Filter: validate range overflow with end of insn
[lttng-ust.git] / liblttng-ust / lttng-filter.c
index 2b24f9d306253eddb6074a7b7d9a616959f56ecc..f9d512c955d571d63f5b8b6daa0b9488f214baac 100644 (file)
@@ -152,10 +152,6 @@ static const char *opnames[] = {
        /* logical */
        [ FILTER_OP_AND ] = "AND",
        [ FILTER_OP_OR ] = "OR",
-       [ FILTER_OP_AND_S64 ] = "AND_S64",
-       [ FILTER_OP_OR_S64 ] = "OR_S64",
-       [ FILTER_OP_AND_DOUBLE ] = "AND_DOUBLE",
-       [ FILTER_OP_OR_DOUBLE ] = "OR_DOUBLE",
 
        /* load */
        [ FILTER_OP_LOAD_FIELD_REF ] = "LOAD_FIELD_REF",
@@ -167,6 +163,11 @@ static const char *opnames[] = {
        [ FILTER_OP_LOAD_STRING ] = "LOAD_STRING",
        [ FILTER_OP_LOAD_S64 ] = "LOAD_S64",
        [ FILTER_OP_LOAD_DOUBLE ] = "LOAD_DOUBLE",
+
+       /* cast */
+       [ FILTER_OP_CAST_TO_S64 ] = "CAST_TO_S64",
+       [ FILTER_OP_CAST_DOUBLE_TO_S64 ] = "CAST_DOUBLE_TO_S64",
+       [ FILTER_OP_CAST_NOP ] = "CAST_NOP",
 };
 
 static
@@ -387,10 +388,6 @@ int lttng_filter_interpret_bytecode(void *filter_data,
                /* logical */
                [ FILTER_OP_AND ] = &&LABEL_FILTER_OP_AND,
                [ FILTER_OP_OR ] = &&LABEL_FILTER_OP_OR,
-               [ FILTER_OP_AND_S64 ] = &&LABEL_FILTER_OP_AND_S64,
-               [ FILTER_OP_OR_S64 ] = &&LABEL_FILTER_OP_OR_S64,
-               [ FILTER_OP_AND_DOUBLE ] = &&LABEL_FILTER_OP_AND_DOUBLE,
-               [ FILTER_OP_OR_DOUBLE ] = &&LABEL_FILTER_OP_OR_DOUBLE,
 
                /* load */
                [ FILTER_OP_LOAD_FIELD_REF ] = &&LABEL_FILTER_OP_LOAD_FIELD_REF,
@@ -402,6 +399,11 @@ int lttng_filter_interpret_bytecode(void *filter_data,
                [ FILTER_OP_LOAD_STRING ] = &&LABEL_FILTER_OP_LOAD_STRING,
                [ FILTER_OP_LOAD_S64 ] = &&LABEL_FILTER_OP_LOAD_S64,
                [ FILTER_OP_LOAD_DOUBLE ] = &&LABEL_FILTER_OP_LOAD_DOUBLE,
+
+               /* cast */
+               [ FILTER_OP_CAST_TO_S64 ] = &&LABEL_FILTER_OP_CAST_TO_S64,
+               [ FILTER_OP_CAST_DOUBLE_TO_S64 ] = &&LABEL_FILTER_OP_CAST_DOUBLE_TO_S64,
+               [ FILTER_OP_CAST_NOP ] = &&LABEL_FILTER_OP_CAST_NOP,
        };
 #endif /* #ifndef INTERPRETER_USE_SWITCH */
 
@@ -653,13 +655,6 @@ int lttng_filter_interpret_bytecode(void *filter_data,
 
                /* logical */
                OP(FILTER_OP_AND):
-               OP(FILTER_OP_OR):
-                       ERR("unsupported non-specialized bytecode op %u\n",
-                               (unsigned int) *(filter_opcode_t *) pc);
-                       ret = -EINVAL;
-                       goto end;
-
-               OP(FILTER_OP_AND_S64):
                {
                        struct logical_op *insn = (struct logical_op *) pc;
 
