Linux kernel (drivers/pci/endpoint/functions): The NTB endpoint function drivers never checked whether their workqueue

Impact

The NTB endpoint function drivers never checked whether their workqueue was actually created, so a failed allocation leaves a NULL pointer that is later handed to queue_work() during endpoint controller init - a NULL dereference that panics the machine at link-up time rather than failing the bind cleanly.

Who can reach it

Endpoint mode with the NTB (non-transparent bridge) function driver bound, plus an allocation failure at bind time - so realistically a memory-pressured endpoint device, not a targeted attack. The dereference itself lands in epf_ntb_epc_init(), which runs when the connected host brings the link up. Inert on a conventional GPU server; relevant to NTB-based host-to-host interconnect hardware.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: do not bind the NTB endpoint function drivers on memory-constrained endpoint devices, and keep headroom so the allocation succeeds.

References