Linux kernel (drivers/vfio/pci/hisilicon): The guest decides whether the host's VFIO migration code has a valid queue

Impact

The guest decides whether the host's VFIO migration code has a valid queue address to work with. A guest that simply never loads the VF driver leaves the migration payload empty, and the destination host dereferences the resulting null address while restoring device state. A tenant crashes the host it is being migrated onto - scored scope-changed by the kernel CNA, and on a shared node that is everyone else's outage.

Who can reach it

A tenant VM assigned a HiSilicon accelerator VF (Kunpeng ZIP/SEC/HPRE class) under hisi_acc_vfio_pci is live-migrated while the guest has not loaded the VF driver. The guest controls the condition entirely - it just does nothing - and the fault lands in host kernel context on the destination. Conditional on the hisi_acc_vfio_pci variant driver being bound, SR-IOV VFs assigned to guests, and live migration being enabled; not reachable on an NVIDIA/AMD GPU fleet that never loads this driver.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on any node using hisi_acc_vfio_pci. Interim: disable live migration for HiSilicon accelerator VFs, or bind plain vfio-pci instead of the migration-capable variant driver.

References