Description
In the Linux kernel, the following vulnerability has been resolved: liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value, but then it is unconditionally passed to skb_add_rx_frag() which looks strange and could lead to null pointer dereference. lio_vf_rep_copy_packet() call trace looks like: octeon_droq_process_packets octeon_droq_fast_process_packets octeon_droq_dispatch_pkt octeon_create_recv_info ...search in the dispatch_list... ->disp_fn(rdisp->rinfo, ...) lio_vf_rep_pkt_recv(struct octeon_recv_info *recv_info, ...) In this path there is no code which sets pg_info->page to NULL. So this check looks unneeded and doesn't solve potential problem. But I guess the author had reason to add a check and I have no such card and can't do real test. In addition, the code in the function liquidio_push_packet() in liquidio/lio_core.c does exactly the same. Based on this, I consider the most acceptable compromise solution to adjust this issue by moving skb_add_rx_frag() into conditional scope. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1f233f327913f3dee0602cba9c64df1903772b55 to < 87d6bdc006f0cbf297a3b2ad6e40ede4c3ee5dc2affected1f233f327913f3dee0602cba9c64df1903772b55 to < dcc7440f32c7a26b067aff6e7d931ec593024a79affected1f233f327913f3dee0602cba9c64df1903772b55 to < cbf18d8128a753cb632bef39470d19befd9c7347affected1f233f327913f3dee0602cba9c64df1903772b55 to < a86490a3712cc513113440a606a0e77130abd47caffected1f233f327913f3dee0602cba9c64df1903772b55 to < f1ab15a09492a5ae8ab1e2c35ba2cf9e150d25eeaffected1f233f327913f3dee0602cba9c64df1903772b55 to < fd2b613bc4c508e55c1221c6595bb889812a4feaaffected1f233f327913f3dee0602cba9c64df1903772b55 to < a6f4d0ec170a46b5f453cacf55dff5989b42bbfaaffected1f233f327913f3dee0602cba9c64df1903772b55 to < c44711b78608c98a3e6b49ce91678cd0917d5349affected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected4.19.317 to ≤ 4.19.*unaffected5.4.279 to ≤ 5.4.*unaffected5.10.221 to ≤ 5.10.*unaffected5.15.162 to ≤ 5.15.*unaffected6.1.95 to ≤ 6.1.*unaffected6.6.35 to ≤ 6.6.*unaffected6.9.6 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/87d6bdc006f0cbf297a3b2ad6e40ede4c3ee5dc2 ↗
- https://git.kernel.org/stable/c/dcc7440f32c7a26b067aff6e7d931ec593024a79 ↗
- https://git.kernel.org/stable/c/cbf18d8128a753cb632bef39470d19befd9c7347 ↗
- https://git.kernel.org/stable/c/a86490a3712cc513113440a606a0e77130abd47c ↗
- https://git.kernel.org/stable/c/f1ab15a09492a5ae8ab1e2c35ba2cf9e150d25ee ↗
- https://git.kernel.org/stable/c/fd2b613bc4c508e55c1221c6595bb889812a4fea ↗
- https://git.kernel.org/stable/c/a6f4d0ec170a46b5f453cacf55dff5989b42bbfa ↗
- https://git.kernel.org/stable/c/c44711b78608c98a3e6b49ce91678cd0917d5349 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