Fix: RCU lock imbalance on error in cmd_snapshot_list_outputs()

The error path of cmd_snapshot_list_outputs() unlocks the
rcu_read_lock. However, this path can be taken without having
ever locked before.

Fixes #1044

Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>

diff --git a/src/bin/lttng-sessiond/cmd.c b/src/bin/lttng-sessiond/cmd.c
index a57afe2c3016be26e9b378d9f42996bbc6cd7545..86c3c765c8dfb2173137894a4fceffb156515ce9 100644 (file)
--- a/src/bin/lttng-sessiond/cmd.c
+++ b/src/bin/lttng-sessiond/cmd.c
@@ -3352,14 +3352,14 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
                if (lttng_strncpy(list[idx].name, output->name,
                                sizeof(list[idx].name))) {
                        ret = -LTTNG_ERR_INVALID;
-                       goto error;
+                       goto error_unlock;
                }
                if (output->consumer->type == CONSUMER_DST_LOCAL) {
                        if (lttng_strncpy(list[idx].ctrl_url,
                                        output->consumer->dst.trace_path,
                                        sizeof(list[idx].ctrl_url))) {
                                ret = -LTTNG_ERR_INVALID;
-                               goto error;
+                               goto error_unlock;
                        }
                } else {
                        /* Control URI. */
@@ -3367,7 +3367,7 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
                                        list[idx].ctrl_url, sizeof(list[idx].ctrl_url));
                        if (ret < 0) {
                                ret = -LTTNG_ERR_NOMEM;
-                               goto error;
+                               goto error_unlock;
                        }
 
                        /* Data URI. */
@@ -3375,7 +3375,7 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
                                        list[idx].data_url, sizeof(list[idx].data_url));
                        if (ret < 0) {
                                ret = -LTTNG_ERR_NOMEM;
-                               goto error;
+                               goto error_unlock;
                        }
                }
                idx++;
@@ -3384,9 +3384,10 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
        *outputs = list;
        list = NULL;
        ret = session->snapshot.nb_output;
+error_unlock:
+       rcu_read_unlock();
 error:
        free(list);
-       rcu_read_unlock();
        return ret;
 }