Linux kernel (drivers/pci): Every write to a device's reset_method sysfs attribute that contains no space leaks the

Impact

Every write to a device's reset_method sysfs attribute that contains no space leaks the buffer it allocated, because strsep() has already nulled the pointer that the free uses. The leak is unbounded and driven entirely by the writer, so a loop over that attribute grows kernel memory until the node is under memory pressure - a slow noisy-neighbour outage on a shared host, on the knob that decides how a device is reset between tenants.

Who can reach it

Needs write access to /sys/bus/pci/devices/<dev>/reset_method, which is root-owned - so host root, or a privileged container with /sys mounted writable. Not reachable by a plain tenant container, not reachable from a guest, and not reachable over the fabric. The reason it is worth carrying is the surface rather than the severity: reset_method is the control that determines which reset a device gets when it is reclaimed from one tenant and handed to the next, and it should not be writable from anything a tenant runs.

What to do

Boot a kernel where reset_method_store() iterates over a separate temporary pointer so the original allocation is still freed. Interim: ensure /sys is mounted read-only in containers and that no tenant workload runs with privileges to write PCI sysfs attributes.

References