CVE-2022-49083

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/omap: Fix regression in probe for NULL pointer dereference

Commit 3f6634d997db ("iommu: Use right way to retrieve iommu_ops") started

triggering a NULL pointer dereference for some omap variants:

__iommu_probe_device from probe_iommu_group+0x2c/0x38

probe_iommu_group from bus_for_each_dev+0x74/0xbc

bus_for_each_dev from bus_iommu_probe+0x34/0x2e8

bus_iommu_probe from bus_set_iommu+0x80/0xc8

bus_set_iommu from omap_iommu_init+0x88/0xcc

omap_iommu_init from do_one_initcall+0x44/0x24

This is caused by omap iommu probe returning 0 instead of ERR_PTR(-ENODEV)

as noted by Jason Gunthorpe <[email protected]>.

Looks like the regression already happened with an earlier commit

6785eb9105e3 ("iommu/omap: Convert to probe/release_device() call-backs")

that changed the function return type and missed converting one place.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References