You're right - there is no such sequence on current mainline.
net_dim_init_irq_moder() has a single in-tree caller (virtio-net). If it
fails, virtnet_probe() still does "goto free", which only ends in
free_netdev(). Nothing calls net_dim_free_irq_moder() on that path, so
the stale dev->irq_moder value is never dereferenced; it disappears when
the net_device is freed.
The dereference becomes reachable with the unwind change in patch 2:
virtnet_init_irq_moder()
-> net_dim_init_irq_moder() /* fails after kfree(moder); irq_moder stale */
goto free_irq_moder; /* patch 2 */
virtnet_free_irq_moder()
net_dim_free_irq_moder()
/* non-NULL irq_moder => */
rtnl_dereference(dev->irq_moder->rx_profile) /* UAF */
kfree(dev->irq_moder) /* freed again */
So patch 1 is not fixing a reachable bug on today's tree by itself; it is
a hard prerequisite for patch 2. Without patch 1, patch 2 would trade the
virtqueue leak for UAF (and a second kfree of moder) on this error path.
I can add this call chain to the patch 1 commit message in v2 if you prefer.
Jianlin
