335static
336int bytecode_is_linked(struct lttng_ust_filter_bytecode_node *filter_bytecode,
7dd08bec 337 struct lttng_event *event)
f488575f
MD
338{
339 struct lttng_bytecode_runtime *bc_runtime;
340
e58095ef
MD
341 cds_list_for_each_entry(bc_runtime,
342 &event->bytecode_runtime_head, node) {
f488575f
MD
343 if (bc_runtime->bc == filter_bytecode)
344 return 1;
345 }
346 return 0;
347}
348
cd54f6d9
MD
349/*
350 * Take a bytecode with reloc table and link it to an event to create a
351 * bytecode runtime.
352 */
2d78951a 353static
7dd08bec 354int _lttng_filter_event_link_bytecode(struct lttng_event *event,
e58095ef
MD
355 struct lttng_ust_filter_bytecode_node *filter_bytecode,
356 struct cds_list_head *insert_loc)
2d78951a 357{
cd54f6d9
MD
358 int ret, offset, next_offset;
359 struct bytecode_runtime *runtime = NULL;
360 size_t runtime_alloc_len;
361
2d78951a
MD
362 if (!filter_bytecode)
363 return 0;
cd54f6d9 364 /* Bytecode already linked */
f488575f 365 if (bytecode_is_linked(filter_bytecode, event))
cd54f6d9 366 return 0;
2d78951a 367
f488575f 368 dbg_printf("Linking...\n");
cd54f6d9
MD
369
370 /* We don't need the reloc table in the runtime */
f488575f 371 runtime_alloc_len = sizeof(*runtime) + filter_bytecode->bc.reloc_offset;
cd54f6d9
MD
372 runtime = zmalloc(runtime_alloc_len);
373 if (!runtime) {
374 ret = -ENOMEM;
e0a7d7ab 375 goto alloc_error;
cd54f6d9 376 }
f488575f 377 runtime->p.bc = filter_bytecode;
53569322 378 runtime->p.session = event->chan->session;
f488575f 379 runtime->len = filter_bytecode->bc.reloc_offset;
cd54f6d9 380 /* copy original bytecode */
f488575f 381 memcpy(runtime->data, filter_bytecode->bc.data, runtime->len);
cd54f6d9
MD
382 /*
383 * apply relocs. Those are a uint16_t (offset in bytecode)
384 * followed by a string (field name).
385 */
f488575f
MD
386 for (offset = filter_bytecode->bc.reloc_offset;
387 offset < filter_bytecode->bc.len;
cd54f6d9
MD
388 offset = next_offset) {
389 uint16_t reloc_offset =
f488575f 390 *(uint16_t *) &filter_bytecode->bc.data[offset];
77aa5901 391 const char *name =
f488575f 392 (const char *) &filter_bytecode->bc.data[offset + sizeof(uint16_t)];
cd54f6d9 393
77aa5901 394 ret = apply_reloc(event, runtime, runtime->len, reloc_offset, name);
cd54f6d9
MD
395 if (ret) {
396 goto link_error;
397 }
77aa5901 398 next_offset = offset + sizeof(uint16_t) + strlen(name) + 1;
cd54f6d9 399 }
9522a886
MD
400 /* Validate bytecode */
401 ret = lttng_filter_validate_bytecode(runtime);
402 if (ret) {
403 goto link_error;
404 }
08c84b15
MD
405 /* Specialize bytecode */
406 ret = lttng_filter_specialize_bytecode(runtime);
407 if (ret) {
408 goto link_error;
409 }
f488575f 410 runtime->p.filter = lttng_filter_interpret_bytecode;
21af05a9 411 runtime->p.link_failed = 0;
e58095ef 412 cds_list_add_rcu(&runtime->p.node, insert_loc);
f488575f 413 dbg_printf("Linking successful.\n");
2d78951a 414 return 0;
cd54f6d9
MD
415
416link_error:
f488575f 417 runtime->p.filter = lttng_filter_false;
21af05a9 418 runtime->p.link_failed = 1;
e58095ef 419 cds_list_add_rcu(&runtime->p.node, insert_loc);
e0a7d7ab 420alloc_error:
f488575f 421 dbg_printf("Linking failed.\n");
cd54f6d9 422 return ret;
2d78951a
MD
423}
424
e58095ef 425void lttng_filter_sync_state(struct lttng_bytecode_runtime *runtime)
2d78951a 426{
e58095ef 427 struct lttng_ust_filter_bytecode_node *bc = runtime->bc;
f488575f 428
21af05a9 429 if (!bc->enabler->enabled || runtime->link_failed)
e58095ef 430 runtime->filter = lttng_filter_false;
21af05a9
MD
431 else
432 runtime->filter = lttng_filter_interpret_bytecode;
2d78951a
MD
433}
434
435/*
e58095ef 436 * Link bytecode for all enablers referenced by an event.
