[PATCH v2] x86/amd_node: Fix PCI device reference counting in amd_smn_init()

[PATCH v2] x86/amd_node: Fix PCI device reference counting in amd_smn_init()

[Yazen Ghannam]

The local "root" pointer is a temporary variable used during the device
search. Therefore, refcount related to the search iterators should be
cleaned up after the search is complete.

Use the __free() cleanup macro to ensure the refcount is decremented
when the temporary pointer goes out of scope.

Additionally, increment the refcount when caching a root pointer. This
ensures the in-use refcount is separate from the temporary search
refcounting.

Finally, drop the redundant "root = NULL" before the second search
loop. The pci_get_class() iterator always decrements the refcount of
its "from" argument, so the first loop can only fall through with
"root" already NULL.

Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260806160159.230453-1-jason.andryuk%40amd.com
Assisted-by: Claude-Code:claude-opus-5
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
---
Link:
https://lore.kernel.org/r/20260824175003.335196-1-yazen.ghannam@amd.com

v1->v2:
* Add SoB from Mario.
* Remove redundant pointer reset.

 arch/x86/kernel/amd_node.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
index 762585775b5a..b7926ba3610a 100644
--- a/arch/x86/kernel/amd_node.c
+++ b/arch/x86/kernel/amd_node.c
@@ -251,7 +251,7 @@ __setup("amd_smn_debugfs_enable", amd_smn_enable_dfs);
 static int __init amd_smn_init(void)
 {
 	u16 count, num_roots, roots_per_node, node, num_nodes;
-	struct pci_dev *root;
+	struct pci_dev *root __free(pci_dev_put) = NULL;
 
 	if (!cpu_feature_enabled(X86_FEATURE_ZEN))
 		return 0;
@@ -262,7 +262,6 @@ static int __init amd_smn_init(void)
 		return 0;
 
 	num_roots = 0;
-	root = NULL;
 	while ((root = get_next_root(root))) {
 		pci_dbg(root, "Reserving PCI config space\n");
 
@@ -299,14 +298,13 @@ static int __init amd_smn_init(void)
 
 	count = 0;
 	node = 0;
-	root = NULL;
 	while (node < num_nodes && (root = get_next_root(root))) {
 		/* Use one root for each node and skip the rest. */
 		if (count++ % roots_per_node)
 			continue;
 
 		pci_dbg(root, "is root for AMD node %u\n", node);
-		amd_roots[node++] = root;
+		amd_roots[node++] = pci_dev_get(root);
 	}
 
 	if (enable_dfs) {

base-commit: 7755fae2ea370ee914797c5bcca922836a818c3d
-- 
2.43.0

Re: [PATCH v2] x86/amd_node: Fix PCI device reference counting in amd_smn_init()

[Serge Hallyn (AMD)]

On Thu, Sep 03, 2026 at 10:43:25AM -0500, Yazen Ghannam wrote:
> The local "root" pointer is a temporary variable used during the device
> search. Therefore, refcount related to the search iterators should be
> cleaned up after the search is complete.
> 
> Use the __free() cleanup macro to ensure the refcount is decremented
> when the temporary pointer goes out of scope.
> 
> Additionally, increment the refcount when caching a root pointer. This
> ensures the in-use refcount is separate from the temporary search
> refcounting.
> 
> Finally, drop the redundant "root = NULL" before the second search
> loop. The pci_get_class() iterator always decrements the refcount of
> its "from" argument, so the first loop can only fall through with
> "root" already NULL.
> 
> Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260806160159.230453-1-jason.andryuk%40amd.com
> Assisted-by: Claude-Code:claude-opus-5
> Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>

