mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-07-26 11:54:30 -04:00
2e05f3d600
tegra186_emc_interconnect_init() copies the MC's ICC aggregate hook into the EMC provider. That hook (tegra234_mc_icc_aggregate / tegra264_mc_icc_aggregate) uses container_of() to recover 'mc', which is only valid when the icc_provider is embedded in struct tegra_mc. For an EMC node the provider is embedded in struct tegra186_emc, so 'mc' points into unrelated memory. This stayed harmless until commitfaafd6ca7e("memory: tegra: make icc_set_bw return zero if BWMGR not supported") added an unconditional read of mc->bwmgr_mrq_supported at the top of the hook. UBSAN catches the stray load on every EMC aggregation: UBSAN: invalid-load in drivers/memory/tegra/tegra234.c:1104:9 load of value 112 is not a valid value for type '_Bool' No functional impact in practice, since the hook's only other mc dereference (mc->num_channels) sits inside a TEGRA_ICC_MC_CPU_CLUSTER* branch that EMC nodes never enter. Fix this by setting the EMC provider's aggregate hook to icc_std_aggregate, instead of borrowing the MC's hook. The MC providers continue using their own aggregate hooks, where container_of() correctly resolves to struct tegra_mc. Reported-by: Jon Hunter <jonathanh@nvidia.com> Fixes:9a38cb2766("memory: tegra: Add interconnect support for DRAM scaling in Tegra234") Signed-off-by: Sumit Gupta <sumitg@nvidia.com> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260527140127.49172-2-sumitg@nvidia.com Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>