Linux kernel (drivers/iommu/intel): Attaching a nested parent domain skips allocating the invalidation batch structure

Impact

Attaching a nested parent domain skips allocating the invalidation batch structure, so the first DMA map into that domain dereferences NULL inside the cache-flush path and oopses the host. The same allocation is done without a lock, so it can also be raced and leaked. The crash arrives from a guest VMM's ordinary map operation.

Who can reach it

A VMM holding /dev/iommu that has created a nested parent domain (vIOMMU / nested translation for a passthrough device) and then calls IOMMU_IOAS_MAP. The upstream trace is qemu-system-x86 on Intel VT-d. No host root. Conditional on nested translation being enabled - plain single-level passthrough does not take this path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not expose nested translation / vIOMMU to tenant VMs on unpatched VT-d hosts.

References