Commit b266bacba796 for kernel

commit b266bacba796ff5c4dcd2ae2fc08aacf7ab39153
Author: Andreas Haarmann-Thiemann <eitschman@nebelreich.de>
Date:   Tue May 5 23:52:17 2026 +0200

    net: ethernet: cortina: Drop half-assembled SKB

    In gmac_rx() (drivers/net/ethernet/cortina/gemini.c), when
    gmac_get_queue_page() returns NULL for the second page of a multi-page
    fragment, the driver logs an error and continues — but does not free the
    partially assembled skb that was being assembled via napi_build_skb() /
    napi_get_frags().

    Free the in-progress partially assembled skb via napi_free_frags()
    and increase the number of dropped frames appropriately
    and assign the skb pointer NULL to make sure it is not lingering
    around, matching the pattern already used elsewhere in the driver.

    Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet")
    Signed-off-by: Andreas Haarmann-Thiemann <eitschman@nebelreich.de>
    Signed-off-by: Linus Walleij <linusw@kernel.org>
    Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
    Link: https://patch.msgid.link/20260505-gemini-ethernet-fix-v2-1-997c31d06079@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index 4824232f4890..065cbbf52686 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -1491,6 +1491,11 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)
 		gpage = gmac_get_queue_page(geth, port, mapping + PAGE_SIZE);
 		if (!gpage) {
 			dev_err(geth->dev, "could not find mapping\n");
+			if (skb) {
+				napi_free_frags(&port->napi);
+				port->stats.rx_dropped++;
+				skb = NULL;
+			}
 			continue;
 		}
 		page = gpage->page;