summaryrefslogtreecommitdiff
path: root/drivers/mtd
diff options
context:
space:
mode:
authorArtem Bityutskiy <Artem.Bityutskiy@nokia.com>2011-05-18 19:08:05 +0400
committerArtem Bityutskiy <Artem.Bityutskiy@nokia.com>2011-06-01 12:23:12 +0400
commit01a4110d2b86b05918debf39c50867cbb9598491 (patch)
treef49a4af9c6834f88457cb4c2b27df745fda58bf6 /drivers/mtd
parentcd6d8567a42907d4e7add0b08f9a2d846690fc65 (diff)
downloadlinux-01a4110d2b86b05918debf39c50867cbb9598491.tar.xz
UBI: fix oops in error path
This patch fixes an oops in the error path of 'ubi_attach_mtd_dev()'. If anything after 'uif_init()' fails, we get an oops in 'cancel_pending()'. The reason is that 'uif_close()' drops the last reference count for 'ubi->dev' and whole 'struct ubi_device' is freed. And then 'ubi_wl_close()'->'cancel_pending()' tries to access the 'ubi' pointer and problems begin. Note, in 'ubi_detach_mtd_dev()' function we get a device reference to work-around this issue. Do the same in the error path of 'ubi_attach_mtd_dev()'. Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Diffstat (limited to 'drivers/mtd')
-rw-r--r--drivers/mtd/ubi/build.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 6d0d48395d8c..6c3fb5ab20f5 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -1019,6 +1019,8 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
out_debugfs:
ubi_debugfs_exit_dev(ubi);
out_uif:
+ get_device(&ubi->dev);
+ ubi_assert(ref);
uif_close(ubi);
out_detach:
ubi_wl_close(ubi);