Linux kernel (drivers/vfio/pci): The error path of the vfio-pci dma-buf export falls through the whole unwind chain

Impact

The error path of the vfio-pci dma-buf export falls through the whole unwind chain after the dma-buf was already exported, producing a double free of the allocated objects and an unbalanced reference count on the vfio device itself. A tenant that can steer the export into its error path gets a double free in the kernel - the classic starting point for host privilege escalation - and can drop the device's refcount below what is live.

Who can reach it

A tenant holding /dev/vfio/<group> calls the dma-buf export ioctl while its own file-descriptor table is exhausted, which it controls simply by opening files up to RLIMIT_NOFILE. That makes the 'unlikely' fd-allocation failure a deliberate, repeatable trigger rather than a rare accident. Conditional on the vfio-pci dma-buf export feature being available; no host privilege.

What to do

Update to a stable kernel carrying commits 83ad334a / e98137f0. Interim: do not enable the vfio-pci dma-buf export feature for tenant devices, and cap per-container file-descriptor limits so the error path is harder to reach on demand.

References