{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nliquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet\n\nIn lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,\nbut then it is unconditionally passed to skb_add_rx_frag() which looks\nstrange and could lead to null pointer dereference.\n\nlio_vf_rep_copy_packet() call trace looks like:\n\tocteon_droq_process_packets\n\t octeon_droq_fast_process_packets\n\t  octeon_droq_dispatch_pkt\n\t   octeon_create_recv_info\n\t    ...search in the dispatch_list...\n\t     ->disp_fn(rdisp->rinfo, ...)\n\t      lio_vf_rep_pkt_recv(struct octeon_recv_info *recv_info, ...)\nIn this path there is no code which sets pg_info->page to NULL.\nSo this check looks unneeded and doesn't solve potential problem.\nBut I guess the author had reason to add a check and I have no such card\nand can't do real test.\nIn addition, the code in the function liquidio_push_packet() in\nliquidio/lio_core.c does exactly the same.\n\nBased on this, I consider the most acceptable compromise solution to\nadjust this issue by moving skb_add_rx_frag() into conditional scope.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c"
               ],
               "versions": [
                  {
                     "version": "1f233f327913",
                     "lessThan": "87d6bdc006f0",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f233f327913",
                     "lessThan": "dcc7440f32c7",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f233f327913",
                     "lessThan": "cbf18d8128a7",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f233f327913",
                     "lessThan": "a86490a3712c",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f233f327913",
                     "lessThan": "f1ab15a09492",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f233f327913",
                     "lessThan": "fd2b613bc4c5",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f233f327913",
                     "lessThan": "a6f4d0ec170a",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1f233f327913",
                     "lessThan": "c44711b78608",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c"
               ],
               "versions": [
                  {
                     "version": "4.15",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "4.15",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "4.19.317",
                     "lessThanOrEqual": "4.19.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.4.279",
                     "lessThanOrEqual": "5.4.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.10.221",
                     "lessThanOrEqual": "5.10.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.15.162",
                     "lessThanOrEqual": "5.15.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.1.95",
                     "lessThanOrEqual": "6.1.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.6.35",
                     "lessThanOrEqual": "6.6.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.9.6",
                     "lessThanOrEqual": "6.9.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.10",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/87d6bdc006f0cbf297a3b2ad6e40ede4c3ee5dc2"
            },
            {
               "url": "https://git.kernel.org/stable/c/dcc7440f32c7a26b067aff6e7d931ec593024a79"
            },
            {
               "url": "https://git.kernel.org/stable/c/cbf18d8128a753cb632bef39470d19befd9c7347"
            },
            {
               "url": "https://git.kernel.org/stable/c/a86490a3712cc513113440a606a0e77130abd47c"
            },
            {
               "url": "https://git.kernel.org/stable/c/f1ab15a09492a5ae8ab1e2c35ba2cf9e150d25ee"
            },
            {
               "url": "https://git.kernel.org/stable/c/fd2b613bc4c508e55c1221c6595bb889812a4fea"
            },
            {
               "url": "https://git.kernel.org/stable/c/a6f4d0ec170a46b5f453cacf55dff5989b42bbfa"
            },
            {
               "url": "https://git.kernel.org/stable/c/c44711b78608c98a3e6b49ce91678cd0917d5349"
            }
         ],
         "title": "liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet",
         "x_generator": {
            "engine": "bippy-c9c4e1df01b2"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2024-39506",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}