When dma_mapping_error() fires during RX buffer refill in nixge_recv(), the skb allocated by netdev_alloc_skb_ip_align() is never freed, and execution continues writing a corrupt physical address into the hardware descriptor ring. Fix by freeing the skb with dev_kfree_skb() and returning early. Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev") Signed-off-by: Bentley Blacketer --- drivers/net/ethernet/ni/nixge.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c index 230d5ff99..b64e2f355 100644 --- a/drivers/net/ethernet/ni/nixge.c +++ b/drivers/net/ethernet/ni/nixge.c @@ -645,8 +645,9 @@ static int nixge_recv(struct net_device *ndev, int budget) NIXGE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE); if (dma_mapping_error(ndev->dev.parent, cur_phys)) { - /* FIXME: bail out and clean up */ - netdev_err(ndev, "Failed to map ...\n"); + netdev_err(ndev, "Failed to map RX buffer\n"); + dev_kfree_skb(new_skb); + return packets; } nixge_hw_dma_bd_set_phys(cur_p, cur_phys); cur_p->cntrl = NIXGE_MAX_JUMBO_FRAME_SIZE; -- 2.54.0