Linux kernel (drivers/pci/controller): The Hyper-V PCI front-end frees its PCI domain number twice on a probe failure

Impact

The Hyper-V PCI front-end frees its PCI domain number twice on a probe failure - once itself and once again through the bridge release callback. The second free returns an ID that may already have been reissued to a different bus, so two PCI domains can end up carrying the same domain number. Duplicate domain numbering means sysfs paths and device lookups that are supposed to distinguish two hierarchies stop doing so, on the very driver that presents passthrough devices to a guest.

Who can reach it

Guest-side, inside a Linux VM on Hyper-V/Azure that is being given a passthrough device - pci-hyperv is that paravirtual front-end. It requires hv_pci_probe() to fail after the domain number is stored, which is a host- or fabric-side condition (device offer withdrawn, channel setup failing) rather than something guest userspace triggers; a tenant with no control over device offers cannot force it. Nodes not running under Hyper-V never load the driver.

What to do

Boot a kernel where pci-hyperv leaves domain_nr release to the PCI core. Interim: on Hyper-V hosts, watch for the 'ida_free called for id=... which is not allocated' warning as the marker that a domain ID has been double-freed, and restart the affected VM rather than letting it continue with ambiguous domain numbering.

References