Fix coverity defects: CID 184285

CID 184285: Read from pointer after free (USE_AFTER_FREE)

This patch fixes an use-after-free in vdev_config_generate_stats()
moving the kmem_free() call at the end of the function.

Reviewed-by: George Melikov <mail@gmelikov.ru>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Giuseppe Di Natale <guss80@gmail.com>
Signed-off-by: loli10K <ezomori.nozomu@gmail.com>
Closes #8120

diff --git a/module/zfs/vdev_label.c b/module/zfs/vdev_label.c
index f990851464762e6c2e9d120a9ca54667213d8bd1..65b847d66470275a024bcb8ffbea82fbaec722c6 100644 (file)
--- a/module/zfs/vdev_label.c
+++ b/module/zfs/vdev_label.c
@@ -228,8 +228,6 @@ vdev_config_generate_stats(vdev_t *vd, nvlist_t *nv)
        fnvlist_add_uint64_array(nv, ZPOOL_CONFIG_VDEV_STATS,
            (uint64_t *)vs, sizeof (*vs) / sizeof (uint64_t));
 
-       kmem_free(vs, sizeof (*vs));
-
        /*
         * Add extended stats into a special extended stats nvlist.  This keeps
         * all the extended stats nicely grouped together.  The extended stats
@@ -354,6 +352,7 @@ vdev_config_generate_stats(vdev_t *vd, nvlist_t *nv)
        fnvlist_add_nvlist(nv, ZPOOL_CONFIG_VDEV_STATS_EX, nvx);
 
        fnvlist_free(nvx);
+       kmem_free(vs, sizeof (*vs));
        kmem_free(vsx, sizeof (*vsx));
 }