From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Sat, 3 Nov 2012 00:41:58 +0000 (+1100)
Subject: memstick: use after free in msb_disk_release()
X-Git-Tag: next-20121107~2^2~222
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=3d3afba67c6f31c37d6ee0323535f14b56c72b04;p=karo-tx-linux.git

memstick: use after free in msb_disk_release()

The original code dereferenced "msb" after freeing it.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Maxim Levitsky <maximlevitsly@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index 71e59376c0c3..4a751c9e5eff 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1983,9 +1983,9 @@ static int msb_disk_release(struct gendisk *disk)
 			msb->usage_count--;
 
 		if (!msb->usage_count) {
-			kfree(msb);
 			disk->private_data = NULL;
 			idr_remove(&msb_disk_idr, msb->disk_id);
+			kfree(msb);
 			put_disk(disk);
 		}
 	}