Linux kernel (drivers/pci/endpoint): Endpoint function sub-groups were created asynchronously by a delayed work item

Impact

Endpoint function sub-groups were created asynchronously by a delayed work item, so removing the directory before the work ran left the worker dereferencing a freed parent - a NULL/dangling dereference inside a kernel workqueue that panics the machine.

Who can reach it

Configfs-driven and trivially reproducible: a loop of mkdir/rmdir under /sys/kernel/config/pci_ep/functions/<driver>/ crashes the kernel within about twenty iterations. That is host root on a machine with the PCI endpoint framework and configfs mounted - so the realistic exposure is an endpoint device whose function configuration is scripted or exposed to a management agent, not a tenant. Inert on a conventional GPU server with no endpoint controller.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: do not expose /sys/kernel/config/pci_ep to any automation that creates and destroys function directories rapidly, and keep configfs unmounted on endpoint machines whose function set is static.

References