Linux kernel (drivers/iommu): The IOVA allocator's retry path overflows, so the lower-bound check is made against zero

Impact

The IOVA allocator's retry path overflows, so the lower-bound check is made against zero and an allocation succeeds with an IOVA below the domain's start address. A DMA address gets handed out outside the range the domain was set up to cover - an address the IOMMU domain does not actually own, which is the shape of a DMA window pointing where it should not. Vendor scores it scope-changed.

Who can reach it

Reached when an IOVA allocation request exceeds the size of the domain's address space, or when the node with the largest address is removed and a subsequent oversized allocation runs the retry path. Driven by in-kernel DMA API users through dma-iommu, so it is the host's device drivers on the hot path rather than a tenant ioctl - a tenant influences it only indirectly, through I/O sizes and mapping churn.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. No useful interim control - the allocator is shared by every DMA API user on the node.

References