Fix: event notification capture: validate buffer length
[lttng-ust.git] / src / lib / lttng-ust / event-notifier-notification.c
CommitLineData
d8d2416d 1/*
c0c0989a 2 * SPDX-License-Identifier: LGPL-2.1-only
d8d2416d
FD
3 *
4 * Copyright (C) 2020 Francis Deslauriers <francis.deslauriers@efficios.com>
d8d2416d
FD
5 */
6
7#define _LGPL_SOURCE
8
b9f82a28 9#include <assert.h>
d8d2416d 10#include <errno.h>
9af5d97a
MJ
11#include <limits.h>
12
f03092d7 13#include <lttng/ust-endian.h>
9d315d6d 14#include "common/logging.h"
a2e4d05e 15#include <urcu/rculist.h>
d8d2416d 16
4b4a1337 17#include "lttng-tracer-core.h"
36c52fff 18#include "lib/lttng-ust/events.h"
c3ba99c2 19#include "common/msgpack/msgpack.h"
b9f82a28 20#include "lttng-bytecode.h"
9d315d6d 21#include "common/patient.h"
d8d2416d 22
d37ecb3f
FD
23/*
24 * We want this write to be atomic AND non-blocking, meaning that we
25 * want to write either everything OR nothing.
26 * According to `pipe(7)`, writes that are less than `PIPE_BUF` bytes must be
27 * atomic, so we bound the capture buffer size to the `PIPE_BUF` minus the size
28 * of the notification struct we are sending alongside the capture buffer.
29 */
30#define CAPTURE_BUFFER_SIZE \
fd17d7ce 31 (PIPE_BUF - sizeof(struct lttng_ust_abi_event_notifier_notification) - 1)
d37ecb3f 32
65c955a5
MD
33#define MSG_WRITE_NIL_LEN 1
34
d37ecb3f
FD
35struct lttng_event_notifier_notification {
36 int notification_fd;
37 uint64_t event_notifier_token;
38 uint8_t capture_buf[CAPTURE_BUFFER_SIZE];
39 struct lttng_msgpack_writer writer;
40 bool has_captures;
41};
42
b9f82a28 43static
c651e872 44int capture_enum(struct lttng_msgpack_writer *writer,
b9f82a28
FD
45 struct lttng_interpreter_output *output)
46{
c651e872 47 int ret;
b9f82a28 48
c651e872
MD
49 ret = lttng_msgpack_begin_map(writer, 2);
50 if (ret) {
51 goto end;
52 }
53 ret = lttng_msgpack_write_str(writer, "type");
54 if (ret) {
55 goto end;
56 }
57 ret = lttng_msgpack_write_str(writer, "enum");
58 if (ret) {
59 goto end;
60 }
61 ret = lttng_msgpack_write_str(writer, "value");
62 if (ret) {
63 goto end;
64 }
b9f82a28
FD
65
66 switch (output->type) {
67 case LTTNG_INTERPRETER_TYPE_SIGNED_ENUM:
c651e872
MD
68 ret = lttng_msgpack_write_signed_integer(writer, output->u.s);
69 if (ret) {
70 goto end;
71 }
b9f82a28
FD
72 break;
73 case LTTNG_INTERPRETER_TYPE_UNSIGNED_ENUM:
c651e872
MD
74 ret = lttng_msgpack_write_signed_integer(writer, output->u.u);
75 if (ret) {
76 goto end;
77 }
b9f82a28
FD
78 break;
79 default:
c651e872
MD
80 CRIT("Unknown enum output type\n");
81 ret = -1;
82 goto end;
b9f82a28
FD
83 }
84
c651e872
MD
85 ret = lttng_msgpack_end_map(writer);
86end:
87 return ret;
b9f82a28
FD
88}
89
90static
91int64_t capture_sequence_element_signed(uint8_t *ptr,
4e48b5d2 92 const struct lttng_ust_type_integer *integer_type)
b9f82a28
FD
93{
94 int64_t value;
a084756d
MD
95 unsigned int size = integer_type->size;
96 bool byte_order_reversed = integer_type->reverse_byte_order;
b9f82a28
FD
97
98 switch (size) {
99 case 8:
100 value = *ptr;
101 break;
102 case 16:
103 {
104 int16_t tmp;
105 tmp = *(int16_t *) ptr;
106 if (byte_order_reversed)
baa8acf3 107 tmp = lttng_ust_bswap_16(tmp);
b9f82a28
FD
108
109 value = tmp;
110 break;
