From dca92471252dfb6d944693fef0869a12193ca55f Mon Sep 17 00:00:00 2001 From: Andriy Gapon Date: Wed, 20 Nov 2013 10:59:41 +0000 Subject: [PATCH] 4088 use after free in arc_release() illumos/illumos-gate@ccc22e130479b5bd7c0002267fee1e0602d3f772 --- uts/common/fs/zfs/arc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/uts/common/fs/zfs/arc.c b/uts/common/fs/zfs/arc.c index e7ce0a589002..121ae751cd96 100644 --- a/uts/common/fs/zfs/arc.c +++ b/uts/common/fs/zfs/arc.c @@ -3332,6 +3332,7 @@ arc_release(arc_buf_t *buf, void *tag) if (l2hdr) { mutex_enter(&l2arc_buflist_mtx); hdr->b_l2hdr = NULL; + list_remove(l2hdr->b_dev->l2ad_buflist, hdr); } buf_size = hdr->b_size; @@ -3415,7 +3416,6 @@ arc_release(arc_buf_t *buf, void *tag) if (l2hdr) { ARCSTAT_INCR(arcstat_l2_asize, -l2hdr->b_asize); - list_remove(l2hdr->b_dev->l2ad_buflist, hdr); kmem_free(l2hdr, sizeof (l2arc_buf_hdr_t)); ARCSTAT_INCR(arcstat_l2_size, -buf_size); mutex_exit(&l2arc_buflist_mtx);