Linux kernel (drivers/iommu): The reset-completion path re-attaches an IOMMU group's domain without checking that the

Impact

The reset-completion path re-attaches an IOMMU group's domain without checking that the group has one, so a group whose default domain never allocated crashes the host on the next device reset. A tenant resetting its own passthrough device takes the node down for everyone on it.

Who can reach it

A tenant holding /dev/vfio/* triggers a device reset (VFIO_DEVICE_RESET or device-fd release), on a device whose IOMMU group has a NULL domain. That NULL state requires a default-domain allocation failure at first probe - memory pressure or a driver error during node bring-up - so it is conditional, but once a node is in that state the crash is one tenant ioctl away.

What to do

Update to a stable kernel carrying commits 17194cd0 / d769711f. Interim: check dmesg for default-domain allocation failures during boot and refuse to schedule tenants onto a node that logged one.

References