Commit 01a4110d authored by Artem Bityutskiy's avatar Artem Bityutskiy

UBI: fix oops in error path

This patch fixes an oops in the error path of 'ubi_attach_mtd_dev()'. If
anything after 'uif_init()' fails, we get an oops in 'cancel_pending()'. The
reason is that 'uif_close()' drops the last reference count for 'ubi->dev' and
whole 'struct ubi_device' is freed. And then
'ubi_wl_close()'->'cancel_pending()' tries to access the 'ubi' pointer and
problems begin.

Note, in 'ubi_detach_mtd_dev()' function we get a device reference to
work-around this issue. Do the same in the error path of
'ubi_attach_mtd_dev()'.
Signed-off-by: default avatarArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
parent cd6d8567
...@@ -1019,6 +1019,8 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset) ...@@ -1019,6 +1019,8 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
out_debugfs: out_debugfs:
ubi_debugfs_exit_dev(ubi); ubi_debugfs_exit_dev(ubi);
out_uif: out_uif:
get_device(&ubi->dev);
ubi_assert(ref);
uif_close(ubi); uif_close(ubi);
out_detach: out_detach:
ubi_wl_close(ubi); ubi_wl_close(ubi);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment