blktap2: Fwd: Fix wild ptr deref during device destruction.

A put_disk() before blk_cleanup_queue() would free gd before gd->queue
is read.

Signed-off-by: Daniel Stodden <daniel.stodden@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@novell.com>

diff --git a/drivers/xen/blktap2/device.c b/drivers/xen/blktap2/device.c
index db5b3cb9567c1e894cfbc93a40743fa7a18d626f..eb21e9683fc2c776f57c889fa8ef1820e92b2622 100644 (file)
--- a/drivers/xen/blktap2/device.c
+++ b/drivers/xen/blktap2/device.c
@@ -1082,8 +1082,8 @@ blktap_device_destroy(struct blktap *tap)
 #endif
 
        del_gendisk(dev->gd);
-       put_disk(dev->gd);
        blk_cleanup_queue(dev->gd->queue);
+       put_disk(dev->gd);
 
        dev->gd = NULL;