Fix: sessiond: error accounting: dereference of null pointer on error path

[lttng-tools.git] / src / bin / lttng-sessiond / event-notifier-error-accounting.c

diff --git a/src/bin/lttng-sessiond/event-notifier-error-accounting.c b/src/bin/lttng-sessiond/event-notifier-error-accounting.c
index 6837fe8f34de7ece5b734b4aeeaf168f19f9ac3f..34dc2b4fe30e8011ca5998407529d5dc0bd3f388 100644 (file)
--- a/src/bin/lttng-sessiond/event-notifier-error-accounting.c
+++ b/src/bin/lttng-sessiond/event-notifier-error-accounting.c
@@ -481,7 +481,6 @@ event_notifier_error_accounting_register_app(struct ust_app *app)
        cpu_counters = NULL;
        goto end;
 
        cpu_counters = NULL;
        goto end;
 

-error_allocate_cpu_counters:

 error_send_cpu_counter_data:
 error_duplicate_cpu_counter:
        /* Teardown any duplicated cpu counters. */
 error_send_cpu_counter_data:
 error_duplicate_cpu_counter:
        /* Teardown any duplicated cpu counters. */


@@ -498,6 +497,7 @@ error_duplicate_cpu_counter:
                free(cpu_counters[i]);
        }
 
                free(cpu_counters[i]);
        }
 

+error_allocate_cpu_counters:

 error_send_counter_data:
        ustctl_release_object(-1, new_counter);
        free(new_counter);
 error_send_counter_data:
        ustctl_release_object(-1, new_counter);
        free(new_counter);


@@ -1003,6 +1003,7 @@ void event_notifier_error_accounting_unregister_event_notifier(
        lttng_ht_lookup(error_counter_indexes_ht, &tracer_token, &iter);
        node = lttng_ht_iter_get_node_u64(&iter);
        if (node) {
        lttng_ht_lookup(error_counter_indexes_ht, &tracer_token, &iter);
        node = lttng_ht_iter_get_node_u64(&iter);
        if (node) {

+               int del_ret;

                struct index_ht_entry *index_entry = caa_container_of(
                                node, typeof(*index_entry), node);
                enum lttng_index_allocator_status index_alloc_status;
                struct index_ht_entry *index_entry = caa_container_of(
                                node, typeof(*index_entry), node);
                enum lttng_index_allocator_status index_alloc_status;


@@ -1023,7 +1024,8 @@ void event_notifier_error_accounting_unregister_event_notifier(
                        /* Don't exit, perform the rest of the clean-up. */
                }
 
                        /* Don't exit, perform the rest of the clean-up. */
                }
 

-               lttng_ht_del(error_counter_indexes_ht, &iter);
+               del_ret = lttng_ht_del(error_counter_indexes_ht, &iter);
+               assert(!del_ret);

                call_rcu(&index_entry->rcu_head, free_index_ht_entry);
        }
 
                call_rcu(&index_entry->rcu_head, free_index_ht_entry);
        }