Linux kernel (drivers/vfio/pci): For passthrough devices whose INTx has to be masked at the irqchip, the IRQ is enabled

Impact

For passthrough devices whose INTx has to be masked at the irqchip, the IRQ is enabled before vfio disables it, so an interrupt arriving in that window double-increments the disable depth. The line stays disabled with no way for the tenant to recover it through vfio, and where that IRQ line is shared with other devices on the host, they stop receiving interrupts too.

Who can reach it

A tenant holding a vfio-pci device fd enabling INTx, with the device asserting its interrupt inside the request_irq window. No host root, and the tenant does not have to win a tight race - it controls when the device asserts. Conditional on a passthrough function that lacks DisINTx support, which is what makes vfio use the exclusive masked-INTx path.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: pass through only MSI/MSI-X-capable functions, and avoid assigning devices whose INTx line is shared with host-owned devices.

References