111 }
112 case 32:
113 {
114 int32_t tmp;
115 tmp = *(int32_t *) ptr;
116 if (byte_order_reversed)
baa8acf3 117 tmp = lttng_ust_bswap_32(tmp);
b9f82a28
FD
118
119 value = tmp;
120 break;
121 }
122 case 64:
123 {
124 int64_t tmp;
125 tmp = *(int64_t *) ptr;
126 if (byte_order_reversed)
baa8acf3 127 tmp = lttng_ust_bswap_64(tmp);
b9f82a28
FD
128
129 value = tmp;
130 break;
131 }
132 default:
c651e872
MD
133 CRIT("Unknown sequence element size\n");
134 value = 0;
b9f82a28
FD
135 }
136
137 return value;
138}
139
140static
141uint64_t capture_sequence_element_unsigned(uint8_t *ptr,
4e48b5d2 142 const struct lttng_ust_type_integer *integer_type)
b9f82a28
FD
143{
144 uint64_t value;
a084756d
MD
145 unsigned int size = integer_type->size;
146 bool byte_order_reversed = integer_type->reverse_byte_order;
b9f82a28
FD
147
148 switch (size) {
149 case 8:
150 value = *ptr;
151 break;
152 case 16:
153 {
154 uint16_t tmp;
155 tmp = *(uint16_t *) ptr;
156 if (byte_order_reversed)
baa8acf3 157 tmp = lttng_ust_bswap_16(tmp);
b9f82a28
FD
158
159 value = tmp;
160 break;
161 }
162 case 32:
163 {
164 uint32_t tmp;
165 tmp = *(uint32_t *) ptr;
166 if (byte_order_reversed)
baa8acf3 167 tmp = lttng_ust_bswap_32(tmp);
b9f82a28
FD
168
169 value = tmp;
170 break;
171 }
172 case 64:
173 {
174 uint64_t tmp;
175 tmp = *(uint64_t *) ptr;
176 if (byte_order_reversed)
baa8acf3 177 tmp = lttng_ust_bswap_64(tmp);
b9f82a28
FD
178
179 value = tmp;
180 break;
181 }
182 default:
c651e872
MD
183 CRIT("Unknown sequence element size\n");
184 value = 0;
b9f82a28
FD
185 }
186
187 return value;
188}
189
b9f82a28 190static
c651e872 191int capture_sequence(struct lttng_msgpack_writer *writer,
b9f82a28
FD
192 struct lttng_interpreter_output *output)
193{
4e48b5d2
MD
194 const struct lttng_ust_type_integer *integer_type;
195 const struct lttng_ust_type_common *nested_type;
b9f82a28
FD
196 uint8_t *ptr;
197 bool signedness;
c651e872 198 int i, ret;
b9f82a28 199
c651e872
MD
200 ret = lttng_msgpack_begin_array(writer, output->u.sequence.nr_elem);
201 if (ret) {
202 goto end;
203 }
b9f82a28
FD
204 ptr = (uint8_t *) output->u.sequence.ptr;
205 nested_type = output->u.sequence.nested_type;
a084756d
MD
206 switch (nested_type->type) {
207 case lttng_ust_type_integer:
208 integer_type = lttng_ust_get_type_integer(nested_type);
b9f82a28 209 break;
a084756d 210 case lttng_ust_type_enum:
b9f82a28 211 /* Treat enumeration as an integer. */
a084756d 212 integer_type = lttng_ust_get_type_integer(lttng_ust_get_type_enum(nested_type)->container_type);
b9f82a28
FD
213 break;
214 default:
c651e872
MD
215 CRIT("Capture of array of non-integer are not supported\n");
216 ret = -1;
217 goto end;
b9f82a28
FD
218 }
219 signedness = integer_type->signedness;
220 for (i = 0; i < output->u.sequence.nr_elem; i++) {
221 if (signedness) {
c651e872 222 ret = lttng_msgpack_write_signed_integer(writer,
b9f82a28
FD
223 capture_sequence_element_signed(ptr, integer_type));
224 } else {
c651e872 225 ret = lttng_msgpack_write_unsigned_integer(writer,
b9f82a28
FD
226 capture_sequence_element_unsigned(ptr, integer_type));
227 }
c651e872
MD
228 if (ret) {
229 goto end;
230 }
b9f82a28
FD
231
232 /*
233 * We assume that alignment is smaller or equal to the size.
