Fix: capture_sequence_element_{un,}signed: handle user-space input

[lttng-modules.git] / src / lttng-event-notifier-notification.c

diff --git a/src/lttng-event-notifier-notification.c b/src/lttng-event-notifier-notification.c
index be481e4b7ca0689675ff3558e5f4295b4689d8c1..ae35b1f45697e78d774f067d2fe665dd23e8bc2d 100644 (file)
--- a/src/lttng-event-notifier-notification.c
+++ b/src/lttng-event-notifier-notification.c
@@ -12,6 +12,7 @@
 #include <lttng/msgpack.h>
 #include <lttng/event-notifier-notification.h>
 #include <lttng/events-internal.h>
+#include <lttng/probe-user.h>
 #include <wrapper/barrier.h>
 
 /*
@@ -100,39 +101,65 @@ int64_t capture_sequence_element_signed(uint8_t *ptr,
 {
        int64_t value = 0;
        unsigned int size = type->size;
+       bool user = type->user;
        bool byte_order_reversed = type->reverse_byte_order;
 
        switch (size) {
        case 8:
-               value = *ptr;
+       {
+               int8_t tmp;
+
+               if (user) {
+                       if (lttng_copy_from_user_check_nofault(&tmp, ptr, sizeof(int8_t)))
+                               tmp = 0;
+               } else {
+                       tmp = *ptr;
+               }
+               value = tmp;
                break;
+       }
        case 16:
        {
                int16_t tmp;
-               tmp = *(int16_t *) ptr;
+
+               if (user) {
+                       if (lttng_copy_from_user_check_nofault(&tmp, ptr, sizeof(int16_t)))
+                               tmp = 0;
+               } else {
+                       tmp = *(int16_t *) ptr;
+               }
                if (byte_order_reversed)
                        __swab16s(&tmp);
-
                value = tmp;
                break;
        }
        case 32:
        {
                int32_t tmp;
-               tmp = *(int32_t *) ptr;
+
+               if (user) {
+                       if (lttng_copy_from_user_check_nofault(&tmp, ptr, sizeof(int32_t)))
+                               tmp = 0;
+               } else {
+                       tmp = *(int32_t *) ptr;
+               }
                if (byte_order_reversed)
                        __swab32s(&tmp);
-
                value = tmp;
                break;
        }
        case 64:
        {
                int64_t tmp;
-               tmp = *(int64_t *) ptr;
+
+               if (user) {
+                       if (lttng_copy_from_user_check_nofault(&tmp, ptr, sizeof(int64_t)))
+                               tmp = 0;
+               } else {
+                       tmp = *(int64_t *) ptr;
+               }
                if (byte_order_reversed)
                        __swab64s(&tmp);
-
                value = tmp;
                break;
        }
@@ -149,39 +176,65 @@ uint64_t capture_sequence_element_unsigned(uint8_t *ptr,
 {
        uint64_t value = 0;
        unsigned int size = type->size;
+       bool user = type->user;
        bool byte_order_reversed = type->reverse_byte_order;
 
