[PATCH net 1/2] net: arcnet: com20020-pci: clean up failed channels

[PATCH net 1/2] net: arcnet: com20020-pci: clean up failed channels

[Myeonghun Pak]

After com20020_found() registers a netdev and requests its IRQ, seven
allocation or LED-registration failure paths free the netdev without
unregistering it or freeing the IRQ. The unfinished channel is not yet
on list_dev, so the common remove path cannot clean it up.

Route those failures through unregister_netdev() and free_irq() before
free_arcdev(). Keep failures before successful com20020_found() on the
existing free-only path.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 6b17a597fc2f ("arcnet: restoring support for multiple Sohard Arcnet cards")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/net/arcnet/com20020-pci.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -243,7 +243,7 @@ static int com20020pci_probe(struct pci_dev *pdev,
 				    GFP_KERNEL);
 		if (!card) {
 			ret = -ENOMEM;
-			goto err_free_arcdev;
+			goto err_unregister_netdev;
 		}
 
 		card->index = i;
@@ -256,14 +256,14 @@ static int com20020pci_probe(struct pci_dev *pdev,
 							dev->dev_id, i);
 			if (!card->tx_led.default_trigger) {
 				ret = -ENOMEM;
-				goto err_free_arcdev;
+				goto err_unregister_netdev;
 			}
 			card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
 							"pci:green:tx:%d-%d",
 							dev->dev_id, i);
 			if (!card->tx_led.name) {
 				ret = -ENOMEM;
-				goto err_free_arcdev;
+				goto err_unregister_netdev;
 			}
 			card->tx_led.dev = &dev->dev;
 			card->recon_led.brightness_set = led_recon_set;
@@ -272,24 +272,24 @@ static int com20020pci_probe(struct pci_dev *pdev,
 							dev->dev_id, i);
 			if (!card->recon_led.default_trigger) {
 				ret = -ENOMEM;
-				goto err_free_arcdev;
+				goto err_unregister_netdev;
 			}
 			card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
 							"pci:red:recon:%d-%d",
 							dev->dev_id, i);
 			if (!card->recon_led.name) {
 				ret = -ENOMEM;
-				goto err_free_arcdev;
+				goto err_unregister_netdev;
 			}
 			card->recon_led.dev = &dev->dev;
 
 			ret = devm_led_classdev_register(&pdev->dev, &card->tx_led);
 			if (ret)
-				goto err_free_arcdev;
+				goto err_unregister_netdev;
 
 			ret = devm_led_classdev_register(&pdev->dev, &card->recon_led);
 			if (ret)
-				goto err_free_arcdev;
+				goto err_unregister_netdev;
 
 			dev_set_drvdata(&dev->dev, card);
 			devm_arcnet_led_init(dev, dev->dev_id, i);
@@ -299,6 +299,9 @@ static int com20020pci_probe(struct pci_dev *pdev,
 		list_add(&card->list, &priv->list_dev);
 		continue;
 
+err_unregister_netdev:
+		unregister_netdev(dev);
+		free_irq(dev->irq, dev);
 err_free_arcdev:
 		free_arcdev(dev);
 		break;

[PATCH net 2/2] net: arcnet: com20020-pci: balance PCI enable on cleanup

[Myeonghun Pak]

com20020pci_probe() enables the PCI device, but neither its later failure
paths nor com20020pci_remove() release the enable reference. This
imbalance already exists in the initial Git import.

Use pcim_enable_device() so PCI is disabled after channel cleanup and
after managed LEDs and I/O regions have been released.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Depends on patch 1/2 to tear down registered channels before managed
PCI cleanup disables the device on probe failure.

 drivers/net/arcnet/com20020-pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -133,7 +133,7 @@ static int com20020pci_probe(struct pci_dev *pdev,
 
 	ret = 0;
 
-	if (pci_enable_device(pdev))
+	if (pcim_enable_device(pdev))
 		return -EIO;
 
 	priv = devm_kzalloc(&pdev->dev, sizeof(struct com20020_priv),

Re: [PATCH net 1/2] net: arcnet: com20020-pci: clean up failed channels

[Andrew Lunn]

On Mon, Sep 14, 2026 at 09:39:45PM -0400, Myeonghun Pak wrote:
> After com20020_found() registers a netdev and requests its IRQ, seven
> allocation or LED-registration failure paths free the netdev without
> unregistering it or freeing the IRQ. The unfinished channel is not yet
> on list_dev, so the common remove path cannot clean it up.
> 
> Route those failures through unregister_netdev() and free_irq() before
> free_arcdev(). Keep failures before successful com20020_found() on the
> existing free-only path.
> 
> This issue was identified during our ongoing static-analysis research
> while reviewing kernel code.
> 
> Fixes: 6b17a597fc2f ("arcnet: restoring support for multiple Sohard Arcnet cards")

I think this tag is wrong. Please check it.

	Andrew