amd-pmf: NULL pointer dereference in tee_client_invoke_func() after failed TA re-init on hibernate restore

Hi,

this is a follow-up to my hibernate report from last year [1], which led to 48d229c70471 ("platform/x86/amd/pmf: Prevent TEE errors after hibernate") and 0ba2035026d0 ("crypto: ccp - Add an S4 restore flow"). I used the get_maintainer.pl script to arrive at the list of recipients.

Claude helped me analyse this and I tried to verify it manually. I have to admit though that I'm very far out of my depth here, so some of it may be wrong. It is real behavior I see though and the explanation _seems _ to make sense to me.

Both are in the kernel I am running.
When the TA re-init in the restore path fails, the next s2idle resume oopses in the PMF work item and the machine slowly locks up.

Hardware (just as last time): HP ZBook Ultra G1a (Ryzen AI MAX+ PRO 395), BIOS X89 Ver. 01.06.02 08/26/2026
Kernel: 7.2.8-arch1-2 (Arch), linux-firmware 20260916

Sequence, all in one boot:

1. 2026-10-06, s2idle resume:

ccp 0000:c3:00.2: tee: command 0x5 timed out, disabling PSP amd-pmf AMDI0105:00: TEE enact cmd failed. err: ffff000e, ret:0

The enact error then repeats about once a second for 12 days, ~540k lines in the journal.
I totally failed to notice this until after the fact :)

2. 2026-10-18, resume from hibernate:

ccp 0000:c3:00.2: tee: ring init command failed with busy status, retrying Failed to open TEE session err:0xffff000e, rc:0
amd-pmf AMDI0105:00: Failed to open TA session (-22)
amd-pmf AMDI0105:00: TEE init failed for UUID[0] ret: -22

Nothing schedules pb_work here, so the system runs fine for hours (this sentence is something Claude told me and I'm not entirely sure what it means, I hope it makes sense).

3. Next s2idle resume, about 1.5 s after "PM: suspend exit":

BUG: kernel NULL pointer dereference, address: 0000000000000020
Workqueue: events amd_pmf_invoke_cmd [amd_pmf]
RIP: 0010:tee_client_invoke_func+0xc/0x30 [tee]
Call Trace:
  amd_pmf_invoke_cmd_enact+0x103/0x770 [amd_pmf]
  amd_pmf_invoke_cmd+0x19/0x40 [amd_pmf]
  process_one_work+0x19f/0x370
  worker_thread+0x1b1/0x310

The kworker dies while it is still busy, so anything that later flushes per-CPU work on that CPU blocks forever. In my case waybar ended up in D state in memfd_add_seals() -> lru_add_drain_all(), every following suspend failed with "1 tasks refusing to freeze", and after a while userdb lookups, reboot and the compositor hung too. Only a hard reset got me out.

I assume the root cause is the PSP disabling itself after the s2idle resume. I have no idea why that happened and I can't remember having seen this before (that said I didn't check actively in the past).

The full kernel log excerpt is attached. I can try to test patches even thought I forgot most of what I learned about building a Kernel from last year. I'm sure I can relearn :)

[1] https://lore.kernel.org/platform-driver-x86/CAD-Ua_gfJnQSo8ucS_7ZwzuhoBRJ14zXP7s8b-zX3ZcxcyWePw@mail.gmail.com/

Thanks,
Lars

# journalctl -b -1 -k, Arch 7.2.8-arch1-2, HP ZBook Ultra G1a (BIOS X89 01.06.02)

## 2026-10-06: PSP disabled after s2idle resume

[26746.180782] lars-laptop kernel: ccp 0000:c3:00.2: tee: command 0x5 timed out, disabling PSP
[26746.180947] lars-laptop kernel: amd-pmf AMDI0105:00: TEE enact cmd failed. err: ffff000e, ret:0

