Linux liquidio driver (Marvell/Cavium, cached VF pci_dev lookup table): TENANT ISOLATION: the LiquidIO PF caches VF

Impact

TENANT ISOLATION: the LiquidIO PF caches VF pci_dev pointers without taking a reference, so the cached pointers can dangle and are then dereferenced when handling a VF function-level-reset request. A VF triggering an FLR — something a tenant does simply by resetting their own device — drives a use-after-free in the host kernel. FLR is the operation an operator relies on to *clean up* between tenants, so the mechanism intended to enforce the handoff boundary is the one that breaks it.

Who can reach it

A tenant holding a LiquidIO VF issuing a function-level reset, or any path that triggers OCTEON_VF_FLR_REQUEST handling on the PF.

What to do

Kernel upgrade plus host reboot on nodes with Marvell LiquidIO adapters. Rolling drain. Note that LiquidIO is end-of-life hardware still present in older inference fleets — if you are running it, weigh replacing the adapters against maintaining kernel patches for a driver that is no longer actively developed.

References