Linux kernel (drivers/iommu): An I/O page-fault group is handed to userspace through iommufd while still sitting on the

Impact

An I/O page-fault group is handed to userspace through iommufd while still sitting on the generic IOPF pending list, so a detach or hardware-page-table replacement frees the group out from under the fault fd. A later read, response, or cleanup touches freed memory - a use-after-free in the very path that arbitrates what a tenant's device is allowed to translate.

Who can reach it

A tenant container holding /dev/iommu with a PRI/IOPF-capable device generates page faults and concurrently detaches the device or replaces its HWPT. Reachable with a GPU or accelerator using SVA, or any passthrough device with ATS+PRI enabled. Conditional on PRI/IOPF being enabled on the device; no host root.

What to do

Update to a stable kernel carrying commits 6da8f374 / 4e74a369. Interim: disable ATS/PRI (and therefore IOPF) for tenant passthrough devices where the workload does not need demand paging, and do not expose /dev/iommu directly to untrusted containers.

References