Linux kernel (drivers/iommu/iommufd): The cache-invalidation ioctl calls a driver operation that may not exist, jumping

Impact

The cache-invalidation ioctl calls a driver operation that may not exist, jumping through a NULL function pointer on a guest VMM's invalidation request. The host takes an unhandled fault at address zero inside the very path that is supposed to make a guest's IOMMU invalidations real, so the failure mode is both a node crash and an invalidation that never happened.

Who can reach it

A VMM holding /dev/iommu issuing IOMMU_HWPT_INVALIDATE - the nested-translation path qemu uses to forward a guest's IOTLB invalidations to hardware. No host root. Conditional on running nested translation on an IOMMU driver that never implemented the user-invalidation op; the upstream trace is qemu on arm64.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not enable nested translation / vIOMMU for tenant VMs on drivers that lack user cache invalidation, and keep /dev/iommu out of tenant containers.

References