@@ -673,7 +668,7 @@ int lttng_filter_interpret_bytecode(void *filter_data,
                        }
                        PO;
                }
-               OP(FILTER_OP_OR_S64):
+               OP(FILTER_OP_OR):
                {
                        struct logical_op *insn = (struct logical_op *) pc;
 
@@ -690,37 +685,6 @@ int lttng_filter_interpret_bytecode(void *filter_data,
                        PO;
                }
 
-               OP(FILTER_OP_AND_DOUBLE):
-               {
-                       struct logical_op *insn = (struct logical_op *) pc;
-
-                       /* If REG_R0 is 0, skip and evaluate to 0 */
-                       if ((reg[REG_R0].type == REG_DOUBLE && unlikely(reg[REG_R0].d == 0.0))
-                                       || (reg[REG_R0].type == REG_S64 && unlikely(reg[REG_R0].v == 0))) {
-                               dbg_printf("Jumping to bytecode offset %u\n",
-                                       (unsigned int) insn->skip_offset);
-                               next_pc = start_pc + insn->skip_offset;
-                       } else {
-                               next_pc += sizeof(struct logical_op);
-                       }
-                       PO;
-               }
-               OP(FILTER_OP_OR_DOUBLE):
-               {
-                       struct logical_op *insn = (struct logical_op *) pc;
-
-                       /* If REG_R0 is nonzero, skip and evaluate to 1 (in double) */
-                       if ((reg[REG_R0].type == REG_DOUBLE && unlikely(reg[REG_R0].d != 0.0))
-                                       || (reg[REG_R0].type == REG_S64 && unlikely(reg[REG_R0].v != 0))) {
-                               reg[REG_R0].d = 1.0;
-                               dbg_printf("Jumping to bytecode offset %u\n",
-                                       (unsigned int) insn->skip_offset);
-                               next_pc = start_pc + insn->skip_offset;
-                       } else {
-                               next_pc += sizeof(struct logical_op);
-                       }
-                       PO;
-               }
 
                /* load */
                OP(FILTER_OP_LOAD_FIELD_REF_STRING):
@@ -732,6 +696,11 @@ int lttng_filter_interpret_bytecode(void *filter_data,
                                ref->offset);
                        reg[insn->reg].str =
                                *(const char * const *) &filter_stack_data[ref->offset];
+                       if (unlikely(!reg[insn->reg].str)) {
+                               dbg_printf("Filter warning: loading a NULL string.\n");
+                               ret = -EINVAL;
+                               goto end;
+                       }
                        reg[insn->reg].type = REG_STRING;
                        reg[insn->reg].seq_len = UINT_MAX;
                        reg[insn->reg].literal = 0;
@@ -752,6 +721,11 @@ int lttng_filter_interpret_bytecode(void *filter_data,
                        reg[insn->reg].str =
                                *(const char **) (&filter_stack_data[ref->offset
                                                                + sizeof(unsigned long)]);
+                       if (unlikely(!reg[insn->reg].str)) {
+                               dbg_printf("Filter warning: loading a NULL sequence.\n");
+                               ret = -EINVAL;
+                               goto end;
+                       }
                        reg[insn->reg].type = REG_STRING;
                        reg[insn->reg].literal = 0;
                        next_pc += sizeof(struct load_op) + sizeof(struct field_ref);
@@ -827,6 +801,29 @@ int lttng_filter_interpret_bytecode(void *filter_data,
                        PO;
                }
 
