Linux kernel (drivers/vfio): VFIO core advertised migration ioctls for devices whose driver never actually initialised

Impact

VFIO core advertised migration ioctls for devices whose driver never actually initialised its migration state, so a tenant holding the device fd could drive the host into an oops through uninitialised kernel state. On a shared node that is a host crash triggered from inside one tenant's passthrough VM.

Who can reach it

A tenant VMM holding /dev/vfio/* for an mlx5 (ConnectX SR-IOV VF) or HiSilicon accelerator function issues the migration state get/set operations even though the device does not report migration support. VFIO core called straight into the driver op, which touched a state mutex that was never initialised. Reachable purely from ioctls on the device fd, no host privilege needed; conditional on the mlx5-vfio-pci or hisi_acc_vfio_pci variant driver being bound and the VF being assigned to the tenant.

What to do

No fixed release is listed in this record; take the fix from the linked stable commits and move passthrough nodes to a current stable/LTS kernel. Interim: unbind the mlx5-vfio-pci / hisi_acc_vfio_pci variant drivers and fall back to plain vfio-pci where live migration of the VF is not a product requirement, or block the migration ioctls at the VMM layer.

References