Fix: illegal memory access in add_uri_to_consumer
[lttng-tools.git] / src / bin / lttng-sessiond / cmd.c
index 9af6d9d4acce64b9b9855e46ed462a624573c693..1327e42e4ddfa8efdd5a550179000a8f77f34150 100644 (file)
@@ -187,7 +187,14 @@ static int get_ust_runtime_stats(struct ltt_session *session,
        int ret;
        struct ltt_ust_session *usess;
 
+       if (!discarded_events || !lost_packets) {
+               ret = -1;
+               goto end;
+       }
+
        usess = session->ust_session;
+       assert(discarded_events);
+       assert(lost_packets);
 
        if (!usess || !session->has_been_started) {
                *discarded_events = 0;
@@ -216,6 +223,7 @@ static int get_ust_runtime_stats(struct ltt_session *session,
                *lost_packets += uchan->per_pid_closed_app_lost;
        } else {
                ERR("Unsupported buffer type");
+               assert(0);
                ret = -1;
                goto end;
        }
@@ -267,7 +275,7 @@ static void list_lttng_channels(enum lttng_domain_type domain,
                rcu_read_lock();
                cds_lfht_for_each_entry(session->ust_session->domain_global.channels->ht,
                                &iter.iter, uchan, node.node) {
-                       uint64_t discarded_events, lost_packets;
+                       uint64_t discarded_events = 0, lost_packets = 0;
 
                        strncpy(channels[i].name, uchan->name, LTTNG_SYMBOL_NAME_LEN);
                        channels[i].attr.overwrite = uchan->attr.overwrite;
@@ -750,12 +758,15 @@ static int add_uri_to_consumer(struct consumer_output *consumer,
                DBG2("Setting trace directory path from URI to %s", uri->dst.path);
                memset(consumer->dst.trace_path, 0,
                                sizeof(consumer->dst.trace_path));
-               strncpy(consumer->dst.trace_path, uri->dst.path,
-                               sizeof(consumer->dst.trace_path));
+               /* Explicit length checks for strcpy and strcat. */
+               if (strlen(uri->dst.path) + strlen(default_trace_dir)
+                               >= sizeof(consumer->dst.trace_path)) {
+                       ret = LTTNG_ERR_FATAL;
+                       goto error;
+               }
+               strcpy(consumer->dst.trace_path, uri->dst.path);
                /* Append default trace dir */
-               strncat(consumer->dst.trace_path, default_trace_dir,
-                               sizeof(consumer->dst.trace_path) -
-                               strlen(consumer->dst.trace_path) - 1);
+               strcat(consumer->dst.trace_path, default_trace_dir);
                /* Flag consumer as local. */
                consumer->type = CONSUMER_DST_LOCAL;
                break;
@@ -1802,7 +1813,7 @@ static int _cmd_enable_event(struct ltt_session *session,
                int wpipe, bool internal_event)
 {
        int ret, channel_created = 0;
-       struct lttng_channel *attr;
+       struct lttng_channel *attr = NULL;
 
        assert(session);
        assert(event);
@@ -1845,15 +1856,16 @@ static int _cmd_enable_event(struct ltt_session *session,
                                ret = LTTNG_ERR_FATAL;
                                goto error;
                        }
-                       strncpy(attr->name, channel_name, sizeof(attr->name));
+                       if (lttng_strncpy(attr->name, channel_name,
+                                       sizeof(attr->name))) {
+                               ret = LTTNG_ERR_INVALID;
+                               goto error;
+                       }
 
                        ret = cmd_enable_channel(session, domain, attr, wpipe);
                        if (ret != LTTNG_OK) {
-                               free(attr);
                                goto error;
                        }
-                       free(attr);
-
                        channel_created = 1;
                }
 
@@ -1982,14 +1994,16 @@ static int _cmd_enable_event(struct ltt_session *session,
                                ret = LTTNG_ERR_FATAL;
                                goto error;
                        }
-                       strncpy(attr->name, channel_name, sizeof(attr->name));
+                       if (lttng_strncpy(attr->name, channel_name,
+                                       sizeof(attr->name))) {
+                               ret = LTTNG_ERR_INVALID;
+                               goto error;
+                       }
 
                        ret = cmd_enable_channel(session, domain, attr, wpipe);
                        if (ret != LTTNG_OK) {
-                               free(attr);
                                goto error;
                        }
-                       free(attr);
 
                        /* Get the newly created channel reference back */
                        uchan = trace_ust_find_channel_by_name(
@@ -2164,6 +2178,7 @@ error:
        free(filter_expression);
        free(filter);
        free(exclusion);
+       free(attr);
        rcu_read_unlock();
        return ret;
 }
@@ -3585,13 +3600,6 @@ static int record_kernel_snapshot(struct ltt_kernel_session *ksess,
        assert(output);
        assert(session);
 