234 * This currently holds true but if it changes in the future,
2fbda51c 235 * we will want to change the pointer arithmetic below to
b9f82a28
FD
236 * take into account that the next element might be further
237 * away.
238 */
239 assert(integer_type->alignment <= integer_type->size);
240
241 /* Size is in number of bits. */
242 ptr += (integer_type->size / CHAR_BIT) ;
243 }
244
c651e872
MD
245 ret = lttng_msgpack_end_array(writer);
246end:
247 return ret;
b9f82a28
FD
248}
249
d37ecb3f 250static
c651e872 251int notification_init(struct lttng_event_notifier_notification *notif,
cda77256 252 const struct lttng_ust_event_notifier *event_notifier)
d8d2416d 253{
d37ecb3f 254 struct lttng_msgpack_writer *writer = &notif->writer;
c651e872 255 int ret = 0;
d37ecb3f 256
115db533
MD
257 notif->event_notifier_token = event_notifier->priv->parent.user_token;
258 notif->notification_fd = event_notifier->priv->group->notification_fd;
d37ecb3f
FD
259 notif->has_captures = false;
260
115db533 261 if (event_notifier->priv->num_captures > 0) {
d37ecb3f
FD
262 lttng_msgpack_writer_init(writer, notif->capture_buf,
263 CAPTURE_BUFFER_SIZE);
264
c651e872
MD
265 ret = lttng_msgpack_begin_array(writer, event_notifier->priv->num_captures);
266 if (ret) {
267 goto end;
268 }
d37ecb3f
FD
269 notif->has_captures = true;
270 }
c651e872
MD
271end:
272 return ret;
d37ecb3f
FD
273}
274
275static
c651e872 276int notification_append_capture(
d37ecb3f
FD
277 struct lttng_event_notifier_notification *notif,
278 struct lttng_interpreter_output *output)
279{
280 struct lttng_msgpack_writer *writer = &notif->writer;
c651e872 281 int ret;
d37ecb3f
FD
282
283 switch (output->type) {
284 case LTTNG_INTERPRETER_TYPE_S64:
c651e872 285 ret = lttng_msgpack_write_signed_integer(writer, output->u.s);
d37ecb3f
FD
286 break;
287 case LTTNG_INTERPRETER_TYPE_U64:
c651e872 288 ret = lttng_msgpack_write_unsigned_integer(writer, output->u.u);
d37ecb3f
FD
289 break;
290 case LTTNG_INTERPRETER_TYPE_DOUBLE:
c651e872 291 ret = lttng_msgpack_write_double(writer, output->u.d);
d37ecb3f
FD
292 break;
293 case LTTNG_INTERPRETER_TYPE_STRING:
c651e872 294 ret = lttng_msgpack_write_str(writer, output->u.str.str);
d37ecb3f
FD
295 break;
296 case LTTNG_INTERPRETER_TYPE_SEQUENCE:
c651e872 297 ret = capture_sequence(writer, output);
d37ecb3f
FD
298 break;
299 case LTTNG_INTERPRETER_TYPE_SIGNED_ENUM:
300 case LTTNG_INTERPRETER_TYPE_UNSIGNED_ENUM:
c651e872 301 ret = capture_enum(writer, output);
d37ecb3f
FD
302 break;
303 default:
c651e872
MD
304 CRIT("Unknown capture output type\n");
305 ret = -1;
d37ecb3f 306 }
c651e872 307 return ret;
d37ecb3f
FD
308}
309
310static
c651e872 311int notification_append_empty_capture(
