Fix: illegal memory access in disable_event

[lttng-tools.git] / src / bin / lttng-sessiond / agent.c

diff --git a/src/bin/lttng-sessiond/agent.c b/src/bin/lttng-sessiond/agent.c
index f2283991a029ce954f794cab9d8ee3251074f690..9935e06121005baa69d444559ce87b09899ce2de 100644 (file)
--- a/src/bin/lttng-sessiond/agent.c
+++ b/src/bin/lttng-sessiond/agent.c
@@ -124,7 +124,7 @@ static void destroy_event_agent_rcu(struct rcu_head *head)
        struct agent_event *event =
                caa_container_of(node, struct agent_event, node);
 
-       free(event);
+       agent_destroy_event(event);
 }
 
 /*
@@ -392,14 +392,17 @@ static int disable_event(struct agent_app *app, struct agent_event *event)
                        app->pid, app->sock->fd);
 
        data_size = sizeof(msg);
+       memset(&msg, 0, sizeof(msg));
+       if (lttng_strncpy(msg.name, event->name, sizeof(msg.name))) {
+               ret = LTTNG_ERR_INVALID;
+               goto error;
+       }
 
        ret = send_header(app->sock, data_size, AGENT_CMD_DISABLE, 0);
        if (ret < 0) {
                goto error_io;
        }
 
-       memset(&msg, 0, sizeof(msg));
-       strncpy(msg.name, event->name, sizeof(msg.name));
        ret = send_payload(app->sock, &msg, sizeof(msg));
        if (ret < 0) {
                goto error_io;
@@ -443,7 +446,7 @@ int agent_send_registration_done(struct agent_app *app)
 
        DBG("Agent sending registration done to app socket %d", app->sock->fd);
 
-       return send_header(app->sock, 0, AGENT_CMD_REG_DONE, 0);
+       return send_header(app->sock, 0, AGENT_CMD_REG_DONE, 1);
 }
 
 /*
@@ -493,11 +496,14 @@ error:
 int agent_disable_event(struct agent_event *event,
                enum lttng_domain_type domain)
 {
-       int ret;
+       int ret = LTTNG_OK;
        struct agent_app *app;
        struct lttng_ht_iter iter;
 
        assert(event);
+       if (!event->enabled) {
+               goto end;
+       }
 
        rcu_read_lock();
 
@@ -515,10 +521,10 @@ int agent_disable_event(struct agent_event *event,
        }
 
        event->enabled = 0;
-       ret = LTTNG_OK;
 
 error:
        rcu_read_unlock();
+end:
        return ret;
 }
 
@@ -677,6 +683,8 @@ void agent_add_app(struct agent_app *app)
 
 /*
  * Delete agent application from the global hash table.
+ *
+ * rcu_read_lock() must be held by the caller.
  */
 void agent_delete_app(struct agent_app *app)
 {
@@ -688,9 +696,7 @@ void agent_delete_app(struct agent_app *app)
        DBG3("Agent deleting app pid: %d and sock: %d", app->pid, app->sock->fd);
 
        iter.iter.node = &app->node.node;
-       rcu_read_lock();
        ret = lttng_ht_del(agent_apps_ht_by_sock, &iter);
-       rcu_read_unlock();
        assert(!ret);
 }
 
@@ -897,7 +903,7 @@ struct agent_event *agent_find_event(const char *name, int loglevel,
        return caa_container_of(node, struct agent_event, node);
 
 error:
-       DBG3("Agent NOT found %s.", name);
+       DBG3("Agent event NOT found %s.", name);
        return NULL;
 }
 
@@ -911,12 +917,12 @@ void agent_destroy_event(struct agent_event *event)
        assert(event);
 
        free(event->filter);
+       free(event->filter_expression);
        free(event);
 }
 
 /*
- * Destroy an agent completely. Note that the given pointer is NOT freed
- * thus a reference to static or stack data can be passed to this function.
+ * Destroy an agent completely.
  */
 void agent_destroy(struct agent *agt)
 {
@@ -955,19 +961,71 @@ void agent_destroy(struct agent *agt)
        rcu_read_unlock();
 
        ht_cleanup_push(agt->events);
+       free(agt);
 }
 
 /*
- * Initialize agent subsystem.
+ * Allocate agent_apps_ht_by_sock.
  */
-int agent_setup(void)
+int agent_app_ht_alloc(void)
 {
+       int ret = 0;
+
        agent_apps_ht_by_sock = lttng_ht_new(0, LTTNG_HT_TYPE_ULONG);
        if (!agent_apps_ht_by_sock) {
-               return -1;
+               ret = -1;
        }
 
-       return 0;
+       return ret;
+}
+
+/*
+ * Destroy a agent application by socket.
+ */
+void agent_destroy_app_by_sock(int sock)
+{
+       struct agent_app *app;
+
+       assert(sock >= 0);
+
+       /*
+        * Not finding an application is a very important error that should NEVER
+        * happen. The hash table deletion is ONLY done through this call when the
+        * main sessiond thread is torn down.
+        */
+       rcu_read_lock();
+       app = agent_find_app_by_sock(sock);
+       assert(app);
+
+       /* RCU read side lock is assumed to be held by this function. */
+       agent_delete_app(app);
+
+       /* The application is freed in a RCU call but the socket is closed here. */
+       agent_destroy_app(app);
+       rcu_read_unlock();
+}
+
+/*
+ * Clean-up the agent app hash table and destroy it.
+ */
+void agent_app_ht_clean(void)
+{
+       struct lttng_ht_node_ulong *node;
+       struct lttng_ht_iter iter;
+
+       if (!agent_apps_ht_by_sock) {
+               return;
+       }
+       rcu_read_lock();
+       cds_lfht_for_each_entry(agent_apps_ht_by_sock->ht, &iter.iter, node, node) {
+               struct agent_app *app;
+
+               app = caa_container_of(node, struct agent_app, node);
+               agent_destroy_app_by_sock(app->sock->fd);
+       }
+       rcu_read_unlock();
+
+       lttng_ht_destroy(agent_apps_ht_by_sock);
 }
 
 /*