Fix: use after free in ring buffer clients

[lttng-modules.git] / lib / ringbuffer / ring_buffer_frontend.c

diff --git a/lib/ringbuffer/ring_buffer_frontend.c b/lib/ringbuffer/ring_buffer_frontend.c
index 225d78c6c49e9d0a5b31c8587c9ef81bdf6701c6..fc8d54139c446e0906b9b0560af3a2a568fa7992 100644 (file)
--- a/lib/ringbuffer/ring_buffer_frontend.c
+++ b/lib/ringbuffer/ring_buffer_frontend.c
@@ -585,6 +585,9 @@ static void channel_unregister_notifiers(struct channel *chan)
 
 static void channel_free(struct channel *chan)
 {
+       if (chan->backend.release_priv_ops) {
+               chan->backend.release_priv_ops(chan->backend.priv_ops);
+       }
        channel_iterator_free(chan);
        channel_backend_free(&chan->backend);
        kfree(chan);
@@ -1256,7 +1259,7 @@ void lib_ring_buffer_switch_old_start(struct lib_ring_buffer *buf,
        commit_count = v_read(config, &buf->commit_hot[oldidx].cc);
        /* Check if the written buffer has to be delivered */
        lib_ring_buffer_check_deliver(config, buf, chan, offsets->old,
-                                     commit_count, oldidx);
+                                     commit_count, oldidx, tsc);
        lib_ring_buffer_write_commit_counter(config, buf, chan, oldidx,
                                             offsets->old, commit_count,
                                             config->cb.subbuffer_header_size());
@@ -1300,7 +1303,7 @@ void lib_ring_buffer_switch_old_end(struct lib_ring_buffer *buf,
        v_add(config, padding_size, &buf->commit_hot[oldidx].cc);
        commit_count = v_read(config, &buf->commit_hot[oldidx].cc);
        lib_ring_buffer_check_deliver(config, buf, chan, offsets->old - 1,
-                                     commit_count, oldidx);
+                                     commit_count, oldidx, tsc);
        lib_ring_buffer_write_commit_counter(config, buf, chan, oldidx,
                                             offsets->old, commit_count,
                                             padding_size);
@@ -1343,7 +1346,7 @@ void lib_ring_buffer_switch_new_start(struct lib_ring_buffer *buf,
        commit_count = v_read(config, &buf->commit_hot[beginidx].cc);
        /* Check if the written buffer has to be delivered */
        lib_ring_buffer_check_deliver(config, buf, chan, offsets->begin,
-                                     commit_count, beginidx);
+                                     commit_count, beginidx, tsc);
        lib_ring_buffer_write_commit_counter(config, buf, chan, beginidx,
                                             offsets->begin, commit_count,
                                             config->cb.subbuffer_header_size());