The xdp_convert_buff_to_frame() function can return NULL when there is
insufficient headroom in the buffer to store the xdp_frame structure
or when the driver didn't reserve enough tailroom for skb_shared_info.

Currently, the sfc driver does not check for this NULL return value
in the XDP_TX case within efx_do_xdp(). While the efx_xdp_tx_buffers()
function has some defensive checks, passing a NULL xdpf can still lead
to undefined behavior when the function tries to access xdpf->len and
xdpf->data.

Fix by adding a proper NULL check in the XDP_TX case, following the
suggestions of the developers.

Fixes: 1b698fa5d8ef ("xdp: Rename convert_to_xdp_frame in xdp_convert_buff_to_frame")
Signed-off-by: Chenyuan Yang <redacted>
Cc: Kunwu Chan <redacted>
Cc: Edward Cree <redacted>
---
 drivers/net/ethernet/sfc/rx.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index ffca82207e47..b56457c23f66 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c

@@ -308,14 +308,20 @@ static bool efx_do_xdp(struct efx_nic *efx, struct efx_channel *channel,
 	case XDP_TX:
 		/* Buffer ownership passes to tx on success. */
 		xdpf = xdp_convert_buff_to_frame(&xdp);
-		err = efx_xdp_tx_buffers(efx, 1, &xdpf, true);
+		if (unlikely(!xdpf))
+			err = -ENOBUFS;
+		else
+			err = efx_xdp_tx_buffers(efx, 1, &xdpf, true);
+
 		if (unlikely(err != 1)) {
 			efx_free_rx_buffers(rx_queue, rx_buf, 1);
 			if (net_ratelimit())
 				netif_err(efx, rx_err, efx->net_dev,
-					  "XDP TX failed (%d)\n", err);
+					  "XDP TX failed (%d)%s\n", err,
+					  err == -ENOBUFS ? " [frame conversion]" : "");
 			channel->n_rx_xdp_bad_drops++;
-			trace_xdp_exception(efx->net_dev, xdp_prog, xdp_act);
+			if (err != -ENOBUFS)
+				trace_xdp_exception(efx->net_dev, xdp_prog, xdp_act);
 		} else {
 			channel->n_rx_xdp_tx++;
 		}

-- 
2.34.1