Linux kernel (arch/s390/pci): When an SR-IOV VF is hot-unplugged its MMIO resources are freed, but the parent bus keeps

Impact

When an SR-IOV VF is hot-unplugged its MMIO resources are freed, but the parent bus keeps pointers to them in its resource list. When the VF is plugged back in - the normal churn of reclaiming a VF from one tenant and issuing it to the next - the stale resources are claimed again, giving a use-after-free on the structures that describe which MMIO window belongs to which function. Resource metadata is the wrong thing to have dangling on a machine that partitions devices between tenants.

Who can reach it

Host-side, and s390 only - the bug lives in the s390 PCI implementation, where individual functions of a multi-function/SR-IOV device can be hotplugged independently (the core change to drivers/pci/bus.c is the supporting API, not the flaw). x86_64 and arm64 GPU nodes are not affected. Triggered by the VF remove/re-add cycle, i.e. by the operator's own VF lifecycle automation rather than directly by a tenant; a tenant that can make its VF drop and reappear influences the timing.

What to do

Boot a patched kernel on any s390 node (the fix adds pci_bus_remove_resource() and drops per-function resources on unplug). Interim on s390: avoid the VF remove/re-add cycle - reboot the LPAR rather than recycling individual VFs between workloads. No action needed on x86_64/arm64 GPU nodes.

References