d37ecb3f
FD
312 struct lttng_event_notifier_notification *notif)
313{
c651e872 314 return lttng_msgpack_write_nil(&notif->writer);
d37ecb3f
FD
315}
316
cda77256 317static void record_error(const struct lttng_ust_event_notifier *event_notifier)
6566528b
FD
318{
319 struct lttng_event_notifier_group *event_notifier_group =
115db533 320 event_notifier->priv->group;
33f43caa 321 struct lttng_counter *error_counter;
6566528b
FD
322 size_t dimension_index[1];
323 int ret;
324
33f43caa
MD
325 error_counter = CMM_LOAD_SHARED(event_notifier_group->error_counter);
326 /*
327 * load-acquire paired with store-release orders creation of the
328 * error counter and setting error_counter_len before the
329 * error_counter is used.
330 * Currently a full memory barrier is used, which could be
331 * turned into acquire-release barriers.
332 */
333 cmm_smp_mb();
c30ad764 334 /* This group may not have an error counter attached to it. */
33f43caa 335 if (!error_counter)
c30ad764
MD
336 return;
337
115db533 338 dimension_index[0] = event_notifier->priv->error_counter_index;
6566528b 339 ret = event_notifier_group->error_counter->ops->counter_add(
33f43caa 340 error_counter->counter, dimension_index, 1);
6566528b
FD
341 if (ret)
342 WARN_ON_ONCE(1);
343}
344
d37ecb3f 345static
6566528b 346void notification_send(struct lttng_event_notifier_notification *notif,
cda77256 347 const struct lttng_ust_event_notifier *event_notifier)
d37ecb3f
FD
348{
349 ssize_t ret;
350 size_t content_len;
351 int iovec_count = 1;
fd17d7ce 352 struct lttng_ust_abi_event_notifier_notification ust_notif = {0};
d37ecb3f
FD
353 struct iovec iov[2];
354
355 assert(notif);
356
115db533 357 ust_notif.token = event_notifier->priv->parent.user_token;
d37ecb3f 358
d8d2416d 359 /*
d37ecb3f
FD
360 * Prepare sending the notification from multiple buffers using an
361 * array of `struct iovec`. The first buffer of the vector is
362 * notification structure itself and is always present.
d8d2416d 363 */
d37ecb3f
FD
364 iov[0].iov_base = &ust_notif;
365 iov[0].iov_len = sizeof(ust_notif);
366
367 if (notif->has_captures) {
368 /*
369 * If captures were requested, the second buffer of the array
370 * is the capture buffer.
371 */
372 assert(notif->writer.buffer);
373 content_len = notif->writer.write_pos - notif->writer.buffer;
d8d2416d 374
d37ecb3f 375 assert(content_len > 0 && content_len <= CAPTURE_BUFFER_SIZE);
d8d2416d 376
d37ecb3f
FD
377 iov[1].iov_base = notif->capture_buf;
378 iov[1].iov_len = content_len;
379
380 iovec_count++;
381 } else {
382 content_len = 0;
383 }
384
385 /*
386 * Update the capture buffer size so that receiver of the buffer will
387 * know how much to expect.
