Fix: illegal memory access in disable_event

[lttng-tools.git] / src / bin / lttng-sessiond / agent.c

diff --git a/src/bin/lttng-sessiond/agent.c b/src/bin/lttng-sessiond/agent.c
index 29541ac23c57a4979470367f3fe464ef0cf7ef5e..9935e06121005baa69d444559ce87b09899ce2de 100644 (file)
--- a/src/bin/lttng-sessiond/agent.c
+++ b/src/bin/lttng-sessiond/agent.c
@@ -124,7 +124,7 @@ static void destroy_event_agent_rcu(struct rcu_head *head)
        struct agent_event *event =
                caa_container_of(node, struct agent_event, node);
 
-       free(event);
+       agent_destroy_event(event);
 }
 
 /*
@@ -392,14 +392,17 @@ static int disable_event(struct agent_app *app, struct agent_event *event)
                        app->pid, app->sock->fd);
 
        data_size = sizeof(msg);
+       memset(&msg, 0, sizeof(msg));
+       if (lttng_strncpy(msg.name, event->name, sizeof(msg.name))) {
+               ret = LTTNG_ERR_INVALID;
+               goto error;
+       }
 
        ret = send_header(app->sock, data_size, AGENT_CMD_DISABLE, 0);
        if (ret < 0) {
                goto error_io;
        }
 
-       memset(&msg, 0, sizeof(msg));
-       strncpy(msg.name, event->name, sizeof(msg.name));
        ret = send_payload(app->sock, &msg, sizeof(msg));
        if (ret < 0) {
                goto error_io;
@@ -919,8 +922,7 @@ void agent_destroy_event(struct agent_event *event)
 }
 
 /*
- * Destroy an agent completely. Note that the given pointer is NOT freed
- * thus a reference to static or stack data can be passed to this function.
+ * Destroy an agent completely.
  */
 void agent_destroy(struct agent *agt)
 {
@@ -959,6 +961,7 @@ void agent_destroy(struct agent *agt)
        rcu_read_unlock();
 
        ht_cleanup_push(agt->events);
+       free(agt);
 }
 
 /*