[PATCH] net: winbond-840: release IRQ on alloc_ringdesc() error path

[Haotian Zhang <vulab@iscas.ac.cn>]

netdev_open() registers the shared IRQ with request_irq() and then calls
alloc_ringdesc().  When alloc_ringdesc() fails, the error path jumps to
out_err, which only calls netif_device_attach() and returns.  The IRQ
handler stays registered forever: net/core/dev.c never calls ndo_stop
when ndo_open fails, so netdev_close(), the only place that frees the
IRQ, is never reached.  The leaked handler is also left enabled on an
uninitialised device.

Add a separate out_err_free_irq label that releases the IRQ before
returning the allocation error, mirroring the cleanup already used by
the sibling de2104x driver.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: DeepSeek-V4.1-Flash
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/dec/tulip/winbond-840.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c
index a5581f1d0141..2ce05a63b289 100644
--- a/drivers/net/ethernet/dec/tulip/winbond-840.c
+++ b/drivers/net/ethernet/dec/tulip/winbond-840.c
@@ -639,7 +639,7 @@ static int netdev_open(struct net_device *dev)
 
 	i = alloc_ringdesc(dev);
 	if (i)
-		goto out_err;
+		goto out_err_free_irq;
 
 	spin_lock_irq(&np->lock);
 	netif_device_attach(dev);
@@ -655,6 +655,8 @@ static int netdev_open(struct net_device *dev)
 	np->timer.expires = jiffies + 1*HZ;
 	add_timer(&np->timer);
 	return 0;
+out_err_free_irq:
+	free_irq(irq, dev);
 out_err:
 	netif_device_attach(dev);
 	return i;
-- 
2.25.1