Linux kernel (drivers/iommu/amd): The AMD-Vi interrupt thread dereferences a NULL domain while reporting an IOMMU page

Impact

The AMD-Vi interrupt thread dereferences a NULL domain while reporting an IOMMU page fault for a device group whose domain was never set up, oopsing the host from inside the fault handler. The faults themselves are generated by devices doing DMA to addresses they are not permitted to touch - exactly what a misbehaving or tenant-programmed device produces.

Who can reach it

An IOMMU page fault raised by a device whose group has no domain configured. A tenant holding a passthrough device can generate IOMMU faults freely by programming bad DMA addresses, but the 'no domain configured' precondition is host-side, so this is not a clean tenant-only path. AMD-Vi (EPYC) hosts; the upstream trace involves an amdgpu device.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: verify every passthrough group has a domain attached before exposing the device to a tenant.

References