The function calls brelse(bh) but then continues to access
the buffer head through bh->b_private, clear_buffer_dirty(),
and clear_buffer_uptodate().

After brelse() decreases the reference count, the buffer head
may be freed, making the subsequent accesses use-after-free.

Fix by moving the brelse(bh) call to the end of the function,
after all accesses to bh have been completed.

Fixes: e93b100931a4 ("GFS2: Fix slab memory leak in gfs2_bufdata")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 fs/gfs2/log.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 78bba8cc10b8..a92c84146de9 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -1038,7 +1038,6 @@ void gfs2_remove_from_journal(struct buffer_head *bh, int meta)
 			set_bit(TR_TOUCHED, &tr->tr_flags);
 		}
 		was_pinned = 1;
-		brelse(bh);
 	}
 	if (bd) {
 		if (bd->bd_tr) {
@@ -1056,6 +1055,8 @@ void gfs2_remove_from_journal(struct buffer_head *bh, int meta)
 	}
 	clear_buffer_dirty(bh);
 	clear_buffer_uptodate(bh);
+	if (was_pinned)
+		brelse(bh);
 }
 
 /**
-- 
2.25.1