When dma_mapping_error() fires during RX buffer refill in nixge_recv(), the skb allocated by netdev_alloc_skb_ip_align() is never freed, and execution continues writing a corrupt physical address into the hardware descriptor ring. Fix by freeing the skb with dev_kfree_skb() and returning early. This was tested via code inspection, as I do not have access to the hardware. If dma_mapping_error() occurs, the current code continues execution, which can leak the skb and program an invalid DMA address into the descriptor ring. This patch ensures proper cleanup and early return on error. Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev") Signed-off-by: Bentley Blacketer --- drivers/net/ethernet/ni/nixge.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c index 230d5ff99..b64e2f355 100644 --- a/drivers/net/ethernet/ni/nixge.c +++ b/drivers/net/ethernet/ni/nixge.c @@ -645,8 +645,9 @@ static int nixge_recv(struct net_device *ndev, int budget) NIXGE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE); if (dma_mapping_error(ndev->dev.parent, cur_phys)) { - /* FIXME: bail out and clean up */ - netdev_err(ndev, "Failed to map ...\n"); + netdev_err(ndev, "Failed to map RX buffer\n"); + dev_kfree_skb(new_skb); + return packets; } nixge_hw_dma_bd_set_phys(cur_p, cur_phys); cur_p->cntrl = NIXGE_MAX_JUMBO_FRAME_SIZE; -- 2.54.0