Fix: use after free on metadata cache reallocation

[lttng-modules.git] / lttng-events.c

diff --git a/lttng-events.c b/lttng-events.c
index 1fecff8efc279a76de3c8344f23236d485f7e5b8..9b3d766915fd4dcd78f564b1681497eccccf5b26 100644 (file)
--- a/lttng-events.c
+++ b/lttng-events.c
@@ -20,6 +20,12 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+/*
+ * This page_alloc.h wrapper needs to be included before gfpflags.h because it
+ * overrides a function with a define.
+ */
+#include "wrapper/page_alloc.h"
+
 #include <linux/module.h>
 #include <linux/list.h>
 #include <linux/mutex.h>
@@ -96,8 +102,11 @@ struct lttng_session *lttng_session_create(void)
                goto err_free_cache;
        metadata_cache->cache_alloc = METADATA_CACHE_DEFAULT_SIZE;
        kref_init(&metadata_cache->refcount);
+       mutex_init(&metadata_cache->lock);
        session->metadata_cache = metadata_cache;
        INIT_LIST_HEAD(&metadata_cache->metadata_stream);
+       memcpy(&metadata_cache->uuid, &session->uuid,
+               sizeof(metadata_cache->uuid));
        list_add(&session->list, &sessions);
        mutex_unlock(&sessions_mutex);
        return session;
@@ -377,8 +386,14 @@ struct lttng_event *lttng_event_create(struct lttng_channel *chan,
         */
        list_for_each_entry(event, &chan->session->events, list) {
                if (!strcmp(event->desc->name, event_param->name)) {
-                       ret = -EEXIST;
-                       goto exist;
+                       /*
+                        * Allow events with the same name to appear in
+                        * different channels.
+                        */
+                       if (event->chan == chan) {
+                               ret = -EEXIST;
+                               goto exist;
+                       }
                }
        }
        event = kmem_cache_zalloc(event_cache, GFP_KERNEL);
@@ -581,10 +596,12 @@ void _lttng_event_destroy(struct lttng_event *event)
 /*
  * Serialize at most one packet worth of metadata into a metadata
  * channel.
- * We have exclusive access to our metadata buffer (protected by the
- * sessions_mutex), so we can do racy operations such as looking for
- * remaining space left in packet and write, since mutual exclusion
- * protects us from concurrent writes.
+ * We grab the metadata cache mutex to get exclusive access to our metadata
+ * buffer and to the metadata cache. Exclusive access to the metadata buffer
+ * allows us to do racy operations such as looking for remaining space left in
+ * packet and write, since mutual exclusion protects us from concurrent writes.
+ * Mutual exclusion on the metadata cache allow us to read the cache content
+ * without racing against reallocation of the cache by updates.
  * Returns the number of bytes written in the channel, 0 if no data
  * was written and a negative value on error.
  */
@@ -596,13 +613,15 @@ int lttng_metadata_output_channel(struct lttng_metadata_stream *stream,
        size_t len, reserve_len;
 
        /*
-        * Ensure we support mutiple get_next / put sequences followed
-        * by put_next. The metadata stream lock internally protects
-        * reading the metadata cache. It can indeed be read
-        * concurrently by "get_next_subbuf" and "flush" operations on
-        * the buffer invoked by different processes.
+        * Ensure we support mutiple get_next / put sequences followed by
+        * put_next. The metadata cache lock protects reading the metadata
+        * cache. It can indeed be read concurrently by "get_next_subbuf" and
+        * "flush" operations on the buffer invoked by different processes.
+        * Moreover, since the metadata cache memory can be reallocated, we
+        * need to have exclusive access against updates even though we only
+        * read it.
         */
-       mutex_lock(&stream->lock);
+       mutex_lock(&stream->metadata_cache->lock);
        WARN_ON(stream->metadata_in < stream->metadata_out);
        if (stream->metadata_in != stream->metadata_out)
                goto end;
@@ -632,13 +651,15 @@ int lttng_metadata_output_channel(struct lttng_metadata_stream *stream,
        ret = reserve_len;
 
 end:
-       mutex_unlock(&stream->lock);
+       mutex_unlock(&stream->metadata_cache->lock);
        return ret;
 }
 
 /*
  * Write the metadata to the metadata cache.
  * Must be called with sessions_mutex held.
+ * The metadata cache lock protects us from concurrent read access from
+ * thread outputting metadata content to ring buffer.
  */
 int lttng_metadata_printf(struct lttng_session *session,
                          const char *fmt, ...)
@@ -657,6 +678,7 @@ int lttng_metadata_printf(struct lttng_session *session,
                return -ENOMEM;
 
        len = strlen(str);
+       mutex_lock(&session->metadata_cache->lock);
        if (session->metadata_cache->metadata_written + len >
                        session->metadata_cache->cache_alloc) {
                char *tmp_cache_realloc;
@@ -676,6 +698,7 @@ int lttng_metadata_printf(struct lttng_session *session,
                        session->metadata_cache->metadata_written,
                        str, len);
        session->metadata_cache->metadata_written += len;
+       mutex_unlock(&session->metadata_cache->lock);
        kfree(str);
 
        list_for_each_entry(stream, &session->metadata_cache->metadata_stream, list)
@@ -684,6 +707,7 @@ int lttng_metadata_printf(struct lttng_session *session,
        return 0;
 
 err:
+       mutex_unlock(&session->metadata_cache->lock);
        kfree(str);
        return -ENOMEM;
 }
@@ -1263,7 +1287,9 @@ static int __init lttng_events_init(void)
        ret = wrapper_lttng_fixup_sig(THIS_MODULE);
        if (ret)
                return ret;
-
+       ret = wrapper_get_pfnblock_flags_mask_init();
+       if (ret)
+               return ret;
        ret = lttng_tracepoint_init();
        if (ret)
                return ret;