+               /* cast */
+               OP(FILTER_OP_CAST_TO_S64):
+                       ERR("unsupported non-specialized bytecode op %u\n",
+                               (unsigned int) *(filter_opcode_t *) pc);
+                       ret = -EINVAL;
+                       goto end;
+
+               OP(FILTER_OP_CAST_DOUBLE_TO_S64):
+               {
+                       struct cast_op *insn = (struct cast_op *) pc;
+
+                       reg[insn->reg].v = (int64_t) reg[insn->reg].d;
+                       reg[insn->reg].type = REG_S64;
+                       next_pc += sizeof(struct cast_op);
+                       PO;
+               }
+
+               OP(FILTER_OP_CAST_NOP):
+               {
+                       next_pc += sizeof(struct cast_op);
+                       PO;
+               }
+
        END_OP
 end:
        /* return 0 (discard) on error */
@@ -884,6 +881,186 @@ error_mismatch:
        return -EINVAL;
 }
 
+/*
+ * Validate bytecode range overflow within the validation pass.
+ * Called for each instruction encountered.
+ */
+static
+int bytecode_validate_overflow(struct bytecode_runtime *bytecode,
+                       void *start_pc, void *pc)
+{
+       int ret = 0;
+
+       switch (*(filter_opcode_t *) pc) {
+       case FILTER_OP_UNKNOWN:
+       default:
+       {
+               ERR("unknown bytecode op %u\n",
+                       (unsigned int) *(filter_opcode_t *) pc);
+               ret = -EINVAL;
+               break;
+       }
+
+       case FILTER_OP_RETURN:
+       {
+               if (unlikely(pc + sizeof(struct return_op)
+                               > start_pc + bytecode->len)) {
+                       ret = -EINVAL;
+               }
+               break;
+       }
+
+       /* binary */
+       case FILTER_OP_MUL:
+       case FILTER_OP_DIV:
+       case FILTER_OP_MOD:
+       case FILTER_OP_PLUS:
+       case FILTER_OP_MINUS:
+       case FILTER_OP_RSHIFT:
+       case FILTER_OP_LSHIFT:
+       case FILTER_OP_BIN_AND:
+       case FILTER_OP_BIN_OR:
+       case FILTER_OP_BIN_XOR:
+       {
+               ERR("unsupported bytecode op %u\n",
+                       (unsigned int) *(filter_opcode_t *) pc);
+               ret = -EINVAL;
+               break;
+       }
+
+       case FILTER_OP_EQ:
+       case FILTER_OP_NE:
+       case FILTER_OP_GT:
+       case FILTER_OP_LT:
+       case FILTER_OP_GE:
+       case FILTER_OP_LE:
+       case FILTER_OP_EQ_STRING:
+       case FILTER_OP_NE_STRING:
+       case FILTER_OP_GT_STRING:
+       case FILTER_OP_LT_STRING:
+       case FILTER_OP_GE_STRING:
+       case FILTER_OP_LE_STRING:
+       case FILTER_OP_EQ_S64:
+       case FILTER_OP_NE_S64:
+       case FILTER_OP_GT_S64:
+       case FILTER_OP_LT_S64:
+       case FILTER_OP_GE_S64:
+       case FILTER_OP_LE_S64:
+       case FILTER_OP_EQ_DOUBLE:
+       case FILTER_OP_NE_DOUBLE:
+       case FILTER_OP_GT_DOUBLE:
+       case FILTER_OP_LT_DOUBLE:
+       case FILTER_OP_GE_DOUBLE:
+       case FILTER_OP_LE_DOUBLE:
+       {
+               if (unlikely(pc + sizeof(struct binary_op)
+                               > start_pc + bytecode->len)) {
+                       ret = -EINVAL;
+               }
+               break;
+       }
+
+       /* unary */
+       case FILTER_OP_UNARY_PLUS:
+       case FILTER_OP_UNARY_MINUS:
+       case FILTER_OP_UNARY_NOT:
+       case FILTER_OP_UNARY_PLUS_S64:
+       case FILTER_OP_UNARY_MINUS_S64:
+       case FILTER_OP_UNARY_NOT_S64:
+       case FILTER_OP_UNARY_PLUS_DOUBLE:
+       case FILTER_OP_UNARY_MINUS_DOUBLE:
+       case FILTER_OP_UNARY_NOT_DOUBLE:
+       {
+               if (unlikely(pc + sizeof(struct unary_op)
+                               > start_pc + bytecode->len)) {
