[BUG] KASAN: use-after-free Read in gfs2_rgrp_go_instantiate

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/177-kasan-use-after-free-read-in-gfs2-rgrp-go-instantiate/

  BUG: KASAN: use-after-free in gfs2_bit_search fs/gfs2/rgrp.c:188 [inline]
  BUG: KASAN: use-after-free in gfs2_bitfit fs/gfs2/rgrp.c:249 [inline]
  BUG: KASAN: use-after-free in count_unlinked fs/gfs2/rgrp.c:1159 [inline]
  BUG: KASAN: use-after-free in gfs2_rgrp_go_instantiate+0xb0d/0x1340
fs/gfs2/rgrp.c:1238
  Read of size 8 at addr ffff888011445000 by task syz-executor/17182
  Call Trace:
   gfs2_rgrp_go_instantiate+0xb0d/0x1340 fs/gfs2/rgrp.c:1238
   gfs2_instantiate+0x151/0x210 fs/gfs2/glock.c:442
   gfs2_glock_holder_ready fs/gfs2/glock.c:1250 [inline]
   gfs2_glock_wait+0x1b2/0x280 fs/gfs2/glock.c:1270
   gfs2_glock_nq_init fs/gfs2/glock.h:253 [inline]
   gfs2_inplace_reserve+0xc43/0x3420 fs/gfs2/rgrp.c:2093
   do_sync+0x64b/0xca0 fs/gfs2/quota.c:948

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,