388 */
389 ust_notif.capture_buf_size = content_len;
d8d2416d 390
d37ecb3f 391 /* Send all the buffers. */
516d12da 392 ret = ust_patient_writev(notif->notification_fd, iov, iovec_count);
d8d2416d
FD
393 if (ret == -1) {
394 if (errno == EAGAIN) {
6566528b
FD
395 record_error(event_notifier);
396 DBG("Cannot send event_notifier notification without blocking: %s",
d8d2416d
FD
397 strerror(errno));
398 } else {
399 DBG("Error to sending event notifier notification: %s",
400 strerror(errno));
401 abort();
402 }
403 }
404}
d37ecb3f 405
65c955a5
MD
406/*
407 * Validate that the buffer has enough room to hold empty capture fields.
408 */
409static
410bool validate_buffer_len(struct lttng_event_notifier_notification *notif, size_t captures_left)
411{
412 if (notif->writer.end_write_pos - notif->writer.write_pos < MSG_WRITE_NIL_LEN * captures_left)
413 return false;
414 return true;
415}
416
6566528b 417void lttng_event_notifier_notification_send(
cda77256 418 const struct lttng_ust_event_notifier *event_notifier,
a2e4d05e 419 const char *stack_data,
b2e37d27 420 struct lttng_ust_probe_ctx *probe_ctx,
a2e4d05e 421 struct lttng_ust_notification_ctx *notif_ctx)
d37ecb3f
FD
422{
423 /*
424 * This function is called from the probe, we must do dynamic
425 * allocation in this context.
426 */
427 struct lttng_event_notifier_notification notif = {0};
65c955a5 428 size_t captures_left;
d37ecb3f 429
65c955a5
MD
430 if (notification_init(&notif, event_notifier))
431 goto error;
432
433 captures_left = event_notifier->priv->num_captures;
434 if (!validate_buffer_len(&notif, captures_left))
435 goto error;
d37ecb3f 436
a2e4d05e 437 if (caa_unlikely(notif_ctx->eval_capture)) {
5469a374 438 struct lttng_ust_bytecode_runtime *capture_bc_runtime;
d37ecb3f
FD
439
440 /*
441 * Iterate over all the capture bytecodes. If the interpreter
442 * functions returns successfully, append the value of the
443 * `output` parameter to the capture buffer. If the interpreter
444 * fails, append an empty capture to the buffer.
445 */
a2e4d05e
MD
446 cds_list_for_each_entry_rcu(capture_bc_runtime,
447 &event_notifier->priv->capture_bytecode_runtime_head, node) {
d37ecb3f 448 struct lttng_interpreter_output output;
c651e872 449 uint8_t *save_pos;
65c955a5 450 int ret = -1;
d37ecb3f 451
c651e872 452 lttng_msgpack_save_writer_pos(&notif.writer, &save_pos);
22c30e27 453 if (capture_bc_runtime->interpreter_func(capture_bc_runtime,
b2e37d27 454 stack_data, probe_ctx, &output) == LTTNG_UST_BYTECODE_INTERPRETER_OK)
c651e872 455 ret = notification_append_capture(&notif, &output);
65c955a5 456 if (ret || !validate_buffer_len(&notif, captures_left)) {
c651e872 457 /*
65c955a5
MD
458 * On append capture error or if the generated
459 * buffer data would not leave enough room to
460 * write empty capture fields for the remaining
461 * fields, skip the field capture by restoring
462 * the msgpack writer position and writing an
463 * empty capture field.
c651e872
MD
464 */
465 lttng_msgpack_restore_writer_pos(&notif.writer, save_pos);
65c955a5
MD
466 ret = notification_append_empty_capture(&notif);
467 if (ret)
468 CRIT("Not enough space for empty capture field\n");
c651e872 469 }
d37ecb3f
FD
470 }
471 }
472
65c955a5
MD
473 if (notif.has_captures && lttng_msgpack_end_array(&notif.writer))
474 goto error;
475
d37ecb3f
FD
476 /*
477 * Send the notification (including the capture buffer) to the
478 * sessiond.
479 */
6566528b 480 notification_send(&notif, event_notifier);
65c955a5
MD
481 return;
482
483error:
484 record_error(event_notifier);
c651e872 485 return;
d37ecb3f 486}
This page took 0.055195 seconds and 4 git commands to generate.