diff options
| author | Artem Bityutskiy <Artem.Bityutskiy@nokia.com> | 2011-05-18 18:08:05 +0300 |
|---|---|---|
| committer | Artem Bityutskiy <Artem.Bityutskiy@nokia.com> | 2011-06-01 11:23:12 +0300 |
| commit | 01a4110d2b86b05918debf39c50867cbb9598491 (patch) | |
| tree | f49a4af9c6834f88457cb4c2b27df745fda58bf6 /drivers/mtd | |
| parent | cd6d8567a42907d4e7add0b08f9a2d846690fc65 (diff) | |
UBI: fix oops in error path
This patch fixes an oops in the error path of 'ubi_attach_mtd_dev()'. If
anything after 'uif_init()' fails, we get an oops in 'cancel_pending()'. The
reason is that 'uif_close()' drops the last reference count for 'ubi->dev' and
whole 'struct ubi_device' is freed. And then
'ubi_wl_close()'->'cancel_pending()' tries to access the 'ubi' pointer and
problems begin.
Note, in 'ubi_detach_mtd_dev()' function we get a device reference to
work-around this issue. Do the same in the error path of
'ubi_attach_mtd_dev()'.
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/ubi/build.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c index 6d0d48395d8..6c3fb5ab20f 100644 --- a/drivers/mtd/ubi/build.c +++ b/drivers/mtd/ubi/build.c @@ -1019,6 +1019,8 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset) out_debugfs: ubi_debugfs_exit_dev(ubi); out_uif: + get_device(&ubi->dev); + ubi_assert(ref); uif_close(ubi); out_detach: ubi_wl_close(ubi); |