On Wed, 30 Sep 2026 16:19:51 +0800 Jianlin Shi wrote: > net_dim_init_irq_moder() publishes the allocated object in > dev->irq_moder before copying the moderation profiles. If kmemdup() > fails, the object is freed but the pointer is left dangling. > net_dim_free_irq_moder() treats a non-NULL irq_moder as live, so a > caller unwinding the failure path would use-after-free. > > NULL the pointer after freeing it. On error the device is left as if > initialization never happened.
Please add an example sequence of calls in the current source tree where this is a problem. Dangling pointers are not an issue unless something tries to deref them. -- pw-bot: cr
