Fix: out of bound array access in filter code
[lttng-ust.git] / liblttng-ust / lttng-filter.c
index 11e7e376a03006bec8fb2af8b86f95f16d53874a..8114db6092b0b72365361733a394590ca3c46bed 100644 (file)
@@ -3,23 +3,28 @@
  *
  * LTTng UST filter code.
  *
- * Copyright (C) 2010-2012 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+ * Copyright (C) 2010-2016 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; only
- * version 2.1 of the License.
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
  *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
  *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
  */
 
+#define _LGPL_SOURCE
 #include <urcu/rculist.h>
 #include "lttng-filter.h"
 
@@ -102,13 +107,14 @@ static const char *opnames[] = {
        [ FILTER_OP_AND ] = "AND",
        [ FILTER_OP_OR ] = "OR",
 
-       /* load */
+       /* load field ref */
        [ FILTER_OP_LOAD_FIELD_REF ] = "LOAD_FIELD_REF",
        [ FILTER_OP_LOAD_FIELD_REF_STRING ] = "LOAD_FIELD_REF_STRING",
        [ FILTER_OP_LOAD_FIELD_REF_SEQUENCE ] = "LOAD_FIELD_REF_SEQUENCE",
        [ FILTER_OP_LOAD_FIELD_REF_S64 ] = "LOAD_FIELD_REF_S64",
        [ FILTER_OP_LOAD_FIELD_REF_DOUBLE ] = "LOAD_FIELD_REF_DOUBLE",
 
+       /* load from immediate operand */
        [ FILTER_OP_LOAD_STRING ] = "LOAD_STRING",
        [ FILTER_OP_LOAD_S64 ] = "LOAD_S64",
        [ FILTER_OP_LOAD_DOUBLE ] = "LOAD_DOUBLE",
@@ -117,6 +123,26 @@ static const char *opnames[] = {
        [ FILTER_OP_CAST_TO_S64 ] = "CAST_TO_S64",
        [ FILTER_OP_CAST_DOUBLE_TO_S64 ] = "CAST_DOUBLE_TO_S64",
        [ FILTER_OP_CAST_NOP ] = "CAST_NOP",
+
+       /* get context ref */
+       [ FILTER_OP_GET_CONTEXT_REF ] = "GET_CONTEXT_REF",
+       [ FILTER_OP_GET_CONTEXT_REF_STRING ] = "GET_CONTEXT_REF_STRING",
+       [ FILTER_OP_GET_CONTEXT_REF_S64 ] = "GET_CONTEXT_REF_S64",
+       [ FILTER_OP_GET_CONTEXT_REF_DOUBLE ] = "GET_CONTEXT_REF_DOUBLE",
+
+       /* load userspace field ref */
+       [ FILTER_OP_LOAD_FIELD_REF_USER_STRING ] = "LOAD_FIELD_REF_USER_STRING",
+       [ FILTER_OP_LOAD_FIELD_REF_USER_SEQUENCE ] = "LOAD_FIELD_REF_USER_SEQUENCE",
+
+       /*
+        * load immediate star globbing pattern (literal string)
+        * from immediate.
+        */
+       [ FILTER_OP_LOAD_STAR_GLOB_STRING ] = "LOAD_STAR_GLOB_STRING",
+
+       /* globbing pattern binary operator: apply to */
+       [ FILTER_OP_EQ_STAR_GLOB_STRING ] = "EQ_STAR_GLOB_STRING",
+       [ FILTER_OP_NE_STAR_GLOB_STRING ] = "NE_STAR_GLOB_STRING",
 };
 
 const char *print_op(enum filter_op op)
@@ -141,11 +167,7 @@ int apply_field_reloc(struct lttng_event *event,
        struct load_op *op;
        uint32_t field_offset = 0;
 
-       dbg_printf("Apply reloc: %u %s\n", reloc_offset, field_name);
-
-       /* Ensure that the reloc is within the code */
-       if (runtime_len - reloc_offset < sizeof(uint16_t))
-               return -EINVAL;
+       dbg_printf("Apply field reloc: %u %s\n", reloc_offset, field_name);
 
        /* Lookup event by name */
        desc = event->desc;
@@ -214,6 +236,102 @@ int apply_field_reloc(struct lttng_event *event,
        return 0;
 }
 
