virtnet_probe() calls init_vqs() before virtnet_init_irq_moder(). When the irq moderation init fails, the error path does "goto free", which only reaches free_netdev(): virtio_reset_device() and virtnet_del_vqs() are skipped, leaking the virtqueues and their DMA mappings. Use the existing free_irq_moder label instead, as virtnet_create_page_pools() already does on failure. This is safe only after net_dim_init_irq_moder() clears dev->irq_moder on its own failure (previous patch); otherwise virtnet_free_irq_moder() would net_dim_free_irq_moder() a dangling pointer, dereferencing freed memory and freeing it a second time. Fixes: dcb67f6a9ead6 ("virtio-net: support dim profile fine-tuning") Signed-off-by: Jianlin Shi --- drivers/net/virtio_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index dd2c41ef6fbe..d3ad1f1334bb 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -7027,7 +7027,7 @@ static int virtnet_probe(struct virtio_device *vdev) err = virtnet_init_irq_moder(vi); if (err) - goto free; + goto free_irq_moder; } /* Create page pools for receive queues. -- 2.43.0