Linux Tegra architecture development
 help / color / mirror / Atom feed
From: Thierry Reding <thierry.reding@kernel.org>
To: Ethan Tidmore <ethantidmore06@gmail.com>
Cc: Krzysztof Kozlowski <krzk@kernel.org>,
	 Jonathan Hunter <jonathanh@nvidia.com>,
	Mikko Perttunen <mperttunen@nvidia.com>,
	 Kees Cook <kees@kernel.org>,
	Svyatoslav Ryhel <clamor95@gmail.com>,
	 linux-tegra@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] memory: tegra: Fix possible null pointer dereference
Date: Fri, 8 May 2026 12:13:16 +0200	[thread overview]
Message-ID: <af21Jb1jJgxfyL79@orome> (raw)
In-Reply-To: <20260508015716.652347-1-ethantidmore06@gmail.com>

[-- Attachment #1: Type: text/plain, Size: 1182 bytes --]

On Thu, May 07, 2026 at 08:57:16PM -0500, Ethan Tidmore wrote:
> The function tegra114_emc_find_timing() has the possibility of returning
> null and it's return value 'timing' is dereferenced before it is
> checked for null.
> 
> Place dereference after null pointer check.
> 
> Detected by Smatch:
> drivers/memory/tegra/tegra114-emc.c:520 tegra114_emc_prepare_timing_change()
> warn: variable dereferenced before check 'timing' (see line 515)
> 
> Fixes: dce208b5405f4 ("memory: tegra: Add Tegra114 EMC driver")
> Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
> ---
>  drivers/memory/tegra/tegra114-emc.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

It's a *very* theoretically possible NULL pointer dereference. Both the
clock and EMC drivers read the timing information from exactly the same
device tree nodes, so their timings should always match. If they don't
something *really* bad is going on and it might be safer to just crash.

On the other hand, if this silences a smatch warning people are just
going to keep sending patches and we might as well just "fix" it now,
so:

Acked-by: Thierry Reding <treding@nvidia.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

      reply	other threads:[~2026-05-08 10:13 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-08  1:57 [PATCH] memory: tegra: Fix possible null pointer dereference Ethan Tidmore
2026-05-08 10:13 ` Thierry Reding [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=af21Jb1jJgxfyL79@orome \
    --to=thierry.reding@kernel.org \
    --cc=clamor95@gmail.com \
    --cc=ethantidmore06@gmail.com \
    --cc=jonathanh@nvidia.com \
    --cc=kees@kernel.org \
    --cc=krzk@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-tegra@vger.kernel.org \
    --cc=mperttunen@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox