From: Jérémie Galarneau <jeremie.galarneau@efficios.com>
Date: Thu, 25 Aug 2016 20:20:47 +0000 (-0400)
Subject: Fix: RCU lock imbalance on error in cmd_snapshot_list_outputs()
X-Git-Tag: v2.7.5~15
X-Git-Url: https://git.lttng.org./?a=commitdiff_plain;h=a2fe8e46e08f794cc5bce047e507e5a86600e9d4;p=lttng-tools.git

Fix: RCU lock imbalance on error in cmd_snapshot_list_outputs()

The error path of cmd_snapshot_list_outputs() unlocks the
rcu_read_lock. However, this path can be taken without having
ever locked before.

Fixes #1044

Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
---

diff --git a/src/bin/lttng-sessiond/cmd.c b/src/bin/lttng-sessiond/cmd.c
index 03c0be680..ffbfd4a62 100644
--- a/src/bin/lttng-sessiond/cmd.c
+++ b/src/bin/lttng-sessiond/cmd.c
@@ -3036,14 +3036,14 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
 		if (lttng_strncpy(list[idx].name, output->name,
 				sizeof(list[idx].name))) {
 			ret = -LTTNG_ERR_INVALID;
-			goto error;
+			goto error_unlock;
 		}
 		if (output->consumer->type == CONSUMER_DST_LOCAL) {
 			if (lttng_strncpy(list[idx].ctrl_url,
 					output->consumer->dst.trace_path,
 					sizeof(list[idx].ctrl_url))) {
 				ret = -LTTNG_ERR_INVALID;
-				goto error;
+				goto error_unlock;
 			}
 		} else {
 			/* Control URI. */
@@ -3051,7 +3051,7 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
 					list[idx].ctrl_url, sizeof(list[idx].ctrl_url));
 			if (ret < 0) {
 				ret = -LTTNG_ERR_NOMEM;
-				goto error;
+				goto error_unlock;
 			}
 
 			/* Data URI. */
@@ -3059,7 +3059,7 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
 					list[idx].data_url, sizeof(list[idx].data_url));
 			if (ret < 0) {
 				ret = -LTTNG_ERR_NOMEM;
-				goto error;
+				goto error_unlock;
 			}
 		}
 		idx++;
@@ -3068,9 +3068,10 @@ ssize_t cmd_snapshot_list_outputs(struct ltt_session *session,
 	*outputs = list;
 	list = NULL;
 	ret = session->snapshot.nb_output;
+error_unlock:
+	rcu_read_unlock();
 error:
 	free(list);
-	rcu_read_unlock();
 	return ret;
 }