From: Bob Peterson <rpeterso@redhat.com>
Date: Tue, 27 Oct 2020 15:10:01 +0000 (-0500)
Subject: gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=d0f17d3883f1e3f085d38572c2ea8edbd5150172;p=linux.git

gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free

Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree.  Fix that by moving the call to kfree below the
call to return_all_reservations.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
---

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index ee491bb9c1ccd..eb1b29734b7f5 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -719,9 +719,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
 		}
 
 		gfs2_free_clones(rgd);
+		return_all_reservations(rgd);
 		kfree(rgd->rd_bits);
 		rgd->rd_bits = NULL;
-		return_all_reservations(rgd);
 		kmem_cache_free(gfs2_rgrpd_cachep, rgd);
 	}
 }