Fix: sessiond: bad fd used while rotating exiting app's buffers

[lttng-tools.git] / src / bin / lttng-sessiond / session.c

diff --git a/src/bin/lttng-sessiond/session.c b/src/bin/lttng-sessiond/session.c
index 2d95aa2687cf2be475faf953a93172c54c7a81ed..39edbdf6945d637aa6413b6825377618e262bf9d 100644 (file)
--- a/src/bin/lttng-sessiond/session.c
+++ b/src/bin/lttng-sessiond/session.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 David Goulet <david.goulet@polymtl.ca>
+ * Copyright (C) 2011 EfficiOS Inc.
  *
  * SPDX-License-Identifier: GPL-2.0-only
  *
@@ -377,28 +377,49 @@ end:
 
 /*
  * Test if ltt_sessions_ht_by_id/name are empty.
- * Return 1 if empty, 0 if not empty.
+ * Return `false` if hash table objects are null.
  * The session list lock must be held.
  */
-static int ltt_sessions_ht_empty(void)
+static bool ltt_sessions_ht_empty(void)
 {
-       unsigned long count;
+       bool empty = false;
 
        if (!ltt_sessions_ht_by_id) {
-               count = 0;
+               /* The hash tables do not exist yet. */
                goto end;
        }
 
        assert(ltt_sessions_ht_by_name);
 
-       count = lttng_ht_get_count(ltt_sessions_ht_by_id);
-       assert(count == lttng_ht_get_count(ltt_sessions_ht_by_name));
+       if (lttng_ht_get_count(ltt_sessions_ht_by_id) != 0) {
+               /* Not empty.*/
+               goto end;
+       }
+
+       /*
+        * At this point it is expected that the `ltt_sessions_ht_by_name` ht is
+        * empty.
+        *
+        * The removal from both hash tables is done in two different
+        * places:
+        *   - removal from `ltt_sessions_ht_by_name` is done during
+        *     `session_destroy()`
+        *   - removal from `ltt_sessions_ht_by_id` is done later
+        *     in `session_release()` on the last reference put.
+        *
+        * This means that it is possible for `ltt_sessions_ht_by_name` to be
+        * empty but for `ltt_sessions_ht_by_id` to still contain objects when
+        * multiple sessions exists. The reverse is false, hence this sanity
+        * check.
+        */
+       assert(lttng_ht_get_count(ltt_sessions_ht_by_name) == 0);
+       empty = true;
 end:
-       return count ? 0 : 1;
+       return empty;
 }
 
 /*
- * Remove a ltt_session from the ltt_sessions_ht_by_id/name.
+ * Remove a ltt_session from the ltt_sessions_ht_by_id.
  * If empty, the ltt_sessions_ht_by_id/name HTs are freed.
  * The session list lock must be held.
  */
@@ -415,10 +436,6 @@ static void del_session_ht(struct ltt_session *ls)
        ret = lttng_ht_del(ltt_sessions_ht_by_id, &iter);
        assert(!ret);
 
-       iter.iter.node = &ls->node_by_name.node;
-       ret = lttng_ht_del(ltt_sessions_ht_by_name, &iter);
-       assert(!ret);
-
        if (ltt_sessions_ht_empty()) {
                DBG("Empty ltt_sessions_ht_by_id/name, destroying hast tables");
                ltt_sessions_ht_destroy();
@@ -1015,6 +1032,7 @@ void session_release(struct urcu_ref *ref)
        lttng_dynamic_array_reset(&session->clear_notifiers);
        free(session->last_archived_chunk_name);
        free(session->base_path);
+       lttng_trigger_put(session->rotate_trigger);
        free(session);
        if (session_published) {
                /*
@@ -1065,8 +1083,23 @@ void session_put(struct ltt_session *session)
  */
 void session_destroy(struct ltt_session *session)
 {
+       int ret;
+       struct lttng_ht_iter iter;
+
        assert(!session->destroyed);
        session->destroyed = true;
+
+       /*
+        * Remove immediately from the "session by name" hash table. Only one
+        * session is expected to exist with a given name for at any given time.
+        *
+        * Even if a session still technically exists for a little while longer,
+        * there is no point in performing action on a "destroyed" session.
+        */
+       iter.iter.node = &session->node_by_name.node;
+       ret = lttng_ht_del(ltt_sessions_ht_by_name, &iter);
+       assert(!ret);
+
        session_put(session);
 }
 
@@ -1383,6 +1416,7 @@ int session_reset_rotation_state(struct ltt_session *session,
                 */
                session_notify_clear(session);
        }
+
        return ret;
 }