In aio_waitcomplete() correct two cases of using an aiocb after freeing it.

1 files changed, 4 insertions, 2 deletions

diff --git a/sys/kern/vfs_aio.c b/sys/kern/vfs_aio.c
index ff700aa..3cff799 100644
--- a/sys/kern/vfs_aio.c
+++ b/sys/kern/vfs_aio.c
@@ -2246,17 +2246,19 @@ aio_waitcomplete(struct thread *td, struct aio_waitcomplete_args *uap)
 				p->p_stats->p_ru.ru_inblock += cb->inputcharge;
 				cb->inputcharge = 0;
 			}
+			error = cb->uaiocb._aiocb_private.error;
 			aio_free_entry(cb);
-			return (cb->uaiocb._aiocb_private.error);
+			return (error);
 		}
 
 		s = splbio();
  		if ((cb = TAILQ_FIRST(&ki->kaio_bufdone)) != 0 ) {
 			splx(s);
 			suword(uap->aiocbp, (uintptr_t)cb->uuaiocb);
+			error = cb->uaiocb._aiocb_private.error;
 			td->td_retval[0] = cb->uaiocb._aiocb_private.status;
 			aio_free_entry(cb);
-			return (cb->uaiocb._aiocb_private.error);
+			return (error);
 		}
 
 		ki->kaio_flags |= KAIO_WAKEUP;