Linux kernel (drivers/vfio/pci): Vfio-pci exports a dma-buf over BAR memory without confirming those BAR resources were

Impact

Vfio-pci exports a dma-buf over BAR memory without confirming those BAR resources were ever actually reserved, so a tenant can obtain a mapping to physical MMIO the driver does not own. That is a handle onto whatever else lives at those addresses - another device's registers, or host-owned MMIO - reachable from inside the container.

Who can reach it

A tenant holding /dev/vfio/<group> calls the vfio-pci dma-buf feature ioctl on a device whose BAR resources were not reserved at probe (BAR sizing quirks, resource conflicts, or a device where the reservation silently failed). Requires the vfio-pci dma-buf export feature to be present and enabled; no host root.

What to do

Update to a stable kernel carrying commits 8443cd44 / 702809da. Interim: do not enable the vfio-pci dma-buf export feature for tenant-held devices, and verify at bind time that each passthrough device's BARs were successfully reserved before handing the group to a tenant.

References