Fix: sessiond: client: leak of trigger object on invalid client message
[lttng-tools.git] / src / bin / lttng-sessiond / client.c
index 8a2ef85b7345c33d89cd2914134bd075a71b4e9e..00b5ec7e4ab7bb4db6a67c0c32855d2e77236162 100644 (file)
@@ -31,6 +31,7 @@
 #include <signal.h>
 #include <stddef.h>
 #include <sys/stat.h>
+#include <unistd.h>
 
 #include "client.h"
 #include "lttng-sessiond.h"
@@ -42,6 +43,7 @@
 #include "utils.h"
 #include "manage-consumer.h"
 #include "clear.h"
+#include "agent-thread.h"
 
 static bool is_root;
 
@@ -693,6 +695,78 @@ error:
        return ret;
 }
 
+static enum lttng_error_code receive_lttng_trigger(struct command_ctx *cmd_ctx,
+               int sock,
+               int *sock_error,
+               struct lttng_trigger **_trigger)
+{
+       int ret;
+       size_t trigger_len;
+       ssize_t sock_recv_len;
+       enum lttng_error_code ret_code;
+       struct lttng_payload trigger_payload;
+       struct lttng_trigger *trigger = NULL;
+
+       lttng_payload_init(&trigger_payload);
+       trigger_len = (size_t) cmd_ctx->lsm.u.trigger.length;
+       ret = lttng_dynamic_buffer_set_size(
+                       &trigger_payload.buffer, trigger_len);
+       if (ret) {
+               ret_code = LTTNG_ERR_NOMEM;
+               goto end;
+       }
+
+       sock_recv_len = lttcomm_recv_unix_sock(
+                       sock, trigger_payload.buffer.data, trigger_len);
+       if (sock_recv_len < 0 || sock_recv_len != trigger_len) {
+               ERR("Failed to receive trigger in command payload");
+               *sock_error = 1;
+               ret_code = LTTNG_ERR_INVALID_PROTOCOL;
+               goto end;
+       }
+
+       /* Receive fds, if any. */
+       if (cmd_ctx->lsm.fd_count > 0) {
+               sock_recv_len = lttcomm_recv_payload_fds_unix_sock(
+                               sock, cmd_ctx->lsm.fd_count, &trigger_payload);
+               if (sock_recv_len > 0 &&
+                               sock_recv_len != cmd_ctx->lsm.fd_count * sizeof(int)) {
+                       ERR("Failed to receive all file descriptors for trigger in command payload: expected fd count = %u, ret = %d",
+                                       cmd_ctx->lsm.fd_count, (int) ret);
+                       ret_code = LTTNG_ERR_INVALID_PROTOCOL;
+                       *sock_error = 1;
+                       goto end;
+               } else if (sock_recv_len <= 0) {
+                       ERR("Failed to receive file descriptors for trigger in command payload: expected fd count = %u, ret = %d",
+                                       cmd_ctx->lsm.fd_count, (int) ret);
+                       ret_code = LTTNG_ERR_FATAL;
+                       *sock_error = 1;
+                       goto end;
+               }
+       }
+
+       /* Deserialize trigger. */
+       {
+               struct lttng_payload_view view =
+                               lttng_payload_view_from_payload(
+                                               &trigger_payload, 0, -1);
+
+               if (lttng_trigger_create_from_payload(&view, &trigger) !=
+                               trigger_len) {
+                       ERR("Invalid trigger received as part of command payload");
+                       ret_code = LTTNG_ERR_INVALID_TRIGGER;
+                       lttng_trigger_put(trigger);
+                       goto end;
+               }
+       }
+
+       *_trigger = trigger;
+       ret_code = LTTNG_OK;
+
+end:
+       return ret_code;
+}
+
 /*
  * Version of setup_lttng_msg() without command header.
  */
@@ -768,10 +842,13 @@ static int process_client_msg(struct command_ctx *cmd_ctx, int *sock,
                int *sock_error)
 {
        int ret = LTTNG_OK;
-       int need_tracing_session = 1;
-       int need_domain;
+       bool need_tracing_session = true;
+       bool need_domain;
+       bool need_consumerd;
 
