Patch "gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free" has been added to the 4.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f2575c0c8561c8a7ca799927599d7a1eba7fbecd
Author: Bob Peterson <rpeterso@xxxxxxxxxx>
Date:   Tue Oct 27 10:10:01 2020 -0500

    gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
    
    [ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
    
    Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
    return_all_reservations, but return_all_reservations still dereferences
    rgd->rd_bits in __rs_deltree.  Fix that by moving the call to kfree below the
    call to return_all_reservations.
    
    Signed-off-by: Bob Peterson <rpeterso@xxxxxxxxxx>
    Signed-off-by: Andreas Gruenbacher <agruenba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 0a80f66365492..0958f76ada6a3 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -730,9 +730,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
 		}
 
 		gfs2_free_clones(rgd);
+		return_all_reservations(rgd);
 		kfree(rgd->rd_bits);
 		rgd->rd_bits = NULL;
-		return_all_reservations(rgd);
 		kmem_cache_free(gfs2_rgrpd_cachep, rgd);
 	}
 }