Linux kernel (drivers/iommu): Removing a device from the per-IOMMU page-fault queue responds to outstanding faults but

Impact

Removing a device from the per-IOMMU page-fault queue responds to outstanding faults but never frees the group structures holding them, so every teardown that happens with faults still pending leaks host kernel memory. The tenant controls both halves - it decides how many faults its assigned device has in flight and when PRI gets disabled - so repeated attach/detach cycles bleed the host.

Who can reach it

A tenant with an ATS/PRI-capable assigned device (SVM-capable GPU, PRI-capable NIC, DSA/IAA) drives the device to generate page requests and then disables PRI or releases the device while requests are still outstanding, repeatedly. No host root needed. Conditional on PRI/IOPF being enabled for tenant-assigned devices.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel. Interim: disable PRI/ATS on tenant-assigned devices that do not need demand paging, and rate-limit device attach/detach cycles per tenant.

References