net_dim_init_irq_moder() leaves dev->irq_moder dangling when
profile allocation fails. virtio-net probe then skips the
virtqueue teardown if that init fails after init_vqs(), leaking
the virtqueues and their DMA mappings.
Patch 1 makes the dim init failure path clear dev->irq_moder, so
net_dim_free_irq_moder() is a no-op afterwards. Patch 2 sends the
virtio-net failure through the existing free_irq_moder unwind
(reset + del_vqs), matching the page-pool failure path. Patch 2
depends on patch 1.
Changes since v1 [1]:
- Patch 1's commit message now documents the call sequence the
maintainer asked for: on current mainline the dangling pointer
is never dereferenced by the only in-tree caller (virtio-net
probe does "goto free", which only reaches free_netdev()). It
becomes reachable once the caller unwinds through
free_irq_moder as patch 2 does, which makes patch 1 a hard
prerequisite rather than a standalone bug fix.
- No functional changes; both patches are identical to v1.
[1] https://lore.kernel.org/netdev/cover.1790751008.git.shijianlin11@foxmail.com/ (local)
Jianlin Shi (2):
dim: clear irq_moder on init failure
virtio-net: unwind VQs when irq moderation init fails
drivers/net/virtio_net.c | 2 +-
lib/dim/net_dim.c | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
Signed-off-by: Jianlin Shi <redacted>
--
2.43.0