t->release can free the kobj.



 25-akpm/lib/kobject.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff -puN lib/kobject.c~kobject-unlimited-name-lengths-use-after-free-fix lib/kobject.c
--- 25/lib/kobject.c~kobject-unlimited-name-lengths-use-after-free-fix	Tue Sep  2 14:43:47 2003
+++ 25-akpm/lib/kobject.c	Tue Sep  2 14:43:47 2003
@@ -445,13 +445,13 @@ void kobject_cleanup(struct kobject * ko
 	struct kset * s = kobj->kset;
 
 	pr_debug("kobject %s: cleaning up\n",kobject_name(kobj));
+	if (kobj->k_name != kobj->name)
+		kfree(kobj->k_name);
+	kobj->k_name = NULL;
 	if (t && t->release)
 		t->release(kobj);
 	if (s)
 		kset_put(s);
-	if (kobj->k_name != kobj->name)
-		kfree(kobj->k_name);
-	kobj->k_name = NULL;
 }
 
 /**

_