-       /* Get the datetime for the snapshot output directory. */
-       ret = utils_get_current_time_str("%Y%m%d-%H%M%S", output->datetime,
-                       sizeof(output->datetime));
-       if (!ret) {
-               ret = LTTNG_ERR_INVALID;
-               goto error;
-       }
 
        /*
         * Copy kernel session sockets so we can communicate with the right
@@ -3639,14 +3647,6 @@ static int record_ust_snapshot(struct ltt_ust_session *usess,
        assert(output);
        assert(session);
 
-       /* Get the datetime for the snapshot output directory. */
-       ret = utils_get_current_time_str("%Y%m%d-%H%M%S", output->datetime,
-                       sizeof(output->datetime));
-       if (!ret) {
-               ret = LTTNG_ERR_INVALID;
-               goto error;
-       }
-
        /*
         * Copy UST session sockets so we can communicate with the right
         * consumer for the snapshot record command.
@@ -3668,9 +3668,6 @@ static int record_ust_snapshot(struct ltt_ust_session *usess,
                case EINVAL:
                        ret = LTTNG_ERR_INVALID;
                        break;
-               case ENODATA:
-                       ret = LTTNG_ERR_SNAPSHOT_NODATA;
-                       break;
                default:
                        ret = LTTNG_ERR_SNAPSHOT_FAIL;
                        break;
@@ -3788,12 +3785,21 @@ int cmd_snapshot_record(struct ltt_session *session,
        unsigned int use_tmp_output = 0;
        struct snapshot_output tmp_output;
        unsigned int snapshot_success = 0;
+       char datetime[16];
 
        assert(session);
        assert(output);
 
        DBG("Cmd snapshot record for session %s", session->name);
 
+       /* Get the datetime for the snapshot output directory. */
+       ret = utils_get_current_time_str("%Y%m%d-%H%M%S", datetime,
+                       sizeof(datetime));
+       if (!ret) {
+               ret = LTTNG_ERR_INVALID;
+               goto error;
+       }
+
        /*
         * Permission denied to create an output if the session is not
         * set in no output mode.
@@ -3824,138 +3830,100 @@ int cmd_snapshot_record(struct ltt_session *session,
                }
                /* Use the global session count for the temporary snapshot. */
                tmp_output.nb_snapshot = session->snapshot.nb_snapshot;
+
+               /* Use the global datetime */
+               memcpy(tmp_output.datetime, datetime, sizeof(datetime));
                use_tmp_output = 1;
        }
 
-       if (session->kernel_session) {
-               struct ltt_kernel_session *ksess = session->kernel_session;
+       if (use_tmp_output) {
+               int64_t nb_packets_per_stream;
 
-               if (use_tmp_output) {
-                       int64_t nb_packets_per_stream;
+               nb_packets_per_stream = get_session_nb_packets_per_stream(session,
+                               tmp_output.max_size);
+               if (nb_packets_per_stream < 0) {
+                       ret = LTTNG_ERR_MAX_SIZE_INVALID;
+                       goto error;
+               }
 
-                       nb_packets_per_stream = get_session_nb_packets_per_stream(session,
-                                       tmp_output.max_size);
-                       if (nb_packets_per_stream < 0) {
-                               ret = LTTNG_ERR_MAX_SIZE_INVALID;
+               if (session->kernel_session) {
+                       ret = record_kernel_snapshot(session->kernel_session,
+                                       &tmp_output, session,
+                                       wait, nb_packets_per_stream);
+                       if (ret != LTTNG_OK) {
                                goto error;
                        }
-                       ret = record_kernel_snapshot(ksess, &tmp_output, session,
+               }
+
+               if (session->ust_session) {
+                       ret = record_ust_snapshot(session->ust_session,
+                                       &tmp_output, session,
                                        wait, nb_packets_per_stream);
                        if (ret != LTTNG_OK) {
                                goto error;
                        }
-                       snapshot_success = 1;
-               } else {
-                       struct snapshot_output *sout;
-                       struct lttng_ht_iter iter;
-
-                       rcu_read_lock();
-                       cds_lfht_for_each_entry(session->snapshot.output_ht->ht,
-                                       &iter.iter, sout, node.node) {
-                               int64_t nb_packets_per_stream;
-
-                               /*
-                                * Make a local copy of the output and assign the possible
-                                * temporary value given by the caller.
-                                */
-                               memset(&tmp_output, 0, sizeof(tmp_output));
-                               memcpy(&tmp_output, sout, sizeof(tmp_output));
-
-                               if (output->max_size != (uint64_t) -1ULL) {
-                                       tmp_output.max_size = output->max_size;
-                               }
+               }
 
