Fix use after free in zfsctl_snapshot_unmount()

tonyhutter · Oct 8, 2016 · 00b65db · 00b65db
1 parent 64c688d
commit 00b65db
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/module/zfs/zfs_ctldir.c b/module/zfs/zfs_ctldir.c
@@ -1032,10 +1032,10 @@ zfsctl_snapshot_unmount(char *snapname, int flags)
 
 	argv[2] = kmem_asprintf(SET_UNMOUNT_CMD,
 	    flags & MNT_FORCE ? "-f " : "", se->se_path);
-	zfsctl_snapshot_rele(se);
 	dprintf("unmount; path=%s\n", se->se_path);
 	error = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
 	strfree(argv[2]);
+	zfsctl_snapshot_rele(se);
 
 
 	/*