Thanks.  FWIW,

> Reviewed-by: Serge Hallyn (AMD) <sergeh@kernel.org>

> ---
> Link:
> https://lore.kernel.org/r/20260824175003.335196-1-yazen.ghannam@amd.com
> 
> v1->v2:
> * Add SoB from Mario.
> * Remove redundant pointer reset.
> 
>  arch/x86/kernel/amd_node.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
> index 762585775b5a..b7926ba3610a 100644
> --- a/arch/x86/kernel/amd_node.c
> +++ b/arch/x86/kernel/amd_node.c
> @@ -251,7 +251,7 @@ __setup("amd_smn_debugfs_enable", amd_smn_enable_dfs);
>  static int __init amd_smn_init(void)
>  {
>  	u16 count, num_roots, roots_per_node, node, num_nodes;
> -	struct pci_dev *root;
> +	struct pci_dev *root __free(pci_dev_put) = NULL;
>  
>  	if (!cpu_feature_enabled(X86_FEATURE_ZEN))
>  		return 0;
> @@ -262,7 +262,6 @@ static int __init amd_smn_init(void)
>  		return 0;
>  
>  	num_roots = 0;
> -	root = NULL;
>  	while ((root = get_next_root(root))) {
>  		pci_dbg(root, "Reserving PCI config space\n");
>  
> @@ -299,14 +298,13 @@ static int __init amd_smn_init(void)
>  
>  	count = 0;
>  	node = 0;
> -	root = NULL;
>  	while (node < num_nodes && (root = get_next_root(root))) {
>  		/* Use one root for each node and skip the rest. */
>  		if (count++ % roots_per_node)
>  			continue;
>  
>  		pci_dbg(root, "is root for AMD node %u\n", node);
> -		amd_roots[node++] = root;
> +		amd_roots[node++] = pci_dev_get(root);
>  	}
>  
>  	if (enable_dfs) {
> 
> base-commit: 7755fae2ea370ee914797c5bcca922836a818c3d
> -- 
> 2.43.0
> 

Re: [PATCH v2] x86/amd_node: Fix PCI device reference counting in amd_smn_init()

[Borislav Petkov]

On Thu, Sep 03, 2026 at 02:37:08PM -0500, Serge Hallyn (AMD) wrote:
> On Thu, Sep 03, 2026 at 10:43:25AM -0500, Yazen Ghannam wrote:
> > The local "root" pointer is a temporary variable used during the device
> > search. Therefore, refcount related to the search iterators should be
> > cleaned up after the search is complete.

Ontop of this:

From: "Borislav Petkov (AMD)" <bp@alien8.de>
Date: Thu, 10 Sep 2026 18:43:33 -0700
Subject: [PATCH] x86/topo: Initialize AMD nodes per package

Sashiko reports that

  If amd_num_nodes() evaluates to 0, kzalloc_objs(*amd_roots, 0) returns the
  truthy ZERO_SIZE_PTR (typically (void *)16).

  Because ZERO_SIZE_PTR is not NULL, the subsequent check for !amd_roots will
  fail to catch it, resulting in a divide-by-zero kernel panic on the very
  next line during the __init boot phase.

Make sure topology_amd_nodes_per_pkg() doesn't return 0 - the AMD nodes per
package count can be trivially 1 if detection fails just like the rest
of the max* and num* packages topology attributes.

Closes: https://sashiko.dev/#/patchset/20260903154325.74343-1-yazen.ghannam%40amd.com
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
---
 arch/x86/kernel/cpu/topology_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/topology_common.c b/arch/x86/kernel/cpu/topology_common.c
index 6845e3c63fbb..7a7442981594 100644
--- a/arch/x86/kernel/cpu/topology_common.c
+++ b/arch/x86/kernel/cpu/topology_common.c
@@ -14,7 +14,7 @@
 struct x86_topology_system x86_topo_system __ro_after_init;
 EXPORT_SYMBOL_GPL(x86_topo_system);
 
-unsigned int __amd_nodes_per_pkg __ro_after_init;
+unsigned int __amd_nodes_per_pkg __ro_after_init = 1;
 EXPORT_SYMBOL_GPL(__amd_nodes_per_pkg);
 
 /* CPUs which are the primary SMT threads */
-- 
2.53.0

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH v2] x86/amd_node: Fix PCI device reference counting in amd_smn_init()

[Yazen Ghannam]

