From: Artem Bityutskiy Date: Wed, 18 May 2011 15:08:05 +0000 (+0300) Subject: UBI: fix oops in error path X-Git-Tag: v3.1-rc1~326^2~3 X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=01a4110d2b86b05918debf39c50867cbb9598491;p=pandora-kernel.git UBI: fix oops in error path This patch fixes an oops in the error path of 'ubi_attach_mtd_dev()'. If anything after 'uif_init()' fails, we get an oops in 'cancel_pending()'. The reason is that 'uif_close()' drops the last reference count for 'ubi->dev' and whole 'struct ubi_device' is freed. And then 'ubi_wl_close()'->'cancel_pending()' tries to access the 'ubi' pointer and problems begin. Note, in 'ubi_detach_mtd_dev()' function we get a device reference to work-around this issue. Do the same in the error path of 'ubi_attach_mtd_dev()'. Signed-off-by: Artem Bityutskiy --- diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c index 6d0d48395d8c..6c3fb5ab20f5 100644 --- a/drivers/mtd/ubi/build.c +++ b/drivers/mtd/ubi/build.c @@ -1019,6 +1019,8 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset) out_debugfs: ubi_debugfs_exit_dev(ubi); out_uif: + get_device(&ubi->dev); + ubi_assert(ref); uif_close(ubi); out_detach: ubi_wl_close(ubi);