[PATCH v2] memory: tegra: Shut down Tegra210 EMC timers before teardown

[PATCH v2] memory: tegra: Shut down Tegra210 EMC timers before teardown

[Myeonghun Pak]

The training and refresh timers can outlive the EMC state on removal
or probe failure after clock attachment, causing use-after-free.

Shut down both timers before detaching the clock provider and releasing
the timing tables to wait for callbacks and prevent rearming. Initialize
them before clock attachment, since set_rate() can start training.

This issue was identified during our ongoing research while reviewing
kernel code.

Fixes: 10de21148f7d ("memory: tegra: Add EMC scaling support code for Tegra210")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Changes in v2:
- Replace the static-analysis attribution with an ongoing-research note,
  following Krzysztof Kozlowski's feedback. No code changes.

v1: https://lore.kernel.org/r/20261011160034.93d011b386c2-1-mhun512@gmail.com

Compile-tested with GCC, W=1 (arm). No runtime testing.

 drivers/memory/tegra/tegra210-emc-core.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/memory/tegra/tegra210-emc-core.c b/drivers/memory/tegra/tegra210-emc-core.c
index e8d4cd8..044ec6f 100644
--- a/drivers/memory/tegra/tegra210-emc-core.c
+++ b/drivers/memory/tegra/tegra210-emc-core.c
@@ -1946,12 +1946,6 @@ static int tegra210_emc_probe(struct platform_device *pdev)
 			config->same_freq = true;
 	}
 
-	err = tegra210_clk_emc_attach(emc->clk, &emc->provider);
-	if (err < 0) {
-		dev_err(&pdev->dev, "failed to attach to EMC clock: %d\n", err);
-		goto release;
-	}
-
 	emc->clkchange_delay = 100;
 	emc->training_interval = 100;
 	dev_set_drvdata(emc->dev, emc);
@@ -1963,6 +1957,12 @@ static int tegra210_emc_probe(struct platform_device *pdev)
 
 	timer_setup(&emc->training, tegra210_emc_train, 0);
 
+	err = tegra210_clk_emc_attach(emc->clk, &emc->provider);
+	if (err < 0) {
+		dev_err(&pdev->dev, "failed to attach to EMC clock: %d\n", err);
+		goto release;
+	}
+
 	tegra210_emc_debugfs_init(emc);
 
 	cd = devm_thermal_of_child_cooling_device_register(emc->dev, np, "emc", emc,
@@ -1978,6 +1978,8 @@ static int tegra210_emc_probe(struct platform_device *pdev)
 
 detach:
 	debugfs_remove_recursive(emc->debugfs.root);
+	timer_shutdown_sync(&emc->training);
+	timer_shutdown_sync(&emc->refresh_timer);
 	tegra210_clk_emc_detach(emc->clk);
 release:
 	of_reserved_mem_device_release(emc->dev);
@@ -1990,6 +1992,8 @@ static void tegra210_emc_remove(struct platform_device *pdev)
 	struct tegra210_emc *emc = platform_get_drvdata(pdev);
 
 	debugfs_remove_recursive(emc->debugfs.root);
+	timer_shutdown_sync(&emc->training);
+	timer_shutdown_sync(&emc->refresh_timer);
 	tegra210_clk_emc_detach(emc->clk);
 	of_reserved_mem_device_release(emc->dev);
 }

Re: [PATCH v2] memory: tegra: Shut down Tegra210 EMC timers before teardown

[Krzysztof Kozlowski]

On 15/10/2026 02:28, Myeonghun Pak wrote:
> The training and refresh timers can outlive the EMC state on removal
> or probe failure after clock attachment, causing use-after-free.
> 
> Shut down both timers before detaching the clock provider and releasing
> the timing tables to wait for callbacks and prevent rearming. Initialize
> them before clock attachment, since set_rate() can start training.
> 
> This issue was identified during our ongoing research while reviewing
> kernel code.

Really? Or you just took Sashiko's report?
https://sashiko.dev/#/bug/linux-47538f77-fb50-4a06-b49b-92dbee8b538b

Running LLM is not an ongoing research.

Applied.

Best regards,
Krzysztof

Re: [PATCH v2] memory: tegra: Shut down Tegra210 EMC timers before teardown

[Krzysztof Kozlowski]

On Wed, 14 Oct 2026 20:28:52 -0400, Myeonghun Pak wrote:
> The training and refresh timers can outlive the EMC state on removal
> or probe failure after clock attachment, causing use-after-free.
> 
> Shut down both timers before detaching the clock provider and releasing
> the timing tables to wait for callbacks and prevent rearming. Initialize
> them before clock attachment, since set_rate() can start training.
> 
> [...]

Applied, thanks!

[1/1] memory: tegra: Shut down Tegra210 EMC timers before teardown
      https://git.kernel.org/krzk/linux-mem-ctrl/c/394c350a34b77f1bb065b675d356ab55b6462ed8

Best regards,
-- 
Krzysztof Kozlowski <krzk@kernel.org>