Linux kernel (drivers/pci): A Downstream Port Containment event and a device removal happening at the same time leave

Impact

A Downstream Port Containment event and a device removal happening at the same time leave the DPC handler polling the config space of a struct pci_dev that has already been freed. That is a use-after-free in an interrupt thread on the host - it panics the node, and a freed-and-reallocated pci_dev is the kind of primitive that turns a device-triggered error into host memory corruption rather than just a crash.

Who can reach it

The DPC half is device-driven, not admin-driven: an endpoint that emits an uncorrectable error - a wedged or deliberately misbehaving NVMe drive, a passthrough GPU or NIC a tenant is hammering with malformed transactions - makes the Downstream Port fire DPC, and dpc_handler() then walks the child device without holding a reference. If a hot-removal (pciehp, surprise removal of an NVMe, or an admin-triggered remove) races that window, the handler dereferences freed memory. Reachable on any node with DPC-capable root/downstream ports and hot-pluggable devices; needs no tenant credentials on the host, only a device that can be pushed into generating errors.

What to do

Update to 5.10.224 / 5.15.165 / 6.1.103 / 6.3 or later. Interim: avoid concurrent hot-remove operations on ports that have DPC enabled, and drain a node before servicing or removing PCIe devices rather than surprise-pulling them under load.

References