Fix: double RCU unlock on event_agent_disable_all

[lttng-tools.git] / src / bin / lttng-sessiond / main.c

diff --git a/src/bin/lttng-sessiond/main.c b/src/bin/lttng-sessiond/main.c
index c5c7d84b1f5d7bb0d434fff7f187665ca9041cc7..0e7de6e5e4786d27383eec0481a48504a84b5c04 100644 (file)
--- a/src/bin/lttng-sessiond/main.c
+++ b/src/bin/lttng-sessiond/main.c
@@ -586,6 +586,34 @@ static int generate_lock_file_path(char *path, size_t len)
        return ret;
 }
 
+/*
+ * Wait on consumer process termination.
+ *
+ * Need to be called with the consumer data lock held or from a context
+ * ensuring no concurrent access to data (e.g: cleanup).
+ */
+static void wait_consumer(struct consumer_data *consumer_data)
+{
+       pid_t ret;
+       int status;
+
+       if (consumer_data->pid <= 0) {
+               return;
+       }
+
+       DBG("Waiting for complete teardown of consumerd (PID: %d)",
+                       consumer_data->pid);
+       ret = waitpid(consumer_data->pid, &status, 0);
+       if (ret == -1) {
+               PERROR("consumerd waitpid pid: %d", consumer_data->pid)
+       }
+       if (!WIFEXITED(status)) {
+               ERR("consumerd termination with error: %d",
+                               WEXITSTATUS(ret));
+       }
+       consumer_data->pid = 0;
+}
+
 /*
  * Cleanup the session daemon's data structures.
  */
@@ -680,6 +708,10 @@ static void sessiond_cleanup(void)
                }
        }
 
+       wait_consumer(&kconsumer_data);
+       wait_consumer(&ustconsumer64_data);
+       wait_consumer(&ustconsumer32_data);
+
        DBG("Cleaning up all agent apps");
        agent_app_ht_clean();
 
@@ -1216,6 +1248,9 @@ static void *thread_manage_consumer(void *data)
 
        DBG("[thread] Manage consumer started");
 
+       rcu_register_thread();
+       rcu_thread_online();
+
        health_register(health_sessiond, HEALTH_SESSIOND_TYPE_CONSUMER);
 
        health_code_update();
@@ -1497,7 +1532,6 @@ error:
 
        unlink(consumer_data->err_unix_sock_path);
        unlink(consumer_data->cmd_unix_sock_path);
-       consumer_data->pid = 0;
        pthread_mutex_unlock(&consumer_data->lock);
 
        /* Cleanup metadata socket mutex. */
@@ -1514,6 +1548,9 @@ error_poll:
        health_unregister(health_sessiond);
        DBG("consumer thread cleanup completed");
 
+       rcu_thread_offline();
+       rcu_unregister_thread();
+
        return NULL;
 }
 
@@ -1781,6 +1818,12 @@ static void sanitize_wait_queue(struct ust_reg_wait_queue *wait_queue)
                                wait_queue->count--;
                                ust_app_destroy(wait_node->app);
                                free(wait_node);
+                               /*
+                                * Silence warning of use-after-free in
+                                * cds_list_for_each_entry_safe which uses
+                                * __typeof__(*wait_node).
+                                */
+                               wait_node = NULL;
                                break;
                        }
                }
@@ -1983,7 +2026,7 @@ static void *thread_dispatch_ust_registration(void *data)
                                 * Don't care about return value. Let the manage apps threads
                                 * handle app unregistration upon socket close.
                                 */
-                               (void) ust_app_register_done(app->sock);
+                               (void) ust_app_register_done(app);
 
                                /*
                                 * Even if the application socket has been closed, send the app
@@ -2025,6 +2068,22 @@ error:
                free(wait_node);
        }
 
+       /* Empty command queue. */
+       for (;;) {
+               /* Dequeue command for registration */
+               node = cds_wfcq_dequeue_blocking(&ust_cmd_queue.head, &ust_cmd_queue.tail);
+               if (node == NULL) {
+                       break;
+               }
+               ust_cmd = caa_container_of(node, struct ust_command, node);
+               ret = close(ust_cmd->sock);
+               if (ret < 0) {
+                       PERROR("close ust sock exit dispatch %d", ust_cmd->sock);
+               }
+               lttng_fd_put(LTTNG_FD_APPS, 1);
+               free(ust_cmd);
+       }
+
 error_testpoint:
        DBG("Dispatch thread dying");
        if (err) {
@@ -2913,6 +2972,8 @@ static int process_client_msg(struct command_ctx *cmd_ctx, int sock,
 
        DBG("Processing client command %d", cmd_ctx->lsm->cmd_type);
 
+       assert(!rcu_read_ongoing());
+
        *sock_error = 0;
 
        switch (cmd_ctx->lsm->cmd_type) {
@@ -4000,6 +4061,7 @@ setup_error:
                session_unlock_list();
        }
 init_setup_error:
+       assert(!rcu_read_ongoing());
        return ret;
 }
 
@@ -5967,6 +6029,10 @@ exit_apps:
        }
 exit_reg_apps:
 
+       /*
+        * Join dispatch thread after joining reg_apps_thread to ensure
+        * we don't leak applications in the queue.
+        */
        ret = pthread_join(dispatch_thread, &status);
        if (ret) {
                errno = ret;
@@ -6032,6 +6098,9 @@ exit_options:
        sessiond_cleanup_options();
 
 exit_set_signal_handler:
+       /* Ensure all prior call_rcu are done. */
+       rcu_barrier();
+
        if (!retval) {
                exit(EXIT_SUCCESS);
        } else {