setup_shmem_window() acquires a PCMCIA memory window using
pcmcia_request_window(). If pcmcia_map_mem_page() or the subsequent
ioremap() fails, the function returns without releasing the requested
window.

pcnet_config() treats shared-memory setup failure as non-fatal and falls
back to setup_dma_config(). Probe can therefore continue while socket
window 3 and its reserved iomem range remain unnecessarily held for the
rest of the bound lifetime of the device. pcmcia_disable_device()
eventually releases the window during teardown.

Route error paths after a successful request through a new release label
that calls pcmcia_release_window(). Fold the existing buffer-verification
cleanup into the same path, keeping iounmap() before the window release
when a mapping exists. Leave the request failure path unchanged.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:GPT-5.6
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Changes in v2:
- Clarify that the window remains reserved only until device teardown.
- Make the DMA fallback and continued probe description conditional.
- Avoid claiming that every request failure leaves no resource held.
- Restore the surrounding indentation for the new goto statements.

Link: https://lore.kernel.org/netdev/20260731161740.44955-1-mhun512@gmail.com/
---
 drivers/net/ethernet/8390/pcnet_cs.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/8390/pcnet_cs.c b/drivers/net/ethernet/8390/pcnet_cs.c
index 19f9c5db3..0cf3c0f3c 100644
--- a/drivers/net/ethernet/8390/pcnet_cs.c
+++ b/drivers/net/ethernet/8390/pcnet_cs.c
@@ -1434,14 +1434,14 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
     offset -= offset % window_size;
     ret = pcmcia_map_mem_page(link, link->resource[3], offset);
     if (ret)
-	    goto failed;
+	    goto release;
 
     /* Try scribbling on the buffer */
     info->base = ioremap(link->resource[3]->start,
 			resource_size(link->resource[3]));
     if (unlikely(!info->base)) {
 	    ret = -ENOMEM;
-	    goto failed;
+	    goto release;
     }
 
     for (i = 0; i < (TX_PAGES<<8); i += 2)
@@ -1452,9 +1452,8 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
     pcnet_reset_8390(dev);
     if (i != (TX_PAGES<<8)) {
 	iounmap(info->base);
-	pcmcia_release_window(link, link->resource[3]);
 	info->base = NULL;
-	goto failed;
+	goto release;
     }
 
     ei_status.mem = info->base + offset;
@@ -1475,6 +1474,8 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
     info->flags |= USE_SHMEM;
     return 0;
 
+release:
+	pcmcia_release_window(link, link->resource[3]);
 failed:
     return 1;
 }
-- 
2.47.1

On Thu, Sep 10, 2026 at 07:14:00PM -0400, Myeonghun Pak wrote:
> setup_shmem_window() acquires a PCMCIA memory window using
> pcmcia_request_window(). If pcmcia_map_mem_page() or the subsequent
> ioremap() fails, the function returns without releasing the requested
> window.
> 
> pcnet_config() treats shared-memory setup failure as non-fatal and falls
> back to setup_dma_config(). Probe can therefore continue while socket
> window 3 and its reserved iomem range remain unnecessarily held for the
> rest of the bound lifetime of the device. pcmcia_disable_device()
> eventually releases the window during teardown.
> 
> Route error paths after a successful request through a new release label
> that calls pcmcia_release_window(). Fold the existing buffer-verification
> cleanup into the same path, keeping iounmap() before the window release
> when a mapping exists. Leave the request failure path unchanged.
> 
> This issue was identified during our ongoing static-analysis research while
> reviewing kernel code.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org

As pointed out by the AI-Generated review of this patch at
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260910231400.31919-1-mhun512%40gmail.com
This patch seems to be more of a cleanup than a bug fix - as noted above in
the patch description, the resources are eventually released anyway.

So I wonder if the Fixes and CC to stable should be dropped.

> Assisted-by: OpenAI:GPT-5.6
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
> Changes in v2:
> - Clarify that the window remains reserved only until device teardown.
> - Make the DMA fallback and continued probe description conditional.
> - Avoid claiming that every request failure leaves no resource held.
> - Restore the surrounding indentation for the new goto statements.
> 
> Link: https://lore.kernel.org/netdev/20260731161740.44955-1-mhun512@gmail.com/

The process nit above notwithstanding, this patch looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>

Thanks for the review. I'll drop the Fixes and stable Cc tags in v3.

2026년 9월 13일 (일) 오전 10:32, Simon Horman <horms@kernel.org>님이 작성:
>
> On Thu, Sep 10, 2026 at 07:14:00PM -0400, Myeonghun Pak wrote:
> > setup_shmem_window() acquires a PCMCIA memory window using
> > pcmcia_request_window(). If pcmcia_map_mem_page() or the subsequent
> > ioremap() fails, the function returns without releasing the requested
> > window.
> >
> > pcnet_config() treats shared-memory setup failure as non-fatal and falls
> > back to setup_dma_config(). Probe can therefore continue while socket
> > window 3 and its reserved iomem range remain unnecessarily held for the
> > rest of the bound lifetime of the device. pcmcia_disable_device()
> > eventually releases the window during teardown.
> >
> > Route error paths after a successful request through a new release label
> > that calls pcmcia_release_window(). Fold the existing buffer-verification
> > cleanup into the same path, keeping iounmap() before the window release
> > when a mapping exists. Leave the request failure path unchanged.
> >
> > This issue was identified during our ongoing static-analysis research while
> > reviewing kernel code.
> >
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Cc: stable@vger.kernel.org
>
> As pointed out by the AI-Generated review of this patch at
> https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260910231400.31919-1-mhun512%40gmail.com
> This patch seems to be more of a cleanup than a bug fix - as noted above in
> the patch description, the resources are eventually released anyway.
>
> So I wonder if the Fixes and CC to stable should be dropped.
>
> > Assisted-by: OpenAI:GPT-5.6
> > Co-developed-by: Ijae Kim <ae878000@gmail.com>
> > Signed-off-by: Ijae Kim <ae878000@gmail.com>
> > Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> > ---
> > Changes in v2:
> > - Clarify that the window remains reserved only until device teardown.
> > - Make the DMA fallback and continued probe description conditional.
> > - Avoid claiming that every request failure leaves no resource held.
> > - Restore the surrounding indentation for the new goto statements.
> >
> > Link: https://lore.kernel.org/netdev/20260731161740.44955-1-mhun512@gmail.com/
>
> The process nit above notwithstanding, this patch looks good to me.
>
> Reviewed-by: Simon Horman <horms@kernel.org>