Linux kernel (drivers/iommu/iommufd): A failed copy_to_user while draining the iommufd fault queue restarts the same

Impact

A failed copy_to_user while draining the iommufd fault queue restarts the same failing copy forever, spinning in the kernel at 100% CPU while holding the fault mutex. The task is not killable, the core is gone until reboot, and the I/O page-fault path for that device is wedged - repeat it once per core and the node is finished.

Who can reach it

A tenant container holding /dev/iommu reads the fault fd into a deliberately bad buffer (unmapped or read-only memory). One read syscall, no host privilege, no hardware prerequisite beyond an IOPF-capable device being attached. Trivially repeatable and deterministic - this is the cheapest node-kill in the shard.

What to do

Update to a stable kernel carrying commits a38e0714 / 5539da12. Interim: do not hand /dev/iommu to tenant containers; run passthrough through a VMM the operator controls so the fault fd is never in tenant hands.

References