## 2026-10-18 09:47: hibernate restore, TA re-init fails

[581049.052477] lars-laptop kernel: PM: hibernation: Basic memory bitmaps created
[581049.052595] lars-laptop kernel: PM: hibernation: Preallocating image memory
[581049.057090] lars-laptop kernel: PM: hibernation: Allocated 4841450 pages for snapshot
[581049.057109] lars-laptop kernel: PM: hibernation: Allocated 19365800 kbytes in 42.36 seconds (457.17 MB/s)
[581049.057732] lars-laptop kernel: PM: hibernation: Normal pages needed: 5734646 + 1024, available pages: 6787409
[581049.058758] lars-laptop kernel: ccp 0000:c3:00.2: tee: ring init command failed with busy status, retrying
[581049.060793] lars-laptop kernel: Failed to open TEE session err:0xffff000e, rc:0
[581049.060810] lars-laptop kernel: amd-pmf AMDI0105:00: Failed to open TA session (-22)
[581049.060908] lars-laptop kernel: amd-pmf AMDI0105:00: TEE init failed for UUID[0] ret: -22
[581049.115930] lars-laptop kernel:  ? __pfx_pci_pm_restore+0x10/0x10
[581049.118804] lars-laptop kernel: PM: hibernation: Basic memory bitmaps freed
[581049.119877] lars-laptop kernel: PM: hibernation: hibernation exit

