DF-4292 — atomctrl_get_smc_sclk_range_table() dereferences the SMU_Info table pointer without a NULL check

Pass-2 finding for sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c. Distinct from DF-1496 (which is the unbounded ucSclkEntryNum count overflow in this same function): DF-4292 is the missing NULL check on the table pointer itself — a VBIOS that omits the SMU_Info data table panics before the count is even read.

The bug (ppatomctrl.c:1368-1374)

ATOM_SMU_INFO_V2_1 *psmu_info =
        (ATOM_SMU_INFO_V2_1 *)smu_atom_get_data_table(hwmgr->adev,
                GetIndexIntoMasterTable(DATA, SMU_Info), &size, &frev, &crev);

for (i = 0; i < psmu_info->ucSclkEntryNum; i++) {      /* NULL deref */

smu_atom_get_data_table() (smu_helper.c:660-673) returns NULL when the VBIOS master data table has no SMU_Info entry; amdgpu_atom_parse_data_header (amdgpu/atom.c:1384-1403) validates nothing. Callers (vegam_smumgr.c:677, polaris10_smumgr.c:807) invoke this during SMU backend init at driver attach:

if (0 == atomctrl_get_smc_sclk_range_table(hwmgr, &range_table_from_vbios)) {

A VEGAM/Polaris VBIOS without an SMU_Info table ⇒ NULL->ucSclkEntryNum ⇒ Fatal trap 12 kernel panic at boot/module-load (CWE-476).

Every sibling getter in this file NULL-checks its data table (atomctrl_get_reference_clock :494, asic_internal_ss_get_ss_table via :1228, atomctrl_calculate_voltage_evv_on_sclk :682, atomctrl_get_leakage_vddc_base_on_leakage :1492, atomctrl_get_avfs_information :1400); this one and atomctrl_initialize_mc_reg_table (DF-4288) are the exceptions.

Reproduce

Not runnable on this guest (no AMD dGPU — env.txt). On hardware: VEGAM or Polaris10/11 dGPU whose VBIOS master data table lacks SMU_Info; kldload amdgpu → panic in atomctrl_get_smc_sclk_range_table at attach.

DF-4292 VERDICT — psmu_info NULL deref

Status: inconclusive (code-trace certain; guest has no AMD dGPU)

Trace

• ppatomctrl.c:1368-1371 — psmu_info = smu_atom_get_data_table(..., GetIndexIntoMasterTable(DATA, SMU_Info), ...).
• ppatomctrl.c:1374 — for (i = 0; i < psmu_info->ucSclkEntryNum; i++) first deref; no NULL check in the function (ppatomctrl.c:1361-1386).
• smu_helper.c:660-673 — helper returns NULL on lookup failure; amdgpu/atom.c:1384-1403 — atom header parser performs no validation, so "table absent from master data table" is fully attacker-shaped.
• Callers (no pre-check): vegam_smumgr.c:677, polaris10_smumgr.c:807 — both inside SMU backend init at driver attach.
• Sibling getters in the same file that DO NULL-check: :494, :614-615, :682-683, :1228-1229, :1400-1401, :1492-1493 — the omission here is an outlier, not a convention.
• Relation to DF-1496: DF-1496 = ucSclkEntryNum unbounded count overflow (requires the table to exist). DF-4292 = table-missing NULL deref (panics one step earlier). Different input condition, different guard.

Impact

Boot/module-load Fatal trap 12 NULL-deref panic (CWE-476) on VEGAM/Polaris with a crafted/defective VBIOS. Low (DF-1496 already covers the worse overflow in this function; this is the cheap companion guard). Not runnable on this guest (no AMD dGPU); trace-certain.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.