Linux kernel (drivers/iommu): An unaligned DMA mapping with no aligned middle section calls into the mapper with length

Impact

An unaligned DMA mapping with no aligned middle section calls into the mapper with length zero, which the newer page-table backend rejects; the error unwind then starts from the wrong offset and unlinks the wrong range, leaving the mapping corrupted. Parts of an IOVA range stay mapped after the mapping is supposed to be torn down, so a device retains a working DMA window into pages the kernel has already released.

Who can reach it

Driven by unaligned I/O buffers on a device forced through SWIOTLB bouncing. Upstream sees it from NVMe passthrough commands (smartctl) on drives behind forced-bounce paths - and tenants in a GPU cluster do hold /dev/nvme* and can issue passthrough commands with arbitrary buffer alignment. Conditional on forced SWIOTLB being in play (untrusted device, sub-page IOVA granule, or a bounce-forcing config); a node with no bouncing never takes this path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: do not expose raw NVMe passthrough (/dev/nvme* admin/IO passthrough ioctls) to tenants, and avoid configurations that force SWIOTLB bouncing for tenant-facing devices.

References