+static
+int apply_context_reloc(struct lttng_event *event,
+               struct bytecode_runtime *runtime,
+               uint32_t runtime_len,
+               uint32_t reloc_offset,
+               const char *context_name)
+{
+       struct field_ref *field_ref;
+       struct load_op *op;
+       struct lttng_ctx_field *ctx_field;
+       int idx;
+       struct lttng_session *session = runtime->p.session;
+
+       dbg_printf("Apply context reloc: %u %s\n", reloc_offset, context_name);
+
+       /* Get context index */
+       idx = lttng_get_context_index(session->ctx, context_name);
+       if (idx < 0) {
+               if (lttng_context_is_app(context_name)) {
+                       int ret;
+
+                       ret = lttng_ust_add_app_context_to_ctx_rcu(context_name,
+                                       &session->ctx);
+                       if (ret)
+                               return ret;
+                       idx = lttng_get_context_index(session->ctx,
+                               context_name);
+                       if (idx < 0)
+                               return -ENOENT;
+               } else {
+                       return -ENOENT;
+               }
+       }
+       /* Check if idx is too large for 16-bit offset */
+       if (idx > FILTER_BYTECODE_MAX_LEN - 1)
+               return -EINVAL;
+
+       /* Get context return type */
+       ctx_field = &session->ctx->fields[idx];
+       op = (struct load_op *) &runtime->data[reloc_offset];
+       field_ref = (struct field_ref *) op->data;
+       switch (ctx_field->event_field.type.atype) {
+       case atype_integer:
+       case atype_enum:
+               op->op = FILTER_OP_GET_CONTEXT_REF_S64;
+               break;
+               /* Sequence and array supported as string */
+       case atype_string:
+       case atype_array:
+       case atype_sequence:
+               op->op = FILTER_OP_GET_CONTEXT_REF_STRING;
+               break;
+       case atype_float:
+               op->op = FILTER_OP_GET_CONTEXT_REF_DOUBLE;
+               break;
+       case atype_dynamic:
+               op->op = FILTER_OP_GET_CONTEXT_REF;
+               break;
+       default:
+               return -EINVAL;
+       }
+       /* set offset to context index within channel contexts */
+       field_ref->offset = (uint16_t) idx;
+       return 0;
+}
+
+static
+int apply_reloc(struct lttng_event *event,
+               struct bytecode_runtime *runtime,
+               uint32_t runtime_len,
+               uint32_t reloc_offset,
+               const char *name)
+{
+       struct load_op *op;
+
+       dbg_printf("Apply reloc: %u %s\n", reloc_offset, name);
+
+       /* Ensure that the reloc is within the code */
+       if (runtime_len - reloc_offset < sizeof(uint16_t))
+               return -EINVAL;
+
+       op = (struct load_op *) &runtime->data[reloc_offset];
+       switch (op->op) {
+       case FILTER_OP_LOAD_FIELD_REF:
+               return apply_field_reloc(event, runtime, runtime_len,
+                       reloc_offset, name);
+       case FILTER_OP_GET_CONTEXT_REF:
+               return apply_context_reloc(event, runtime, runtime_len,
+                       reloc_offset, name);
+       default:
+               ERR("Unknown reloc op type %u\n", op->op);
+               return -EINVAL;
+       }
+       return 0;
+}
+
 static
 int bytecode_is_linked(struct lttng_ust_filter_bytecode_node *filter_bytecode,
                struct lttng_event *event)
@@ -257,6 +375,7 @@ int _lttng_filter_event_link_bytecode(struct lttng_event *event,
                goto alloc_error;
        }
        runtime->p.bc = filter_bytecode;
+       runtime->p.session = event->chan->session;
        runtime->len = filter_bytecode->bc.reloc_offset;
        /* copy original bytecode */
        memcpy(runtime->data, filter_bytecode->bc.data, runtime->len);
@@ -269,14 +388,14 @@ int _lttng_filter_event_link_bytecode(struct lttng_event *event,
                        offset = next_offset) {
                uint16_t reloc_offset =
                        *(uint16_t *) &filter_bytecode->bc.data[offset];
-               const char *field_name =
+               const char *name =
                        (const char *) &filter_bytecode->bc.data[offset + sizeof(uint16_t)];
 
-               ret = apply_field_reloc(event, runtime, runtime->len, reloc_offset, field_name);
+               ret = apply_reloc(event, runtime, runtime->len, reloc_offset, name);
                if (ret) {
                        goto link_error;
                }
-               next_offset = offset + sizeof(uint16_t) + strlen(field_name) + 1;
+               next_offset = offset + sizeof(uint16_t) + strlen(name) + 1;
        }
        /* Validate bytecode */
        ret = lttng_filter_validate_bytecode(runtime);
This page took 0.026514 seconds and 4 git commands to generate.