From ea5f1a200b974c8fdd51993c282d8ae0dc2aa871 Mon Sep 17 00:00:00 2001 From: Chunwei Chen Date: Fri, 27 May 2016 17:28:12 -0700 Subject: [PATCH] Fix use-after-free in splat_taskq_test7 This splat_vprint is using tq_arg->name after tq_arg is freed. Signed-off-by: Chunwei Chen Signed-off-by: Brian Behlendorf Closes #557 --- module/splat/splat-taskq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/module/splat/splat-taskq.c b/module/splat/splat-taskq.c index 8f06f41..f26f828 100644 --- a/module/splat/splat-taskq.c +++ b/module/splat/splat-taskq.c @@ -1040,11 +1040,12 @@ splat_taskq_test7_impl(struct file *file, void *arg, boolean_t prealloc) error = (tq_arg->depth == SPLAT_TASKQ_DEPTH_MAX ? 0 : -EINVAL); + splat_vprint(file, SPLAT_TASKQ_TEST7_NAME, + "Taskq '%s' destroying\n", tq_arg->name); + kmem_free(tqe, sizeof (taskq_ent_t)); kmem_free(tq_arg, sizeof (splat_taskq_arg_t)); - splat_vprint(file, SPLAT_TASKQ_TEST7_NAME, - "Taskq '%s' destroying\n", tq_arg->name); taskq_destroy(tq); return (error); -- 2.39.2