Linux kernel (drivers/vfio/mdev): If creating an mdev type's sysfs entries partially fails, the parent still registers

Impact

If creating an mdev type's sysfs entries partially fails, the parent still registers as successful, and later unregistration walks uninitialized type pointers and dereferences garbage. mdev is the mechanism vGPU partitioning is built on, so this sits on the code that carves one physical GPU into per-tenant devices.

Who can reach it

Needs host root: the failure is reached by an allocation failing during mdev parent registration at module load, then unloading the module. Upstream found it with fault injection. Not tenant-reachable - flagged because it is on the mdev/vGPU registration path that defines tenant device boundaries, not because a tenant can drive it.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not load/unload mdev parent drivers on a node carrying live tenants.

References