blktap: Fix wild ptr deref during device destruction. A put_disk() before blk_cleanup_queue() would free gd before gd->queue is read. Signed-off-by: Daniel Stodden diff -r 7d0b5bd0725f -r 46943b8f83b5 drivers/xen/blktap/device.c --- a/drivers/xen/blktap/device.c Fri Feb 05 11:12:24 2010 -0800 +++ b/drivers/xen/blktap/device.c Wed Feb 24 16:18:30 2010 -0800 @@ -1027,8 +1027,8 @@ #endif del_gendisk(dev->gd); + blk_cleanup_queue(dev->gd->queue); put_disk(dev->gd); - blk_cleanup_queue(dev->gd->queue); dev->gd = NULL;