Re: kernel NULL pointer dereference in quirk_clear_strap_no_soft_reset_dev2_f0 -> amd_smn_read

[Marek Marczykowski-Górecki]

On Fri, Jun 05, 2026 at 04:09:49PM -0700, Borislav Petkov wrote:
> On Sat, Jun 06, 2026 at 12:40:20AM +0200, Marek Marczykowski-Górecki wrote:
> > There is nothing here that would prevent amd_smn_read() being called
> > inside a guest...
> 
> Yah, there should've been...
> 
> Anyway, something like the untested below, pls give it a run.
> 
> Thx.
> 
> ---
> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
> index 0be01725a2a4..52eff7fac667 100644
> --- a/arch/x86/kernel/amd_node.c
> +++ b/arch/x86/kernel/amd_node.c
...
> @@ -311,6 +324,10 @@ static int __init amd_smn_init(void)
>  	smn_exclusive = true;
>  
>  	return 0;
> +
> +err_out:
> +	amd_node_off = true;
> +	return err;
>  }
>  
>  fs_initcall(amd_smn_init);

Is it actually guaranteed to run before PCI fixups? They are done via
fs_initcall_sync. IMO it would be safer to guard __amd_smn_rw() with
something that would also detect calls before amd_smn_init() is called.
Like using smn_exclusive in the Penny's patch, or amd_roots in the
Mario's patch.

That said, amd_smn_read() called before amd_smn_init() would (should?)
fail anyway, even in non-virtualized case. So, maybe this approach
(still crash on NULL ptr when called before amd_smn_init()) is
acceptable?

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

Attachment: signature.asc
Description: PGP signature