Fix: sessiond: use after free

[lttng-tools.git] / src / bin / lttng-sessiond / cmd.c

diff --git a/src/bin/lttng-sessiond/cmd.c b/src/bin/lttng-sessiond/cmd.c
index 74c50579307ea24d3ef0f6582d6c8e421ded8312..28c1290adfb59467d2c3cdef8be3c58beba187eb 100644 (file)
--- a/src/bin/lttng-sessiond/cmd.c
+++ b/src/bin/lttng-sessiond/cmd.c
@@ -388,7 +388,7 @@ static enum lttng_error_code list_lttng_ust_global_events(char *channel_name,
        node = lttng_ht_iter_get_node_str(&iter);
        if (node == NULL) {
                ret_code = LTTNG_ERR_UST_CHAN_NOT_FOUND;
-               goto end;
+               goto error;
        }
 
        uchan = caa_container_of(&node->node, struct ltt_ust_channel, node.node);
@@ -421,14 +421,14 @@ static enum lttng_error_code list_lttng_ust_global_events(char *channel_name,
                tmp_event = lttng_event_create();
                if (!tmp_event) {
                        ret_code = LTTNG_ERR_NOMEM;
-                       goto end;
+                       goto error;
                }
 
                if (lttng_strncpy(tmp_event->name, uevent->attr.name,
                                LTTNG_SYMBOL_NAME_LEN)) {
                        ret_code = LTTNG_ERR_FATAL;
                        lttng_event_destroy(tmp_event);
-                       goto end;
+                       goto error;
                }
 
                tmp_event->name[LTTNG_SYMBOL_NAME_LEN - 1] = '\0';
@@ -2560,31 +2560,70 @@ error:
 /*
  * Command LTTNG_LIST_TRACEPOINT_FIELDS processed by the client thread.
  */
-ssize_t cmd_list_tracepoint_fields(enum lttng_domain_type domain,
-               struct lttng_event_field **fields)
+enum lttng_error_code cmd_list_tracepoint_fields(enum lttng_domain_type domain,
+               struct lttng_payload *reply)
 {
+       enum lttng_error_code ret_code;
        int ret;
-       ssize_t nb_fields = 0;
+       unsigned int i, nb_fields;
+       struct lttng_event_field *fields = NULL;
+       struct lttcomm_list_command_header reply_command_header = {};
+       size_t reply_command_header_offset;
+
+       assert(reply);
+
+       /* Reserve space for command reply header. */
+       reply_command_header_offset = reply->buffer.size;
+       ret = lttng_dynamic_buffer_set_size(&reply->buffer,
+                       reply_command_header_offset +
+                               sizeof(struct lttcomm_list_command_header));
+       if (ret) {
+               ret_code = LTTNG_ERR_NOMEM;
+               goto error;
+       }
 
        switch (domain) {
        case LTTNG_DOMAIN_UST:
-               nb_fields = ust_app_list_event_fields(fields);
-               if (nb_fields < 0) {
-                       ret = LTTNG_ERR_UST_LIST_FAIL;
+               ret = ust_app_list_event_fields(&fields);
+               if (ret < 0) {
+                       ret_code = LTTNG_ERR_UST_LIST_FAIL;
                        goto error;
                }
+
                break;
        case LTTNG_DOMAIN_KERNEL:
        default:        /* fall-through */
-               ret = LTTNG_ERR_UND;
+               ret_code = LTTNG_ERR_UND;
+               goto error;
+       }
+
+       nb_fields = ret;
+
+       for (i = 0; i < nb_fields; i++) {
+               ret = lttng_event_field_serialize(&fields[i], reply);
+               if (ret) {
+                       ret_code = LTTNG_ERR_NOMEM;
+                       goto error;
+               }
+       }
+
+       if (nb_fields > UINT32_MAX) {
+               ERR("Tracepoint field count would overflow the tracepoint field listing command's reply");
+               ret_code = LTTNG_ERR_OVERFLOW;
                goto error;
        }
 
-       return nb_fields;
+       /* Update command reply header. */
+       reply_command_header.count = (uint32_t) nb_fields;
+
+       memcpy(reply->buffer.data + reply_command_header_offset, &reply_command_header,
+                       sizeof(reply_command_header));
+
+       ret_code = LTTNG_OK;
 
 error:
-       /* Return negative value to differentiate return code */
-       return -ret;
+       free(fields);
+       return ret_code;
 }
 
 enum lttng_error_code cmd_list_syscalls(
@@ -3727,8 +3766,8 @@ enum lttng_error_code cmd_list_channels(enum lttng_domain_type domain,
 
                        channel = trace_ust_channel_to_lttng_channel(uchan);
                        if (!channel) {
-                               ret = LTTNG_ERR_NOMEM;
-                               break;
+                               ret_code = LTTNG_ERR_NOMEM;
+                               goto end;
                        }
 
                        extended = (struct lttng_channel_extended *)
@@ -3739,7 +3778,7 @@ enum lttng_error_code cmd_list_channels(enum lttng_domain_type domain,
                        if (ret < 0) {
                                lttng_channel_destroy(channel);
                                ret_code = LTTNG_ERR_UNK;
-                               break;
+                               goto end;
                        }
 
                        extended->discarded_events = discarded_events;
@@ -3750,11 +3789,12 @@ enum lttng_error_code cmd_list_channels(enum lttng_domain_type domain,
                        if (ret) {
                                ERR("Failed to serialize lttng_channel: channel name = '%s'",
                                                channel->name);
+                               lttng_channel_destroy(channel);
                                ret_code = LTTNG_ERR_UNK;
-                               ret = -1;
-                               break;
+                               goto end;
                        }
 
+                       lttng_channel_destroy(channel);
                        i++;
                }
                rcu_read_unlock();