Fix: metadata stream leak, missing list removal and locking

The metadata stream is part of a list of metadata streams in the
metadata cache. Its addition to the list should be protected by
the metadata cache lock. It needs to be paired with protection
of list iteration with the same lock.

Removal from the list is entirely missing, and should be added
to lttng_metadata_ring_buffer_release (with proper locking).

This missing list removal was probably not causing issues because the
metadata stream structure was leaked: a kfree() is missing from
lttng_metadata_ring_buffer_release as well.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

diff --git a/lttng-abi.c b/lttng-abi.c
index b0b638d4f5f61168004a5d2b95e75428a1273345..0c41dc3b405518ffc718ea3cf0750209a3c162da 100644 (file)
--- a/lttng-abi.c
+++ b/lttng-abi.c
@@ -984,8 +984,12 @@ int lttng_metadata_ring_buffer_release(struct inode *inode, struct file *file)
        struct lttng_metadata_stream *stream = file->private_data;
        struct lib_ring_buffer *buf = stream->priv;
 
+       mutex_lock(&stream->metadata_cache->lock);
+       list_del(&stream->list);
+       mutex_unlock(&stream->metadata_cache->lock);
        kref_put(&stream->metadata_cache->refcount, metadata_cache_destroy);
        module_put(stream->transport->owner);
+       kfree(stream);
        return lib_ring_buffer_release(inode, file, buf);
 }
 
@@ -1137,8 +1141,10 @@ int lttng_abi_open_metadata_stream(struct file *channel_file)
        if (ret < 0)
                goto fd_error;
 
+       mutex_lock(&session->metadata_cache->lock);
        list_add(&metadata_stream->list,
                &session->metadata_cache->metadata_stream);
+       mutex_unlock(&session->metadata_cache->lock);
        return ret;
 
 fd_error:

diff --git a/lttng-events.c b/lttng-events.c
index ebcc0467a6681278e2e81f174870c5f9582886ae..f5948f076283740f6a16f2487e23a42f26e3ddaa 100644 (file)
--- a/lttng-events.c
+++ b/lttng-events.c
@@ -1662,9 +1662,9 @@ void lttng_metadata_end(struct lttng_session *session)
        if (atomic_dec_return(&session->metadata_cache->producing) == 0) {
                struct lttng_metadata_stream *stream;
 
-               mutex_unlock(&session->metadata_cache->lock);
                list_for_each_entry(stream, &session->metadata_cache->metadata_stream, list)
                        wake_up_interruptible(&stream->read_wait);
+               mutex_unlock(&session->metadata_cache->lock);
        }
 }