In the Linux kernel, the following vulnerability has been resolved:
iommu/omap: Fix regression in probe for NULL pointer dereference
Commit 3f6634d997db ("iommu: Use right way to retrieve iommu_ops") started triggering a NULL pointer dereference for some omap variants:
_iommuprobedevice from probeiommugroup+0x2c/0x38 probeiommugroup from busforeachdev+0x74/0xbc busforeachdev from busiommuprobe+0x34/0x2e8 busiommuprobe from bussetiommu+0x80/0xc8 bussetiommu from omapiommuinit+0x88/0xcc omapiommuinit from doone_initcall+0x44/0x24
This is caused by omap iommu probe returning 0 instead of ERR_PTR(-ENODEV) as noted by Jason Gunthorpe jgg@ziepe.ca.
Looks like the regression already happened with an earlier commit 6785eb9105e3 ("iommu/omap: Convert to probe/release_device() call-backs") that changed the function return type and missed converting one place.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d89f2b9eadbcf3ce93c6d7238f68299a1f84968",
"signature_version": "v1",
"digest": {
"function_hash": "255086775026069954194171944635515390989",
"length": 943.0
},
"target": {
"function": "omap_iommu_probe_device",
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-0e72e424",
"deprecated": false,
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd905fed87ce01ac010011bb8f44ed0140116ceb",
"signature_version": "v1",
"digest": {
"function_hash": "255086775026069954194171944635515390989",
"length": 943.0
},
"target": {
"function": "omap_iommu_probe_device",
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-479c7fbc",
"deprecated": false,
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71ff461c3f41f6465434b9e980c01782763e7ad8",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"311789231930557465195499025692785549869",
"275659551576333075301700184948253024970",
"320805343453486506440415439283693698177",
"248425001883709991435248349235643592461"
]
},
"target": {
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-54532cfd",
"deprecated": false,
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71ff461c3f41f6465434b9e980c01782763e7ad8",
"signature_version": "v1",
"digest": {
"function_hash": "255086775026069954194171944635515390989",
"length": 943.0
},
"target": {
"function": "omap_iommu_probe_device",
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-54b90351",
"deprecated": false,
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d89f2b9eadbcf3ce93c6d7238f68299a1f84968",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"311789231930557465195499025692785549869",
"275659551576333075301700184948253024970",
"320805343453486506440415439283693698177",
"248425001883709991435248349235643592461"
]
},
"target": {
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-58f36f22",
"deprecated": false,
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea518578aa8a9a0280605b53cc33f707e10c8178",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"311789231930557465195499025692785549869",
"275659551576333075301700184948253024970",
"320805343453486506440415439283693698177",
"248425001883709991435248349235643592461"
]
},
"target": {
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-b2a20ff9",
"deprecated": false,
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e239117bd97c8556f9187af7a9a7938db4e021",
"signature_version": "v1",
"digest": {
"function_hash": "255086775026069954194171944635515390989",
"length": 943.0
},
"target": {
"function": "omap_iommu_probe_device",
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-cc151d00",
"deprecated": false,
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e239117bd97c8556f9187af7a9a7938db4e021",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"311789231930557465195499025692785549869",
"275659551576333075301700184948253024970",
"320805343453486506440415439283693698177",
"248425001883709991435248349235643592461"
]
},
"target": {
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-ccb9607b",
"deprecated": false,
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd905fed87ce01ac010011bb8f44ed0140116ceb",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"311789231930557465195499025692785549869",
"275659551576333075301700184948253024970",
"320805343453486506440415439283693698177",
"248425001883709991435248349235643592461"
]
},
"target": {
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-f0d9dec4",
"deprecated": false,
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea518578aa8a9a0280605b53cc33f707e10c8178",
"signature_version": "v1",
"digest": {
"function_hash": "255086775026069954194171944635515390989",
"length": 943.0
},
"target": {
"function": "omap_iommu_probe_device",
"file": "drivers/iommu/omap-iommu.c"
},
"id": "CVE-2022-49083-f18e13fc",
"deprecated": false,
"signature_type": "Function"
}
]