Linux Kernel MTK IOMMU debugfs NULL Pointer Dereference in dev_id_show

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Type: Undefined Behavior Problem Description: In , when is NULL, accessing leads to a null pointer dereference (invalid memory location). Remediation: - Handle the success case within the loop and return after the loop. - Add validation for user input on . Impact Scope File: Function: Impact: May cause kernel crash or unexpected behavior. POC/Exploit Code ```c static int dev_id_show(struct seq_file f, void unused) { struct mtk_iommu mtk_iommu = seq->private; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu->domain; struct mtk_iommu_domain domain = mtk_iommu

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel MTK IOMMU debugfs NULL Pointer Dereference in dev_id_show