Fix: use after free on metadata cache reallocation

[lttng-modules.git] / lttng-abi.c

diff --git a/lttng-abi.c b/lttng-abi.c
index 381a73904dfe60e6e6d0a8bc66a0cecf5fd65bf8..6993a46fb740039d22a647d1b13fef567b70dbc6 100644 (file)
--- a/lttng-abi.c
+++ b/lttng-abi.c
@@ -49,6 +49,7 @@
 #include "wrapper/ringbuffer/backend.h"
 #include "wrapper/ringbuffer/frontend.h"
 #include "wrapper/poll.h"
+#include "wrapper/file.h"
 #include "lttng-abi.h"
 #include "lttng-abi-old.h"
 #include "lttng-events.h"
@@ -83,7 +84,7 @@ int lttng_abi_create_session(void)
        session = lttng_session_create();
        if (!session)
                return -ENOMEM;
-       session_fd = get_unused_fd();
+       session_fd = lttng_get_unused_fd();
        if (session_fd < 0) {
                ret = session_fd;
                goto fd_error;
@@ -112,7 +113,7 @@ int lttng_abi_tracepoint_list(void)
        struct file *tracepoint_list_file;
        int file_fd, ret;
 
-       file_fd = get_unused_fd();
+       file_fd = lttng_get_unused_fd();
        if (file_fd < 0) {
                ret = file_fd;
                goto fd_error;
@@ -332,7 +333,7 @@ int lttng_abi_create_channel(struct file *session_file,
        int chan_fd;
        int ret = 0;
 
-       chan_fd = get_unused_fd();
+       chan_fd = lttng_get_unused_fd();
        if (chan_fd < 0) {
                ret = chan_fd;
                goto fd_error;
@@ -564,9 +565,11 @@ unsigned int lttng_metadata_ring_buffer_poll(struct file *filp,
                if (finalized)
                        mask |= POLLHUP;
 
+               mutex_lock(&stream->metadata_cache->lock);
                if (stream->metadata_cache->metadata_written >
                                stream->metadata_out)
                        mask |= POLLIN;
+               mutex_unlock(&stream->metadata_cache->lock);
        }
 
        return mask;
@@ -783,7 +786,7 @@ int lttng_abi_create_stream_fd(struct file *channel_file, void *stream_priv,
        int stream_fd, ret;
        struct file *stream_file;
 
-       stream_fd = get_unused_fd();
+       stream_fd = lttng_get_unused_fd();
        if (stream_fd < 0) {
                ret = stream_fd;
                goto fd_error;
@@ -864,7 +867,6 @@ int lttng_abi_open_metadata_stream(struct file *channel_file)
        metadata_stream->priv = buf;
        stream_priv = metadata_stream;
        metadata_stream->transport = channel->transport;
-       mutex_init(&metadata_stream->lock);
 
        /*
         * Since life-time of metadata cache differs from that of
@@ -920,7 +922,7 @@ int lttng_abi_create_event(struct file *channel_file,
        }
        switch (event_param->instrumentation) {
        default:
-               event_fd = get_unused_fd();
+               event_fd = lttng_get_unused_fd();
                if (event_fd < 0) {
                        ret = event_fd;
                        goto fd_error;