This series fixes error handling around the lan966x page pool:
1/3 adds the missing IS_ERR check after page_pool_create(), preventing
a kernel oops when the error pointer flows into
xdp_rxq_info_reg_mem_model().
2/3 plugs page pool leaks in the lan966x_fdma_rx_alloc() and
lan966x_fdma_init() error paths, now reachable after 1/3.
3/3 fixes a use-after-free and page pool leak in the
lan966x_fdma_reload() restore path, where the hardware could
resume DMA into pages already returned to the page pool.
David Carlier (3):
net: lan966x: fix page_pool error handling in
lan966x_fdma_rx_alloc_page_pool()
net: lan966x: fix page pool leak in error paths
net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
.../ethernet/microchip/lan966x/lan966x_fdma.c | 28 ++++++++++++++++---
1 file changed, 24 insertions(+), 4 deletions(-)
--
v2 -> v3:
- 1/3: remove blank line between page_pool_create() and IS_ERR check (Jakub)
- 2/3: drop rx->page_pool = NULL for consistency with lan966x_fdma_init()
cleanup; update commit message accordingly (Jakub)
- 3/3: remove blank line between kmemdup() and !old_pages check (Jakub)
v1 -> v2: address caller error paths raised by Jakub's review; add patches
2/3 and 3/3
v1: https://lore.kernel.org/netdev/20260402172823.83467-1-devnexen@gmail.com
v2: https://lore.kernel.org/netdev/20260403230714.10667-1-devnexen@gmail.com
2.53.0