[PATCH] memory: tegra: Guard against NULL mc_regs in IRQ handler

[PATCH] memory: tegra: Guard against NULL mc_regs in IRQ handler

[Ashish Mhetre]

The per-error decode in tegra30_mc_handle_irq() dereferences
mc->soc->regs unconditionally. This 'regs' structure is optional and is
only used for decoding and logging MC error interrupts. The rest of the
MC functionality does not depend on it.

When adding support for the Tegra238 SoC, the 'regs' structure was
initially omitted because it is only used for error logging. We found
that this resulted in a NULL pointer dereference in IRQ context, causing
a crash when an MC error interrupt fired. Although existing upstream
devices will not hit this condition because 'regs' is present, guard
against it to improve the robustness of the driver.

Skip the decode and just clear the interrupt when mc_regs is NULL. This
bypasses the error interrupt logging while keeping the remaining MC
functionality intact.

Signed-off-by: Ashish Mhetre <amhetre@nvidia.com>
---
 drivers/memory/tegra/mc.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c
index ec80ea9cc173..6ac7d5f5e597 100644
--- a/drivers/memory/tegra/mc.c
+++ b/drivers/memory/tegra/mc.c
@@ -598,6 +598,13 @@ irqreturn_t tegra30_mc_handle_irq(int irq, void *data)
 	if (!status)
 		return IRQ_NONE;
 
+	if (!mc->soc->regs) {
+		dev_err_ratelimited(mc->dev,
+				    "MC error interrupt 0x%08lx with no error register map, Clearing.\n",
+				    status);
+		goto clear;
+	}
+
 	for_each_set_bit(bit, &status, 32) {
 		const char *error = tegra_mc_status_names[bit] ?: "unknown";
 		const char *client = "unknown", *desc;
@@ -736,6 +743,7 @@ irqreturn_t tegra30_mc_handle_irq(int irq, void *data)
 				    desc, perm);
 	}
 
+clear:
 	/* clear interrupts */
 	if (mc->soc->num_channels) {
 		mc_ch_writel(mc, channel, status, MC_INTSTATUS);
-- 
2.50.1

Re: [PATCH] memory: tegra: Guard against NULL mc_regs in IRQ handler

[Krzysztof Kozlowski]

On Fri, 03 Jul 2026 04:56:53 +0000, Ashish Mhetre wrote:
> The per-error decode in tegra30_mc_handle_irq() dereferences
> mc->soc->regs unconditionally. This 'regs' structure is optional and is
> only used for decoding and logging MC error interrupts. The rest of the
> MC functionality does not depend on it.
> 
> When adding support for the Tegra238 SoC, the 'regs' structure was
> initially omitted because it is only used for error logging. We found
> that this resulted in a NULL pointer dereference in IRQ context, causing
> a crash when an MC error interrupt fired. Although existing upstream
> devices will not hit this condition because 'regs' is present, guard
> against it to improve the robustness of the driver.
> 
> [...]

Applied, thanks!

[1/1] memory: tegra: Guard against NULL mc_regs in IRQ handler
      https://git.kernel.org/krzk/linux-mem-ctrl/c/8111c7f3723f414b7f655a3880775cbbd0e9de8e

Best regards,
-- 
Krzysztof Kozlowski <krzk@kernel.org>