memstick: use after free in msb_disk_release()

The original code dereferenced "msb" after freeing it.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Maxim Levitsky <maximlevitsly@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index 71e59376c0c313cbf7a2d773c49ce60d86bc76f4..4a751c9e5eff2e7e2054a85cf47bf1ba3b4a01f0 100644 (file)
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1983,9 +1983,9 @@ static int msb_disk_release(struct gendisk *disk)
                        msb->usage_count--;
 
                if (!msb->usage_count) {
-                       kfree(msb);
                        disk->private_data = NULL;
                        idr_remove(&msb_disk_idr, msb->disk_id);
+                       kfree(msb);
                        put_disk(disk);
                }
        }