Linux kernel (drivers/iommu/amd): The AMD-Vi PPR (peripheral page request) notifier looked up the faulting PCI device

CVSS 4.0CVE-2022-50505Kernel, userspace & hypervisorcurated

Impact

The AMD-Vi PPR (peripheral page request) notifier looked up the faulting PCI device and never dropped the reference it took, so every page-request event a device generates permanently pins one more reference to that device. The device can then never be cleanly released back to the pool, and the refcount is driven by a tenant's own workload - reclaiming a GPU or accelerator after a tenant is done with it stops working.

Who can reach it

Device-driven: a tenant running an SVA/PRI workload on an AMD-Vi host makes the assigned device emit page requests, and each one leaks a pci_dev reference in host kernel context. No host privilege needed - the tenant just uses demand paging on its own assigned device. Conditional on AMD-Vi with the amd_iommu_v2 / PPR path active and a PRI-capable device assigned to the tenant.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on AMD nodes. Interim: disable PRI/ATS on tenant-assigned devices where demand paging is not required, and watch for devices that refuse to unbind after a tenant releases them.

References

https://git.kernel.org/stable/c/bdb2113dd8f17a3cc84a2b4be4968a849f69ec72 https://git.kernel.org/stable/c/efd50c65fd1cdef63eb58825f3fe72496443764c https://nvd.nist.gov/vuln/detail/CVE-2022-50505

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.