2d78951a 437 */
e58095ef
MD
438void lttng_enabler_event_link_bytecode(struct lttng_event *event,
439 struct lttng_enabler *enabler)
2d78951a 440{
e58095ef
MD
441 struct lttng_ust_filter_bytecode_node *bc;
442 struct lttng_bytecode_runtime *runtime;
443
444 /* Can only be called for events with desc attached */
445 assert(event->desc);
446
447 /* Link each bytecode. */
448 cds_list_for_each_entry(bc, &enabler->filter_bytecode_head, node) {
449 int found = 0, ret;
450 struct cds_list_head *insert_loc;
451
452 cds_list_for_each_entry(runtime,
453 &event->bytecode_runtime_head, node) {
454 if (runtime->bc == bc) {
455 found = 1;
456 break;
457 }
458 }
459 /* Skip bytecode already linked */
460 if (found)
461 continue;
462
463 /*
464 * Insert at specified priority (seqnum) in increasing
465 * order.
466 */
467 cds_list_for_each_entry_reverse(runtime,
468 &event->bytecode_runtime_head, node) {
469 if (runtime->bc->bc.seqnum < bc->bc.seqnum) {
470 /* insert here */
471 insert_loc = &runtime->node;
472 goto add_within;
473 }
474 }
475 /* Add to head to list */
476 insert_loc = &event->bytecode_runtime_head;
477 add_within:
f488575f 478 dbg_printf("linking bytecode\n");
e58095ef
MD
479 ret = _lttng_filter_event_link_bytecode(event, bc,
480 insert_loc);
481 if (ret) {
482 dbg_printf("[lttng filter] warning: cannot link event bytecode\n");
483 }
2d78951a 484 }
2d78951a
MD
485}
486
487/*
e58095ef 488 * We own the filter_bytecode if we return success.
2d78951a 489 */
e58095ef 490int lttng_filter_enabler_attach_bytecode(struct lttng_enabler *enabler,
f488575f 491 struct lttng_ust_filter_bytecode_node *filter_bytecode)
2d78951a 492{
e58095ef 493 cds_list_add(&filter_bytecode->node, &enabler->filter_bytecode_head);
2d78951a
MD
494 return 0;
495}
f488575f 496
e58095ef 497void lttng_free_enabler_filter_bytecode(struct lttng_enabler *enabler)
f488575f
MD
498{
499 struct lttng_ust_filter_bytecode_node *filter_bytecode, *tmp;
500
501 cds_list_for_each_entry_safe(filter_bytecode, tmp,
e58095ef 502 &enabler->filter_bytecode_head, node) {
f488575f
MD
503 free(filter_bytecode);
504 }
505}
506
7dd08bec 507void lttng_free_event_filter_runtime(struct lttng_event *event)
f488575f
MD
508{
509 struct bytecode_runtime *runtime, *tmp;
510
511 cds_list_for_each_entry_safe(runtime, tmp,
e58095ef 512 &event->bytecode_runtime_head, p.node) {
f488575f
MD
513 free(runtime);
514 }
515}
This page took 0.052537 seconds and 4 git commands to generate.