Linux kernel (drivers/pci): Pm_runtime_get_sync() does not wait for an already-running .runtime_idle() callback, so a

Impact

Pm_runtime_get_sync() does not wait for an already-running .runtime_idle() callback, so a driver can be torn out from under a callback that is still executing and touching driver data. The result is a use-after-free and an unhandled page fault in the host kernel during driver unbind.

Who can reach it

The unbind path is not an exotic operation in a GPU cloud - it is the passthrough provisioning flow. Every time the control plane detaches a GPU, NIC or NVMe from its host driver to bind it to vfio-pci for a tenant, pci_device_remove() runs, and if the device's .runtime_idle() callback happens to be in flight the two race. Needs host root to initiate (the operator's own automation), and a driver that implements runtime_idle; the reported crash was rtsx_pcr, but the defect is in the generic PCI driver core so any such driver qualifies. Frequent rebind cycles - i.e. fast tenant turnover - widen the window.

What to do

Update to a kernel carrying the fix (no fixed_in published; take the stable commits below into your branch). Interim: quiesce and idle a device before unbinding it - disable runtime PM on the device (power/control = on) prior to unbind/rebind in your passthrough provisioning scripts.

References