diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 35f48a39144c04b515db0cc4c096a5527b5d5786..9c30d38c6f0d893cb85e0df3f15cbe62ae351dce 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3921,10 +3921,11 @@ static int binder_thread_read(struct binder_proc *proc,
 			binder_inner_proc_unlock(proc);
 			if (put_user(e->cmd, (uint32_t __user *)ptr))
 				return -EFAULT;
+			cmd = e->cmd;
 			e->cmd = BR_OK;
 			ptr += sizeof(uint32_t);
 
-			binder_stat_br(proc, thread, e->cmd);
+			binder_stat_br(proc, thread, cmd);
 		} break;
 		case BINDER_WORK_TRANSACTION_COMPLETE: {
 			binder_inner_proc_unlock(proc);