On Thu, Sep 10, 2026 at 08:03:03PM -0700, Borislav Petkov wrote:
> On Thu, Sep 03, 2026 at 02:37:08PM -0500, Serge Hallyn (AMD) wrote:
> > On Thu, Sep 03, 2026 at 10:43:25AM -0500, Yazen Ghannam wrote:
> > > The local "root" pointer is a temporary variable used during the device
> > > search. Therefore, refcount related to the search iterators should be
> > > cleaned up after the search is complete.
> 
> Ontop of this:
> 
> From: "Borislav Petkov (AMD)" <bp@alien8.de>
> Date: Thu, 10 Sep 2026 18:43:33 -0700
> Subject: [PATCH] x86/topo: Initialize AMD nodes per package
> 
> Sashiko reports that
> 
>   If amd_num_nodes() evaluates to 0, kzalloc_objs(*amd_roots, 0) returns the
>   truthy ZERO_SIZE_PTR (typically (void *)16).
> 
>   Because ZERO_SIZE_PTR is not NULL, the subsequent check for !amd_roots will
>   fail to catch it, resulting in a divide-by-zero kernel panic on the very
>   next line during the __init boot phase.
> 
> Make sure topology_amd_nodes_per_pkg() doesn't return 0 - the AMD nodes per
> package count can be trivially 1 if detection fails just like the rest
> of the max* and num* packages topology attributes.
> 
> Closes: https://sashiko.dev/#/patchset/20260903154325.74343-1-yazen.ghannam%40amd.com
> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
> ---
>  arch/x86/kernel/cpu/topology_common.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kernel/cpu/topology_common.c b/arch/x86/kernel/cpu/topology_common.c
> index 6845e3c63fbb..7a7442981594 100644
> --- a/arch/x86/kernel/cpu/topology_common.c
> +++ b/arch/x86/kernel/cpu/topology_common.c
> @@ -14,7 +14,7 @@
>  struct x86_topology_system x86_topo_system __ro_after_init;
>  EXPORT_SYMBOL_GPL(x86_topo_system);
>  
> -unsigned int __amd_nodes_per_pkg __ro_after_init;
> +unsigned int __amd_nodes_per_pkg __ro_after_init = 1;
>  EXPORT_SYMBOL_GPL(__amd_nodes_per_pkg);
>  
>  /* CPUs which are the primary SMT threads */
> -- 

Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>

Thanks,
Yazen

Re: [PATCH v2] x86/amd_node: Fix PCI device reference counting in amd_smn_init()

[Serge Hallyn]

On Thu, Sep 10, 2026 at 08:03:03PM -0700, Borislav Petkov wrote:
> On Thu, Sep 03, 2026 at 02:37:08PM -0500, Serge Hallyn (AMD) wrote:
> > On Thu, Sep 03, 2026 at 10:43:25AM -0500, Yazen Ghannam wrote:
> > > The local "root" pointer is a temporary variable used during the device
> > > search. Therefore, refcount related to the search iterators should be
> > > cleaned up after the search is complete.
> 
> Ontop of this:
> 
> From: "Borislav Petkov (AMD)" <bp@alien8.de>
> Date: Thu, 10 Sep 2026 18:43:33 -0700
> Subject: [PATCH] x86/topo: Initialize AMD nodes per package
> 
> Sashiko reports that
> 
>   If amd_num_nodes() evaluates to 0, kzalloc_objs(*amd_roots, 0) returns the
>   truthy ZERO_SIZE_PTR (typically (void *)16).
> 
>   Because ZERO_SIZE_PTR is not NULL, the subsequent check for !amd_roots will
>   fail to catch it, resulting in a divide-by-zero kernel panic on the very
>   next line during the __init boot phase.
> 
> Make sure topology_amd_nodes_per_pkg() doesn't return 0 - the AMD nodes per
> package count can be trivially 1 if detection fails just like the rest
> of the max* and num* packages topology attributes.

May not be worth it, but should we also add a num_nodes == 0 or
ZERO_OR_NULL_PTR(amd_roots) check, in case as code churns we
end up with another way for amd_num_nodes() to return 0?

