Fix: RCU lock imbalance on error in cmd_snapshot_list_outputs()

The error path of cmd_snapshot_list_outputs() unlocks the
rcu_read_lock. However, this path can be taken without having
ever locked before.

Fixes #1044

Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>

diff --git a/src/bin/lttng-sessiond/cmd.c b/src/bin/lttng-sessiond/cmd.c
index 03c0be68071bc5d760112f2d3d9644f80aee0e41..ffbfd4a6208017fd2543713c041b4f5bf877a5cc 100644 (file)
--- a/src/bin/lttng-sessiond/cmd.c
+++ b/src/bin/lttng-sessiond/cmd.c
@@ -3036,14 +3036,14 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
                if (lttng_strncpy(list[idx].name, output->name,
                                sizeof(list[idx].name))) {
                        ret = -LTTNG_ERR_INVALID;
-                       goto error;
+                       goto error_unlock;
                }
                if (output->consumer->type == CONSUMER_DST_LOCAL) {
                        if (lttng_strncpy(list[idx].ctrl_url,
                                        output->consumer->dst.trace_path,
                                        sizeof(list[idx].ctrl_url))) {
                                ret = -LTTNG_ERR_INVALID;
-                               goto error;
+                               goto error_unlock;
                        }
                } else {
                        /* Control URI. */
@@ -3051,7 +3051,7 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
                                        list[idx].ctrl_url, sizeof(list[idx].ctrl_url));
                        if (ret < 0) {
                                ret = -LTTNG_ERR_NOMEM;
-                               goto error;
+                               goto error_unlock;
                        }
 
                        /* Data URI. */
@@ -3059,7 +3059,7 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
                                        list[idx].data_url, sizeof(list[idx].data_url));
                        if (ret < 0) {
                                ret = -LTTNG_ERR_NOMEM;
-                               goto error;
+                               goto error_unlock;
                        }
                }
                idx++;
@@ -3068,9 +3068,10 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
        *outputs = list;
        list = NULL;
        ret = session->snapshot.nb_output;
+error_unlock:
+       rcu_read_unlock();
 error:
        free(list);
-       rcu_read_unlock();
        return ret;
 }