Subject: blktap2: Fix wild ptr deref during device destruction.

A put_disk() before blk_cleanup_queue() would free gd before gd->queue
is read.

Signed-off-by: Daniel Stodden <daniel.stodden@xxxxxxxxxx>
Signed-off-by: Jan Beulich <jbeulich@xxxxxxxxxx>

--- a/drivers/xen/blktap2/device.c
+++ b/drivers/xen/blktap2/device.c
@@ -1077,8 +1077,8 @@
 #endif
 
 	del_gendisk(dev->gd);
+	blk_cleanup_queue(dev->gd->queue);
 	put_disk(dev->gd);
-	blk_cleanup_queue(dev->gd->queue);
 
 	dev->gd = NULL;