Linux kernel (drivers/iommu): A dropped return statement made the IOMMU fault handler process a partial PRI

Impact

A dropped return statement made the IOMMU fault handler process a partial PRI page-request group as if it were complete, instead of collecting it and waiting. The device decides when a group is partial, so a tenant driving a PRI-capable passthrough device can emit the right sequence of page requests and crash the host kernel from inside its own VM or container.

Who can reach it

The fault is generated by the device, and in a passthrough cluster the device is under tenant control. A tenant with an ATS/PRI-capable assigned device (SVM-capable GPU, PRI-capable NIC, DSA/IAA accelerator) issues page requests marked as part of a multi-request group; the host handler mishandles the partial group and eventually crashes. No host root, no fabric access needed - just the assigned device. Conditional on PRI/IOPF being enabled for devices handed to tenants.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel. Interim: disable PRI/ATS on tenant-assigned devices where the workload does not require demand paging, which removes the fault-reporting path entirely.

References