net: lantiq_xrx200: restore buffer if memory allocation failed

[ Upstream commit c9c3b1775f80fa21f5bff874027d2ccb10f5d90c ]

In a situation where memory allocation fails, an invalid buffer address
is stored. When this descriptor is used again, the system panics in the
build_skb() function when accessing memory.

Fixes: 7ea6cd16f159 ("lantiq: net: fix duplicated skb in rx descriptor ring")
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c
index 25adce7f0c7c04570a106de4797bff3b1aa6641a..57f27cc7724e7b63873b3205e42a08bd3a30a697 100644 (file)
--- a/drivers/net/ethernet/lantiq_xrx200.c
+++ b/drivers/net/ethernet/lantiq_xrx200.c
@@ -193,6 +193,7 @@ static int xrx200_alloc_buf(struct xrx200_chan *ch, void *(*alloc)(unsigned int
 
        ch->rx_buff[ch->dma.desc] = alloc(priv->rx_skb_size);
        if (!ch->rx_buff[ch->dma.desc]) {
+               ch->rx_buff[ch->dma.desc] = buf;
                ret = -ENOMEM;
                goto skip;
        }