Re: [PATCH v2 03/10] ARM: tegra: tf701t: Add MC and EMC timing nodes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Medium] The `emc-timings-0` node added to `clock@60006000` violates the `nvidia,tegra114-car` DT binding (which enforces `additionalProperties: false` and explicitly rejects `emc-timings`). Furthermore, `clk-tegra114.c` lacks the specialized `tegra_clk_emc` driver and does not parse these timings, rendering the EMC DFS functionality incomplete and the device tree addition dead code.

Pre-existing issues:
- [Critical] `tegra114_emc_probe()` triggers an out-of-bounds heap write via type confusion. It unconditionally calls `tegra124_clk_set_emc_callbacks()`, which looks up the `"emc"` clock and uses `container_of()` to cast its `clk_hw` pointer to a `struct tegra_clk_emc`. However, on Tegra114, the `"emc"` clock is initialized by `tegra_periph_clk_init()` as a `struct tegra_clk_periph_gate`, which is much smaller. Writing the callback pointers into this structure overwrites adjacent SLAB memory.
--

--- Patch [3]: [PATCH v2 03/10] ARM: tegra: tf701t: Add MC and EMC timing nodes ---
commit 2497fc2e2b1505b1ff38584be3fcc67d52de87c4
Author: Svyatoslav Ryhel <clamor95@gmail.com>

ARM: tegra: tf701t: Add MC and EMC timing nodes

Configure Memory Controllers of ASUS TF701T.

> diff --git a/arch/arm/boot/dts/nvidia/tegra114-asus-tf701t.dts b/arch/arm/boot/dts/nvidia/tegra114-asus-tf701t.dts
> index 55e9256e80f33..00eeedf3ef7a5 100644
> --- a/arch/arm/boot/dts/nvidia/tegra114-asus-tf701t.dts
> +++ b/arch/arm/boot/dts/nvidia/tegra114-asus-tf701t.dts
> @@ -101,6 +101,89 @@ panel_secondary: panel@0 {
>  		};
>  	};
>  
> +	clock@60006000 {
> +		emc-timings-0 {
> +			nvidia,ram-code = <0>;

[Severity: Medium]
Does the nvidia,tegra114-car DT binding support emc-timings? The schema
enforces additionalProperties: false and explicitly rejects emc-timings.

Furthermore, since clk-tegra114.c lacks the specialized tegra_clk_emc driver
and does not parse these timings, does this addition become dead code?

[ ... ]
> @@ -1610,6 +1693,636 @@ i2c-thermtrip {
>  		};
>  	};
>  
> +	memory-controller@70019000 {
> +		emc-timings-0 {
> +			/* Mozart Rev B Hynix DDR3 792MHz */
> +			nvidia,ram-code = <0>;

[Severity: Critical]
This is a pre-existing issue, but does adding these memory controller nodes
cause the tegra114-emc driver to probe, which unconditionally triggers an
out-of-bounds heap write?

In tegra114_emc_probe(), it unconditionally calls
tegra124_clk_set_emc_callbacks(), which looks up the "emc" clock and uses
container_of() to cast its clk_hw pointer to a struct tegra_clk_emc:

drivers/clk/tegra/clk-tegra124-emc.c:tegra124_clk_set_emc_callbacks() {
    ...
    tegra = container_of(hw, struct tegra_clk_emc, hw);

    tegra->prepare_timing_change = prep_cb;
    tegra->complete_timing_change = complete_cb;
    ...
}

However, on Tegra114, the "emc" clock is initialized by
tegra_periph_clk_init() as a much smaller struct tegra_clk_periph_gate.
Would writing these callback pointers overwrite adjacent SLAB memory?

> +
> +			timing-12750000 {
> +				clock-frequency = <12750000>;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721101059.451699-1-clamor95@gmail.com?part=3