iommu AtomicPool Deref

Vulnerability analysis

In the IOMMU DMA allocation path for non-blocking, non-coherent requests, the code allocates from an atomic memory pool and then checks a secondary output parameter to determine whether the allocation succeeded. However, that parameter is only populated on success, so a failed pool allocation can go undetected and the code proceeds to use a null page pointer for IOMMU mapping, causing a kernel NULL pointer dereference and panic. The fix checks the returned page pointer directly immediately after the pool allocation and returns failure before any mapping is attempted. This path is reachable by local processes that can trigger device driver DMA operations on systems with IOMMU enabled and a device configured for non-coherent DMA; no network access or special hardware beyond an IOMMU-capable platform is required.