Fix: Double free in utils_partial_realpath error path
[lttng-tools.git] / src / common / utils.c
index 337713eb78ab39493bb745c994d7d43df9400d0f..901ddb036771d77ff7ab1c2f723c98db7f895bbb 100644 (file)
  * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
-#define _GNU_SOURCE
 #define _LGPL_SOURCE
 #include <assert.h>
 #include <ctype.h>
 #include <fcntl.h>
 #include <limits.h>
 #include <stdlib.h>
-#include <string.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 #include <grp.h>
 #include <pwd.h>
 #include <sys/file.h>
-#include <dirent.h>
+#include <unistd.h>
 
 #include <common/common.h>
 #include <common/runas.h>
 #include <common/compat/getenv.h>
+#include <common/compat/string.h>
+#include <common/compat/dirent.h>
+#include <lttng/constant.h>
 
 #include "utils.h"
 #include "defaults.h"
@@ -55,7 +56,7 @@
 LTTNG_HIDDEN
 char *utils_partial_realpath(const char *path, char *resolved_path, size_t size)
 {
-       char *cut_path, *try_path = NULL, *try_path_prev = NULL;
+       char *cut_path = NULL, *try_path = NULL, *try_path_prev = NULL;
        const char *next, *prev, *end;
 
        /* Safety net */
@@ -82,6 +83,8 @@ char *utils_partial_realpath(const char *path, char *resolved_path, size_t size)
 
        /* Resolve the canonical path of the first part of the path */
        while (try_path != NULL && next != end) {
+               char *try_path_buf = NULL;
+
                /*
                 * If there is not any '/' left, we want to try with
                 * the full path
@@ -92,15 +95,22 @@ char *utils_partial_realpath(const char *path, char *resolved_path, size_t size)
                }
 
                /* Cut the part we will be trying to resolve */
-               cut_path = strndup(path, next - path);
+               cut_path = lttng_strndup(path, next - path);
                if (cut_path == NULL) {
-                       PERROR("strndup");
+                       PERROR("lttng_strndup");
+                       goto error;
+               }
+
+               try_path_buf = zmalloc(LTTNG_PATH_MAX);
+               if (!try_path_buf) {
+                       PERROR("zmalloc");
                        goto error;
                }
 
                /* Try to resolve this part */
-               try_path = realpath((char *)cut_path, NULL);
+               try_path = realpath((char *) cut_path, try_path_buf);
                if (try_path == NULL) {
+                       free(try_path_buf);
                        /*
                         * There was an error, we just want to be assured it
                         * is linked to an unexistent directory, if it's another
@@ -117,6 +127,7 @@ char *utils_partial_realpath(const char *path, char *resolved_path, size_t size)
                        }
                } else {
                        /* Save the place we are before trying the next step */
+                       try_path_buf = NULL;
                        free(try_path_prev);
                        try_path_prev = try_path;
                        prev = next;
@@ -124,7 +135,8 @@ char *utils_partial_realpath(const char *path, char *resolved_path, size_t size)
 
                /* Free the allocated memory */
                free(cut_path);
-       };
+               cut_path = NULL;
+       }
 
        /* Allocate memory for the resolved path if necessary */
        if (resolved_path == NULL) {
@@ -161,6 +173,8 @@ char *utils_partial_realpath(const char *path, char *resolved_path, size_t size)
                /* Free the allocated memory */
                free(cut_path);
                free(try_path_prev);
+               cut_path = NULL;
+               try_path_prev = NULL;
        /*
         * Else, we just copy the path in our resolved_path to
         * return it as is
@@ -174,6 +188,11 @@ char *utils_partial_realpath(const char *path, char *resolved_path, size_t size)
 
 error:
        free(resolved_path);
+       free(cut_path);
+       free(try_path);
+       if (try_path_prev != try_path) {
+               free(try_path_prev);
+       }
        return NULL;
 }
 
@@ -226,9 +245,9 @@ char *utils_expand_path(const char *path)
        while ((next = strstr(absolute_path, "/./"))) {
 
                /* We prepare the start_path not containing it */
-               start_path = strndup(absolute_path, next - absolute_path);
+               start_path = lttng_strndup(absolute_path, next - absolute_path);
                if (!start_path) {
-                       PERROR("strndup");
+                       PERROR("lttng_strndup");
                        goto error;
                }
                /* And we concatenate it with the part after this string */
@@ -246,9 +265,9 @@ char *utils_expand_path(const char *path)
                }
 
                /* Then we prepare the start_path not containing it */
-               start_path = strndup(absolute_path, previous - absolute_path);
+               start_path = lttng_strndup(absolute_path, previous - absolute_path);
                if (!start_path) {
-                       PERROR("strndup");
+                       PERROR("lttng_strndup");
                        goto error;
                }
 
@@ -476,7 +495,7 @@ int utils_create_pid_file(pid_t pid, const char *filepath)
                goto error;
        }
 
