NULL pointer dereference in drivers/mmc/core/block.c?

[Sergey Shtylyov <s.shtylyov@xxxxxx>]

Hello!

   The below function is called several times in block.c without checking
the result for NULL:

static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk)
{
	struct mmc_blk_data *md;

	mutex_lock(&open_lock);
	md = disk->private_data;
	if (md && !kref_get_unless_zero(&md->kref))
		md = NULL;
	mutex_unlock(&open_lock);

	return md;
}

   While disk->private_data seems to always be non-NULL during these calls,
kref_get_unless_zero() may return 0 at the same time (am I right though?)...
   Ulf, could you please clarify?

MBR, Sergey