[src/trunk]: src/sys/ufs/ffs Prevent use-after-free where genfs_node_destroy(...

[hannken <hannken%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/217875872aed
branches:  trunk
changeset: 829382:217875872aed
user:      hannken <hannken%NetBSD.org@localhost>
date:      Sun Jan 28 10:02:00 2018 +0000

description:
Prevent use-after-free where genfs_node_destroy() would destroy
a lock residing in the just freed inode data.

diffstat:

 sys/ufs/ffs/ffs_vfsops.c |  10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diffs (36 lines):

diff -r 82671150b811 -r 217875872aed sys/ufs/ffs/ffs_vfsops.c
--- a/sys/ufs/ffs/ffs_vfsops.c  Sun Jan 28 10:01:18 2018 +0000
+++ b/sys/ufs/ffs/ffs_vfsops.c  Sun Jan 28 10:02:00 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ffs_vfsops.c,v 1.355 2017/11/15 21:21:18 christos Exp $        */
+/*     $NetBSD: ffs_vfsops.c,v 1.356 2018/01/28 10:02:00 hannken Exp $ */
 
 /*-
  * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ffs_vfsops.c,v 1.355 2017/11/15 21:21:18 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ffs_vfsops.c,v 1.356 2018/01/28 10:02:00 hannken Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_ffs.h"
@@ -2024,14 +2024,14 @@
 {
        struct inode *ip = VTOI(vp);
 
+       genfs_node_destroy(vp);
+       vp->v_data = NULL;
+
        if (ump->um_fstype == UFS1)
                pool_cache_put(ffs_dinode1_cache, ip->i_din.ffs1_din);
        else
                pool_cache_put(ffs_dinode2_cache, ip->i_din.ffs2_din);
        pool_cache_put(ffs_inode_cache, ip);
-
-       genfs_node_destroy(vp);
-       vp->v_data = NULL;
 }
 
 /*