setup_shmem_window() acquires a PCMCIA memory window with pcmcia_request_window() and only releases it on the buffer-verification failure path. If pcmcia_map_mem_page() or the subsequent ioremap() fails, the function jumps straight to the "failed" label, which returns without calling pcmcia_release_window(). The requested window is leaked. This is reachable in practice: pcnet_config() treats a setup_shmem_window() failure as non-fatal and falls back to setup_dma_config(), so probe can continue and even succeed while the requested shared-memory window is left allocated. Route the post-request error paths through a new "release" label that calls pcmcia_release_window() before returning, and fold the existing buffer-verification cleanup into it. iounmap() is still performed before the release where an ioremap() mapping exists, preserving the original teardown order. The pcmcia_request_window() failure path still returns directly, as no window is held there. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- drivers/net/ethernet/8390/pcnet_cs.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/8390/pcnet_cs.c b/drivers/net/ethernet/8390/pcnet_cs.c index 19f9c5db3f3b..e2081d493749 100644 --- a/drivers/net/ethernet/8390/pcnet_cs.c +++ b/drivers/net/ethernet/8390/pcnet_cs.c @@ -1434,14 +1434,14 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg, offset -= offset % window_size; ret = pcmcia_map_mem_page(link, link->resource[3], offset); if (ret) - goto failed; + goto release; /* Try scribbling on the buffer */ info->base = ioremap(link->resource[3]->start, resource_size(link->resource[3])); if (unlikely(!info->base)) { ret = -ENOMEM; - goto failed; + goto release; } for (i = 0; i < (TX_PAGES<<8); i += 2) @@ -1452,9 +1452,8 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg, pcnet_reset_8390(dev); if (i != (TX_PAGES<<8)) { iounmap(info->base); - pcmcia_release_window(link, link->resource[3]); info->base = NULL; - goto failed; + goto release; } ei_status.mem = info->base + offset; @@ -1475,6 +1474,8 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg, info->flags |= USE_SHMEM; return 0; +release: + pcmcia_release_window(link, link->resource[3]); failed: return 1; } -- 2.47.1