Linux kernel (drivers/iommu): The IOMMU group's domain pointer is left stale when a device reset races a detach, and

Impact

The IOMMU group's domain pointer is left stale when a device reset races a detach, and the reset-completion path then re-attaches a domain that has already been freed. That is a use-after-free on the object that defines which host memory a passed-through device may DMA to - the strongest primitive a tenant device can get for reaching outside its own address space.

Who can reach it

A tenant holding /dev/vfio/* triggers a device reset - VFIO_DEVICE_RESET, or simply closing the device fd, which resets on release - while another thread detaches or replaces the domain. Multi-device IOMMU groups and PCI DMA-alias quirks widen the window, and those are common in GPU topologies behind PCIe switches. No host root required.

What to do

Update to a stable kernel carrying commits 8fc289e8 / 5474e6e1. Interim: put each tenant's passthrough devices in a single-device IOMMU group where the topology allows it (ACS on the upstream switch ports), and avoid handing tenants devices whose group contains functions belonging to other workloads.

References