Fix: lttng_trace_archive_location_serialize is called on freed memory

[lttng-tools.git] / src / bin / lttng-sessiond / cmd.c

diff --git a/src/bin/lttng-sessiond/cmd.c b/src/bin/lttng-sessiond/cmd.c
index b608df1e145fc41979792c191d0e5ed5dbc55b22..3146126b2c44f3a1e2d761e507174160c9a63e14 100644 (file)
--- a/src/bin/lttng-sessiond/cmd.c
+++ b/src/bin/lttng-sessiond/cmd.c
@@ -510,7 +510,6 @@ static int list_lttng_agent_events(struct agent *agt,
 
        rcu_read_lock();
        nb_event = lttng_ht_get_count(agt->events);
-       rcu_read_unlock();
        if (nb_event == 0) {
                ret = nb_event;
                *total_size = 0;
@@ -524,7 +523,6 @@ static int list_lttng_agent_events(struct agent *agt,
         * This is only valid because the commands which add events are
         * processed in the same thread as the listing.
         */
-       rcu_read_lock();
        cds_lfht_for_each_entry(agt->events->ht, &iter.iter, event, node.node) {
                ret = increment_extended_len(event->filter_expression, NULL, NULL,
                                &extended_len);
@@ -534,7 +532,6 @@ static int list_lttng_agent_events(struct agent *agt,
                        goto error;
                }
        }
-       rcu_read_unlock();
 
        *total_size = nb_event * sizeof(*tmp_events) + extended_len;
        tmp_events = zmalloc(*total_size);
@@ -547,7 +544,6 @@ static int list_lttng_agent_events(struct agent *agt,
        extended_at = ((uint8_t *) tmp_events) +
                nb_event * sizeof(struct lttng_event);
 
-       rcu_read_lock();
        cds_lfht_for_each_entry(agt->events->ht, &iter.iter, event, node.node) {
                strncpy(tmp_events[i].name, event->name, sizeof(tmp_events[i].name));
                tmp_events[i].name[sizeof(tmp_events[i].name) - 1] = '\0';
@@ -3307,6 +3303,7 @@ void cmd_destroy_session_reply(const struct ltt_session *session,
        payload_size_before_location = payload.size;
        comm_ret = lttng_trace_archive_location_serialize(location,
                        &payload);
+       lttng_trace_archive_location_put(location);
        if (comm_ret < 0) {
                ERR("Failed to serialize the location of the trace archive produced during the destruction of session \"%s\"",
                                session->name);