From: Yun Lu cp_tx_timeout() ignores the return value of cp_init_rings(). If the RX buffer refill fails there, cp_clean_rings() has already dropped all rx_skb entries, yet the driver restarts the hardware and schedules NAPI unconditionally. cp_rx_poll() then dereferences a NULL rx_skb slot and hits BUG_ON(!skb), crashing the kernel; the RX ring also stays empty until the next close/open cycle. On refill failure, keep the queue stopped and leave the device down until the next open instead of restarting into a guaranteed BUG. Fixes: 9030c0d24dbb ("8139cp: implement the missing dev->tx_timeout") Signed-off-by: Yun Lu --- drivers/net/ethernet/realtek/8139cp.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c index 03929bb0bd79..968bc0a2086e 100644 --- a/drivers/net/ethernet/realtek/8139cp.c +++ b/drivers/net/ethernet/realtek/8139cp.c @@ -1273,7 +1273,13 @@ static void cp_tx_timeout(struct net_device *dev, unsigned int txqueue) cp_stop_hw(cp); cp_clean_rings(cp); - cp_init_rings(cp); + if (cp_init_rings(cp)) { + netif_err(cp, tx_err, dev, + "Failed to allocate RX buffers, not restarting\n"); + netif_stop_queue(dev); + spin_unlock_irqrestore(&cp->lock, flags); + return; + } cp_start_hw(cp); __cp_set_rx_mode(dev); cpw16_f(IntrMask, cp_norx_intr_mask); -- 2.25.1