Linux Kernel IOMMU Return Value Handling Vulnerability in DRM MSM

A vulnerability in the Linux kernel's DRM MSM component has been addressed. The issue arose because the IOMMU mapping function was not properly handling error return values. Instead of returning a negative error code when an issue occurred, it would issue a warning and return a zero, which could lead to incorrect behavior. This vulnerability affects the Linux kernel stable tree.

Impact

The vulnerability could lead to improper error handling in IOMMU operations, potentially causing issues in memory management or device operations that rely on correct IOMMU functionality.

Reproduction

The vulnerability can be reproduced by using the IOMMU mapping functions in the DRM MSM component of the Linux kernel. The issue arises when the mapping function encounters an error, as it will incorrectly return a zero and issue a warning, rather than returning the appropriate negative error code. This can be observed by mapping a scatter-gather table with an invalid IOVA or protection flag, which would trigger the error handling path.

Remediation

The vulnerability has been fixed in the Linux kernel. Users can apply the latest patches available in the Linux kernel stable tree to address this issue.