Staging: ipack: dereferencing freed memory

We free "dev" then dereference it on the next line.

Cc: Samuel Iglesias Gonsalvez <siglesias@igalia.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/ipack/bridges/tpci200.c b/drivers/staging/ipack/bridges/tpci200.c
index ab6ea0a5548cb6cb52bcb16722920ba8796d9f28..08cd85150ef2ff168afa8edb3314cc78e0caa63e 100644 (file)
--- a/drivers/staging/ipack/bridges/tpci200.c
+++ b/drivers/staging/ipack/bridges/tpci200.c
@@ -867,8 +867,8 @@ static int tpci200_slot_unregister(struct ipack_device *dev)
                return -ERESTARTSYS;
 
        ipack_device_unregister(dev);
-       kfree(dev);
        tpci200->slots[dev->slot].dev = NULL;
+       kfree(dev);
        mutex_unlock(&tpci200->mutex);
 
        return 0;