-       ret = fprintf(fp, "%d\n", pid);
+       ret = fprintf(fp, "%d\n", (int) pid);
        if (ret < 0) {
                PERROR("fprintf pid file");
                goto error;
@@ -485,7 +504,7 @@ int utils_create_pid_file(pid_t pid, const char *filepath)
        if (fclose(fp)) {
                PERROR("fclose");
        }
-       DBG("Pid %d written in file %s", pid, filepath);
+       DBG("Pid %d written in file %s", (int) pid, filepath);
        ret = 0;
 error:
        return ret;
@@ -500,11 +519,13 @@ int utils_create_lock_file(const char *filepath)
 {
        int ret;
        int fd;
+       struct flock lock;
 
        assert(filepath);
 
-       fd = open(filepath, O_CREAT,
-               O_WRONLY | S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+       memset(&lock, 0, sizeof(lock));
+       fd = open(filepath, O_CREAT | O_WRONLY, S_IRUSR | S_IWUSR |
+               S_IRGRP | S_IWGRP);
        if (fd < 0) {
                PERROR("open lock file %s", filepath);
                ret = -1;
@@ -516,8 +537,12 @@ int utils_create_lock_file(const char *filepath)
         * already a process using the same lock file running
         * and we should exit.
         */
-       ret = flock(fd, LOCK_EX | LOCK_NB);
-       if (ret) {
+       lock.l_whence = SEEK_SET;
+       lock.l_type = F_WRLCK;
+
+       ret = fcntl(fd, F_SETLK, &lock);
+       if (ret == -1) {
+               PERROR("fcntl lock file");
                ERR("Could not get lock file %s, another instance is running.",
                        filepath);
                if (close(fd)) {
@@ -531,6 +556,44 @@ error:
        return fd;
 }
 
+/*
+ * On some filesystems (e.g. nfs), mkdir will validate access rights before
+ * checking for the existence of the path element. This means that on a setup
+ * where "/home/" is a mounted NFS share, and running as an unpriviledged user,
+ * recursively creating a path of the form "/home/my_user/trace/" will fail with
+ * EACCES on mkdir("/home", ...).
+ *
+ * Performing a stat(...) on the path to check for existence allows us to
+ * work around this behaviour.
+ */
+static
+int mkdir_check_exists(const char *path, mode_t mode)
+{
+       int ret = 0;
+       struct stat st;
+
+       ret = stat(path, &st);
+       if (ret == 0) {
+               if (S_ISDIR(st.st_mode)) {
+                       /* Directory exists, skip. */
+                       goto end;
+               } else {
+                       /* Exists, but is not a directory. */
+                       errno = ENOTDIR;
+                       ret = -1;
+                       goto end;
+               }
+       }
+
+       /*
+        * Let mkdir handle other errors as the caller expects mkdir
+        * semantics.
+        */
+       ret = mkdir(path, mode);
+end:
+       return ret;
+}
+
 /*
  * Create directory using the given path and mode.
  *
@@ -542,7 +605,7 @@ int utils_mkdir(const char *path, mode_t mode, int uid, int gid)
        int ret;
 
        if (uid < 0 || gid < 0) {
-               ret = mkdir(path, mode);
+               ret = mkdir_check_exists(path, mode);
        } else {
                ret = run_as_mkdir(path, mode, uid, gid);
        }
@@ -597,9 +660,9 @@ int _utils_mkdir_recursive_unsafe(const char *path, mode_t mode)
                                ret = -1;
                                goto error;
                        }
-                       ret = mkdir(tmp, mode);
+                       ret = mkdir_check_exists(tmp, mode);
                        if (ret < 0) {
-                               if (errno != EEXIST) {
+                               if (errno != EACCES) {
                                        PERROR("mkdir recursive");
                                        ret = -errno;
                                        goto error;
@@ -609,14 +672,10 @@ int _utils_mkdir_recursive_unsafe(const char *path, mode_t mode)
                }
        }
 
-       ret = mkdir(tmp, mode);
+       ret = mkdir_check_exists(tmp, mode);
        if (ret < 0) {
-               if (errno != EEXIST) {
-                       PERROR("mkdir recursive last element");
-                       ret = -errno;
-               } else {
-                       ret = 0;
-               }
+               PERROR("mkdir recursive last element");
+               ret = -errno;
        }
 
 error:
@@ -763,10 +822,6 @@ int utils_unlink_stream_file(const char *path_name, char *file_name, uint64_t si
                ret = unlink(path);
        } else {
                ret = run_as_unlink(path, uid, gid);
-               if (ret < 0) {
-                       errno = -ret;
-                       ret = -1;
-               }
        }
        if (ret < 0) {
                goto error;
@@ -792,7 +847,6 @@ int utils_rotate_stream_file(char *path_name, char *file_name, uint64_t size,
 {
        int ret;
 
