The xdp_convert_buff_to_frame() function can return NULL when there is insufficient headroom in the buffer to store the xdp_frame structure or when the driver didn't reserve enough tailroom for skb_shared_info. Currently, the sfc siena driver does not check for this NULL return value in the XDP_TX case within efx_do_xdp(). Fix by adding a proper NULL check in the XDP_TX case. If conversion fails, free the RX buffer and increment the bad drops counter, following the same pattern used for other XDP error conditions in this driver. Signed-off-by: Chenyuan Yang Fixes: d48523cb88e0 ("sfc: Copy shared files needed for Siena (part 2)") --- drivers/net/ethernet/sfc/siena/rx.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/sfc/siena/rx.c b/drivers/net/ethernet/sfc/siena/rx.c index 98d3c0743c0f..65f6daad3168 100644 --- a/drivers/net/ethernet/sfc/siena/rx.c +++ b/drivers/net/ethernet/sfc/siena/rx.c @@ -310,6 +310,12 @@ static bool efx_do_xdp(struct efx_nic *efx, struct efx_channel *channel, case XDP_TX: /* Buffer ownership passes to tx on success. */ xdpf = xdp_convert_buff_to_frame(&xdp); + if (unlikely(!xdpf)) { + efx_siena_free_rx_buffers(rx_queue, rx_buf, 1); + channel->n_rx_xdp_bad_drops++; + break; + } + err = efx_siena_xdp_tx_buffers(efx, 1, &xdpf, true); if (unlikely(err != 1)) { efx_siena_free_rx_buffers(rx_queue, rx_buf, 1); -- 2.34.1