fs/adfs: super: fix use-after-free bug

Fix a use-after-free bug during filesystem initialisation, where we
access the disc record (which is stored in a buffer) after we have
released the buffer.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 4 insertions, 1 deletions

diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index 2f81c1c29757..b1243433add7 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -378,6 +378,7 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
         struct buffer_head *bh;
         struct object_info root_obj;
         unsigned char *b_data;
+        unsigned int blocksize;
         struct adfs_sb_info *asb;
         struct inode *root;
         int ret = -EINVAL;
@@ -423,8 +424,10 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
                 goto error_badfs;
         }
 
+        blocksize = 1 << dr->log2secsize;
         brelse(bh);
-        if (sb_set_blocksize(sb, 1 << dr->log2secsize)) {
+
+        if (sb_set_blocksize(sb, blocksize)) {
                 bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize);
                 if (!bh) {
                         adfs_msg(sb, KERN_ERR,