Linux kernel (drivers/pci/controller): The Intel VMD driver guarded config-space access with a lock type that becomes a

Impact

The Intel VMD driver guarded config-space access with a lock type that becomes a sleeping lock under PREEMPT_RT, while the PCI core calls into it with interrupts disabled. Reading config space then sleeps in atomic context - a BUG splat and a wedged CPU on the shared node, reached from an ordinary sysfs read rather than anything privileged.

Who can reach it

The reported call chain starts in sysfs: pci_read_config -> pci_user_read_config_byte -> vmd_pci_read, i.e. a read of /sys/bus/pci/devices/<dev>/config for a device behind Intel VMD. Any local process that can open that file reaches it, including a tenant container with the default sysfs mount. Conditional on two things and inert without both: a PREEMPT_RT kernel, and Intel VMD enabled in BIOS (common on Intel server platforms fronting NVMe).

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: on PREEMPT_RT nodes, either disable VMD in BIOS or mask sysfs config-space files from tenant containers; on non-RT kernels no action is needed.

References