+                       ret = -EINVAL;
+               }
+               break;
+       }
+
+       /* logical */
+       case FILTER_OP_AND:
+       case FILTER_OP_OR:
+       {
+               if (unlikely(pc + sizeof(struct logical_op)
+                               > start_pc + bytecode->len)) {
+                       ret = -EINVAL;
+               }
+               break;
+       }
+
+       /* load */
+       case FILTER_OP_LOAD_FIELD_REF:
+       {
+               ERR("Unknown field ref type\n");
+               ret = -EINVAL;
+               break;
+       }
+       case FILTER_OP_LOAD_FIELD_REF_STRING:
+       case FILTER_OP_LOAD_FIELD_REF_SEQUENCE:
+       case FILTER_OP_LOAD_FIELD_REF_S64:
+       case FILTER_OP_LOAD_FIELD_REF_DOUBLE:
+       {
+               if (unlikely(pc + sizeof(struct load_op) + sizeof(struct field_ref)
+                               > start_pc + bytecode->len)) {
+                       ret = -EINVAL;
+               }
+               break;
+       }
+
+       case FILTER_OP_LOAD_STRING:
+       {
+               struct load_op *insn = (struct load_op *) pc;
+               uint32_t str_len, maxlen;
+
+               if (unlikely(pc + sizeof(struct load_op)
+                               > start_pc + bytecode->len)) {
+                       ret = -EINVAL;
+                       break;
+               }
+
+               maxlen = start_pc + bytecode->len - pc - sizeof(struct load_op);
+               str_len = strnlen(insn->data, maxlen);
+               if (unlikely(str_len >= maxlen)) {
+                       /* Final '\0' not found within range */
+                       ret = -EINVAL;
+               }
+               break;
+       }
+
+       case FILTER_OP_LOAD_S64:
+       {
+               if (unlikely(pc + sizeof(struct load_op) + sizeof(struct literal_numeric)
+                               > start_pc + bytecode->len)) {
+                       ret = -EINVAL;
+               }
+               break;
+       }
+
+       case FILTER_OP_LOAD_DOUBLE:
+       {
+               if (unlikely(pc + sizeof(struct load_op) + sizeof(struct literal_double)
+                               > start_pc + bytecode->len)) {
+                       ret = -EINVAL;
+               }
+               break;
+       }
+
+       case FILTER_OP_CAST_TO_S64:
+       case FILTER_OP_CAST_DOUBLE_TO_S64:
+       case FILTER_OP_CAST_NOP:
+       {
+               if (unlikely(pc + sizeof(struct cast_op)
+                               > start_pc + bytecode->len)) {
+                       ret = -EINVAL;
+               }
+               break;
+       }
+       }
+
+       return ret;
+}
+
 static
 int lttng_filter_validate_bytecode(struct bytecode_runtime *bytecode)
 {
@@ -900,7 +1077,7 @@ int lttng_filter_validate_bytecode(struct bytecode_runtime *bytecode)
        start_pc = &bytecode->data[0];
        for (pc = next_pc = start_pc; pc - start_pc < bytecode->len;
                        pc = next_pc) {
-               if (unlikely(pc >= start_pc + bytecode->len)) {
+               if (bytecode_validate_overflow(bytecode, start_pc, pc) != 0) {
                        ERR("filter bytecode overflow\n");
                        ret = -EINVAL;
                        goto end;
@@ -1127,18 +1304,11 @@ int lttng_filter_validate_bytecode(struct bytecode_runtime *bytecode)
                /* logical */
                case FILTER_OP_AND:
                case FILTER_OP_OR:
-               case FILTER_OP_AND_S64:
-               case FILTER_OP_OR_S64:
-               case FILTER_OP_AND_DOUBLE:
-               case FILTER_OP_OR_DOUBLE:
                {
                        struct logical_op *insn = (struct logical_op *) pc;
 
