Linux kernel (drivers/vfio/pci/hisilicon): The VFIO migration driver reassembled the device's event-queue DMA addresses

Impact

The VFIO migration driver reassembled the device's event-queue DMA addresses from hardware registers in the wrong byte order, so after a live migration the accelerator was programmed to DMA at addresses that were never the ones the guest set up. The device ends up writing to the wrong place inside the assigned domain and the guest's crypto services fail; the same class of mistake in an address-composition path is what turns a migration into a stray-DMA event, and the fix has to carry a magic-number check because guests migrated from old kernels otherwise land on bad addresses silently.

Who can reach it

Not attacker-initiated: triggered by live-migrating a guest that has a HiSilicon accelerator VF assigned under hisi_acc_vfio_pci, including migrations from an older kernel to a newer one. The resulting DMA is still bounded by the guest's IOMMU domain, so this is corruption and device malfunction inside the tenant rather than a host escape. Conditional on hisi_acc_vfio_pci being bound and live migration being in use - not reachable on an NVIDIA/AMD GPU fleet that never loads this driver.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on nodes using hisi_acc_vfio_pci, and patch source and destination hosts together so the migration magic-number handling matches. Interim: disable live migration for HiSilicon accelerator VFs.

References