Linux kernel (drivers/pci/pcie): The ASPM link state of a PCIe switch is freed as soon as ANY function on the upstream

Impact

The ASPM link state of a PCIe switch is freed as soon as ANY function on the upstream port is removed, while downstream ports still hold it as their parent link. Every subsequent reference is a use-after-free, and the reported symptom is a general protection fault that takes the whole node down - all tenants on it, not just the one whose device went away.

Who can reach it

Triggered by device removal under a multi-function PCIe switch upstream port, which is exactly the topology in a GPU box where a Broadcom/PLX switch fans out to eight accelerators or a bank of NVMe. The upstream note says the faults are ESPECIALLY frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order and therefore hits the non-zero function before function 0. No tenant credentials are needed - a surprise removal, a device that drops off the link, or a maintenance pull supplies the event. Requires ASPM enabled and a switch with a multi-function upstream port.

What to do

Update to 5.4.292 / 5.10.236 / 5.15.180 / 6.1.134 / 6.4 / 6.5 or later. Interim: drain the node before any planned PCIe removal under a switch, and consider disabling ASPM (pcie_aspm=off) on nodes where hot-removal under a switch is routine.

References