From: Jakub Kicinski <kuba@kernel.org>
To: Jianlin Shi <shijianlin11@foxmail.com>
Cc: netdev@vger.kernel.org, virtualization@lists.linux.dev,
mst@redhat.com, jasowangio@gmail.com, eperezma@redhat.com,
xuanzhuo@linux.alibaba.com, andrew+netdev@lunn.ch,
davem@davemloft.net, edumazet@google.com, pabeni@redhat.com,
talgi@nvidia.com, hengqi@linux.alibaba.com, horms@kernel.org
Subject: Re: [PATCH 1/2] dim: clear irq_moder on init failure
Date: Mon, 5 Oct 2026 18:53:35 -0700 [thread overview]
Message-ID: <20261005185335.2f8e8b42@kernel.org> (raw)
In-Reply-To: <8d6a637142c411f83771fda5b57bb4451651488b.1790751008.git.shijianlin11@foxmail.com>
On Wed, 30 Sep 2026 16:19:51 +0800 Jianlin Shi wrote:
> net_dim_init_irq_moder() publishes the allocated object in
> dev->irq_moder before copying the moderation profiles. If kmemdup()
> fails, the object is freed but the pointer is left dangling.
> net_dim_free_irq_moder() treats a non-NULL irq_moder as live, so a
> caller unwinding the failure path would use-after-free.
>
> NULL the pointer after freeing it. On error the device is left as if
> initialization never happened.
Please add an example sequence of calls in the current source tree
where this is a problem. Dangling pointers are not an issue unless
something tries to deref them.
--
pw-bot: cr
next prev parent reply other threads:[~2026-10-06 1:53 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-30 8:19 [PATCH 0/2] virtio-net/dim: fix irq moderation init failure unwind Jianlin Shi
2026-09-30 8:19 ` [PATCH 1/2] dim: clear irq_moder on init failure Jianlin Shi
2026-09-30 8:33 ` sashiko-bot
2026-10-06 1:53 ` Jakub Kicinski [this message]
2026-10-08 15:42 ` Jianlin Shi
2026-09-30 8:19 ` [PATCH 2/2] virtio-net: unwind VQs when irq moderation init fails Jianlin Shi
2026-09-30 8:33 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261005185335.2f8e8b42@kernel.org \
--to=kuba@kernel.org \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eperezma@redhat.com \
--cc=hengqi@linux.alibaba.com \
--cc=horms@kernel.org \
--cc=jasowangio@gmail.com \
--cc=mst@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=shijianlin11@foxmail.com \
--cc=talgi@nvidia.com \
--cc=virtualization@lists.linux.dev \
--cc=xuanzhuo@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.