Fix: sessiond: use after free

[lttng-tools.git] / src / bin / lttng-sessiond / cmd.c

diff --git a/src/bin/lttng-sessiond/cmd.c b/src/bin/lttng-sessiond/cmd.c
index cf6764d6171b51446ffa62dec330bd386013500a..28c1290adfb59467d2c3cdef8be3c58beba187eb 100644 (file)
--- a/src/bin/lttng-sessiond/cmd.c
+++ b/src/bin/lttng-sessiond/cmd.c
@@ -3766,8 +3766,8 @@ enum lttng_error_code cmd_list_channels(enum lttng_domain_type domain,
 
                        channel = trace_ust_channel_to_lttng_channel(uchan);
                        if (!channel) {
-                               ret = LTTNG_ERR_NOMEM;
-                               break;
+                               ret_code = LTTNG_ERR_NOMEM;
+                               goto end;
                        }
 
                        extended = (struct lttng_channel_extended *)
@@ -3778,7 +3778,7 @@ enum lttng_error_code cmd_list_channels(enum lttng_domain_type domain,
                        if (ret < 0) {
                                lttng_channel_destroy(channel);
                                ret_code = LTTNG_ERR_UNK;
-                               break;
+                               goto end;
                        }
 
                        extended->discarded_events = discarded_events;
@@ -3789,11 +3789,12 @@ enum lttng_error_code cmd_list_channels(enum lttng_domain_type domain,
                        if (ret) {
                                ERR("Failed to serialize lttng_channel: channel name = '%s'",
                                                channel->name);
+                               lttng_channel_destroy(channel);
                                ret_code = LTTNG_ERR_UNK;
-                               ret = -1;
-                               break;
+                               goto end;
                        }
 
+                       lttng_channel_destroy(channel);
                        i++;
                }
                rcu_read_unlock();