Commit 076344a6ad9d for kernel

commit 076344a6ad9d1308faaed1402fdcfdda68b604ab
Author: David Carlier <devnexen@gmail.com>
Date:   Sun Apr 5 06:52:40 2026 +0100

    net: lan966x: fix page pool leak in error paths

    lan966x_fdma_rx_alloc() creates a page pool but does not destroy it if
    the subsequent fdma_alloc_coherent() call fails, leaking the pool.

    Similarly, lan966x_fdma_init() frees the coherent DMA memory when
    lan966x_fdma_tx_alloc() fails but does not destroy the page pool that
    was successfully created by lan966x_fdma_rx_alloc(), leaking it.

    Add the missing page_pool_destroy() calls in both error paths.

    Fixes: 11871aba1974 ("net: lan96x: Use page_pool API")
    Cc: stable@vger.kernel.org
    Signed-off-by: David Carlier <devnexen@gmail.com>
    Link: https://patch.msgid.link/20260405055241.35767-3-devnexen@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
index 74851c63e46a..10773fe93d4d 100644
--- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
@@ -119,8 +119,10 @@ static int lan966x_fdma_rx_alloc(struct lan966x_rx *rx)
 		return PTR_ERR(rx->page_pool);

 	err = fdma_alloc_coherent(lan966x->dev, fdma);
-	if (err)
+	if (err) {
+		page_pool_destroy(rx->page_pool);
 		return err;
+	}

 	fdma_dcbs_init(fdma, FDMA_DCB_INFO_DATAL(fdma->db_size),
 		       FDMA_DCB_STATUS_INTR);
@@ -957,6 +959,7 @@ int lan966x_fdma_init(struct lan966x *lan966x)
 	err = lan966x_fdma_tx_alloc(&lan966x->tx);
 	if (err) {
 		fdma_free_coherent(lan966x->dev, &lan966x->rx.fdma);
+		page_pool_destroy(lan966x->rx.page_pool);
 		return err;
 	}