In the original code if ems_pcmcia_check_chan() returned false then
it called free_sja1000dev(dev) but did not set the error code or jump
to the clean up code. This frees "dev" and leads to a use after free.
I flipped the ems_pcmcia_check_chan() check around to make the error
handling more consistent and readable. That lets us pull the rest of
the code in one tab.
Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card")
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
---
drivers/net/can/sja1000/ems_pcmcia.c | 44 +++++++++++++++-------------
1 file changed, 23 insertions(+), 21 deletions(-)
diff --git a/drivers/net/can/sja1000/ems_pcmcia.c b/drivers/net/can/sja1000/ems_pcmcia.c
index e21b169c14c0..271fe9444827 100644
--- a/drivers/net/can/sja1000/ems_pcmcia.c
+++ b/drivers/net/can/sja1000/ems_pcmcia.c
@@ -210,28 +210,30 @@ static int ems_pcmcia_add_card(struct pcmcia_device *pdev, unsigned long base)
(i * EMS_PCMCIA_CAN_CTRL_SIZE);
/* Check if channel is present */
- if (ems_pcmcia_check_chan(priv)) {
- priv->read_reg = ems_pcmcia_read_reg;
- priv->write_reg = ems_pcmcia_write_reg;
- priv->can.clock.freq = EMS_PCMCIA_CAN_CLOCK;
- priv->ocr = EMS_PCMCIA_OCR;
- priv->cdr = EMS_PCMCIA_CDR;
- priv->flags |= SJA1000_CUSTOM_IRQ_HANDLER;
-
- /* Register SJA1000 device */
- err = register_sja1000dev(dev);
- if (err) {
- free_sja1000dev(dev);
- goto failure_cleanup;
- }
-
- card->channels++;
-
- printk(KERN_INFO "%s: registered %s on channel "
- "#%d at 0x%p, irq %d\n", DRV_NAME, dev->name,
- i, priv->reg_base, dev->irq);
- } else
+ if (!ems_pcmcia_check_chan(priv)) {
+ err = -EINVAL;
free_sja1000dev(dev);
+ goto failure_cleanup;
+ }
+ priv->read_reg = ems_pcmcia_read_reg;
+ priv->write_reg = ems_pcmcia_write_reg;
+ priv->can.clock.freq = EMS_PCMCIA_CAN_CLOCK;
+ priv->ocr = EMS_PCMCIA_OCR;
+ priv->cdr = EMS_PCMCIA_CDR;
+ priv->flags |= SJA1000_CUSTOM_IRQ_HANDLER;
+
+ /* Register SJA1000 device */
+ err = register_sja1000dev(dev);
+ if (err) {
+ free_sja1000dev(dev);
+ goto failure_cleanup;
+ }
+
+ card->channels++;
+
+ printk(KERN_INFO "%s: registered %s on channel "
+ "#%d at 0x%p, irq %d\n", DRV_NAME, dev->name,
+ i, priv->reg_base, dev->irq);
}
err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
--
2.20.1
