> net_dim_init_irq_moder() publishes the allocated object in
> dev->irq_moder before copying the moderation profiles. If kmemdup()
> fails, the object is freed but the pointer is left dangling.
> net_dim_free_irq_moder() treats a non-NULL irq_moder as live, so a
> caller unwinding the failure path would use-after-free.
>
> NULL the pointer after freeing it. On error the device is left as if
> initialization never happened.
>
> Fixes: f750dfe825b90 ("ethtool: provide customized dim profile management")
> Signed-off-by: Jianlin Shi <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
