From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 12 Oct 2012 04:22:42 +0000 (+1100)
Subject: memstick: use after free in msb_disk_release()
X-Git-Tag: next-20121015~1^2~68
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=6831fd7c8f24f6627c84b74c47e9270087cd8d71;p=karo-tx-linux.git

memstick: use after free in msb_disk_release()

The original code dereferenced "msb" after freeing it.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Maxim Levitsky <maximlevitsly@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index 71e59376c0c3..4a751c9e5eff 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1983,9 +1983,9 @@ static int msb_disk_release(struct gendisk *disk)
 			msb->usage_count--;
 
 		if (!msb->usage_count) {
-			kfree(msb);
 			disk->private_data = NULL;
 			idr_remove(&msb_disk_idr, msb->disk_id);
+			kfree(msb);
 			put_disk(disk);
 		}
 	}