Fix: RCU read-side lock released too early in destroy_agent_app

Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>

diff --git a/src/bin/lttng-sessiond/agent-thread.c b/src/bin/lttng-sessiond/agent-thread.c
index 33cb387c906dd744a12aa8dff554fb2dfda13ab8..9ac975cbf1ea9539c4d81db352089b25d12af561 100644 (file)
--- a/src/bin/lttng-sessiond/agent-thread.c
+++ b/src/bin/lttng-sessiond/agent-thread.c
@@ -90,13 +90,13 @@ static void destroy_agent_app(int sock)
        rcu_read_lock();
        app = agent_find_app_by_sock(sock);
        assert(app);
-       rcu_read_unlock();
 
-       /* RCU read side lock is taken in this function call. */
+       /* RCU read side lock is assumed to be held by this function. */
        agent_delete_app(app);
 
        /* The application is freed in a RCU call but the socket is closed here. */
        agent_destroy_app(app);
+       rcu_read_unlock();
 }
 
 /*

diff --git a/src/bin/lttng-sessiond/agent.c b/src/bin/lttng-sessiond/agent.c
index 6375894a7d7dfd45add0b4fc742daa83c2993cd9..1eb64c25e32b937282bd5f1b45c7442d3909b188 100644 (file)
--- a/src/bin/lttng-sessiond/agent.c
+++ b/src/bin/lttng-sessiond/agent.c
@@ -680,6 +680,8 @@ void agent_add_app(struct agent_app *app)
 
 /*
  * Delete agent application from the global hash table.
+ *
+ * rcu_read_lock() must be held by the caller.
  */
 void agent_delete_app(struct agent_app *app)
 {
@@ -691,9 +693,7 @@ void agent_delete_app(struct agent_app *app)
        DBG3("Agent deleting app pid: %d and sock: %d", app->pid, app->sock->fd);
 
        iter.iter.node = &app->node.node;
-       rcu_read_lock();
        ret = lttng_ht_del(agent_apps_ht_by_sock, &iter);
-       rcu_read_unlock();
        assert(!ret);
 }