[PATCH] memory: tegra: Shut down Tegra210 EMC timers before teardown

[PATCH] memory: tegra: Shut down Tegra210 EMC timers before teardown

[Myeonghun Pak]

The training and refresh timers can outlive the EMC state on removal
or probe failure after clock attachment, causing use-after-free.

Shut down both timers before detaching the clock provider and releasing
the timing tables to wait for callbacks and prevent rearming. Initialize
them before clock attachment, since set_rate() can start training.

This issue was found by static analysis.

Fixes: 10de21148f7d ("memory: tegra: Add EMC scaling support code for Tegra210")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Compile-tested with GCC, W=1 (arm). No runtime testing.

 drivers/memory/tegra/tegra210-emc-core.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/memory/tegra/tegra210-emc-core.c b/drivers/memory/tegra/tegra210-emc-core.c
index e8d4cd8..044ec6f 100644
--- a/drivers/memory/tegra/tegra210-emc-core.c
+++ b/drivers/memory/tegra/tegra210-emc-core.c
@@ -1946,12 +1946,6 @@ static int tegra210_emc_probe(struct platform_device *pdev)
 			config->same_freq = true;
 	}
 
-	err = tegra210_clk_emc_attach(emc->clk, &emc->provider);
-	if (err < 0) {
-		dev_err(&pdev->dev, "failed to attach to EMC clock: %d\n", err);
-		goto release;
-	}
-
 	emc->clkchange_delay = 100;
 	emc->training_interval = 100;
 	dev_set_drvdata(emc->dev, emc);
@@ -1963,6 +1957,12 @@ static int tegra210_emc_probe(struct platform_device *pdev)
 
 	timer_setup(&emc->training, tegra210_emc_train, 0);
 
+	err = tegra210_clk_emc_attach(emc->clk, &emc->provider);
+	if (err < 0) {
+		dev_err(&pdev->dev, "failed to attach to EMC clock: %d\n", err);
+		goto release;
+	}
+
 	tegra210_emc_debugfs_init(emc);
 
 	cd = devm_thermal_of_child_cooling_device_register(emc->dev, np, "emc", emc,
@@ -1978,6 +1978,8 @@ static int tegra210_emc_probe(struct platform_device *pdev)
 
 detach:
 	debugfs_remove_recursive(emc->debugfs.root);
+	timer_shutdown_sync(&emc->training);
+	timer_shutdown_sync(&emc->refresh_timer);
 	tegra210_clk_emc_detach(emc->clk);
 release:
 	of_reserved_mem_device_release(emc->dev);
@@ -1990,6 +1992,8 @@ static void tegra210_emc_remove(struct platform_device *pdev)
 	struct tegra210_emc *emc = platform_get_drvdata(pdev);
 
 	debugfs_remove_recursive(emc->debugfs.root);
+	timer_shutdown_sync(&emc->training);
+	timer_shutdown_sync(&emc->refresh_timer);
 	tegra210_clk_emc_detach(emc->clk);
 	of_reserved_mem_device_release(emc->dev);
 }

Re: [PATCH] memory: tegra: Shut down Tegra210 EMC timers before teardown

[Krzysztof Kozlowski]

On 11/10/2026 22:00, Myeonghun Pak wrote:
> The training and refresh timers can outlive the EMC state on removal
> or probe failure after clock attachment, causing use-after-free.
> 
> Shut down both timers before detaching the clock provider and releasing
> the timing tables to wait for callbacks and prevent rearming. Initialize
> them before clock attachment, since set_rate() can start training.
> 
> This issue was found by static analysis.

You are expected to name the tool or be silent. Reading code by LLM is
not static analysis. It's statistical guessing, nothing to do with
static analysis.

Best regards,
Krzysztof