Re: [PATCH v3 03/10] ARM: tegra: tf701t: Add MC and EMC timing nodes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The tegra114-emc driver causes a heap out-of-bounds write by calling tegra124_clk_set_emc_callbacks(), which incorrectly casts the Tegra114 "emc" GATE clock to a struct tegra_clk_emc.
--

--- Patch [3]: [PATCH v3 03/10] ARM: tegra: tf701t: Add MC and EMC timing nodes ---
commit 0da36cf6ac395d6c7a0f9761226778f6cf5ac2ed
Author: Svyatoslav Ryhel <clamor95@gmail.com>

ARM: tegra: tf701t: Add MC and EMC timing nodes

This commit configures the Memory Controllers for the ASUS TF701T by adding
the required EMC and MC timing nodes to the device tree.

> diff --git a/arch/arm/boot/dts/nvidia/tegra114-asus-tf701t.dts b/arch/arm/boot/dts/nvidia/tegra114-asus-tf701t.dts
> --- a/arch/arm/boot/dts/nvidia/tegra114-asus-tf701t.dts
> +++ b/arch/arm/boot/dts/nvidia/tegra114-asus-tf701t.dts
> @@ -1610,6 +1693,636 @@ i2c-thermtrip {
>  		};
>  	};
>  
> +	memory-controller@70019000 {
> +		emc-timings-0 {
> +			/* Mozart Rev B Hynix DDR3 792MHz */
> +			nvidia,ram-code = <0>;

[Severity: Critical]
This isn't a bug introduced by this patch, but it appears that enabling these
nodes causes the tegra114-emc driver to probe, which triggers a pre-existing
heap out-of-bounds write.

During probe, drivers/memory/tegra/tegra114-emc.c:tegra114_emc_probe() calls
tegra124_clk_set_emc_callbacks(). That function retrieves the "emc" clock and
blindly casts it to struct tegra_clk_emc to assign the callbacks:

drivers/clk/tegra/clk-tegra124-emc.c:tegra124_clk_set_emc_callbacks() {
    ...
    hw = __clk_get_hw(clk);
    tegra = container_of(hw, struct tegra_clk_emc, hw);

    tegra->prepare_timing_change = prep_cb;
    tegra->complete_timing_change = complete_cb;
    ...
}

However, on Tegra114, the "emc" clock is registered as a much smaller
struct tegra_clk_periph_gate, not a struct tegra_clk_emc:

drivers/clk/tegra/clk-tegra-periph.c:gate_clks() {
    ...
    GATE("emc", "emc_mux", 57, 0, tegra_clk_emc, CLK_IS_CRITICAL),
    ...
}

Writing to tegra->prepare_timing_change and tegra->complete_timing_change
overwrites adjacent memory past the end of the tegra_clk_periph_gate structure.

Should the clock registration in Tegra114 be updated to use tegra_clk_emc,
or does the EMC driver need a different way to handle callbacks on this
platform before these nodes are enabled?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260731114106.169398-1-clamor95@gmail.com?part=3