Linux kernel (drivers/iommu): The ARM long-descriptor unmap path returns a negative errno through an unsigned size_t

Impact

The ARM long-descriptor unmap path returns a negative errno through an unsigned size_t, so the caller is told roughly 2^64 bytes were unmapped. That value is added to the IOVA in the unmap loop, overflowing the address and hitting a BUG_ON - a kernel panic that takes every tenant on the node with it - while the unmap itself walks into addresses that were never part of the request.

Who can reach it

Reached when an unmap request covers a page-table entry that is already absent. On a passthrough node the unmap originates from a tenant's VMM through vfio or iommufd, though the upper layers normally track mapped areas well enough that hitting an absent entry means state is already inconsistent (a WARN fires first). arm64 hosts using io-pgtable-arm, i.e. SMMUv3 on Grace-class GPU nodes. x86 is unaffected.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. No practical interim control on affected arm64 nodes beyond patching.

References