-       DBG("Processing client command %d", cmd_ctx->lsm.cmd_type);
+       DBG("Processing client command '%s\' (%d)",
+               lttcomm_sessiond_command_str(cmd_ctx->lsm.cmd_type),
+               cmd_ctx->lsm.cmd_type);
 
        assert(!rcu_read_ongoing());
 
@@ -793,17 +870,27 @@ static int process_client_msg(struct command_ctx *cmd_ctx, int *sock,
        case LTTNG_SET_SESSION_SHM_PATH:
        case LTTNG_REGENERATE_METADATA:
        case LTTNG_REGENERATE_STATEDUMP:
-       case LTTNG_REGISTER_TRIGGER:
-       case LTTNG_UNREGISTER_TRIGGER:
        case LTTNG_ROTATE_SESSION:
        case LTTNG_ROTATION_GET_INFO:
        case LTTNG_ROTATION_SET_SCHEDULE:
        case LTTNG_SESSION_LIST_ROTATION_SCHEDULES:
        case LTTNG_CLEAR_SESSION:
-               need_domain = 0;
+       case LTTNG_LIST_TRIGGERS:
+               need_domain = false;
                break;
        default:
-               need_domain = 1;
+               need_domain = true;
+       }
+
+       /* Needs a functioning consumerd? */
+       switch (cmd_ctx->lsm.cmd_type) {
+       case LTTNG_REGISTER_TRIGGER:
+       case LTTNG_UNREGISTER_TRIGGER:
+               need_consumerd = false;
+               break;
+       default:
+               need_consumerd = true;
+               break;
        }
 
        if (config.no_kernel && need_domain
@@ -846,6 +933,8 @@ static int process_client_msg(struct command_ctx *cmd_ctx, int *sock,
        case LTTNG_DATA_PENDING:
        case LTTNG_ROTATE_SESSION:
        case LTTNG_ROTATION_GET_INFO:
+       case LTTNG_REGISTER_TRIGGER:
+       case LTTNG_LIST_TRIGGERS:
                break;
        default:
                /* Setup lttng message with no payload */
@@ -866,7 +955,8 @@ static int process_client_msg(struct command_ctx *cmd_ctx, int *sock,
        case LTTNG_SAVE_SESSION:
        case LTTNG_REGISTER_TRIGGER:
        case LTTNG_UNREGISTER_TRIGGER:
-               need_tracing_session = 0;
+       case LTTNG_LIST_TRIGGERS:
+               need_tracing_session = false;
                break;
        default:
                DBG("Getting session %s by name", cmd_ctx->lsm.session.name);
@@ -944,7 +1034,8 @@ static int process_client_msg(struct command_ctx *cmd_ctx, int *sock,
                }
 
                /* Consumer is in an ERROR state. Report back to client */
-               if (uatomic_read(&kernel_consumerd_state) == CONSUMER_ERROR) {
+               if (need_consumerd && uatomic_read(&kernel_consumerd_state) ==
+                                                     CONSUMER_ERROR) {
                        ret = LTTNG_ERR_NO_KERNCONSUMERD;
                        goto error;
                }
@@ -989,14 +1080,21 @@ static int process_client_msg(struct command_ctx *cmd_ctx, int *sock,
        case LTTNG_DOMAIN_JUL:
        case LTTNG_DOMAIN_LOG4J:
        case LTTNG_DOMAIN_PYTHON:
+               if (!agent_tracing_is_enabled()) {
+                       ret = LTTNG_ERR_AGENT_TRACING_DISABLED;
+                       goto error;
+               }
+               /* Fallthrough */
        case LTTNG_DOMAIN_UST:
        {
                if (!ust_app_supported()) {
                        ret = LTTNG_ERR_NO_UST;
                        goto error;
                }
+
                /* Consumer is in an ERROR state. Report back to client */
-               if (uatomic_read(&ust_consumerd_state) == CONSUMER_ERROR) {
+               if (need_consumerd && uatomic_read(&ust_consumerd_state) ==
+                                                     CONSUMER_ERROR) {
                        ret = LTTNG_ERR_NO_USTCONSUMERD;
                        goto error;
                }
@@ -1281,9 +1379,17 @@ error_add_context:
                                                .value_type;
                struct process_attr_value *value;
                enum lttng_error_code ret_code;
+               long login_name_max;
+
+               login_name_max = sysconf(_SC_LOGIN_NAME_MAX);
+               if (login_name_max < 0) {
+                       PERROR("Failed to get _SC_LOGIN_NAME_MAX system configuration");
+                       ret = LTTNG_ERR_INVALID;
+                       goto error;
+               }
 
