[PATCH AUTOSEL 5.4 10/42] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free

[Sasha Levin]

From: Bob Peterson <rpete...@redhat.com>

[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]

Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree.  Fix that by moving the call to kfree below the
call to return_all_reservations.

Signed-off-by: Bob Peterson <rpete...@redhat.com>
Signed-off-by: Andreas Gruenbacher <agrue...@redhat.com>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 fs/gfs2/rgrp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 2466bb44a23c5..e23735084ad17 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -736,9 +736,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
                }
 
                gfs2_free_clones(rgd);
+               return_all_reservations(rgd);
                kfree(rgd->rd_bits);
                rgd->rd_bits = NULL;
-               return_all_reservations(rgd);
                kmem_cache_free(gfs2_rgrpd_cachep, rgd);
        }
 }
-- 
2.27.0