From d4753beb37afbe0575fbe4f27ffec5117cd43424 Mon Sep 17 00:00:00 2001
From: Russ Cox <rsc@swtch.com>
Date: Thu, 12 Oct 2006 03:21:03 +0000
Subject: [PATCH] dangling pointer reference (Tim Wiess)

---
 kern/devmnt.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/kern/devmnt.c b/kern/devmnt.c
index 3d09f5d..d03f41c 100644
--- a/kern/devmnt.c
+++ b/kern/devmnt.c
@@ -220,9 +220,6 @@ mntversion(Chan *c, char *version, int msize, int returnlen)
 	m->msize = f.msize;
 	unlock(&mntalloc.lk);
 
-	poperror();	/* msg */
-	free(msg);
-
 	lock(&m->lk);
 	m->queue = 0;
 	m->rip = 0;
@@ -232,16 +229,19 @@ mntversion(Chan *c, char *version, int msize, int returnlen)
 	m->c = c;
 	unlock(&m->lk);
 
+	poperror();	/* msg */
 	poperror();	/* c */
 	qunlock(&c->umqlock);
 
 	k = strlen(f.version);
 	if(returnlen > 0){
-		if(returnlen < k)
+		if(returnlen < k){
+			free(msg);
 			error(Eshort);
+		}
 		memmove(version, f.version, k);
 	}
-
+	free(msg);
 	return k;
 }