net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()

commit 3fd0da4fd8851a7e62d009b7db6c4a05b092bc19 upstream.

page_pool_create() can return an ERR_PTR on failure. The return value
is used unconditionally in the loop that follows, passing the error
pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),
which dereferences it, causing a kernel oops.

Add an IS_ERR check after page_pool_create() to return early on failure.

Fixes: 11871aba1974 ("net: lan96x: Use page_pool API")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Link: https://patch.msgid.link/20260405055241.35767-2-devnexen@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
index 50267071810429a692753f82e4ab6f0180b52340..1b898f57ec7bfeef2de102b110e954dfbfdb2579 100644 (file)
--- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
@@ -91,6 +91,8 @@ static int lan966x_fdma_rx_alloc_page_pool(struct lan966x_rx *rx)
                pp_params.dma_dir = DMA_BIDIRECTIONAL;
 
        rx->page_pool = page_pool_create(&pp_params);
+       if (unlikely(IS_ERR(rx->page_pool)))
+               return PTR_ERR(rx->page_pool);
 
        for (int i = 0; i < lan966x->num_phys_ports; ++i) {
                struct lan966x_port *port;