-       assert(new_count);
        assert(stream_fd);
 
        ret = close(out_fd);
@@ -815,18 +869,22 @@ int utils_rotate_stream_file(char *path_name, char *file_name, uint64_t size,
                 * Unlinking the old file rather than overwriting it
                 * achieves this.
                 */
-               *new_count = (*new_count + 1) % count;
-               ret = utils_unlink_stream_file(path_name, file_name,
-                               size, *new_count, uid, gid, 0);
+               if (new_count) {
+                       *new_count = (*new_count + 1) % count;
+               }
+               ret = utils_unlink_stream_file(path_name, file_name, size,
+                               new_count ? *new_count : 0, uid, gid, 0);
                if (ret < 0 && errno != ENOENT) {
                        goto error;
                }
        } else {
-               (*new_count)++;
+               if (new_count) {
+                       (*new_count)++;
+               }
        }
 
-       ret = utils_create_stream_file(path_name, file_name, size, *new_count,
-                       uid, gid, 0);
+       ret = utils_create_stream_file(path_name, file_name, size,
+                       new_count ? *new_count : 0, uid, gid, 0);
        if (ret < 0) {
                goto error;
        }
@@ -1197,6 +1255,7 @@ LTTNG_HIDDEN
 int utils_recursive_rmdir(const char *path)
 {
        DIR *dir;
+       size_t path_len;
        int dir_fd, ret = 0, closeret, is_empty = 1;
        struct dirent *entry;
 
@@ -1206,19 +1265,41 @@ int utils_recursive_rmdir(const char *path)
                PERROR("Cannot open '%s' path", path);
                return -1;
        }
-       dir_fd = dirfd(dir);
+       dir_fd = lttng_dirfd(dir);
        if (dir_fd < 0) {
-               PERROR("dirfd");
+               PERROR("lttng_dirfd");
                return -1;
        }
 
+       path_len = strlen(path);
        while ((entry = readdir(dir))) {
+               struct stat st;
+               size_t name_len;
+               char filename[PATH_MAX];
+
                if (!strcmp(entry->d_name, ".")
-                               || !strcmp(entry->d_name, ".."))
+                               || !strcmp(entry->d_name, "..")) {
+                       continue;
+               }
+
+               name_len = strlen(entry->d_name);
+               if (path_len + name_len + 2 > sizeof(filename)) {
+                       ERR("Failed to remove file: path name too long (%s/%s)",
+                               path, entry->d_name);
                        continue;
-               switch (entry->d_type) {
-               case DT_DIR:
-               {
+               }
+               if (snprintf(filename, sizeof(filename), "%s/%s",
+                               path, entry->d_name) < 0) {
+                       ERR("Failed to format path.");
+                       continue;
+               }
+
+               if (stat(filename, &st)) {
+                       PERROR("stat");
+                       continue;
+               }
+
+               if (S_ISDIR(st.st_mode)) {
                        char subpath[PATH_MAX];
 
                        strncpy(subpath, path, PATH_MAX);
@@ -1230,12 +1311,9 @@ int utils_recursive_rmdir(const char *path)
                        if (utils_recursive_rmdir(subpath)) {
                                is_empty = 0;
                        }
-                       break;
-               }
-               case DT_REG:
+               } else if (S_ISREG(st.st_mode)) {
                        is_empty = 0;
-                       break;
-               default:
+               } else {
                        ret = -EINVAL;
                        goto end;
                }
@@ -1251,3 +1329,56 @@ end:
        }
        return ret;
 }
+
+LTTNG_HIDDEN
+int utils_truncate_stream_file(int fd, off_t length)
+{
+       int ret;
+
+       ret = ftruncate(fd, length);
+       if (ret < 0) {
+               PERROR("ftruncate");
+               goto end;
+       }
+       ret = lseek(fd, length, SEEK_SET);
+       if (ret < 0) {
+               PERROR("lseek");
+               goto end;
+       }
+end:
+       return ret;
+}
+
+static const char *get_man_bin_path(void)
+{
+       char *env_man_path = lttng_secure_getenv(DEFAULT_MAN_BIN_PATH_ENV);
+
+       if (env_man_path) {
+               return env_man_path;
+       }
+
+       return DEFAULT_MAN_BIN_PATH;
+}
+
+LTTNG_HIDDEN
+int utils_show_man_page(int section, const char *page_name)
+{
+       char section_string[8];
+       const char *man_bin_path = get_man_bin_path();
+       int ret;
+
+       /* Section integer -> section string */
+       ret = sprintf(section_string, "%d", section);
+       assert(ret > 0 && ret < 8);
+
+       /*
+        * Execute man pager.
+        *
+        * We provide --manpath to man here because LTTng-tools can
+        * be installed outside /usr, in which case its man pages are
+        * not located in the default /usr/share/man directory.
+        */
+       ret = execlp(man_bin_path, "man", "--manpath", MANPATH,
+               section_string, page_name, NULL);
+       return ret;
+}
This page took 0.028999 seconds and 4 git commands to generate.