Fix: consumerd: use-after-free of metadata bucket

[lttng-tools.git] / src / common / kernel-consumer / kernel-consumer.cpp

diff --git a/src/common/kernel-consumer/kernel-consumer.cpp b/src/common/kernel-consumer/kernel-consumer.cpp
index aa443027effe021529816ad6a1ea7ffbd8dc3163..42242ad1231aed54a79ef30ab3b324e353809c6f 100644 (file)
--- a/src/common/kernel-consumer/kernel-consumer.cpp
+++ b/src/common/kernel-consumer/kernel-consumer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Julien Desfossez <julien.desfossez@polymtl.ca>
+ * Copyright (C) 2011 EfficiOS Inc.
  * Copyright (C) 2011 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
  * Copyright (C) 2017 Jérémie Galarneau <jeremie.galarneau@efficios.com>
  *
@@ -138,7 +138,7 @@ error:
 /*
  * Take a snapshot of all the stream of a channel
  * RCU read-side lock must be held across this function to ensure existence of
- * channel. The channel lock must be held by the caller.
+ * channel.
  *
  * Returns 0 on success, < 0 on error
  */
@@ -153,6 +153,9 @@ static int lttng_kconsumer_snapshot_channel(
 
        DBG("Kernel consumer snapshot channel %" PRIu64, key);
 
+       /* Prevent channel modifications while we perform the snapshot.*/
+       pthread_mutex_lock(&channel->lock);
+
        rcu_read_lock();
 
        /* Splice is not supported yet for channel snapshot. */
@@ -346,13 +349,14 @@ end_unlock:
        pthread_mutex_unlock(&stream->lock);
 end:
        rcu_read_unlock();
+       pthread_mutex_unlock(&channel->lock);
        return ret;
 }
 
 /*
  * Read the whole metadata available for a snapshot.
  * RCU read-side lock must be held across this function to ensure existence of
- * metadata_channel. The channel lock must be held by the caller.
+ * metadata_channel.
  *
  * Returns 0 on success, < 0 on error
  */
@@ -375,7 +379,7 @@ static int lttng_kconsumer_snapshot_metadata(
        metadata_stream = metadata_channel->metadata_stream;
        LTTNG_ASSERT(metadata_stream);
 
-       pthread_mutex_lock(&metadata_stream->lock);
+       metadata_stream->read_subbuffer_ops.lock(metadata_stream);
        LTTNG_ASSERT(metadata_channel->trace_chunk);
        LTTNG_ASSERT(metadata_stream->trace_chunk);
 
@@ -430,8 +434,7 @@ static int lttng_kconsumer_snapshot_metadata(
 
        ret = 0;
 error_snapshot:
-       pthread_mutex_unlock(&metadata_stream->lock);
-       cds_list_del(&metadata_stream->send_node);
+       metadata_stream->read_subbuffer_ops.unlock(metadata_stream);
        consumer_stream_destroy(metadata_stream, NULL);
        metadata_channel->metadata_stream = NULL;
        rcu_read_unlock();
@@ -479,11 +482,17 @@ int lttng_kconsumer_recv_cmd(struct lttng_consumer_local_data *ctx,
        switch (msg.cmd_type) {
        case LTTNG_CONSUMER_ADD_RELAYD_SOCKET:
        {
+               uint32_t major = msg.u.relayd_sock.major;
+               uint32_t minor = msg.u.relayd_sock.minor;
+               enum lttcomm_sock_proto protocol = (enum lttcomm_sock_proto)
+                               msg.u.relayd_sock.relayd_socket_protocol;
+
                /* Session daemon status message are handled in the following call. */
                consumer_add_relayd_socket(msg.u.relayd_sock.net_index,
-                               msg.u.relayd_sock.type, ctx, sock, consumer_sockpoll,
-                               &msg.u.relayd_sock.sock, msg.u.relayd_sock.session_id,
-                               msg.u.relayd_sock.relayd_session_id);
+                               msg.u.relayd_sock.type, ctx, sock,
+                               consumer_sockpoll, msg.u.relayd_sock.session_id,
+                               msg.u.relayd_sock.relayd_session_id, major,
+                               minor, protocol);
                goto end_nosignal;
        }
        case LTTNG_CONSUMER_ADD_CHANNEL:
@@ -960,7 +969,6 @@ error_streams_sent_nosignal:
                        ERR("Channel %" PRIu64 " not found", key);
                        ret_code = LTTCOMM_CONSUMERD_CHAN_NOT_FOUND;
                } else {
-                       pthread_mutex_lock(&channel->lock);
                        if (msg.u.snapshot_channel.metadata == 1) {
                                int ret_snapshot;
 
@@ -988,7 +996,6 @@ error_streams_sent_nosignal:
                                        ret_code = LTTCOMM_CONSUMERD_SNAPSHOT_FAILED;
                                }
                        }
-                       pthread_mutex_unlock(&channel->lock);
                }
                health_code_update();