Linux kernel (drivers/pci/pcie): The AER subsystem allocates its per-device error-tracking structure without checking

Impact

The AER subsystem allocates its per-device error-tracking structure without checking for failure, then dereferences it unconditionally. If that allocation fails, every subsequent AER access is a NULL dereference and the node panics - so a burst of PCIe errors arriving while the machine is under memory pressure turns into a full node outage for every tenant.

Who can reach it

Precondition is an allocation failure, which is the honest limiter here - but both halves are things a tenant supplies on a busy GPU node. Memory pressure is the steady state on a node packed with tenants, and the error events are generated by the devices themselves: a tenant with a passthrough GPU, NIC or NVMe behind /dev/vfio/* can drive its own device into producing correctable and uncorrectable PCIe errors at will, which is what makes the AER path run in the first place. No host credentials required for the error-generating half.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: keep real headroom on nodes so the allocation does not fail, and alert on AER error rates per device so a tenant hammering its passthrough device into an error storm is visible before it matters.

References