Commit 3fd0da4fd885 for kernel

commit 3fd0da4fd8851a7e62d009b7db6c4a05b092bc19
Author: David Carlier <devnexen@gmail.com>
Date:   Sun Apr 5 06:52:39 2026 +0100

    net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()

    page_pool_create() can return an ERR_PTR on failure. The return value
    is used unconditionally in the loop that follows, passing the error
    pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),
    which dereferences it, causing a kernel oops.

    Add an IS_ERR check after page_pool_create() to return early on failure.

    Fixes: 11871aba1974 ("net: lan96x: Use page_pool API")
    Cc: stable@vger.kernel.org
    Signed-off-by: David Carlier <devnexen@gmail.com>
    Link: https://patch.msgid.link/20260405055241.35767-2-devnexen@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
index 7b6369e43451..74851c63e46a 100644
--- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
@@ -91,6 +91,8 @@ static int lan966x_fdma_rx_alloc_page_pool(struct lan966x_rx *rx)
 		pp_params.dma_dir = DMA_BIDIRECTIONAL;

 	rx->page_pool = page_pool_create(&pp_params);
+	if (unlikely(IS_ERR(rx->page_pool)))
+		return PTR_ERR(rx->page_pool);

 	for (int i = 0; i < lan966x->num_phys_ports; ++i) {
 		struct lan966x_port *port;