[PATCH net] wan: wanxl: Only reset hardware after BAR mapping

[PATCH net] wan: wanxl: Only reset hardware after BAR mapping

[Ruoyu Wang]

wanxl_pci_init_one() stores the freshly allocated card in driver data
before the PLX BAR is mapped.  Several early probe failures then unwind
through wanxl_pci_remove_one(), including failure to allocate the coherent
status area or to restore the DMA mask.

wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and
wanxl_reset() dereferences card->plx.  On those early failures card->plx
is still NULL, so the error path can dereference a NULL MMIO pointer.

Only issue the hardware reset once the BAR mapping exists.  The remaining
cleanup in wanxl_pci_remove_one() already checks whether later resources
were allocated.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/net/wan/wanxl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wan/wanxl.c b/drivers/net/wan/wanxl.c
index d4da88c771129..065c00c12cc16 100644
--- a/drivers/net/wan/wanxl.c
+++ b/drivers/net/wan/wanxl.c
@@ -514,7 +514,8 @@ static void wanxl_pci_remove_one(struct pci_dev *pdev)
 	if (card->irq)
 		free_irq(card->irq, card);
 
-	wanxl_reset(card);
+	if (card->plx)
+		wanxl_reset(card);
 
 	for (i = 0; i < RX_QUEUE_LENGTH; i++)
 		if (card->rx_skbs[i]) {
-- 
2.51.0

Re: [PATCH net] wan: wanxl: Only reset hardware after BAR mapping

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Wed,  8 Jul 2026 22:34:15 +0800 you wrote:
> wanxl_pci_init_one() stores the freshly allocated card in driver data
> before the PLX BAR is mapped.  Several early probe failures then unwind
> through wanxl_pci_remove_one(), including failure to allocate the coherent
> status area or to restore the DMA mask.
> 
> wanxl_pci_remove_one() unconditionally calls wanxl_reset(), and
> wanxl_reset() dereferences card->plx.  On those early failures card->plx
> is still NULL, so the error path can dereference a NULL MMIO pointer.
> 
> [...]

Here is the summary with links:
  - [net] wan: wanxl: Only reset hardware after BAR mapping
    https://git.kernel.org/netdev/net/c/91957b89da99

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html