Fix: double RCU unlock on event_agent_disable_all

[lttng-tools.git] / src / bin / lttng-sessiond / main.c

diff --git a/src/bin/lttng-sessiond/main.c b/src/bin/lttng-sessiond/main.c
index 43f750a820fbf7c087ca9e5df4d275b3cc065cc9..0e7de6e5e4786d27383eec0481a48504a84b5c04 100644 (file)
--- a/src/bin/lttng-sessiond/main.c
+++ b/src/bin/lttng-sessiond/main.c
@@ -586,6 +586,34 @@ static int generate_lock_file_path(char *path, size_t len)
        return ret;
 }
 
+/*
+ * Wait on consumer process termination.
+ *
+ * Need to be called with the consumer data lock held or from a context
+ * ensuring no concurrent access to data (e.g: cleanup).
+ */
+static void wait_consumer(struct consumer_data *consumer_data)
+{
+       pid_t ret;
+       int status;
+
+       if (consumer_data->pid <= 0) {
+               return;
+       }
+
+       DBG("Waiting for complete teardown of consumerd (PID: %d)",
+                       consumer_data->pid);
+       ret = waitpid(consumer_data->pid, &status, 0);
+       if (ret == -1) {
+               PERROR("consumerd waitpid pid: %d", consumer_data->pid)
+       }
+       if (!WIFEXITED(status)) {
+               ERR("consumerd termination with error: %d",
+                               WEXITSTATUS(ret));
+       }
+       consumer_data->pid = 0;
+}
+
 /*
  * Cleanup the session daemon's data structures.
  */
@@ -680,6 +708,10 @@ static void sessiond_cleanup(void)
                }
        }
 
+       wait_consumer(&kconsumer_data);
+       wait_consumer(&ustconsumer64_data);
+       wait_consumer(&ustconsumer32_data);
+
        DBG("Cleaning up all agent apps");
        agent_app_ht_clean();
 
@@ -1500,7 +1532,6 @@ error:
 
        unlink(consumer_data->err_unix_sock_path);
        unlink(consumer_data->cmd_unix_sock_path);
-       consumer_data->pid = 0;
        pthread_mutex_unlock(&consumer_data->lock);
 
        /* Cleanup metadata socket mutex. */
@@ -1787,6 +1818,12 @@ static void sanitize_wait_queue(struct ust_reg_wait_queue *wait_queue)
                                wait_queue->count--;
                                ust_app_destroy(wait_node->app);
                                free(wait_node);
+                               /*
+                                * Silence warning of use-after-free in
+                                * cds_list_for_each_entry_safe which uses
+                                * __typeof__(*wait_node).
+                                */
+                               wait_node = NULL;
                                break;
                        }
                }
@@ -1989,7 +2026,7 @@ static void *thread_dispatch_ust_registration(void *data)
                                 * Don't care about return value. Let the manage apps threads
                                 * handle app unregistration upon socket close.
                                 */
-                               (void) ust_app_register_done(app->sock);
+                               (void) ust_app_register_done(app);
 
                                /*
                                 * Even if the application socket has been closed, send the app
@@ -2935,6 +2972,8 @@ static int process_client_msg(struct command_ctx *cmd_ctx, int sock,
 
        DBG("Processing client command %d", cmd_ctx->lsm->cmd_type);
 
+       assert(!rcu_read_ongoing());
+
        *sock_error = 0;
 
        switch (cmd_ctx->lsm->cmd_type) {
@@ -4022,6 +4061,7 @@ setup_error:
                session_unlock_list();
        }
 init_setup_error:
+       assert(!rcu_read_ongoing());
        return ret;
 }