-                       if (unlikely(reg[REG_R0].type == REG_TYPE_UNKNOWN
-                                       || reg[REG_R1].type == REG_TYPE_UNKNOWN
-                                       || reg[REG_R0].type == REG_STRING
-                                       || reg[REG_R1].type == REG_STRING)) {
-                               ERR("Logical comparator can only be applied to numeric and floating point registers\n");
+                       if (reg[REG_R0].type != REG_S64) {
+                               ERR("Logical comparator expects S64 register\n");
                                ret = -EINVAL;
                                goto end;
                        }
@@ -1150,41 +1320,6 @@ int lttng_filter_validate_bytecode(struct bytecode_runtime *bytecode)
                                ret = -EINVAL;
                                goto end;
                        }
-                       if (insn->op == FILTER_OP_AND_S64
-                                       || insn->op == FILTER_OP_OR_S64) {
-                               if (reg[REG_R0].type != REG_S64
-                                               || reg[REG_R1].type != REG_S64) {
-                                       ret = -EINVAL;
-                                       goto end;
-                               }
-                       }
-                       if (insn->op == FILTER_OP_AND_DOUBLE
-                                       || insn->op == FILTER_OP_OR_DOUBLE) {
-                               if (reg[REG_R0].type != REG_DOUBLE
-                                               && reg[REG_R1].type != REG_DOUBLE) {
-                                       ERR("Double operator should have at least one double register\n");
-                                       ret = -EINVAL;
-                                       goto end;
-                               }
-                       }
-                       switch(reg[REG_R0].type) {
-                       default:
-                       case REG_STRING:
-                               ERR("unknown register type\n");
-                               ret = -EINVAL;
-                               goto end;
-
-                       case REG_S64:
-                               if (reg[REG_R1].type == REG_S64) {
-                                       reg[REG_R0].type = REG_S64;
-                               } else {
-                                       reg[REG_R0].type = REG_DOUBLE;
-                               }
-                               break;
-                       case REG_DOUBLE:
-                               reg[REG_R0].type = REG_DOUBLE;
-                               break;
-                       }
                        next_pc += sizeof(struct logical_op);
                        break;
                }
@@ -1301,6 +1436,50 @@ int lttng_filter_validate_bytecode(struct bytecode_runtime *bytecode)
                                        + sizeof(struct literal_double);
                        break;
                }
+
+               case FILTER_OP_CAST_TO_S64:
+               case FILTER_OP_CAST_DOUBLE_TO_S64:
+               {
+                       struct cast_op *insn = (struct cast_op *) pc;
+
+                       if (unlikely(insn->reg >= REG_ERROR)) {
+                               ERR("invalid register %u\n",
+                                       (unsigned int) insn->reg);
+                               ret = -EINVAL;
+                               goto end;
+                       }
+                       switch (reg[insn->reg].type) {
+                       default:
+                               ERR("unknown register type\n");
+                               ret = -EINVAL;
+                               goto end;
+
+                       case REG_STRING:
+                               ERR("Cast op can only be applied to numeric or floating point registers\n");
+                               ret = -EINVAL;
+                               goto end;
+                       case REG_S64:
+                               break;
+                       case REG_DOUBLE:
+                               break;
+                       }
+                       if (insn->op == FILTER_OP_CAST_DOUBLE_TO_S64) {
+                               if (reg[insn->reg].type != REG_DOUBLE) {
+                                       ERR("Cast expects double\n");
+                                       ret = -EINVAL;
+                                       goto end;
+                               }
+                       }
+                       reg[insn->reg].type = REG_S64;
+                       next_pc += sizeof(struct cast_op);
+                       break;
+               }
+               case FILTER_OP_CAST_NOP:
+               {
+                       next_pc += sizeof(struct cast_op);
+                       break;
+               }
+
                }
        }
 end:
@@ -1619,66 +1798,7 @@ int lttng_filter_specialize_bytecode(struct bytecode_runtime *bytecode)
 
