virtnet_probe() calls init_vqs() before virtnet_init_irq_moder().
When the irq moderation init fails, the error path does "goto
free", which only reaches free_netdev(): virtio_reset_device() and
virtnet_del_vqs() are skipped, leaking the virtqueues and their
DMA mappings.
Use the existing free_irq_moder label instead, as
virtnet_create_page_pools() already does on failure. This is safe
only after net_dim_init_irq_moder() clears dev->irq_moder on its
own failure (previous patch); otherwise virtnet_free_irq_moder()
would net_dim_free_irq_moder() a dangling pointer, dereferencing
freed memory and freeing it a second time.
Fixes: dcb67f6a9ead6 ("virtio-net: support dim profile fine-tuning")
Signed-off-by: Jianlin Shi <redacted>
---
drivers/net/virtio_net.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index dd2c41ef6fbe..d3ad1f1334bb 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -7027,7 +7027,7 @@ static int virtnet_probe(struct virtio_device *vdev)
err = virtnet_init_irq_moder(vi);
if (err)
- goto free;
+ goto free_irq_moder;
}
/* Create page pools for receive queues.
--
2.43.0