2 files changed, 12 insertions, 3 deletions

diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index 8567f4fad501..dd7651ff5b43 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -89,6 +89,8 @@ static void __iomem *
 set_cis_map(struct pcmcia_socket *s, unsigned int card_offset, unsigned int flags)
 {
     pccard_mem_map *mem = &s->cis_mem;
+    int ret;
+
     if (!(s->features & SS_CAP_STATIC_MAP) && mem->res == NULL) {
         mem->res = pcmcia_find_mem_region(0, s->map_size, s->map_size, 0, s);
         if (mem->res == NULL) {
@@ -99,7 +101,12 @@ set_cis_map(struct pcmcia_socket *s, unsigned int card_offset, unsigned int flag
     }
     mem->card_start = card_offset;
     mem->flags = flags;
-    s->ops->set_mem_map(s, mem);
+    ret = s->ops->set_mem_map(s, mem);
+    if (ret) {
+        iounmap(s->cis_virt);
+        return NULL;
+    }
+
     if (s->features & SS_CAP_STATIC_MAP) {
         if (s->cis_virt)
             iounmap(s->cis_virt);
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index c8f21796c592..51aa04b7ecc9 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -372,6 +372,9 @@ static int do_mem_probe(u_long base, u_long num, struct pcmcia_socket *s)
            base, base+num-1);
     bad = fail = 0;
     step = (num < 0x20000) ? 0x2000 : ((num>>4) & ~0x1fff);
+    /* don't allow too large steps */
+    if (step > 0x800000)
+        step = 0x800000;
     /* cis_readable wants to map 2x map_size */
     if (step < 2 * s->map_size)
         step = 2 * s->map_size;
@@ -465,8 +468,7 @@ static void validate_mem(struct pcmcia_socket *s, unsigned int probe_mask)
 
         for (m = s_data->mem_db.next; m != &s_data->mem_db; m = mm.next) {
                 mm = *m;
-                if (do_mem_probe(mm.base, mm.num, s))
-                        break;
+                do_mem_probe(mm.base, mm.num, s);
         }
 }