> Closes: https://sashiko.dev/#/patchset/20260903154325.74343-1-yazen.ghannam%40amd.com
> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
> ---
>  arch/x86/kernel/cpu/topology_common.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kernel/cpu/topology_common.c b/arch/x86/kernel/cpu/topology_common.c
> index 6845e3c63fbb..7a7442981594 100644
> --- a/arch/x86/kernel/cpu/topology_common.c
> +++ b/arch/x86/kernel/cpu/topology_common.c
> @@ -14,7 +14,7 @@
>  struct x86_topology_system x86_topo_system __ro_after_init;
>  EXPORT_SYMBOL_GPL(x86_topo_system);
>  
> -unsigned int __amd_nodes_per_pkg __ro_after_init;
> +unsigned int __amd_nodes_per_pkg __ro_after_init = 1;
>  EXPORT_SYMBOL_GPL(__amd_nodes_per_pkg);
>  
>  /* CPUs which are the primary SMT threads */
> -- 
> 2.53.0
> 
> -- 
> Regards/Gruss,
>     Boris.
> 
> https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH v2] x86/amd_node: Fix PCI device reference counting in amd_smn_init()

[Borislav Petkov]

On Fri, Sep 11, 2026 at 11:33:56AM -0500, Serge Hallyn wrote:
> May not be worth it, but should we also add a num_nodes == 0 or
> ZERO_OR_NULL_PTR(amd_roots) check, in case as code churns we
> end up with another way for amd_num_nodes() to return 0?

Thought about it... then looked at all kzalloc_objs() callers and how they're
not protecting against that. So yeah, before this turns into a whack-a-mole
game I'd say let's remain conservative and see what happens first...

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

[tip: x86/urgent] x86/amd_node: Fix PCI device reference counting in amd_smn_init()

[tip-bot2 for Yazen Ghannam]

The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     27600805e62f800bacf990354632eae4e487d34c
Gitweb:        https://git.kernel.org/tip/27600805e62f800bacf990354632eae4e487d34c
Author:        Yazen Ghannam <yazen.ghannam@amd.com>
AuthorDate:    Thu, 03 Sep 2026 10:43:25 -05:00
Committer:     Borislav Petkov (AMD) <bp@alien8.de>
CommitterDate: Thu, 10 Sep 2026 18:05:43 -07:00

x86/amd_node: Fix PCI device reference counting in amd_smn_init()

The local "root" pointer is a temporary variable used during the device
search. Therefore, refcount related to the search iterators should be cleaned
up after the search is complete.

Use the __free() cleanup macro to ensure the refcount is decremented when the
temporary pointer goes out of scope.

Additionally, increment the refcount when caching a root pointer. This ensures
the in-use refcount is separate from the temporary search refcounting.

Finally, drop the redundant "root = NULL" before the second search loop. The
pci_get_class() iterator always decrements the refcount of its "from"
argument, so the first loop can only fall through with "root" already NULL.

Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
Closes: https://sashiko.dev/#/patchset/20260806160159.230453-1-jason.andryuk%40amd.com
Reported-by: Sashiko <sashiko-bot@kernel.org>
Assisted-by: LLM
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Cc: <stable@kernel.org>
Link: https://patch.msgid.link/20260903154325.74343-1-yazen.ghannam@amd.com
---
 arch/x86/kernel/amd_node.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
index 7625857..b7926ba 100644
--- a/arch/x86/kernel/amd_node.c
+++ b/arch/x86/kernel/amd_node.c
@@ -251,7 +251,7 @@ __setup("amd_smn_debugfs_enable", amd_smn_enable_dfs);
 static int __init amd_smn_init(void)
 {
 	u16 count, num_roots, roots_per_node, node, num_nodes;
-	struct pci_dev *root;
+	struct pci_dev *root __free(pci_dev_put) = NULL;
 
 	if (!cpu_feature_enabled(X86_FEATURE_ZEN))
 		return 0;
@@ -262,7 +262,6 @@ static int __init amd_smn_init(void)
 		return 0;
 
 	num_roots = 0;
-	root = NULL;
 	while ((root = get_next_root(root))) {
 		pci_dbg(root, "Reserving PCI config space\n");
 
@@ -299,14 +298,13 @@ static int __init amd_smn_init(void)
 
 	count = 0;
 	node = 0;
-	root = NULL;
 	while (node < num_nodes && (root = get_next_root(root))) {
 		/* Use one root for each node and skip the rest. */
 		if (count++ % roots_per_node)
 			continue;
 
 		pci_dbg(root, "is root for AMD node %u\n", node);
-		amd_roots[node++] = root;
+		amd_roots[node++] = pci_dev_get(root);
 	}
 
 	if (enable_dfs) {