In the arm_smmu_device_probe() probe function, we have the following call chain: arm_smmu_device_probe() --> arm_smmu_init_structures() --> arm_smmu_init_queues() --> iopf_queue_alloc() This memory allocation has to be undone in the error handling path of the probe, as already done in the remove function. While at it, also move a iommu_device_sysfs_remove() call to the newly created error handling path so that error handling is all at the same place. Fixes: 395ad89d11fd ("iommu/arm-smmu-v3: Add stall support for platform devices") Signed-off-by: Christophe JAILLET <christophe.jaillet@xxxxxxxxxx> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index ab160198edd6..2051b1ed1ff6 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3826,22 +3826,27 @@ static int arm_smmu_device_probe(struct platform_device *pdev) /* Reset the device */ ret = arm_smmu_device_reset(smmu, bypass); if (ret) - return ret; + goto err_free_queue; /* And we're up. Go go go! */ ret = iommu_device_sysfs_add(&smmu->iommu, dev, NULL, "smmu3.%pa", &ioaddr); if (ret) - return ret; + goto err_free_queue; ret = iommu_device_register(&smmu->iommu, &arm_smmu_ops, dev); if (ret) { dev_err(dev, "Failed to register iommu\n"); - iommu_device_sysfs_remove(&smmu->iommu); - return ret; + goto err_remove_sysfs; } return 0; + +err_remove_sysfs: + iommu_device_sysfs_remove(&smmu->iommu); +err_free_queue: + iopf_queue_free(smmu->evtq.iopf); + return ret; } static int arm_smmu_device_remove(struct platform_device *pdev) -- 2.34.1