diff options
| author | Chunwei Chen <[email protected]> | 2016-05-27 17:28:12 -0700 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2016-05-31 11:58:42 -0700 |
| commit | ea5f1a200b974c8fdd51993c282d8ae0dc2aa871 (patch) | |
| tree | a1a7c8844e3ff54d490da84983e4f5648d7d0e29 | |
| parent | f58040c0fc8bc6490fcc75db7fc3e709dfc3c656 (diff) | |
Fix use-after-free in splat_taskq_test7
This splat_vprint is using tq_arg->name after tq_arg is freed.
Signed-off-by: Chunwei Chen <[email protected]>
Signed-off-by: Brian Behlendorf <[email protected]>
Closes #557
| -rw-r--r-- | module/splat/splat-taskq.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/module/splat/splat-taskq.c b/module/splat/splat-taskq.c index 8f06f413d..f26f828d9 100644 --- a/module/splat/splat-taskq.c +++ b/module/splat/splat-taskq.c @@ -1040,11 +1040,12 @@ splat_taskq_test7_impl(struct file *file, void *arg, boolean_t prealloc) error = (tq_arg->depth == SPLAT_TASKQ_DEPTH_MAX ? 0 : -EINVAL); + splat_vprint(file, SPLAT_TASKQ_TEST7_NAME, + "Taskq '%s' destroying\n", tq_arg->name); + kmem_free(tqe, sizeof (taskq_ent_t)); kmem_free(tq_arg, sizeof (splat_taskq_arg_t)); - splat_vprint(file, SPLAT_TASKQ_TEST7_NAME, - "Taskq '%s' destroying\n", tq_arg->name); taskq_destroy(tq); return (error); |