tree f49a4af9c6834f88457cb4c2b27df745fda58bf6
parent cd6d8567a42907d4e7add0b08f9a2d846690fc65
author Artem Bityutskiy <Artem.Bityutskiy@nokia.com> 1305731285 +0300
committer Artem Bityutskiy <Artem.Bityutskiy@nokia.com> 1306916592 +0300

UBI: fix oops in error path

This patch fixes an oops in the error path of 'ubi_attach_mtd_dev()'. If
anything after 'uif_init()' fails, we get an oops in 'cancel_pending()'. The
reason is that 'uif_close()' drops the last reference count for 'ubi->dev' and
whole 'struct ubi_device' is freed. And then
'ubi_wl_close()'->'cancel_pending()' tries to access the 'ubi' pointer and
problems begin.

Note, in 'ubi_detach_mtd_dev()' function we get a device reference to
work-around this issue. Do the same in the error path of
'ubi_attach_mtd_dev()'.

Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>