From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Date: Mon, 29 Apr 2013 21:13:56 +0000 (-0400)
Subject: Fix: segfault in buffer_reg_channel_destroy()
X-Git-Tag: v2.2.0-rc2~29
X-Git-Url: https://git.lttng.org/?p=lttng-tools.git;a=commitdiff_plain;h=55d7e8605242476e653997d4d4ac2ee999b225f0

Fix: segfault in buffer_reg_channel_destroy()

Can be called with NULL pointer, which trigger segfault on ERR() which
try to dereference it.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
---

diff --git a/src/bin/lttng-sessiond/buffer-registry.c b/src/bin/lttng-sessiond/buffer-registry.c
index 765294fa4..5751b8d58 100644
--- a/src/bin/lttng-sessiond/buffer-registry.c
+++ b/src/bin/lttng-sessiond/buffer-registry.c
@@ -506,12 +506,14 @@ void buffer_reg_channel_destroy(struct buffer_reg_channel *regp,
 			buffer_reg_stream_destroy(sreg, domain);
 		}
 
-		ret = ust_ctl_release_object(-1, regp->obj.ust);
-		if (ret < 0 && ret != -EPIPE && ret != -LTTNG_UST_ERR_EXITING) {
-			ERR("Buffer reg channel release obj handle %d failed with ret %d",
-					regp->obj.ust->handle, ret);
+		if (regp->obj.ust) {
+			ret = ust_ctl_release_object(-1, regp->obj.ust);
+			if (ret < 0 && ret != -EPIPE && ret != -LTTNG_UST_ERR_EXITING) {
+				ERR("Buffer reg channel release obj handle %d failed with ret %d",
+						regp->obj.ust->handle, ret);
+			}
+			free(regp->obj.ust);
 		}
-		free(regp->obj.ust);
 		lttng_fd_put(LTTNG_FD_APPS, 1);
 		break;
 	}