Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Zhang Changzhong <zhangchangzhong@huawei.com>
To:     Wolfgang Grandegger <wg@grandegger.com>,
        Marc Kleine-Budde <mkl@pengutronix.de>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>, Julia Lawall <julia@diku.dk>,
        Pavel Cheblakov <P.B.Cheblakov@inp.nsk.su>
CC:     Zhang Changzhong <zhangchangzhong@huawei.com>,
        <linux-can@vger.kernel.org>, <netdev@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>
Subject: [PATCH v2] can: sja1000: plx_pci: fix error handling path in plx_pci_add_card()
Date:   Fri, 25 Nov 2022 21:46:14 +0800
Message-ID: <1669383975-17332-1-git-send-email-zhangchangzhong@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

If pci_iomap() or register_sja1000dev() fails, netdev will not be
registered, but plx_pci_del_card() still deregisters the netdev.

To avoid this, let's free the netdev and clear card->net_dev[i] before
calling plx_pci_del_card(). In addition, add the missing pci_iounmap()
when the channel does not exist.

Compile tested only.

Fixes: 951f2f960e5b ("drivers/net/can/sja1000/plx_pci.c: eliminate double free")
Fixes: 24c4a3b29255 ("can: add support for CAN interface cards based on the PLX90xx PCI bridge")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
---
v1->v2: switch to goto style fix.

 drivers/net/can/sja1000/plx_pci.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index 5de1ebb..134a8cb 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -678,7 +678,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
 		if (!addr) {
 			err = -ENOMEM;
 			dev_err(&pdev->dev, "Failed to remap BAR%d\n", cm->bar);
-			goto failure_cleanup;
+			goto failure_free_dev;
 		}
 
 		priv->reg_base = addr + cm->offset;
@@ -699,7 +699,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
 			if (err) {
 				dev_err(&pdev->dev, "Registering device failed "
 					"(err=%d)\n", err);
-				goto failure_cleanup;
+				goto failure_iounmap;
 			}
 
 			card->channels++;
@@ -710,6 +710,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
 		} else {
 			dev_err(&pdev->dev, "Channel #%d not detected\n",
 				i + 1);
+			pci_iounmap(pdev, priv->reg_base);
 			free_sja1000dev(dev);
 			card->net_dev[i] = NULL;
 		}
@@ -738,6 +739,11 @@ static int plx_pci_add_card(struct pci_dev *pdev,
 	}
 	return 0;
 
+failure_iounmap:
+	pci_iounmap(pdev, priv->reg_base);
+failure_free_dev:
+	free_sja1000dev(dev);
+	card->net_dev[i] = NULL;
 failure_cleanup:
 	dev_err(&pdev->dev, "Error: %d. Cleaning Up.\n", err);
 
-- 
2.9.5