Fix: lttng-modules teardown NULL pointer OOPS

Accessing the lttng channel and lttng session from the metadata ring
buffer client is a bad idea, because we don't have any reference
ensuring those are valid for the lifetime of the metadata cache.
Therefore, rather than keeping a lttng channel as private data pointer
for the metadata ring buffer channel, keep a pointer to the metadata
cache instead: this will ensure we don't shoot ourself in the foot and
access data we for which coherency is not guaranteed (we don't hold any
reference to it).

Anyway, the only reason why we needed to access the lttng session from
the metadata client in the first place was the UUID of the session. Copy
it into the metadata cache instead.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

diff --git a/lttng-events.c b/lttng-events.c
index 98992f9f7943047f967233edffb4083df39585b8..39e04e51dd0918559b03f35f1f4a215726abb95c 100644 (file)
--- a/lttng-events.c
+++ b/lttng-events.c
@@ -98,6 +98,8 @@ struct lttng_session *lttng_session_create(void)
        kref_init(&metadata_cache->refcount);
        session->metadata_cache = metadata_cache;
        INIT_LIST_HEAD(&metadata_cache->metadata_stream);
+       memcpy(&metadata_cache->uuid, &session->uuid,
+               sizeof(metadata_cache->uuid));
        list_add(&session->list, &sessions);
        mutex_unlock(&sessions_mutex);
        return session;

diff --git a/lttng-events.h b/lttng-events.h
index 3e8f80935e6449a196d88adc3a0ed2fcb77599d2..c84689cb3c96cd8ef703486ba3a6928ad263b226 100644 (file)
--- a/lttng-events.h
+++ b/lttng-events.h
@@ -333,6 +333,7 @@ struct lttng_metadata_cache {
        unsigned int metadata_written;  /* Number of bytes written in metadata cache */
        struct kref refcount;           /* Metadata cache usage */
        struct list_head metadata_stream;       /* Metadata stream list */
+       uuid_le uuid;                   /* Trace session unique ID (copy) */
 };
 
 struct lttng_session *lttng_session_create(void);

diff --git a/lttng-ring-buffer-metadata-client.h b/lttng-ring-buffer-metadata-client.h
index f077f4f6c523b56f2c20337a893afa25827037eb..9e0353042517e5fbb38dd191778aab51e3ed7800 100644 (file)
--- a/lttng-ring-buffer-metadata-client.h
+++ b/lttng-ring-buffer-metadata-client.h
@@ -99,11 +99,12 @@ static void client_buffer_begin(struct lib_ring_buffer *buf, u64 tsc,
                (struct metadata_packet_header *)
                        lib_ring_buffer_offset_address(&buf->backend,
                                subbuf_idx * chan->backend.subbuf_size);
-       struct lttng_channel *lttng_chan = channel_get_private(chan);
-       struct lttng_session *session = lttng_chan->session;
+       struct lttng_metadata_cache *metadata_cache =
+               channel_get_private(chan);
 
        header->magic = TSDL_MAGIC_NUMBER;
-       memcpy(header->uuid, session->uuid.b, sizeof(session->uuid));
+       memcpy(header->uuid, metadata_cache->uuid.b,
+               sizeof(metadata_cache->uuid));
        header->checksum = 0;           /* 0 if unused */
        header->content_size = 0xFFFFFFFF; /* in bits, for debugging */
        header->packet_size = 0xFFFFFFFF;  /* in bits, for debugging */
@@ -239,7 +240,8 @@ struct channel *_channel_create(const char *name,
 {
        struct channel *chan;
 
-       chan = channel_create(&client_config, name, lttng_chan, buf_addr,
+       chan = channel_create(&client_config, name,
+                             lttng_chan->session->metadata_cache, buf_addr,
                              subbuf_size, num_subbuf, switch_timer_interval,
                              read_timer_interval);
        if (chan) {