d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix use-after-free in splat_taskq_test7

Browse Source 
This splat_vprint is using tq_arg->name after tq_arg is freed.

Signed-off-by: Chunwei Chen <david.chen@osnexus.com>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Closes #557
This commit is contained in:
Chunwei Chen 2016-05-27 17:28:12 -07:00 committed by Brian Behlendorf
parent f58040c0fc
commit ea5f1a200b
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
module/splat/splat-taskq.c
View File

@ -1040,11 +1040,12 @@ splat_taskq_test7_impl(struct file *file, void *arg, boolean_t prealloc)
error = (tq_arg->depth == SPLAT_TASKQ_DEPTH_MAX ? 0 : -EINVAL);
splat_vprint(file, SPLAT_TASKQ_TEST7_NAME,
"Taskq '%s' destroying\n", tq_arg->name);
kmem_free(tqe, sizeof (taskq_ent_t));
kmem_free(tq_arg, sizeof (splat_taskq_arg_t));
splat_vprint(file, SPLAT_TASKQ_TEST7_NAME,
"Taskq '%s' destroying\n", tq_arg->name);
taskq_destroy(tq);
return (error);