Linux kernel (drivers/iommu/iommufd): A user-supplied page shift of 63 overflows the divisor in the iommufd

Impact

A user-supplied page shift of 63 overflows the divisor in the iommufd dirty-tracking bitmap math to zero, giving a divide-by-zero in kernel context. A tenant holding /dev/iommu takes down its own host thread and, on a panic_on_oops fleet, the whole node - a noisy-neighbour outage for every other tenant on the box.

Who can reach it

Any process with /dev/iommu open requests a dirty-tracking bitmap read with an absurd page size, so pgshift reaches 63 and BITS_PER_TYPE * pgsize wraps to zero. Pure ioctl input validation on an fd a passthrough tenant already holds; no device or host root required. Conditional on iommufd being in use and dirty tracking being reachable by the caller.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel. Interim: keep /dev/iommu out of containers that do not perform passthrough, and validate page-size arguments in the VMM layer that proxies dirty tracking.

References