Linux kernel (drivers/pci/hotplug): Powering off a physical function that still has child virtual functions drops the

Impact

Powering off a physical function that still has child virtual functions drops the pci_dev reference twice. The refcount underflows, the struct pci_dev can be freed while still in use, and the host then operates on a released device object - a use-after-free reachable through the PF/VF lifecycle, which is the same lifecycle that hands VFs to tenants.

Who can reach it

s390 only - the bug is in the s390 PCI hotplug slot driver, so it applies to Linux in an IBM Z LPAR or z/VM guest, not to x86 or ARM GPU nodes. Reached by writing to the slot power attribute in sysfs (host root) for a PF that still has VFs attached; the double put is on the path that was supposed to REFUSE that operation. Include it in your inventory only if s390 is part of your estate; on a conventional GPU fleet it is inert.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim on s390: disable all VFs on a PF before powering its slot off, and keep slot power control out of any automation that runs while VFs are assigned.

References