From: Myeonghun Pak <mhun512@gmail.com>

SYM53C500_config() calls SYM53C500_release() from its early failure
path even though those failures can happen before a SCSI host has been
allocated and stored in link->priv. SYM53C500_release() unconditionally
dereferences info->host and then tears down a fully registered host, so
the probe error path can dereference a NULL host instead of unwinding only
the resources acquired so far.

Use pcmcia_disable_device() on configuration failures and let
SYM53C500_probe() free the per-device allocation when configuration
fails, because the driver's remove callback is not called after a failed
probe.

Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/scsi/pcmcia/sym53c500_cs.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/pcmcia/sym53c500_cs.c b/drivers/scsi/pcmcia/sym53c500_cs.c
index 1530c1ad5d..95a001c16a 100644
--- a/drivers/scsi/pcmcia/sym53c500_cs.c
+++ b/drivers/scsi/pcmcia/sym53c500_cs.c
@@ -800,12 +800,12 @@ SYM53C500_config(struct pcmcia_device *link)
 err_free_scsi:
 	scsi_host_put(host);
 err_release:
-	release_region(port_base, 0x10);
+	pcmcia_disable_device(link);
 	printk(KERN_INFO "sym53c500_cs: no SCSI devices found\n");
 	return -ENODEV;
 
 failed:
-	SYM53C500_release(link);
+	pcmcia_disable_device(link);
 	return -ENODEV;
 } /* SYM53C500_config */
 
@@ -845,6 +845,7 @@ static int
 SYM53C500_probe(struct pcmcia_device *link)
 {
 	struct scsi_info_t *info;
+	int ret;
 
 	dev_dbg(&link->dev, "SYM53C500_attach()\n");
 
@@ -856,7 +857,13 @@ SYM53C500_probe(struct pcmcia_device *link)
 	link->priv = info;
 	link->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_IO;
 
-	return SYM53C500_config(link);
+	ret = SYM53C500_config(link);
+	if (ret) {
+		kfree(info);
+		link->priv = NULL;
+	}
+
+	return ret;
 } /* SYM53C500_attach */
 
 MODULE_AUTHOR("Bob Tracy <rct@frus.com>");

…
> Use pcmcia_disable_device() on configuration failures and let
…

How do you think about to avoid a bit of duplicate source code
for an improved implementation of the function “SYM53C500_config”?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/coding-style.rst?h=v7.0#n526
https://elixir.bootlin.com/linux/v7.0.1/source/drivers/scsi/pcmcia/sym53c500_cs.c#L698-L810

Regards,
Markus