Linux kernel (drivers/iommu/amd): AMD-Vi updated the domain's I/O page-table mode before running the code that frees

Impact

AMD-Vi updated the domain's I/O page-table mode before running the code that frees the old page table, so the teardown walked with the wrong mode and the page-table memory was never released. Upstream observed it directly when launching VMs with passthrough devices - so on a node doing normal tenant VM churn, host kernel memory bleeds away on every passthrough VM start until the node runs out and takes every tenant on it down with it.

Who can reach it

Triggered by the routine act of attaching a device to a domain and changing its page-table mode, which is what happens each time a passthrough VM is launched on an AMD-Vi host. The tenant drives the rate through ordinary start/stop of its own instances via the control plane; no host root is needed to cause the churn, though the VMM performs the attach. Conditional on AMD-Vi and PCI passthrough being in use.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on AMD passthrough nodes. Interim: monitor host slab/page usage across passthrough VM churn and drain nodes that trend upward, and avoid rapid create/destroy cycles of passthrough instances until patched.

References