## 2026-10-18 14:55: first s2idle resume after that, Oops

[587617.019053] lars-laptop kernel: PM: suspend exit
[587618.558141] lars-laptop kernel: BUG: kernel NULL pointer dereference, address: 0000000000000020
[587618.558369] lars-laptop kernel: #PF: supervisor read access in kernel mode
[587618.561111] lars-laptop kernel: #PF: error_code(0x0000) - not-present page
[587618.561161] lars-laptop kernel: PGD 0 P4D 0 
[587618.561193] lars-laptop kernel: Oops: Oops: 0000 [#1] SMP NOPTI
[587618.561211] lars-laptop kernel: CPU: 4 UID: 0 PID: 3986355 Comm: kworker/4:3 Tainted: G        W  OE       7.2.8-arch1-2 #1 PREEMPT(full)  186163caea6eb5dc4b2a0252463c7ce1c6927294
[587618.561227] lars-laptop kernel: Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[587618.561240] lars-laptop kernel: Hardware name: HP HP ZBook Ultra G1a 14 inch Mobile Workstation PC/8D01, BIOS X89 Ver. 01.06.02 08/26/2026
[587618.561250] lars-laptop kernel: Workqueue: events amd_pmf_invoke_cmd [amd_pmf]
[587618.561260] lars-laptop kernel: RIP: 0010:tee_client_invoke_func+0xc/0x30 [tee]
[587618.561271] lars-laptop kernel: Code: cc b8 ea ff ff ff c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 8b 07 <48> 8b 40 20 48 8b 40 08 48 8b 40 40 48 85 c0 74 06 ff e0 cc cc cc
[587618.561282] lars-laptop kernel: RSP: 0018:ffffcca766cf3d80 EFLAGS: 00010246
[587618.561292] lars-laptop kernel: RAX: 0000000000000000 RBX: ffff8b00412ac038 RCX: ffffcca766cf3da8
[587618.561302] lars-laptop kernel: RDX: ffffcca766cf3da8 RSI: ffffcca766cf3d90 RDI: ffff8b097944f700
[587618.561312] lars-laptop kernel: RBP: ffff8b008e500000 R08: 0000000000000001 R09: ffff8b0041e89000
[587618.561324] lars-laptop kernel: R10: ffff8b0041e06458 R11: ffff8b0040042800 R12: ffff8b0b8db322c0
[587618.561334] lars-laptop kernel: R13: ffff8b0040295605 R14: 0000000000000000 R15: ffff8b00412ac3a0
[587618.561344] lars-laptop kernel: FS:  0000000000000000(0000) GS:ffff8b0bed62a000(0000) knlGS:0000000000000000
[587618.561355] lars-laptop kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[587618.561364] lars-laptop kernel: CR2: 0000000000000020 CR3: 0000000791822000 CR4: 0000000000f50ef0
[587618.561377] lars-laptop kernel: PKRU: 55555554
[587618.561387] lars-laptop kernel: Call Trace:
[587618.561395] lars-laptop kernel:  <TASK>
[587618.561405] lars-laptop kernel:  amd_pmf_invoke_cmd_enact+0x103/0x770 [amd_pmf 70105009d363dd1ff2c61244727826315bb588fe]
[587618.561416] lars-laptop kernel:  amd_pmf_invoke_cmd+0x19/0x40 [amd_pmf 70105009d363dd1ff2c61244727826315bb588fe]
[587618.561426] lars-laptop kernel:  process_one_work+0x19f/0x370
[587618.561438] lars-laptop kernel:  worker_thread+0x1b1/0x310
[587618.561446] lars-laptop kernel:  ? __pfx_worker_thread+0x10/0x10
[587618.561454] lars-laptop kernel:  kthread+0xe4/0x120
[587618.561461] lars-laptop kernel:  ? __pfx_kthread+0x10/0x10
[587618.561470] lars-laptop kernel:  ret_from_fork+0x2a7/0x330
[587618.561479] lars-laptop kernel:  ? __pfx_kthread+0x10/0x10
[587618.561487] lars-laptop kernel:  ret_from_fork_asm+0x1a/0x30
[587618.561495] lars-laptop kernel:  </TASK>
[587618.561504] lars-laptop kernel: Modules linked in: mt7925e mt7925_common tcp_diag inet_diag rfcomm hid_sensor_prox hid_sensor_gyro_3d hid_sensor_trigger kfifo_buf hid_sensor_iio_common industrialio snd_seq_dummy snd_hrtimer hid_sensor_hub snd_seq snd_seq_device ccm algif_hash algif_skcipher af_alg nf_conntrack_netlink xt_nat xt_tcpudp veth xt_conntrack xt_MASQUERADE bridge stp llc xfrm_user xfrm_algo xt_set ip_set xt_addrtype nft_compat x_tables bnep btusb btmtk btrtl btbcm btintel bluetooth overlay snd_acp_legacy_mach snd_acp_mach snd_soc_nau8821 snd_acp3x_rn snd_acp70 nft_reject_inet snd_acp_i2s nf_reject_ipv4 snd_acp_pdm nf_reject_ipv6 snd_soc_dmic snd_acp_pcm nft_reject snd_sof_amd_acp70 snd_sof_amd_acp63 snd_sof_amd_vangogh snd_sof_amd_rembrandt snd_sof_amd_renoir snd_sof_amd_acp snd_sof_pci snd_sof_xtensa_dsp nft_chain_nat nf_nat snd_sof nf_conntrack snd_sof_utils snd_pci_acp7x nf_defrag_ipv6 snd_pci_ps nf_defrag_ipv4 snd_soc_acpi_amd_match snd_amd_sdw_acpi intel_rapl_msr snd_ctl_led soundwire_amd intel_rapl_common
[587618.561582] lars-laptop kernel:  soundwire_generic_allocation nf_tables snd_hda_codec_alc269 soundwire_bus snd_hda_codec_realtek_lib snd_hda_scodec_component snd_soc_sdca snd_hda_scodec_cs35l56_spi snd_hda_codec_generic snd_hda_codec_atihdmi snd_soc_core snd_hda_codec_hdmi mt792x_lib snd_compress mt76_connac_lib ac97_bus snd_hda_intel vfat snd_pcm_dmaengine mt76 snd_hda_codec fat snd_acp_pci hp_bioscfg snd_amd_acpi_mach amd_isp4_capture snd_hda_core mac80211 spd5118 snd_intel_dspcfg videobuf2_vmalloc snd_acp_legacy_common snd_hda_scodec_cs35l56_i2c kvm_amd snd_hda_scodec_cs35l56 videobuf2_memops snd_pci_acp6x snd_intel_sdw_acpi ucsi_acpi firmware_attributes_class videobuf2_v4l2 snd_hda_cirrus_scodec sp5100_tco snd_pci_acp5x snd_hwdep kvm snd_soc_cs35l56_shared typec_ucsi videobuf2_common snd_rn_pci_acp3x cfg80211 snd_soc_cs_amp_lib roles snd_pcm snd_acp_config hp_wmi videodev amdxdna joydev cs_dsp snd_soc_acpi typec snd_timer irqbypass sparse_keymap i2c_piix4 mousedev hid_multitouch gpio_keys rfkill rapl snd wmi_bmof amd_pmf libarc4 mc
[587618.561857] lars-laptop kernel:  pinctrl_amdisp i2c_designware_amdisp soundcore i2c_smbus k10temp snd_pci_acp3x thunderbolt amdtee i2c_hid_acpi amd_sfh i2c_hid serial_multi_instantiate soc_button_array amd_isp4 wireless_hotkey amd_pmc mac_hid crypto_user i2c_dev acpi_call(OE) dm_crypt encrypted_keys trusted asn1_encoder tee amdgpu dm_mod drm_buddy amdxcp i2c_algo_bit drm_ttm_helper ttm drm_exec aesni_intel drm_panel_backlight_quirks gf128mul gpu_sched nvme aead drm_suballoc_helper nvme_core drm_display_helper video nvme_keyring ccp cec wmi nvme_auth serio_raw [last unloaded: mt7925_common]
[587618.561877] lars-laptop kernel: CR2: 0000000000000020
[587618.561887] lars-laptop kernel: ---[ end trace 0000000000000000 ]---

