[PATCH 02/13] 8139cp: handle cp_init_rings() failure in cp_tx_timeout()

From: Yun Lu <redacted>

cp_tx_timeout() ignores the return value of cp_init_rings(). If the
RX buffer refill fails there, cp_clean_rings() has already dropped
all rx_skb entries, yet the driver restarts the hardware and
schedules NAPI unconditionally. cp_rx_poll() then dereferences a
NULL rx_skb slot and hits BUG_ON(!skb), crashing the kernel; the RX
ring also stays empty until the next close/open cycle.

On refill failure, keep the queue stopped and leave the device down
until the next open instead of restarting into a guaranteed BUG.

Fixes: 9030c0d24dbb ("8139cp: implement the missing dev->tx_timeout")
Signed-off-by: Yun Lu <redacted>
---
 drivers/net/ethernet/realtek/8139cp.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index 03929bb0bd79..968bc0a2086e 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c

@@ -1273,7 +1273,13 @@ static void cp_tx_timeout(struct net_device *dev, unsigned int txqueue)
 
 	cp_stop_hw(cp);
 	cp_clean_rings(cp);
-	cp_init_rings(cp);
+	if (cp_init_rings(cp)) {
+		netif_err(cp, tx_err, dev,
+			  "Failed to allocate RX buffers, not restarting\n");
+		netif_stop_queue(dev);
+		spin_unlock_irqrestore(&cp->lock, flags);
+		return;
+	}
 	cp_start_hw(cp);
 	__cp_set_rx_mode(dev);
 	cpw16_f(IntrMask, cp_norx_intr_mask);

-- 
2.25.1