Fix: channel leak on error

Use a regular pattern for all commands:

If the command callback takes ownership of a pointer or file descriptor,
it sets them to NULL or -1. Therefore, the caller can always try to free
the pointer, or close it if it is greater or equal to 0.

This eliminates memory and fd leaks on error.

Change-Id: I0f9cba5fc0f4c095c8ec8f3e8970de8a10386876
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

diff --git a/liblttng-ust/lttng-ust-abi.c b/liblttng-ust/lttng-ust-abi.c
index ff3aab5313cbc7c0f7bb68a189794b7208cbcb8a..b5c305a951cc23e6a290401ce2b5c03b894e1d3c 100644 (file)
--- a/liblttng-ust/lttng-ust-abi.c
+++ b/liblttng-ust/lttng-ust-abi.c
@@ -498,6 +498,10 @@ int lttng_abi_map_channel(int session_objd,
                goto handle_error;
        }
 
+       /* Ownership of chan_data and wakeup_fd taken by channel handle. */
+       uargs->channel.chan_data = NULL;
+       uargs->channel.wakeup_fd = -1;
+
        chan = shmp(channel_handle, channel_handle->chan);
        assert(chan);
        chan->handle = channel_handle;
@@ -581,24 +585,9 @@ alloc_error:
        channel_destroy(chan, channel_handle, 0);
        return ret;
 
-       /*
-        * error path before channel creation (owning chan_data and
-        * wakeup_fd).
-        */
 handle_error:
 active:
 invalid:
-       {
-               int close_ret;
-
-               lttng_ust_lock_fd_tracker();
-               close_ret = close(wakeup_fd);
-               lttng_ust_unlock_fd_tracker();
-               if (close_ret) {
-                       PERROR("close");
-               }
-       }
-       free(chan_data);
        return ret;
 }
 

diff --git a/liblttng-ust/lttng-ust-comm.c b/liblttng-ust/lttng-ust-comm.c
index 59f14050f1b5dfdd4d53dc73d3730d9387a96142..ead0d7fecbc6d15f03ab120ff9f3524b063bf454 100644 (file)
--- a/liblttng-ust/lttng-ust-comm.c
+++ b/liblttng-ust/lttng-ust-comm.c
@@ -1065,6 +1065,17 @@ int handle_message(struct sock_info *sock_info,
                                        &args, sock_info);
                else
                        ret = -ENOSYS;
+               if (args.channel.wakeup_fd >= 0) {
+                       int close_ret;
+
+                       lttng_ust_lock_fd_tracker();
+                       close_ret = close(args.channel.wakeup_fd);
+                       lttng_ust_unlock_fd_tracker();
+                       args.channel.wakeup_fd = -1;
+                       if (close_ret)
+                               PERROR("close");
+               }
+               free(args.channel.chan_data);
                break;
        }
        case LTTNG_UST_STREAM: