- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] sbitmap: fix infinite loop caused by negative wait_cnt
by Li Lingfeng 24 Nov '25

24 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID5F52 -------------------------------- A race condition in sbitmap_queue_wake_up() can cause an infinite loop when multiple CPUs concurrently decrement the same wait_cnt, resulting in a negative value that still satisfies the original condition check. The race scenario: CPU20 (in ioctl context): - Calls __sbq_wake_up() and selects ws based on wake_index CPU3 (in softirq): - Concurrently selects the same ws (wake_index unchanged) - Decrements wait_cnt from 1 to 0 CPU20 (interrupted by softirq): - Selects the same ws again (wake_index still unchanged) - Decrements wait_cnt from 0 to -1 - Returns true because (wait_cnt < 0) - Enters infinite loop in while(__sbq_wake_up(sbq)) The root cause is that sbq_wake_ptr() returns the wait_state when atomic_read(&ws->wait_cnt) is non-zero, which includes negative values. Since wake_index is never updated when the same ws is repeatedly selected, multiple CPUs can race on the same wait_state, driving wait_cnt increasingly negative and triggering the infinite loop condition. Fix this by explicitly checking that wait_cnt is positive (> 0) in sbq_wake_ptr(), preventing selection of wait_states with negative counts and breaking the infinite loop condition. Fixes: 084cd94d0b2a ("sbitmap: fix possible io hung due to lost wakeup") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- lib/sbitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/sbitmap.c b/lib/sbitmap.c index 9fe2aebc13da..dbe4e3bc6b33 100644 --- a/lib/sbitmap.c +++ b/lib/sbitmap.c @@ -554,7 +554,7 @@ static struct sbq_wait_state *sbq_wake_ptr(struct sbitmap_queue *sbq) for (i = 0; i < SBQ_WAIT_QUEUES; i++) { struct sbq_wait_state *ws = &sbq->ws[wake_index]; - if (waitqueue_active(&ws->wait) && atomic_read(&ws->wait_cnt)) { + if (waitqueue_active(&ws->wait) && (atomic_read(&ws->wait_cnt) > 0)) { if (wake_index != atomic_read(&sbq->wake_index)) atomic_set(&sbq->wake_index, wake_index); return ws; -- 2.46.1

2 1

[PATCH OLK-6.6] net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
by Yao Kai 24 Nov '25

24 Nov '25

From: Oleksij Rempel <o.rempel(a)pengutronix.de> stable inclusion from stable-v6.6.112 commit 724a9db84188f80ef60b1f21cc7b4e9c84e0cb64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BB4 CVE: CVE-2025-40120 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3d3c4cd5c62f24bb3cb4511b7a95df707635e00a upstream. Prevent USB runtime PM (autosuspend) for AX88772* in bind. usbnet enables runtime PM (autosuspend) by default, so disabling it via the usb_driver flag is ineffective. On AX88772B, autosuspend shows no measurable power saving with current driver (no link partner, admin up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering the PHY off on admin-down, not from USB autosuspend. The real hazard is that with runtime PM enabled, ndo_open() (under RTNL) may synchronously trigger autoresume (usb_autopm_get_interface()) into asix_resume() while the USB PM lock is held. Resume paths then invoke phylink/phylib and MDIO, which also expect RTNL, leading to possible deadlocks or PM lock vs MDIO wake issues. To avoid this, keep the device runtime-PM active by taking a usage reference in ax88772_bind() and dropping it in unbind(). A non-zero PM usage count blocks runtime suspend regardless of userspace policy (.../power/control - pm_runtime_allow/forbid), making this approach robust against sysfs overrides. Holding a runtime-PM usage ref does not affect system-wide suspend; system sleep/resume callbacks continue to run as before. Fixes: 4a2c7217cd5a ("net: usb: asix: ax88772: manage PHY PM from MAC") Reported-by: Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> Closes: https://lore.kernel.org/all/DCGHG5UJT9G3.2K1GHFZ3H87T0@gmail.com Tested-by: Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> Reported-by: Marek Szyprowski <m.szyprowski(a)samsung.com> Closes: https://lore.kernel.org/all/b5ea8296-f981-445d-a09a-2f389d7f6fdd@samsung.com Cc: stable(a)vger.kernel.org Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://patch.msgid.link/20251005081203.3067982-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/net/usb/asix_devices.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c index 6d77083e6e10..9ced9441066c 100644 --- a/drivers/net/usb/asix_devices.c +++ b/drivers/net/usb/asix_devices.c @@ -625,6 +625,21 @@ static void ax88772_suspend(struct usbnet *dev) asix_read_medium_status(dev, 1)); } +/* Notes on PM callbacks and locking context: + * + * - asix_suspend()/asix_resume() are invoked for both runtime PM and + * system-wide suspend/resume. For struct usb_driver the ->resume() + * callback does not receive pm_message_t, so the resume type cannot + * be distinguished here. + * + * - The MAC driver must hold RTNL when calling phylink interfaces such as + * phylink_suspend()/resume(). Those calls will also perform MDIO I/O. + * + * - Taking RTNL and doing MDIO from a runtime-PM resume callback (while + * the USB PM lock is held) is fragile. Since autosuspend brings no + * measurable power saving here, we block it by holding a PM usage + * reference in ax88772_bind(). + */ static int asix_suspend(struct usb_interface *intf, pm_message_t message) { struct usbnet *dev = usb_get_intfdata(intf); @@ -921,6 +936,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) if (ret) goto initphy_err; + /* Keep this interface runtime-PM active by taking a usage ref. + * Prevents runtime suspend while bound and avoids resume paths + * that could deadlock (autoresume under RTNL while USB PM lock + * is held, phylink/MDIO wants RTNL). + */ + pm_runtime_get_noresume(&intf->dev); + return 0; initphy_err: @@ -950,6 +972,8 @@ static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf) phylink_destroy(priv->phylink); ax88772_mdio_unregister(priv); asix_rx_fixup_common_free(dev->driver_priv); + /* Drop the PM usage ref taken in bind() */ + pm_runtime_put(&intf->dev); } static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf) @@ -1609,6 +1633,11 @@ static struct usb_driver asix_driver = { .resume = asix_resume, .reset_resume = asix_resume, .disconnect = usbnet_disconnect, + /* usbnet enables autosuspend by default (supports_autosuspend=1). + * We keep runtime-PM active for AX88772* by taking a PM usage + * reference in ax88772_bind() (pm_runtime_get_noresume()) and + * dropping it in unbind(), which effectively blocks autosuspend. + */ .supports_autosuspend = 1, .disable_hub_initiated_lpm = 1, }; -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-39964
by Gu Bowen 24 Nov '25

24 Nov '25

CVE-2025-39964 Eric Biggers (1): crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Herbert Xu (1): crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg crypto/af_alg.c | 7 +++++++ include/crypto/if_alg.h | 10 ++++++---- 2 files changed, 13 insertions(+), 4 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 0/4] CVE-2025-40179
by Yongjian Sun 24 Nov '25

24 Nov '25

Baokun Li (1): ext4: align max orphan file size with e2fsprogs limit Jan Kara (2): ext4: verify orphan file size is not too big ext4: free orphan info with kvfree Liao Yuanhong (1): ext4: use kmalloc_array() for array space allocation fs/ext4/orphan.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) -- 2.39.2

2 5

[PATCH OLK-6.6] ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
by Bowen You 24 Nov '25

