From 7f3d60aaffd98218c3313c1ed1021dba2c503bfd Mon Sep 17 00:00:00 2001
From: Keir Fraser <keir.fraser@citrix.com>
Date: Mon, 1 Mar 2010 09:55:54 +0000
Subject: [PATCH] blktap2: Fwd: Fix wild ptr deref during device destruction.

A put_disk() before blk_cleanup_queue() would free gd before gd->queue
is read.

Signed-off-by: Daniel Stodden <daniel.stodden@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@novell.com>
---
 drivers/xen/blktap2/device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/xen/blktap2/device.c b/drivers/xen/blktap2/device.c
index db5b3cb9..eb21e968 100644
--- a/drivers/xen/blktap2/device.c
+++ b/drivers/xen/blktap2/device.c
@@ -1082,8 +1082,8 @@ blktap_device_destroy(struct blktap *tap)
 #endif
 
 	del_gendisk(dev->gd);
-	put_disk(dev->gd);
 	blk_cleanup_queue(dev->gd->queue);
+	put_disk(dev->gd);
 
 	dev->gd = NULL;
 
-- 
2.39.5