Fix: lttng-modules teardown NULL pointer OOPS

Accessing the lttng channel and lttng session from the metadata ring
buffer client is a bad idea, because we don't have any reference
ensuring those are valid for the lifetime of the metadata cache.
Therefore, rather than keeping a lttng channel as private data pointer
for the metadata ring buffer channel, keep a pointer to the metadata
cache instead: this will ensure we don't shoot ourself in the foot and
access data we for which coherency is not guaranteed (we don't hold any
reference to it).

Anyway, the only reason why we needed to access the lttng session from
the metadata client in the first place was the UUID of the session. Copy
it into the metadata cache instead.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

diff --git a/lttng-events.c b/lttng-events.c
index 1fecff8efc279a76de3c8344f23236d485f7e5b8..b2d0d754907d863903566921d0ac3521619978df 100644 (file)
--- a/lttng-events.c
+++ b/lttng-events.c
@@ -98,6 +98,8 @@ struct lttng_session *lttng_session_create(void)
        kref_init(&metadata_cache->refcount);
        session->metadata_cache = metadata_cache;
        INIT_LIST_HEAD(&metadata_cache->metadata_stream);
+       memcpy(&metadata_cache->uuid, &session->uuid,
+               sizeof(metadata_cache->uuid));
        list_add(&session->list, &sessions);
        mutex_unlock(&sessions_mutex);
        return session;

diff --git a/lttng-events.h b/lttng-events.h
index b09bd4fceaf352d7f1508c1cd90e8c40203a7cae..64a1ac56777f5a141c012b758a449e34fed16627 100644 (file)
--- a/lttng-events.h
+++ b/lttng-events.h
@@ -333,6 +333,7 @@ struct lttng_metadata_cache {
        unsigned int metadata_written;  /* Number of bytes written in metadata cache */
        struct kref refcount;           /* Metadata cache usage */
        struct list_head metadata_stream;       /* Metadata stream list */
+       uuid_le uuid;                   /* Trace session unique ID (copy) */
 };
 
 struct lttng_session *lttng_session_create(void);

diff --git a/lttng-ring-buffer-metadata-client.h b/lttng-ring-buffer-metadata-client.h
index f077f4f6c523b56f2c20337a893afa25827037eb..9e0353042517e5fbb38dd191778aab51e3ed7800 100644 (file)
--- a/lttng-ring-buffer-metadata-client.h
+++ b/lttng-ring-buffer-metadata-client.h
@@ -99,11 +99,12 @@ static void client_buffer_begin(struct lib_ring_buffer *buf, u64 tsc,
                (struct metadata_packet_header *)
                        lib_ring_buffer_offset_address(&buf->backend,
                                subbuf_idx * chan->backend.subbuf_size);
-       struct lttng_channel *lttng_chan = channel_get_private(chan);
-       struct lttng_session *session = lttng_chan->session;
+       struct lttng_metadata_cache *metadata_cache =
+               channel_get_private(chan);
 
        header->magic = TSDL_MAGIC_NUMBER;
-       memcpy(header->uuid, session->uuid.b, sizeof(session->uuid));
+       memcpy(header->uuid, metadata_cache->uuid.b,
+               sizeof(metadata_cache->uuid));
        header->checksum = 0;           /* 0 if unused */
        header->content_size = 0xFFFFFFFF; /* in bits, for debugging */
        header->packet_size = 0xFFFFFFFF;  /* in bits, for debugging */
@@ -239,7 +240,8 @@ struct channel *_channel_create(const char *name,
 {
        struct channel *chan;
 
-       chan = channel_create(&client_config, name, lttng_chan, buf_addr,
+       chan = channel_create(&client_config, name,
+                             lttng_chan->session->metadata_cache, buf_addr,
                              subbuf_size, num_subbuf, switch_timer_interval,
                              read_timer_interval);
        if (chan) {