CVE-2024-39506

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet

In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,

but then it is unconditionally passed to skb_add_rx_frag() which looks

strange and could lead to null pointer dereference.

lio_vf_rep_copy_packet() call trace looks like:

octeon_droq_process_packets

octeon_droq_fast_process_packets

octeon_droq_dispatch_pkt

octeon_create_recv_info

...search in the dispatch_list...

->disp_fn(rdisp->rinfo, ...)

lio_vf_rep_pkt_recv(struct octeon_recv_info *recv_info, ...)

In this path there is no code which sets pg_info->page to NULL.

So this check looks unneeded and doesn't solve potential problem.

But I guess the author had reason to add a check and I have no such card

and can't do real test.

In addition, the code in the function liquidio_push_packet() in

liquidio/lio_core.c does exactly the same.

Based on this, I c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References