Fix: lttng-sessiond segfault during session destruction

In `cmd.c:cmd_destroy_session()`, if rotate_size is set for the
session, the condition is unsubscribed.

During unsubscription, the session's stored value is never nulled
out. It could happen that later, after the session is unlocked, the
rotate thread may try to do another round of unsubscribe/subscribe,
causing a double free of the condition.

Change-Id: I183a32224d25345a2088959e6d5c4e41a82d6801
Signed-off-by: Kienan Stewart <kstewart@efficios.com>
Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>

Author: kienanstewart

src/bin/lttng-sessiond/rotate.c

@@ -124,13 +124,15 @@ int unsubscribe_session_consumed_size_rotation(struct ltt_session *session,
 		ret = -1;
 		goto end;
 	}
+	session->rotate_condition = NULL;
 
 	ret = notification_thread_command_unregister_trigger(
 			notification_thread_handle, session->rotate_trigger);
 	if (ret != LTTNG_OK) {
 		ERR("Session unregister trigger error: %d", ret);
 		goto end;
 	}
+	session->rotate_trigger = NULL;
 
 	ret = 0;
 end: