From: Brian King <brking@us.ibm.com>

While fixing an oops in the st driver in a dirty release path, I
encountered an oops in cdev_put for cdevs allocated using cdev_alloc.  If
cdev_del is called when the cdev kobject still has an open user, when the
last cdev_put is called, the cdev_put will call kobject_put, which will end
up ultimately releasing the cdev in cdev_dynamic_release.  Patch fixes the
oops by preventing cdev_put from accessing freed memory.

Signed-off-by: Brian King <brking@us.ibm.com>
Cc: <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 fs/char_dev.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

diff -puN fs/char_dev.c~cdev-cdev_put-oops fs/char_dev.c
--- 25/fs/char_dev.c~cdev-cdev_put-oops	Fri Jul  8 16:04:06 2005
+++ 25-akpm/fs/char_dev.c	Fri Jul  8 16:04:57 2005
@@ -277,8 +277,9 @@ static struct kobject *cdev_get(struct c
 void cdev_put(struct cdev *p)
 {
 	if (p) {
+		struct module *owner = p->owner;
 		kobject_put(&p->kobj);
-		module_put(p->owner);
+		module_put(owner);
 	}
 }
 
_