Fix: race between statedump and library destructor
authorMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Thu, 20 Sep 2018 18:11:17 +0000 (14:11 -0400)
committerMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Thu, 20 Sep 2018 19:12:44 +0000 (15:12 -0400)
commit4a013d7a122a3ab19972848036cac24d1b47883c
tree5c2e8c0a1b4949d3ceb2dd999857fd0ea4bbedc7
parent5fe0ab0b1d4d0b91f0fefcd38d2afaace9a0f712
Fix: race between statedump and library destructor

The locking scheme for ust_lock() returns a teardown state (variable
lttng_ust_comm_should_quit) which is set by library destructor with lock
held.

It requires that when ust listener threads use this lock to protect
against concurrent accesses to a data structure, in addition to take
the lock, they need to check the return value of ust_lock() and
skip their critical section entirely if the return value indicates
that teardown is ongoing.

Iteration over all loaded libraries by lttng_ust_dl_update() starts by
iter_begin which grabs the lock, and sets data->cancel state
appropriately if teardown is ongoing. Then extract_bin_info_events()
uses the data->cancel state to skip over use of the protected structures
as needed, but iter_end() fails to take this data->cancel state into
account. Therefore, it can access data structures concurrently while
their teardown is ongoing which leads to crashes.

Fixes: #1169
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
liblttng-ust/lttng-ust-statedump.c
This page took 0.024824 seconds and 4 git commands to generate.