From: Darrick J. Wong <darrick.wong@oracle.com>
Date: Wed, 11 Mar 2020 17:37:53 +0000 (-0700)
Subject: xfs: fix use-after-free when aborting corrupt attr inactivation
X-Git-Tag: v5.7-rc1~125^2~56
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=496b9bcd62b0b3a160be61e3265a086f97adcbd3;p=thirdparty%2Flinux.git

xfs: fix use-after-free when aborting corrupt attr inactivation

Log the corrupt buffer before we release the buffer.

Fixes: a5155b870d687 ("xfs: always log corruption errors")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
---

diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index bbfa6ba84dcd7..fe8f60b59ec4d 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -145,8 +145,8 @@ xfs_attr3_node_inactive(
 	 * Since this code is recursive (gasp!) we must protect ourselves.
 	 */
 	if (level > XFS_DA_NODE_MAXDEPTH) {
-		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */
 		xfs_buf_corruption_error(bp);
+		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */
 		return -EFSCORRUPTED;
 	}