24 Nov '25

From: Yuhao Jiang <danisjiang(a)gmail.com> mainline inclusion from mainline-v6.18-rc4 commit 8f067aa59430266386b83c18b983ca583faa6a11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID7X34 CVE: CVE-2025-40211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Yuhao Jiang <danisjiang(a)gmail.com> Reviewed-by: Hans de Goede <hansg(a)kernel.org> [ rjw: Changelog edit ] Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c index a971770e24ff..841db33e9475 100644 --- a/drivers/acpi/acpi_video.c +++ b/drivers/acpi/acpi_video.c @@ -1952,8 +1952,10 @@ static void acpi_video_bus_remove_notify_handler(struct acpi_video_bus *video) struct acpi_video_device *dev; mutex_lock(&video->device_list_lock); - list_for_each_entry(dev, &video->video_device_list, entry) + list_for_each_entry(dev, &video->video_device_list, entry) { acpi_video_dev_remove_notify_handler(dev); + cancel_delayed_work_sync(&dev->switch_brightness_work); + } mutex_unlock(&video->device_list_lock); acpi_video_bus_stop_devices(video); -- 2.34.1

2 1

[PATCH OLK-5.10] ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
by Bowen You 24 Nov '25

24 Nov '25

From: Yuhao Jiang <danisjiang(a)gmail.com> mainline inclusion from mainline-v6.18-rc4 commit 8f067aa59430266386b83c18b983ca583faa6a11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID7X34 CVE: CVE-2025-40211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Yuhao Jiang <danisjiang(a)gmail.com> Reviewed-by: Hans de Goede <hansg(a)kernel.org> [ rjw: Changelog edit ] Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c index b2364ac455f3..f67871e8f383 100644 --- a/drivers/acpi/acpi_video.c +++ b/drivers/acpi/acpi_video.c @@ -2028,8 +2028,10 @@ static void acpi_video_bus_remove_notify_handler(struct acpi_video_bus *video) struct acpi_video_device *dev; mutex_lock(&video->device_list_lock); - list_for_each_entry(dev, &video->video_device_list, entry) + list_for_each_entry(dev, &video->video_device_list, entry) { acpi_video_dev_remove_notify_handler(dev); + cancel_delayed_work_sync(&dev->switch_brightness_work); + } mutex_unlock(&video->device_list_lock); acpi_video_bus_stop_devices(video); -- 2.34.1

2 1

[PATCH OLK-6.6] Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
by Cai Xinchen 24 Nov '25

24 Nov '25

From: Zhen Ni <zhen.ni(a)easystack.cn> stable inclusion from stable-v6.6.112 commit fd8a23ecbc602d00e47b27f20b07350867d0ebe5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WHX CVE: CVE-2025-40035 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream. Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields. Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput") Cc: stable(a)vger.kernel.org Signed-off-by: Zhen Ni <zhen.ni(a)easystack.cn> Link: https://lore.kernel.org/r/20250928063737.74590-1-zhen.ni@easystack.cn Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/input/misc/uinput.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 2c973f15cab7..edb62a284548 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -775,6 +775,7 @@ static int uinput_ff_upload_to_user(char __user *buffer, if (in_compat_syscall()) { struct uinput_ff_upload_compat ff_up_compat; + memset(&ff_up_compat, 0, sizeof(ff_up_compat)); ff_up_compat.request_id = ff_up->request_id; ff_up_compat.retval = ff_up->retval; /* -- 2.34.1

2 1

[openeuler:OLK-5.10 3304/3304] include/linux/sunrpc/xdr.h:606:10: warning: result of comparison of constant 4611686018427387903 with expression of type '__u32' (aka 'unsigned int') is always false
by kernel test robot 24 Nov '25

