Re: kernel NULL pointer dereference in quirk_clear_strap_no_soft_reset_dev2_f0 -> amd_smn_read

Marek Marczykowski-Górecki <[email protected]> Sat, 6 Jun 2026 01:37:03 +0200

Newsgroups	dev.linux.lists.regressions,org.kernel.vger.linux-kernel
Message-ID	<aiNdoGL2JCC1VIiW@mail-itl>

On Fri, Jun 05, 2026 at 04:09:49PM -0700, Borislav Petkov wrote:
> On Sat, Jun 06, 2026 at 12:40:20AM +0200, Marek Marczykowski-Górecki wrote:
> > There is nothing here that would prevent amd_smn_read() being called
> > inside a guest...
> 
> Yah, there should've been...
> 
> Anyway, something like the untested below, pls give it a run.
> 
> Thx.
> 
> ---
> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
> index 0be01725a2a4..52eff7fac667 100644
> --- a/arch/x86/kernel/amd_node.c
> +++ b/arch/x86/kernel/amd_node.c
...
> @@ -311,6 +324,10 @@ static int __init amd_smn_init(void)
>  	smn_exclusive = true;
>  
>  	return 0;
> +
> +err_out:
> +	amd_node_off = true;
> +	return err;
>  }
>  
>  fs_initcall(amd_smn_init);

Is it actually guaranteed to run before PCI fixups? They are done via
fs_initcall_sync. IMO it would be safer to guard __amd_smn_rw() with
something that would also detect calls before amd_smn_init() is called.
Like using smn_exclusive in the Penny's patch, or amd_roots in the
Mario's patch.

That said, amd_smn_read() called before amd_smn_init() would (should?)
fail anyway, even in non-virtualized case. So, maybe this approach
(still crash on NULL ptr when called before amd_smn_init()) is
acceptable?

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

signature.asc (application/pgp-signature, 488 B)