Rolf Eike Beer

The vulnerability is caused by overrunning the sglist and incorrectly testing `sg dma len(sglist)` before `nents`. Normally, this doesn't cause a crash, but in this case, `sglist` crossed a page boundary. The bug occurs in the following code: `while (sg dma len(sglist) && nents--)`. The fix is simply to test `nents` first and move the decrement of `nents` into the loop.

A sysfs leak in the `alloc iommu()` function has been resolved. The `iommu device sysfs add()` function is called before, and it has to be cleaned on subsequent errors.