wan: pc300too: abort path on failure

In function pc300_pci_init_one(), on the ioremap error path, function
pc300_pci_remove_one() is called to free the allocated memory. However,
the path is not terminated, and the freed memory will be used later,
resulting in use-after-free bugs. This path fixes the bug.

Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/wan/pc300too.c b/drivers/net/wan/pc300too.c
index e1dd1ec18d64c0a4eb6d16bd5c85d0dec485ee36..b9b934b7713c94e49c384acc95cc8cf4bf98d739 100644 (file)
--- a/drivers/net/wan/pc300too.c
+++ b/drivers/net/wan/pc300too.c
@@ -346,6 +346,7 @@ static int pc300_pci_init_one(struct pci_dev *pdev,
            card->rambase == NULL) {
                pr_err("ioremap() failed\n");
                pc300_pci_remove_one(pdev);
+               return -ENOMEM;
        }
 
        /* PLX PCI 9050 workaround for local configuration register read bug */