If pci_iomap() or register_sja1000dev() fails, netdev will not be
registered, but plx_pci_del_card() still deregisters the netdev.
To avoid this, let's free the netdev and clear card->net_dev[i] before
calling plx_pci_del_card(). In addition, add the missing pci_iounmap()
when the channel does not exist.
Compile tested only.
Fixes: 951f2f960e5b ("drivers/net/can/sja1000/plx_pci.c: eliminate double free")
Fixes: 24c4a3b29255 ("can: add support for CAN interface cards based on the PLX90xx PCI bridge")
Signed-off-by: Zhang Changzhong <[email protected]>
---
v1->v2: switch to goto style fix.
drivers/net/can/sja1000/plx_pci.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index 5de1ebb..134a8cb 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -678,7 +678,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
if (!addr) {
err = -ENOMEM;
dev_err(&pdev->dev, "Failed to remap BAR%d\n", cm->bar);
- goto failure_cleanup;
+ goto failure_free_dev;
}
priv->reg_base = addr + cm->offset;
@@ -699,7 +699,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
if (err) {
dev_err(&pdev->dev, "Registering device failed "
"(err=%d)\n", err);
- goto failure_cleanup;
+ goto failure_iounmap;
}
card->channels++;
@@ -710,6 +710,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
} else {
dev_err(&pdev->dev, "Channel #%d not detected\n",
i + 1);
+ pci_iounmap(pdev, priv->reg_base);
free_sja1000dev(dev);
card->net_dev[i] = NULL;
}
@@ -738,6 +739,11 @@ static int plx_pci_add_card(struct pci_dev *pdev,
}
return 0;
+failure_iounmap:
+ pci_iounmap(pdev, priv->reg_base);
+failure_free_dev:
+ free_sja1000dev(dev);
+ card->net_dev[i] = NULL;
failure_cleanup:
dev_err(&pdev->dev, "Error: %d. Cleaning Up.\n", err);
--
2.9.5
On 25.11.2022 21:46:14, Zhang Changzhong wrote:
> If pci_iomap() or register_sja1000dev() fails, netdev will not be
> registered, but plx_pci_del_card() still deregisters the netdev.
>
> To avoid this, let's free the netdev and clear card->net_dev[i] before
> calling plx_pci_del_card(). In addition, add the missing pci_iounmap()
> when the channel does not exist.
>
> Compile tested only.
>
> Fixes: 951f2f960e5b ("drivers/net/can/sja1000/plx_pci.c: eliminate double free")
> Fixes: 24c4a3b29255 ("can: add support for CAN interface cards based on the PLX90xx PCI bridge")
> Signed-off-by: Zhang Changzhong <[email protected]>
> ---
> v1->v2: switch to goto style fix.
>
> drivers/net/can/sja1000/plx_pci.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
> index 5de1ebb..134a8cb 100644
> --- a/drivers/net/can/sja1000/plx_pci.c
> +++ b/drivers/net/can/sja1000/plx_pci.c
> @@ -678,7 +678,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
> if (!addr) {
> err = -ENOMEM;
> dev_err(&pdev->dev, "Failed to remap BAR%d\n", cm->bar);
> - goto failure_cleanup;
> + goto failure_free_dev;
> }
>
> priv->reg_base = addr + cm->offset;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> @@ -699,7 +699,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
> if (err) {
> dev_err(&pdev->dev, "Registering device failed "
> "(err=%d)\n", err);
> - goto failure_cleanup;
> + goto failure_iounmap;
> }
>
> card->channels++;
> @@ -710,6 +710,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
> } else {
> dev_err(&pdev->dev, "Channel #%d not detected\n",
> i + 1);
> + pci_iounmap(pdev, priv->reg_base);
> free_sja1000dev(dev);
> card->net_dev[i] = NULL;
> }
> @@ -738,6 +739,11 @@ static int plx_pci_add_card(struct pci_dev *pdev,
> }
> return 0;
>
> +failure_iounmap:
> + pci_iounmap(pdev, priv->reg_base);
^^^^^^^^^^^^^^
reg_base it not that what has been mapped, but with an offset.
> +failure_free_dev:
> + free_sja1000dev(dev);
> + card->net_dev[i] = NULL;
> failure_cleanup:
> dev_err(&pdev->dev, "Error: %d. Cleaning Up.\n", err);
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Embedded Linux | https://www.pengutronix.de |
Vertretung West/Dortmund | Phone: +49-231-2826-924 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |