Btrfs: fix use-after-free in btrfs_replay_log

@log_root_tree should not be referenced after kfree.
Signed-off-by: NLiu Bo <bo.li.liu@oracle.com>
Reviewed-by: NDavid Sterba <dsterba@suse.cz>
Reported-by: NJulia Lawall <julia.lawall@lip6.fr>
Signed-off-by: NChris Mason <clm@fb.com>

fs/btrfs/disk-io.c

@@ -2321,8 +2321,9 @@ static int btrfs_replay_log(struct btrfs_fs_info *fs_info,
 			fs_info->generation + 1);
 	if (IS_ERR(log_tree_root->node)) {
 		printk(KERN_ERR "BTRFS: failed to read log tree\n");
+		ret = PTR_ERR(log_tree_root->node);
 		kfree(log_tree_root);
-		return PTR_ERR(log_tree_root->node);
+		return ret;
 	} else if (!extent_buffer_uptodate(log_tree_root->node)) {
 		printk(KERN_ERR "BTRFS: failed to read log tree\n");
 		free_extent_buffer(log_tree_root->node);