Linux kernel (drivers/pci/endpoint/functions): When BAR allocation fails, the endpoint test function frees the backing

Impact

When BAR allocation fails, the endpoint test function frees the backing memory but leaves the stale pointer in place, so the next allocation round frees the same buffer again. A double free in the host kernel oopses the node, and double frees are a classic route to heap control rather than a mere crash.

Who can reach it

Endpoint mode required, and the trigger comes from the OTHER side of the link: the connected host rebooting deasserts PERST#, which restarts BAR allocation on the endpoint. If inbound windows are exhausted so pci_epc_set_bar() fails, each host reboot re-runs the failing path and hits the double free. That makes it remotely drivable, pre-authentication, by whoever controls the host the endpoint is plugged into - a real consideration for a card handed to a tenant chassis, and inert on a conventional GPU server.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: configure endpoint functions with no more BARs than the controller has free inbound windows, so the allocation failure that starts this sequence never occurs.

References