                /* logical */
                case FILTER_OP_AND:
-               {
-                       struct logical_op *insn = (struct logical_op *) pc;
-
-                       switch(reg[REG_R0].type) {
-                       default:
-                       case REG_STRING:
-                               ERR("unknown register type\n");
-                               ret = -EINVAL;
-                               goto end;
-
-                       case REG_S64:
-                               if (reg[REG_R1].type == REG_S64) {
-                                       insn->op = FILTER_OP_AND_S64;
-                                       reg[REG_R0].type = REG_S64;
-                               } else {
-                                       insn->op = FILTER_OP_AND_DOUBLE;
-                                       reg[REG_R0].type = REG_DOUBLE;
-                               }
-                               break;
-                       case REG_DOUBLE:
-                               insn->op = FILTER_OP_AND_DOUBLE;
-                               reg[REG_R0].type = REG_DOUBLE;
-                               break;
-                       }
-                       next_pc += sizeof(struct logical_op);
-                       break;
-               }
                case FILTER_OP_OR:
-               {
-                       struct logical_op *insn = (struct logical_op *) pc;
-
-                       switch(reg[REG_R0].type) {
-                       default:
-                       case REG_STRING:
-                               ERR("unknown register type\n");
-                               ret = -EINVAL;
-                               goto end;
-
-                       case REG_S64:
-                               if (reg[REG_R1].type == REG_S64) {
-                                       insn->op = FILTER_OP_OR_S64;
-                                       reg[REG_R0].type = REG_S64;
-                               } else {
-                                       insn->op = FILTER_OP_OR_DOUBLE;
-                                       reg[REG_R0].type = REG_DOUBLE;
-                               }
-                               break;
-                       case REG_DOUBLE:
-                               insn->op = FILTER_OP_OR_DOUBLE;
-                               reg[REG_R0].type = REG_DOUBLE;
-                               break;
-                       }
-                       next_pc += sizeof(struct logical_op);
-                       break;
-               }
-
-               case FILTER_OP_AND_S64:
-               case FILTER_OP_OR_S64:
-               case FILTER_OP_AND_DOUBLE:
-               case FILTER_OP_OR_DOUBLE:
                {
                        next_pc += sizeof(struct logical_op);
                        break;
@@ -1751,14 +1871,54 @@ int lttng_filter_specialize_bytecode(struct bytecode_runtime *bytecode)
                                        + sizeof(struct literal_double);
                        break;
                }
+
+               /* cast */
+               case FILTER_OP_CAST_TO_S64:
+               {
+                       struct cast_op *insn = (struct cast_op *) pc;
+
+                       switch (reg[insn->reg].type) {
+                       default:
+                               ERR("unknown register type\n");
+                               ret = -EINVAL;
+                               goto end;
+
+                       case REG_STRING:
+                               ERR("Cast op can only be applied to numeric or floating point registers\n");
+                               ret = -EINVAL;
+                               goto end;
+                       case REG_S64:
+                               insn->op = FILTER_OP_CAST_NOP;
+                               break;
+                       case REG_DOUBLE:
+                               insn->op = FILTER_OP_CAST_DOUBLE_TO_S64;
+                               break;
+                       }
+                       reg[insn->reg].type = REG_S64;
+                       next_pc += sizeof(struct cast_op);
+                       break;
+               }
+               case FILTER_OP_CAST_DOUBLE_TO_S64:
+               {
+                       struct cast_op *insn = (struct cast_op *) pc;
+
+                       reg[insn->reg].type = REG_S64;
+                       next_pc += sizeof(struct cast_op);
+                       break;
+               }
+               case FILTER_OP_CAST_NOP:
+               {
+                       next_pc += sizeof(struct cast_op);
+                       break;
+               }
+
+
                }
        }
 end:
        return ret;
 }
 
-
-
 static
 int apply_field_reloc(struct ltt_event *event,
                struct bytecode_runtime *runtime,
This page took 0.030387 seconds and 4 git commands to generate.