[PATCH] net: 8390: pcnet_cs: release PCMCIA window on setup_shmem_window() error

[PATCH] net: 8390: pcnet_cs: release PCMCIA window on setup_shmem_window() error

[Myeonghun Pak]

setup_shmem_window() acquires a PCMCIA memory window with
pcmcia_request_window() and only releases it on the buffer-verification
failure path. If pcmcia_map_mem_page() or the subsequent ioremap()
fails, the function jumps straight to the "failed" label, which returns
without calling pcmcia_release_window(). The requested window is leaked.

This is reachable in practice: pcnet_config() treats a
setup_shmem_window() failure as non-fatal and falls back to
setup_dma_config(), so probe can continue and even succeed while the
requested shared-memory window is left allocated.

Route the post-request error paths through a new "release" label that
calls pcmcia_release_window() before returning, and fold the existing
buffer-verification cleanup into it. iounmap() is still performed before
the release where an ioremap() mapping exists, preserving the original
teardown order. The pcmcia_request_window() failure path still returns
directly, as no window is held there.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/net/ethernet/8390/pcnet_cs.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/8390/pcnet_cs.c b/drivers/net/ethernet/8390/pcnet_cs.c
index 19f9c5db3f3b..e2081d493749 100644
--- a/drivers/net/ethernet/8390/pcnet_cs.c
+++ b/drivers/net/ethernet/8390/pcnet_cs.c
@@ -1434,14 +1434,14 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
     offset -= offset % window_size;
     ret = pcmcia_map_mem_page(link, link->resource[3], offset);
     if (ret)
-	    goto failed;
+	goto release;
 
     /* Try scribbling on the buffer */
     info->base = ioremap(link->resource[3]->start,
 			resource_size(link->resource[3]));
     if (unlikely(!info->base)) {
 	    ret = -ENOMEM;
-	    goto failed;
+	goto release;
     }
 
     for (i = 0; i < (TX_PAGES<<8); i += 2)
@@ -1452,9 +1452,8 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
     pcnet_reset_8390(dev);
     if (i != (TX_PAGES<<8)) {
 	iounmap(info->base);
-	pcmcia_release_window(link, link->resource[3]);
 	info->base = NULL;
-	goto failed;
+	goto release;
     }
 
     ei_status.mem = info->base + offset;
@@ -1475,6 +1474,8 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
     info->flags |= USE_SHMEM;
     return 0;
 
+release:
+	pcmcia_release_window(link, link->resource[3]);
 failed:
     return 1;
 }
-- 
2.47.1