-                               nb_packets_per_stream = get_session_nb_packets_per_stream(session,
-                                               tmp_output.max_size);
-                               if (nb_packets_per_stream < 0) {
-                                       ret = LTTNG_ERR_MAX_SIZE_INVALID;
-                                       goto error;
-                               }
+               snapshot_success = 1;
+       } else {
+               struct snapshot_output *sout;
+               struct lttng_ht_iter iter;
 
-                               /* Use temporary name. */
-                               if (*output->name != '\0') {
-                                       strncpy(tmp_output.name, output->name,
-                                                       sizeof(tmp_output.name));
-                               }
+               rcu_read_lock();
+               cds_lfht_for_each_entry(session->snapshot.output_ht->ht,
+                               &iter.iter, sout, node.node) {
+                       int64_t nb_packets_per_stream;
 
-                               tmp_output.nb_snapshot = session->snapshot.nb_snapshot;
+                       /*
+                        * Make a local copy of the output and assign the possible
+                        * temporary value given by the caller.
+                        */
+                       memset(&tmp_output, 0, sizeof(tmp_output));
+                       memcpy(&tmp_output, sout, sizeof(tmp_output));
 
-                               ret = record_kernel_snapshot(ksess, &tmp_output,
-                                               session, wait, nb_packets_per_stream);
-                               if (ret != LTTNG_OK) {
-                                       rcu_read_unlock();
-                                       goto error;
-                               }
-                               snapshot_success = 1;
+                       if (output->max_size != (uint64_t) -1ULL) {
+                               tmp_output.max_size = output->max_size;
                        }
-                       rcu_read_unlock();
-               }
-       }
-
-       if (session->ust_session) {
-               struct ltt_ust_session *usess = session->ust_session;
-
-               if (use_tmp_output) {
-                       int64_t nb_packets_per_stream;
 
                        nb_packets_per_stream = get_session_nb_packets_per_stream(session,
                                        tmp_output.max_size);
                        if (nb_packets_per_stream < 0) {
                                ret = LTTNG_ERR_MAX_SIZE_INVALID;
+                               rcu_read_unlock();
                                goto error;
                        }
-                       ret = record_ust_snapshot(usess, &tmp_output, session,
-                                       wait, nb_packets_per_stream);
-                       if (ret != LTTNG_OK) {
-                               goto error;
-                       }
-                       snapshot_success = 1;
-               } else {
-                       struct snapshot_output *sout;
-                       struct lttng_ht_iter iter;
-
-                       rcu_read_lock();
-                       cds_lfht_for_each_entry(session->snapshot.output_ht->ht,
-                                       &iter.iter, sout, node.node) {
-                               int64_t nb_packets_per_stream;
 
-                               /*
-                                * Make a local copy of the output and assign the possible
-                                * temporary value given by the caller.
-                                */
-                               memset(&tmp_output, 0, sizeof(tmp_output));
-                               memcpy(&tmp_output, sout, sizeof(tmp_output));
+                       /* Use temporary name. */
+                       if (*output->name != '\0') {
+                               strncpy(tmp_output.name, output->name,
+                                               sizeof(tmp_output.name));
+                       }
 
-                               if (output->max_size != (uint64_t) -1ULL) {
-                                       tmp_output.max_size = output->max_size;
-                               }
+                       tmp_output.nb_snapshot = session->snapshot.nb_snapshot;
+                       memcpy(tmp_output.datetime, datetime, sizeof(datetime));
 
-                               nb_packets_per_stream = get_session_nb_packets_per_stream(session,
-                                               tmp_output.max_size);
-                               if (nb_packets_per_stream < 0) {
-                                       ret = LTTNG_ERR_MAX_SIZE_INVALID;
+                       if (session->kernel_session) {
+                               ret = record_kernel_snapshot(session->kernel_session,
+                                               &tmp_output, session,
+                                               wait, nb_packets_per_stream);
+                               if (ret != LTTNG_OK) {
                                        rcu_read_unlock();
                                        goto error;
                                }
+                       }
 
-                               /* Use temporary name. */
-                               if (*output->name != '\0') {
-                                       strncpy(tmp_output.name, output->name,
-                                                       sizeof(tmp_output.name));
-                               }
-
-                               tmp_output.nb_snapshot = session->snapshot.nb_snapshot;
-
-                               ret = record_ust_snapshot(usess, &tmp_output, session,
+                       if (session->ust_session) {
+                               ret = record_ust_snapshot(session->ust_session,
+                                               &tmp_output, session,
                                                wait, nb_packets_per_stream);
                                if (ret != LTTNG_OK) {
                                        rcu_read_unlock();
                                        goto error;
                                }
-                               snapshot_success = 1;
                        }
-                       rcu_read_unlock();
+                       snapshot_success = 1;
                }
+               rcu_read_unlock();
        }
 
        if (snapshot_success) {
This page took 0.027896 seconds and 4 git commands to generate.