svn commit: r340333 - stable/12/sys/vm

[Mark Johnston]

Author: markj
Date: Sat Nov 10 20:36:48 2018
New Revision: 340333
URL: https://svnweb.freebsd.org/changeset/base/340333

Log:
  MFC r340241:
  Fix a use-after-free in swp_pager_meta_free().
  
  Approved by:	re (gjb)

Modified:
  stable/12/sys/vm/swap_pager.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/vm/swap_pager.c
==============================================================================
--- stable/12/sys/vm/swap_pager.c	Sat Nov 10 20:34:59 2018	(r340332)
+++ stable/12/sys/vm/swap_pager.c	Sat Nov 10 20:36:48 2018	(r340333)
@@ -1972,13 +1972,13 @@ swp_pager_meta_free(vm_object_t object, vm_pindex_t pi
 			swp_pager_update_freerange(&s_free, &n_free, sb->d[i]);
 			sb->d[i] = SWAPBLK_NONE;
 		}
+		pindex = sb->p + SWAP_META_PAGES;
 		if (swp_pager_swblk_empty(sb, 0, start) &&
 		    swp_pager_swblk_empty(sb, limit, SWAP_META_PAGES)) {
 			SWAP_PCTRIE_REMOVE(&object->un_pager.swp.swp_blks,
 			    sb->p);
 			uma_zfree(swblk_zone, sb);
 		}
-		pindex = sb->p + SWAP_META_PAGES;
 	}
 	swp_pager_freeswapspace(s_free, n_free);
 }