                /* Receive remaining variable length payload if applicable. */
-               if (name_len > LOGIN_NAME_MAX) {
+               if (name_len > login_name_max) {
                        /*
                         * POSIX mandates user and group names that are at least
                         * 8 characters long. Note that although shadow-utils
@@ -1291,9 +1397,9 @@ error_add_context:
                         * limit (from bits/utmp.h, UT_NAMESIZE),
                         * LOGIN_NAME_MAX is defined to 256.
                         */
-                       ERR("Rejecting process attribute tracker value %s as the provided exceeds the maximal allowed length: argument length = %zu, maximal length = %d",
+                       ERR("Rejecting process attribute tracker value %s as the provided exceeds the maximal allowed length: argument length = %zu, maximal length = %ld",
                                        add_value ? "addition" : "removal",
-                                       name_len, LOGIN_NAME_MAX);
+                                       name_len, login_name_max);
                        ret = LTTNG_ERR_INVALID;
                        goto error;
                }
@@ -1325,6 +1431,11 @@ error_add_context:
 
                payload_view = lttng_buffer_view_from_dynamic_buffer(
                                &payload, 0, name_len);
+               if (name_len > 0 && !lttng_buffer_view_is_valid(&payload_view)) {
+                       ret = LTTNG_ERR_INVALID_PROTOCOL;
+                       goto error_add_remove_tracker_value;
+               }
+
                /*
                 * Validate the value type and domains are legal for the process
                 * attribute tracker that is specified and convert the value to
@@ -2024,14 +2135,70 @@ error_add_context:
        }
        case LTTNG_REGISTER_TRIGGER:
        {
-               ret = cmd_register_trigger(cmd_ctx, *sock,
-                               notification_thread_handle);
+               struct lttng_trigger *payload_trigger;
+               struct lttng_trigger *return_trigger;
+               size_t original_reply_payload_size;
+               size_t reply_payload_size;
+               const struct lttng_credentials cmd_creds = {
+                       .uid = LTTNG_OPTIONAL_INIT_VALUE(cmd_ctx->creds.uid),
+                       .gid = LTTNG_OPTIONAL_INIT_VALUE(cmd_ctx->creds.gid),
+               };
+
+               ret = setup_empty_lttng_msg(cmd_ctx);
+               if (ret) {
+                       ret = LTTNG_ERR_NOMEM;
+                       goto setup_error;
+               }
+
+               ret = receive_lttng_trigger(
+                               cmd_ctx, *sock, sock_error, &payload_trigger);
+               if (ret != LTTNG_OK) {
+                       goto error;
+               }
+
+               original_reply_payload_size = cmd_ctx->reply_payload.buffer.size;
+
+               ret = cmd_register_trigger(&cmd_creds, payload_trigger,
+                               notification_thread_handle, &return_trigger);
+               if (ret != LTTNG_OK) {
+                       lttng_trigger_put(payload_trigger);
+                       goto error;
+               }
+
+               ret = lttng_trigger_serialize(return_trigger, &cmd_ctx->reply_payload);
+               lttng_trigger_put(payload_trigger);
+               lttng_trigger_put(return_trigger);
+               if (ret) {
+                       ERR("Failed to serialize trigger in reply to \"register trigger\" command");
+                       ret = LTTNG_ERR_NOMEM;
+                       goto error;
+               }
+
+               reply_payload_size = cmd_ctx->reply_payload.buffer.size -
+                       original_reply_payload_size;
+