        switch (size) {
        case 8:
-               value = *ptr;
+       {
+               uint8_t tmp;
+
+               if (user) {
+                       if (lttng_copy_from_user_check_nofault(&tmp, ptr, sizeof(uint8_t)))
+                               tmp = 0;
+               } else {
+                       tmp = *ptr;
+               }
+               value = tmp;
                break;
+       }
        case 16:
        {
                uint16_t tmp;
-               tmp = *(uint16_t *) ptr;
+
+               if (user) {
+                       if (lttng_copy_from_user_check_nofault(&tmp, ptr, sizeof(uint16_t)))
+                               tmp = 0;
+               } else {
+                       tmp = *(uint16_t *) ptr;
+               }
                if (byte_order_reversed)
                        __swab16s(&tmp);
-
                value = tmp;
                break;
        }
        case 32:
        {
                uint32_t tmp;
-               tmp = *(uint32_t *) ptr;
+
+               if (user) {
+                       if (lttng_copy_from_user_check_nofault(&tmp, ptr, sizeof(uint32_t)))
+                               tmp = 0;
+               } else {
+                       tmp = *(uint32_t *) ptr;
+               }
                if (byte_order_reversed)
                        __swab32s(&tmp);
-
                value = tmp;
                break;
        }
        case 64:
        {
                uint64_t tmp;
-               tmp = *(uint64_t *) ptr;
+
+               if (user) {
+                       if (lttng_copy_from_user_check_nofault(&tmp, ptr, sizeof(uint64_t)))
+                               tmp = 0;
+               } else {
+                       tmp = *(uint64_t *) ptr;
+               }
                if (byte_order_reversed)
                        __swab64s(&tmp);
-
                value = tmp;
                break;
        }
@@ -283,7 +336,11 @@ int notification_append_capture(
                }
                break;
        case LTTNG_INTERPRETER_TYPE_STRING:
-               ret = lttng_msgpack_write_str(writer, output->u.str.str);
+               if (output->u.str.user) {
+                       ret = lttng_msgpack_write_user_str(writer, output->u.str.user_str);
+               } else {
+                       ret = lttng_msgpack_write_str(writer, output->u.str.str);
+               }
                if (ret) {
                        WARN_ON_ONCE(1);
                        goto end;
@@ -381,7 +438,7 @@ void notification_send(struct lttng_event_notifier_notification *notif,
                struct lttng_kernel_event_notifier *event_notifier)
 {
        struct lttng_event_notifier_group *event_notifier_group = event_notifier->priv->group;
-       struct lib_ring_buffer_ctx ctx;
+       struct lttng_kernel_ring_buffer_ctx ctx;
        struct lttng_kernel_abi_event_notifier_notification kernel_notif;
        size_t capture_buffer_content_len, reserve_size;
        int ret;
@@ -400,34 +457,32 @@ void notification_send(struct lttng_event_notifier_notification *notif,
        reserve_size += capture_buffer_content_len;
        kernel_notif.capture_buf_size = capture_buffer_content_len;
 
-       lib_ring_buffer_ctx_init(&ctx, event_notifier_group->chan, NULL, reserve_size,
-                       lttng_alignof(kernel_notif), -1);
-       ret = event_notifier_group->ops->event_reserve(&ctx, 0);
+       lib_ring_buffer_ctx_init(&ctx, event_notifier_group->chan, reserve_size,
+                       lttng_alignof(kernel_notif), NULL);
+       ret = event_notifier_group->ops->event_reserve(&ctx);
        if (ret < 0) {
                record_error(event_notifier);
                return;
        }
 
-       lib_ring_buffer_align_ctx(&ctx, lttng_alignof(kernel_notif));
-
        /* Write the notif structure. */
        event_notifier_group->ops->event_write(&ctx, &kernel_notif,
-                       sizeof(kernel_notif));
+                       sizeof(kernel_notif), lttng_alignof(kernel_notif));
 
        /*
         * Write the capture buffer. No need to realigned as the below is a raw
         * char* buffer.
         */
        event_notifier_group->ops->event_write(&ctx, &notif->capture_buf,
-                       capture_buffer_content_len);
+                       capture_buffer_content_len, 1);
 
        event_notifier_group->ops->event_commit(&ctx);
        irq_work_queue(&event_notifier_group->wakeup_pending);
 }
 
 void lttng_event_notifier_notification_send(struct lttng_kernel_event_notifier *event_notifier,
-               struct lttng_probe_ctx *probe_ctx,
                const char *stack_data,
+               struct lttng_kernel_probe_ctx *probe_ctx,
                struct lttng_kernel_notification_ctx *notif_ctx)
 {
        struct lttng_event_notifier_notification notif = { 0 };
@@ -443,7 +498,7 @@ void lttng_event_notifier_notification_send(struct lttng_kernel_event_notifier *
        }
 
        if (unlikely(notif_ctx->eval_capture)) {
-               struct lttng_bytecode_runtime *capture_bc_runtime;
+               struct lttng_kernel_bytecode_runtime *capture_bc_runtime;
 
                /*
                 * Iterate over all the capture bytecodes. If the interpreter
@@ -455,8 +510,8 @@ void lttng_event_notifier_notification_send(struct lttng_kernel_event_notifier *
                                &event_notifier->priv->capture_bytecode_runtime_head, node) {
                        struct lttng_interpreter_output output;
 
-                       if (capture_bc_runtime->interpreter_funcs.capture(capture_bc_runtime, probe_ctx,
-                                       stack_data, &output) & LTTNG_INTERPRETER_RECORD_FLAG)
+                       if (capture_bc_runtime->interpreter_func(capture_bc_runtime,
+                                       stack_data, probe_ctx, &output) == LTTNG_KERNEL_BYTECODE_INTERPRETER_OK)
                                ret = notification_append_capture(&notif, &output);
                        else
                                ret = notification_append_empty_capture(&notif);