## 2026-10-18 15:01: waybar stuck behind the dead kworker, suspend fails

[587984.013936] lars-laptop kernel: Freezing user space processes failed after 20.005 seconds (1 tasks refusing to freeze, wq_busy=0):
[587984.013960] lars-laptop kernel: task:waybar          state:D stack:0     pid:2665  tgid:2665  ppid:1406   task_flags:0x400000 flags:0x00080002
[587984.013973] lars-laptop kernel: Call Trace:
[587984.013991] lars-laptop kernel:  <TASK>
[587984.014017] lars-laptop kernel:  __schedule+0x420/0x1770
[587984.014044] lars-laptop kernel:  schedule+0x27/0xa0
[587984.014059] lars-laptop kernel:  schedule_timeout+0xdc/0x120
[587984.014073] lars-laptop kernel:  wait_for_completion+0x9a/0x180
[587984.014092] lars-laptop kernel:  __flush_work+0x315/0x450
[587984.014106] lars-laptop kernel:  ? __queue_work+0x16c/0x570
[587984.014119] lars-laptop kernel:  ? __pfx_wq_barrier_func+0x10/0x10
[587984.014134] lars-laptop kernel:  __lru_add_drain_all+0x1d8/0x230
[587984.014145] lars-laptop kernel:  memfd_add_seals+0x368/0x660
[587984.014160] lars-laptop kernel:  memfd_fcntl+0x87/0xa0
[587984.014174] lars-laptop kernel:  do_fcntl+0x56e/0x980
[587984.014186] lars-laptop kernel:  ? do_syscall_64+0xaa/0x660
[587984.014200] lars-laptop kernel:  ? vms_complete_munmap_vmas+0x212/0x230
[587984.014220] lars-laptop kernel:  __x64_sys_fcntl+0xb0/0x120
[587984.014232] lars-laptop kernel:  do_syscall_64+0xaa/0x660
[587984.014271] lars-laptop kernel:  ? __vm_munmap+0x133/0x200
[587984.014316] lars-laptop kernel:  ? do_futex+0x11d/0x1f0
[587984.014335] lars-laptop kernel:  ? __x64_sys_munmap+0x1b/0x30
[587984.014350] lars-laptop kernel:  ? do_syscall_64+0xaa/0x660
[587984.014361] lars-laptop kernel:  ? vm_mmap_pgoff+0x161/0x210
[587984.014392] lars-laptop kernel:  ? do_syscall_64+0x252/0x660
[587984.014407] lars-laptop kernel:  ? ksys_mmap_pgoff+0x168/0x200
[587984.014569] lars-laptop kernel:  ? do_syscall_64+0xaa/0x660
[587984.014584] lars-laptop kernel:  ? __x64_sys_openat+0x61/0xa0
[587984.014597] lars-laptop kernel:  ? do_syscall_64+0xaa/0x660
[587984.014609] lars-laptop kernel:  ? do_syscall_64+0x5f/0x660
[587984.014621] lars-laptop kernel:  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[587984.014635] lars-laptop kernel: RIP: 0033:0x7f14ef394678
[587984.014648] lars-laptop kernel: RSP: 002b:00007ffdbfdaa520 EFLAGS: 00000202 ORIG_RAX: 0000000000000048
[587984.014662] lars-laptop kernel: RAX: ffffffffffffffda RBX: 00007ffdbfdb1600 RCX: 00007f14ef394678
[587984.014678] lars-laptop kernel: RDX: 000000000000000f RSI: 0000000000000409 RDI: 0000000000000029
[587984.014694] lars-laptop kernel: RBP: 00007ffdbfdab690 R08: 00007f14f2471000 R09: 00007f14f2471010
[587984.014708] lars-laptop kernel: R10: 00000000457ec5ce R11: 0000000000000202 R12: 00007f14f058f380
[587984.014721] lars-laptop kernel: R13: 00007ffdbfdb1740 R14: 0000000000000029 R15: 00007ffdbfdb16e8
[587984.014734] lars-laptop kernel:  </TASK>