Commit 3fd0da4f authored by David Carlier's avatar David Carlier Committed by Paolo Abeni
Browse files

net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() 



page_pool_create() can return an ERR_PTR on failure. The return value
is used unconditionally in the loop that follows, passing the error
pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),
which dereferences it, causing a kernel oops.

Add an IS_ERR check after page_pool_create() to return early on failure.

Fixes: 11871aba ("net: lan96x: Use page_pool API")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDavid Carlier <devnexen@gmail.com>
Link: https://patch.msgid.link/20260405055241.35767-2-devnexen@gmail.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent c71ba669

drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c

+2 −0
Original line number Diff line number Diff line
@@ -91,6 +91,8 @@ static int lan966x_fdma_rx_alloc_page_pool(struct lan966x_rx *rx) 
		pp_params.dma_dir = DMA_BIDIRECTIONAL;



	rx->page_pool = page_pool_create(&pp_params);

	if (unlikely(IS_ERR(rx->page_pool)))

		return PTR_ERR(rx->page_pool);



	for (int i = 0; i < lan966x->num_phys_ports; ++i) {

		struct lan966x_port *port;