Linux kernel (drivers/iommu/intel): VT-d accepted a PASID attachment to a nested domain whose parent has dirty tracking

Impact

VT-d accepted a PASID attachment to a nested domain whose parent has dirty tracking configured, even though the kernel cannot track dirty pages in that configuration. Dirty pages are then silently dropped, so a tenant VM that is live-migrated or checkpointed comes back with stale memory - guest data corruption the operator produced, with no error anywhere.

Who can reach it

Reached by the VMM / control plane driving iommufd: attach a PASID to a nested domain while the nesting parent has IOMMU dirty tracking enabled. Conditional on VT-d scalable mode with nested translation and dirty-tracking-based live migration in use. Not a tenant-driven memory-safety break - the exposure is to the operator's own migration path.

What to do

Update to a stable kernel carrying commits 3ea9ce75 / 9009c1af, which fails the attach up front instead of losing pages. Interim: do not combine PASID attachment to nested domains with IOMMU dirty tracking - disable dirty-tracking-based live migration for guests using vIOMMU nesting.

References