24 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4a93a68b1fa420e5791d9f16414d427f8dd90fb4 commit: fd2b905e3179865f7a512dfcfe14f10b6067236d [3304/3304] NFSD: prevent integer overflow on 32 bit systems config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20251124/202511241524.zGjjHi86-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9e9fe08b16ea2c4d9867fb4974edf2a3776d6ece) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251124/202511241524.zGjjHi86-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511241524.zGjjHi86-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from init/do_mounts.c:23: In file included from include/linux/nfs_fs.h:31: In file included from include/linux/sunrpc/auth.h:13: In file included from include/linux/sunrpc/sched.h:19: >> include/linux/sunrpc/xdr.h:606:10: warning: result of comparison of constant 4611686018427387903 with expression of type '__u32' (aka 'unsigned int') is always false [-Wtautological-constant-out-of-range-compare] 606 | if (len > SIZE_MAX / sizeof(*p)) | ~~~ ^ ~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. vim +606 include/linux/sunrpc/xdr.h 584 585 /** 586 * xdr_stream_decode_uint32_array - Decode variable length array of integers 587 * @xdr: pointer to xdr_stream 588 * @array: location to store the integer array or NULL 589 * @array_size: number of elements to store 590 * 591 * Return values: 592 * On success, returns number of elements stored in @array 593 * %-EBADMSG on XDR buffer overflow 594 * %-EMSGSIZE if the size of the array exceeds @array_size 595 */ 596 static inline ssize_t 597 xdr_stream_decode_uint32_array(struct xdr_stream *xdr, 598 __u32 *array, size_t array_size) 599 { 600 __be32 *p; 601 __u32 len; 602 ssize_t retval; 603 604 if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) 605 return -EBADMSG; > 606 if (len > SIZE_MAX / sizeof(*p)) 607 return -EBADMSG; 608 p = xdr_inline_decode(xdr, len * sizeof(*p)); 609 if (unlikely(!p)) 610 return -EBADMSG; 611 if (array == NULL) 612 return len; 613 if (len <= array_size) { 614 if (len < array_size) 615 memset(array+len, 0, (array_size-len)*sizeof(*array)); 616 array_size = len; 617 retval = len; 618 } else 619 retval = -EMSGSIZE; 620 for (; array_size > 0; p++, array++, array_size--) 621 *array = be32_to_cpup(p); 622 return retval; 623 } 624 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
by Ziming Du 24 Nov '25

24 Nov '25

From: I Viswanath <viswanathiyyappan(a)gmail.com> stable inclusion from stable-v6.6.112 commit 6394bade9daab8e318c165fe43bba012bf13cd8e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B6J CVE: CVE-2025-40140 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks. Reported-and-tested-by: syzbot+78cae3f37c62ad092caa(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Michal Pecio <michal.pecio(a)gmail.com> Signed-off-by: I Viswanath <viswanathiyyappan(a)gmail.com> Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/usb/rtl8150.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index ddff6f19ff98e..92add3daadbb1 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) rtl8150_t *dev = netdev_priv(netdev); u16 rx_creg = 0x9e; - netif_stop_queue(netdev); if (netdev->flags & IFF_PROMISC) { rx_creg |= 0x0001; dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); @@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) rx_creg &= 0x00fc; } async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); - netif_wake_queue(netdev); } static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, -- 2.43.0

2 1

[PATCH OLK-6.6] net: dlink: handle copy_thresh allocation failure
by Ziming Du 24 Nov '25

24 Nov '25

From: Yeounsu Moon <yyyynoom(a)gmail.com> stable inclusion from stable-v6.6.112 commit ea87151df398d407a632c7bf63013290f01c5009 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WGB CVE: CVE-2025-40053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Yeounsu Moon <yyyynoom(a)gmail.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c index db6615aa921b1..8fa9f7bf20abc 100644 --- a/drivers/net/ethernet/dlink/dl2k.c +++ b/drivers/net/ethernet/dlink/dl2k.c @@ -947,15 +947,18 @@ receive_packet (struct net_device *dev) } else { struct sk_buff *skb; + skb = NULL; /* Small skbuffs for short packets */ - if (pkt_len > copy_thresh) { + if (pkt_len <= copy_thresh) + skb = netdev_alloc_skb_ip_align(dev, pkt_len); + if (!skb) { dma_unmap_single(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, DMA_FROM_DEVICE); skb_put (skb = np->rx_skbuff[entry], pkt_len); np->rx_skbuff[entry] = NULL; - } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { + } else { dma_sync_single_for_cpu(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, -- 2.43.0

2 1