Fix: sessiond: use after free

[lttng-tools.git] / src / bin / lttng-sessiond / cmd.cpp

diff --git a/src/bin/lttng-sessiond/cmd.cpp b/src/bin/lttng-sessiond/cmd.cpp
index 659e389b29df286c1d3c7dab2049ce7b5909a48d..0ca7f217244bd81d7cba98431347d60e7f61c9b4 100644 (file)
--- a/src/bin/lttng-sessiond/cmd.cpp
+++ b/src/bin/lttng-sessiond/cmd.cpp
@@ -3765,8 +3765,8 @@ enum lttng_error_code cmd_list_channels(enum lttng_domain_type domain,
 
                        channel = trace_ust_channel_to_lttng_channel(uchan);
                        if (!channel) {
-                               ret = LTTNG_ERR_NOMEM;
-                               break;
+                               ret_code = LTTNG_ERR_NOMEM;
+                               goto end;
                        }
 
                        extended = (struct lttng_channel_extended *)
@@ -3777,7 +3777,7 @@ enum lttng_error_code cmd_list_channels(enum lttng_domain_type domain,
                        if (ret < 0) {
                                lttng_channel_destroy(channel);
                                ret_code = LTTNG_ERR_UNK;
-                               break;
+                               goto end;
                        }
 
                        extended->discarded_events = discarded_events;
@@ -3788,11 +3788,12 @@ enum lttng_error_code cmd_list_channels(enum lttng_domain_type domain,
                        if (ret) {
                                ERR("Failed to serialize lttng_channel: channel name = '%s'",
                                                channel->name);
+                               lttng_channel_destroy(channel);
                                ret_code = LTTNG_ERR_UNK;
-                               ret = -1;
-                               break;
+                               goto end;
                        }
 
+                       lttng_channel_destroy(channel);
                        i++;
                }
                rcu_read_unlock();