Fix module get/put handling wrt data free (use after free)

[lttng-modules.git] / probes / lttng-kprobes.c

diff --git a/probes/lttng-kprobes.c b/probes/lttng-kprobes.c
index daef3600feefd580bb0db79357d09428f8eb21eb..9dd3569b4a794d59f5a7cbec2a060fb1d3cd9a6f 100644 (file)
--- a/probes/lttng-kprobes.c
+++ b/probes/lttng-kprobes.c
@@ -29,7 +29,7 @@ int lttng_kprobes_handler_pre(struct kprobe *p, struct pt_regs *regs)
                return 0;
        lib_ring_buffer_ctx_init(&ctx, chan->chan, NULL, sizeof(data),
                                 ltt_alignof(data), -1);
-       ret = chan->ops->event_reserve(&ctx);
+       ret = chan->ops->event_reserve(&ctx, event->id);
        if (ret < 0)
                return 0;
        lib_ring_buffer_align_ctx(&ctx, ltt_alignof(data));
@@ -59,18 +59,25 @@ int lttng_create_kprobe_event(const char *name, struct ltt_event *event)
        desc->nr_fields = 1;
        desc->fields = field =
                kzalloc(1 * sizeof(struct lttng_event_field), GFP_KERNEL);
+       if (!field) {
+               ret = -ENOMEM;
+               goto error_field;
+       }
        field->name = "ip";
        field->type.atype = atype_integer;
-       field->type.u.basic.integer.size = sizeof(unsigned long);
-       field->type.u.basic.integer.alignment = ltt_alignof(unsigned long);
+       field->type.u.basic.integer.size = sizeof(unsigned long) * CHAR_BIT;
+       field->type.u.basic.integer.alignment = ltt_alignof(unsigned long) * CHAR_BIT;
        field->type.u.basic.integer.signedness = 0;
        field->type.u.basic.integer.reverse_byte_order = 0;
        field->type.u.basic.integer.base = 16;
        field->type.u.basic.integer.encoding = lttng_encode_none;
+       desc->owner = THIS_MODULE;
        event->desc = desc;
 
        return 0;
 
+error_field:
+       kfree(desc->name);
 error_str:
        kfree(desc);
        return ret;
@@ -118,6 +125,7 @@ int lttng_kprobes_register(const char *name,
 register_error:
        kfree(event->u.kprobe.symbol_name);
 name_error:
+       kfree(event->desc->fields);
        kfree(event->desc->name);
        kfree(event->desc);
 error:
@@ -128,11 +136,17 @@ EXPORT_SYMBOL_GPL(lttng_kprobes_register);
 void lttng_kprobes_unregister(struct ltt_event *event)
 {
        unregister_kprobe(&event->u.kprobe.kp);
+}
+EXPORT_SYMBOL_GPL(lttng_kprobes_unregister);
+
+void lttng_kprobes_destroy_private(struct ltt_event *event)
+{
        kfree(event->u.kprobe.symbol_name);
+       kfree(event->desc->fields);
        kfree(event->desc->name);
        kfree(event->desc);
 }
-EXPORT_SYMBOL_GPL(lttng_kprobes_unregister);
+EXPORT_SYMBOL_GPL(lttng_kprobes_destroy_private);
 
 MODULE_LICENSE("GPL and additional rights");
 MODULE_AUTHOR("Mathieu Desnoyers");