Fix module get/put handling wrt data free (use after free)

[lttng-modules.git] / ltt-events.c

diff --git a/ltt-events.c b/ltt-events.c
index 17d87095c5a1b4bea0c15f9e8906fcb7bab47992..84ad1de50a34d998248e7ea05129852c0c7b80c9 100644 (file)
--- a/ltt-events.c
+++ b/ltt-events.c
@@ -235,7 +235,7 @@ struct ltt_event *ltt_event_create(struct ltt_channel *chan,
        /* Populate ltt_event structure before tracepoint registration. */
        smp_wmb();
        switch (event_param->instrumentation) {
-       case LTTNG_KERNEL_TRACEPOINTS:
+       case LTTNG_KERNEL_TRACEPOINT:
                event->desc = ltt_event_get(event_param->name);
                if (!event->desc)
                        goto register_error;
@@ -245,7 +245,7 @@ struct ltt_event *ltt_event_create(struct ltt_channel *chan,
                if (ret)
                        goto register_error;
                break;
-       case LTTNG_KERNEL_KPROBES:
+       case LTTNG_KERNEL_KPROBE:
                ret = lttng_kprobes_register(event_param->name,
                                event_param->u.kprobe.symbol_name,
                                event_param->u.kprobe.offset,
@@ -253,13 +253,17 @@ struct ltt_event *ltt_event_create(struct ltt_channel *chan,
                                event);
                if (ret)
                        goto register_error;
+               ret = try_module_get(event->desc->owner);
+               WARN_ON_ONCE(!ret);
                break;
-       case LTTNG_KERNEL_FUNCTION_TRACER:
+       case LTTNG_KERNEL_FUNCTION:
                ret = lttng_ftrace_register(event_param->name,
                                event_param->u.ftrace.symbol_name,
                                event);
                if (ret)
                        goto register_error;
+               ret = try_module_get(event->desc->owner);
+               WARN_ON_ONCE(!ret);
                break;
        default:
                WARN_ON_ONCE(1);
@@ -293,19 +297,18 @@ int _ltt_event_unregister(struct ltt_event *event)
        int ret = -EINVAL;
 
        switch (event->instrumentation) {
-       case LTTNG_KERNEL_TRACEPOINTS:
+       case LTTNG_KERNEL_TRACEPOINT:
                ret = tracepoint_probe_unregister(event->desc->name,
                                                  event->desc->probe_callback,
                                                  event);
                if (ret)
                        return ret;
-               ltt_event_put(event->desc);
                break;
-       case LTTNG_KERNEL_KPROBES:
+       case LTTNG_KERNEL_KPROBE:
                lttng_kprobes_unregister(event);
                ret = 0;
                break;
-       case LTTNG_KERNEL_FUNCTION_TRACER:
+       case LTTNG_KERNEL_FUNCTION:
                lttng_ftrace_unregister(event);
                ret = 0;
                break;
@@ -321,7 +324,21 @@ int _ltt_event_unregister(struct ltt_event *event)
 static
 void _ltt_event_destroy(struct ltt_event *event)
 {
-       ltt_event_put(event->desc);
+       switch (event->instrumentation) {
+       case LTTNG_KERNEL_TRACEPOINT:
+               ltt_event_put(event->desc);
+               break;
+       case LTTNG_KERNEL_KPROBE:
+               module_put(event->desc->owner);
+               lttng_kprobes_destroy_private(event);
+               break;
+       case LTTNG_KERNEL_FUNCTION:
+               module_put(event->desc->owner);
+               lttng_ftrace_destroy_private(event);
+               break;
+       default:
+               WARN_ON_ONCE(1);
+       }
        list_del(&event->list);
        kmem_cache_free(event_cache, event);
 }