[PATCH] mtd: ubi: Fix UBI device reference leak in ubi_detach_mtd_dev()

[Wentao Liang]

ubi_detach_mtd_dev() takes a reference on the UBI device with
ubi_get_device() and drops the matching kobject reference only after
the shutdown notification has been sent.  When the device is still in
use and a forced detach was not requested, the function returns -EBUSY
before that put_device(), so the reference taken by ubi_get_device() is
never released and the device is never freed.

Drop the reference on the busy path as well.

Fixes: 7e84c961b2eb ("mtd: ubi: introduce pre-removal notification for UBI volumes")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/mtd/ubi/build.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 674ad87809df..d81f5e0395ac 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -1106,6 +1106,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
 	if (ubi->ref_count) {
 		if (!anyway) {
 			spin_unlock(&ubi_devices_lock);
+			put_device(&ubi->dev);
 			return -EBUSY;
 		}
 		/* This may only happen if there is a bug */
-- 
2.34.1