staging: slicoss: fix multiple free-after-free in slic_entry_remove

[pandora-kernel.git] / drivers / staging / slicoss / slicoss.c

diff --git a/drivers/staging/slicoss/slicoss.c b/drivers/staging/slicoss/slicoss.c
index e27b88f..c6c1c40 100644 (file)
--- a/drivers/staging/slicoss/slicoss.c
+++ b/drivers/staging/slicoss/slicoss.c
@@ -1422,8 +1422,7 @@ static void slic_cmdq_addcmdpage(struct adapter *adapter, u32 *page)
                spin_lock_irqsave(&adapter->handle_lock.lock,
                                adapter->handle_lock.flags);
                pslic_handle  =  adapter->pfree_slic_handles;
-               if (pslic_handle)
-                       adapter->pfree_slic_handles = pslic_handle->next;
+               adapter->pfree_slic_handles = pslic_handle->next;
                spin_unlock_irqrestore(&adapter->handle_lock.lock,
                                adapter->handle_lock.flags);
                pslic_handle->type = SLIC_HANDLE_CMD;
@@ -2955,8 +2954,6 @@ static void slic_card_cleanup(struct sliccard *card)
 static void slic_entry_remove(struct pci_dev *pcidev)
 {
        struct net_device *dev = pci_get_drvdata(pcidev);
-       u32 mmio_start = 0;
-       uint mmio_len = 0;
        struct adapter *adapter = netdev_priv(dev);
        struct sliccard *card;
        struct mcast_address *mcaddr, *mlist;
@@ -2965,12 +2962,6 @@ static void slic_entry_remove(struct pci_dev *pcidev)
        slic_unmap_mmio_space(adapter);
        unregister_netdev(dev);
 
-       mmio_start = pci_resource_start(pcidev, 0);
-       mmio_len = pci_resource_len(pcidev, 0);
-
-       release_mem_region(mmio_start, mmio_len);
-
-       iounmap((void __iomem *)dev->base_addr);
        /* free multicast addresses */
        mlist = adapter->mcastaddrs;
        while (mlist) {
@@ -3595,7 +3586,6 @@ static int slic_entry_probe(struct pci_dev *pcidev,
        struct net_device *netdev;
        struct adapter *adapter;
        void __iomem *memmapped_ioaddr = NULL;
-       u32 status = 0;
        ulong mmio_start = 0;
        ulong mmio_len = 0;
        struct sliccard *card = NULL;
@@ -3686,16 +3676,11 @@ static int slic_entry_probe(struct pci_dev *pcidev,
                adapter->allocated = 1;
        }
 
-       status = slic_card_init(card, adapter);
+       err = slic_card_init(card, adapter);
+       if (err)
+               goto err_out_unmap;
 
-       if (status != 0) {
-               card->state = CARD_FAIL;
-               adapter->state = ADAPT_FAIL;
-               adapter->linkstate = LINK_DOWN;
-               dev_err(&pcidev->dev, "FAILED status[%x]\n", status);
-       } else {
-               slic_adapter_set_hwaddr(adapter);
-       }
+       slic_adapter_set_hwaddr(adapter);
 
        netdev->base_addr = (unsigned long)adapter->memorybase;
        netdev->irq = adapter->irq;
@@ -3712,7 +3697,7 @@ static int slic_entry_probe(struct pci_dev *pcidev,
 
        cards_found++;
 
-       return status;
+       return 0;
 
 err_out_unmap:
        iounmap(memmapped_ioaddr);