Re: [PATCH 1/2] dim: clear irq_moder on init failure

[Jianlin Shi <shijianlin11@foxmail.com>]

You're right - there is no such sequence on current mainline.

net_dim_init_irq_moder() has a single in-tree caller (virtio-net). If it
fails, virtnet_probe() still does "goto free", which only ends in
free_netdev(). Nothing calls net_dim_free_irq_moder() on that path, so
the stale dev->irq_moder value is never dereferenced; it disappears when
the net_device is freed.

The dereference becomes reachable with the unwind change in patch 2:

  virtnet_init_irq_moder()
    -> net_dim_init_irq_moder()  /* fails after kfree(moder); irq_moder stale */
  goto free_irq_moder;            /* patch 2 */
    virtnet_free_irq_moder()
      net_dim_free_irq_moder()
        /* non-NULL irq_moder => */
        rtnl_dereference(dev->irq_moder->rx_profile)  /* UAF */
        kfree(dev->irq_moder)                         /* freed again */

So patch 1 is not fixing a reachable bug on today's tree by itself; it is
a hard prerequisite for patch 2. Without patch 1, patch 2 would trade the
virtqueue leak for UAF (and a second kfree of moder) on this error path.

I can add this call chain to the patch 1 commit message in v2 if you prefer.

Jianlin