Summary

kv_set_smc_sram_address/kv_read_smc_sram_dword/kv_copy_bytes_to_smc drive the SMC_IND_INDEX_0 → SMC_IND_DATA_0 indirect register pair (a non-atomic index/data sequence) with raw WREG32/RREG32 and never acquire rdev->smc_idx_lock. The lock exists and is documented as "protects concurrent SMC based register access" (radeon.h:2342-2343, init at radeon_device.c:1399). Every sibling radeon SMC file (ci_smc.c, si_smc.c, rv770_smc.c) and the RREG32_SMC/ WREG32_SMC accessors (ni.c:41-58) take this lock around the same register pair; kv_smc.c is the lone exception — the radeon twin of amdgpu DF-2130.

Root cause

Identical to DF-2130 (amdgpu twin). kv_smc.c uses raw WREG32/RREG32/WREG32_P on SMC_IND_INDEX_0/SMC_IND_DATA_0/ SMC_IND_ACCESS_CNTL without acquiring rdev->smc_idx_lock, bypassing the serialization that every sibling file (ci_smc.c:64,228,252,267; si_smc.c:62,264,288,303; rv770_smc.c:311,472,609,624) and the RREG32_SMC/WREG32_SMC macros enforce.

Threat model & preconditions

• Attacker position: local user on a system with a Kaveri/Kabini/Mullins APU (radeon CIK KV parts) and DPM enabled.
• Privileges gained or impact: GPU-internal: wrong dword written to or read from SMC SRAM → corrupted DPM tables / voltage tables / soft registers → GPU hang / display freeze / soft-lockup (local DoS recoverable by reboot). No host kernel memory corruption and no privilege escalation vector found — impact confined to the GPU/SMC subsystem.
• Required config or capabilities: KV APU + radeon DPM compiled in (default).
• Reachability: concurrent kernel-internal DPM workers; unprivileged user influences DPM activity (GPU workloads triggering power-state transitions, UVD/VCE/ACP/SAM power-gating messages, thermal/workqueue handlers reading soft registers).

Recommended fix

Mirror ci_smc.c: acquire rdev->smc_idx_lock around the SRAM indirect access in kv_read_smc_sram_dword and kv_copy_bytes_to_smc. kv_set_smc_sram_address stays lockless (only called from within these two now-locked functions, exactly like ci_set_smc_sram_address). Every return ret; inside the locked section must be converted to a labeled epilogue that drops the lock first — see DF-2130 for the full diff pattern.

References

• DF-2130 — amdgpu twin of this bug.
• sys/dev/drm/radeon/ci_smc.c:64,228,252,267 — correctly-locked siblings.
• sys/dev/drm/radeon/radeon.h:2342-2343 — smc_idx_lock documentation.

Timeline

• 2026-07-25 Discovered during automated audit.
• 2026-07-25 Reported to DragonFlyBSD security contact.