X-Git-Url: https://git.lttng.org/?p=lttng-tools.git;a=blobdiff_plain;f=src%2Fbin%2Flttng-relayd%2Fmain.c;h=d82a3412d7b8578be8f5b39abf0a9fd949ff07bc;hp=a93151ac47f560875f07c9cbf113225f9dd892cc;hb=cd2ef1ef1d54ced9e4d0d03b865bb7fc6a905f80;hpb=8cf93def79a257058bdf3a25843e0627707a18bd

diff --git a/src/bin/lttng-relayd/main.c b/src/bin/lttng-relayd/main.c
index a93151ac4..d82a3412d 100644
--- a/src/bin/lttng-relayd/main.c
+++ b/src/bin/lttng-relayd/main.c
@@ -1340,6 +1340,18 @@ int relay_close_stream(struct lttcomm_relayd_hdr *recv_hdr,
 	session->stream_count--;
 	assert(session->stream_count >= 0);
 
+	/*
+	 * Remove the stream from the connection recv list since we are about to
+	 * flag it invalid and thus might be freed. This has to be done here since
+	 * only the control thread can do actions on that list.
+	 *
+	 * Note that this stream might NOT be in the list but we have to try to
+	 * remove it here else this can race with the stream destruction freeing
+	 * the object and the connection destroy doing a use after free when
+	 * deleting the remaining nodes in this list.
+	 */
+	cds_list_del(&stream->recv_list);
+
 	/* Check if we can close it or else the data will do it. */
 	try_close_stream(session, stream);