Linux kernel (drivers/vfio/pci/mlx5): Migration and dirty-tracking state flags for an mlx5 VF were packed into shared

Impact

Migration and dirty-tracking state flags for an mlx5 VF were packed into shared bitfields updated non-atomically from concurrent paths, including a reset on one device reaching across to another. A lost update means the driver's view of deferred_reset, dirty-logging active, or error state diverges from reality - a passthrough NIC can be treated as reset when it was not, or dirty-page logging can be believed active when it is off, which silently corrupts a migrated tenant's memory.

Who can reach it

Driven by tenant-visible actions on an mlx5 SR-IOV VF bound to mlx5-vfio-pci: a tenant issuing device resets or migration state changes through /dev/vfio/* while the operator's dirty-tracking or VF event handling runs concurrently. Conditional on Mellanox/NVIDIA ConnectX VFs with the mlx5 vfio variant driver - which is the standard configuration for SR-IOV NIC passthrough in GPU clouds.

What to do

Update to a stable kernel carrying commits 1dd99b8f / f1db80a6. Interim: bind VFs to plain vfio-pci where live migration and dirty tracking are not needed, and serialize tenant-initiated resets against migration operations in the VMM.

References