The call to del_gendisk follows an non-refcounted gd->queue
pointer. We release the last ref in blk_cleanup_queue. Fixed by
reordering releases accordingly.
Signed-off-by: Daniel Stodden <daniel.stodden@citrix.com>
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
        /* Flush gnttab callback work. Must be done with no locks held. */
        flush_scheduled_work();
 
-       blk_cleanup_queue(info->rq);
-       info->rq = NULL;
-
        minor = info->gd->first_minor;
        nr_minors = info->gd->minors;
        del_gendisk(info->gd);
        xlbd_release_minors(minor, nr_minors);
 
+       blk_cleanup_queue(info->rq);
+       info->rq = NULL;
+
  out:
        if (info->xbdev)
                xenbus_frontend_closed(info->xbdev);