+               update_lttng_msg(cmd_ctx, 0, reply_payload_size);
+
+               ret = LTTNG_OK;
                break;
        }
        case LTTNG_UNREGISTER_TRIGGER:
        {
-               ret = cmd_unregister_trigger(cmd_ctx, *sock,
+               struct lttng_trigger *payload_trigger;
+               const struct lttng_credentials cmd_creds = {
+                       .uid = LTTNG_OPTIONAL_INIT_VALUE(cmd_ctx->creds.uid),
+                       .gid = LTTNG_OPTIONAL_INIT_VALUE(cmd_ctx->creds.gid),
+               };
+
+               ret = receive_lttng_trigger(
+                               cmd_ctx, *sock, sock_error, &payload_trigger);
+               if (ret != LTTNG_OK) {
+                       goto error;
+               }
+
+               ret = cmd_unregister_trigger(&cmd_creds, payload_trigger,
                                notification_thread_handle);
+               lttng_trigger_put(payload_trigger);
                break;
        }
        case LTTNG_ROTATE_SESSION:
@@ -2138,6 +2305,44 @@ error_add_context:
                ret = cmd_clear_session(cmd_ctx->session, sock);
                break;
        }
+       case LTTNG_LIST_TRIGGERS:
+       {
+               struct lttng_triggers *return_triggers = NULL;
+               size_t original_payload_size;
+               size_t payload_size;
+
+               ret = setup_empty_lttng_msg(cmd_ctx);
+               if (ret) {
+                       ret = LTTNG_ERR_NOMEM;
+                       goto setup_error;
+               }
+
+               original_payload_size = cmd_ctx->reply_payload.buffer.size;
+
+               ret = cmd_list_triggers(cmd_ctx,
+                               notification_thread_handle, &return_triggers);
+               if (ret != LTTNG_OK) {
+                       goto error;
+               }
+
+               assert(return_triggers);
+               ret = lttng_triggers_serialize(
+                               return_triggers, &cmd_ctx->reply_payload);
+               lttng_triggers_destroy(return_triggers);
+               if (ret) {
+                       ERR("Failed to serialize triggers in reply to `list triggers` command");
+                       ret = LTTNG_ERR_NOMEM;
+                       goto error;
+               }
+
+               payload_size = cmd_ctx->reply_payload.buffer.size -
+                       original_payload_size;
+
+               update_lttng_msg(cmd_ctx, 0, payload_size);
+
+               ret = LTTNG_OK;
+               break;
+       }
        default:
                ret = LTTNG_ERR_UND;
                break;
@@ -2412,6 +2617,11 @@ static void *thread_manage_clients(void *data)
                        continue;
                }
 
+               if (ret < LTTNG_OK || ret >= LTTNG_ERR_NR) {
+                       WARN("Command returned an invalid status code, returning unknown error: command type = %d, ret = %d", cmd_ctx.lsm.cmd_type, ret);
+                       ret = LTTNG_ERR_UNK;
+               }
+
                cmd_completion_handler = cmd_pop_completion_handler();
                if (cmd_completion_handler) {
                        enum lttng_error_code completion_code;
@@ -2433,8 +2643,7 @@ static void *thread_manage_clients(void *data)
                        struct lttcomm_lttng_msg *llm = (typeof(
                                        llm)) cmd_ctx.reply_payload.buffer.data;
 
-                       assert(cmd_ctx.reply_payload.buffer.size >=
-                              sizeof(llm));
+                       assert(cmd_ctx.reply_payload.buffer.size >= sizeof(*llm));
                        assert(cmd_ctx.lttng_msg_size == cmd_ctx.reply_payload.buffer.size);
 
                        llm->fd_count = lttng_payload_view_get_fd_handle_count(&view);
This page took 0.027977 seconds and 4 git commands to generate.