From c8fd652ce7abe85c5238356248d1918ea9ff5ff8 Mon Sep 17 00:00:00 2001 From: LOLi Date: Mon, 12 Nov 2018 03:09:00 +0100 Subject: [PATCH] Fix coverity defects: CID 184285 CID 184285: Read from pointer after free (USE_AFTER_FREE) This patch fixes an use-after-free in vdev_config_generate_stats() moving the kmem_free() call at the end of the function. Reviewed-by: George Melikov Reviewed-by: Brian Behlendorf Reviewed-by: Giuseppe Di Natale Signed-off-by: loli10K Closes #8120 --- module/zfs/vdev_label.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/module/zfs/vdev_label.c b/module/zfs/vdev_label.c index f99085146476..65b847d66470 100644 --- a/module/zfs/vdev_label.c +++ b/module/zfs/vdev_label.c @@ -228,8 +228,6 @@ vdev_config_generate_stats(vdev_t *vd, nvlist_t *nv) fnvlist_add_uint64_array(nv, ZPOOL_CONFIG_VDEV_STATS, (uint64_t *)vs, sizeof (*vs) / sizeof (uint64_t)); - kmem_free(vs, sizeof (*vs)); - /* * Add extended stats into a special extended stats nvlist. This keeps * all the extended stats nicely grouped together. The extended stats @@ -354,6 +352,7 @@ vdev_config_generate_stats(vdev_t *vd, nvlist_t *nv) fnvlist_add_nvlist(nv, ZPOOL_CONFIG_VDEV_STATS_EX, nvx); fnvlist_free(nvx); + kmem_free(vs, sizeof (*vs)); kmem_free(vsx, sizeof (*vsx)); }