Fix: consumerd: use-after-free of metadata bucket

[lttng-tools.git] / src / common / consumer / consumer-stream.c

diff --git a/src/common/consumer/consumer-stream.c b/src/common/consumer/consumer-stream.c
index ef29866a00c8d79be136f3788cce0d1b323e0053..1edd908044c453ff5d436ad7da819b1b843ff5f6 100644 (file)
--- a/src/common/consumer/consumer-stream.c
+++ b/src/common/consumer/consumer-stream.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Julien Desfossez <julien.desfossez@polymtl.ca>
+ * Copyright (C) 2011 EfficiOS Inc.
  * Copyright (C) 2011 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
  * Copyright (C) 2013 David Goulet <dgoulet@efficios.com>
  *
@@ -670,6 +670,7 @@ struct lttng_consumer_stream *consumer_stream_create(
                goto error;
        }
 
+       stream->send_node = CDS_LIST_HEAD_INIT(stream->send_node);
        stream->chan = channel;
        stream->key = stream_key;
        stream->trace_chunk = trace_chunk;
@@ -1059,6 +1060,8 @@ void consumer_stream_destroy(struct lttng_consumer_stream *stream,
 {
        assert(stream);
 
+       cds_list_del_init(&stream->send_node);
+
        /* Stream is in monitor mode. */
        if (stream->monitor) {
                struct lttng_consumer_channel *free_chan = NULL;
@@ -1091,6 +1094,7 @@ void consumer_stream_destroy(struct lttng_consumer_stream *stream,
                         * If the stream is not visible globally, this needs to be done
                         * outside of the consumer data lock section.
                         */
+                       destroy_close_stream(stream);
                        free_chan = unref_channel(stream);
                }