greybus-dev

greybus-dev@lists.linaro.org

19 participants
781 discussions

[PATCH] Greybus audio protocols drivers: correct sscanf() return value check

by Alexander A. Klimov

manager_sysfs_add_store() passes 6 pointers to sscanf(), but required latter to return 7 which always failed the operation. I corrected it to 6. Signed-off-by: Alexander A. Klimov <grandmaster(a)al2klimov.de> --- drivers/staging/greybus/audio_manager_sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/audio_manager_sysfs.c b/drivers/staging/greybus/audio_manager_sysfs.c index fcd518f954..ff323ca815 100644 --- a/drivers/staging/greybus/audio_manager_sysfs.c +++ b/drivers/staging/greybus/audio_manager_sysfs.c @@ -23,7 +23,7 @@ static ssize_t manager_sysfs_add_store(struct kobject *kobj, desc.name, &desc.vid, &desc.pid, &desc.intf_id, &desc.ip_devices, &desc.op_devices); - if (num != 7) + if (num != 6) return -EINVAL; num = gb_audio_manager_add(&desc); -- 2.54.0

2 weeks, 2 days

[PATCH v1] greybus: authentication: validate CAP response payload size

by Muhammad Bilal

cap_get_ims_certificate() and cap_authenticate() copy variable-length response data directly into fixed-size UAPI buffers using the untrusted op->response->payload_size value without any bounds checks. A malicious or compromised Greybus endpoint can return an oversized certificate or signature payload, causing a kernel heap overflow. Fix both functions by: - Rejecting responses shorter than sizeof(*response) with -EPROTO. - Rejecting payloads exceeding CAP_CERTIFICATE_MAX_SIZE (1600) or CAP_SIGNATURE_MAX_SIZE (320) with -EMSGSIZE. - Copying only the validated size into the UAPI buffer. Fixes: e3eda54d0b5f ("greybus: Add Component Authentication Protocol support") Signed-off-by: Muhammad Bilal <meatuni001(a)gmail.com> --- drivers/staging/greybus/authentication.c | 34 +++++++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/drivers/staging/greybus/authentication.c b/drivers/staging/greybus/authentication.c index 97b9937bb..103cc15d2 100644 --- a/drivers/staging/greybus/authentication.c +++ b/drivers/staging/greybus/authentication.c @@ -109,6 +109,7 @@ static int cap_get_ims_certificate(struct gb_cap *cap, u32 class, u32 id, struct gb_cap_get_ims_certificate_request *request; struct gb_cap_get_ims_certificate_response *response; size_t max_size = gb_operation_get_payload_size_max(connection); + size_t cert_size; struct gb_operation *op; int ret; @@ -131,9 +132,21 @@ static int cap_get_ims_certificate(struct gb_cap *cap, u32 class, u32 id, } response = op->response->payload; + + if (op->response->payload_size < sizeof(*response)) { + ret = -EPROTO; + goto done; + } + + cert_size = op->response->payload_size - sizeof(*response); + if (cert_size > CAP_CERTIFICATE_MAX_SIZE) { + ret = -EMSGSIZE; + goto done; + } + *result = response->result_code; - *size = op->response->payload_size - sizeof(*response); - memcpy(certificate, response->certificate, *size); + *size = (u32)cert_size; + memcpy(certificate, response->certificate, cert_size); done: gb_operation_put(op); @@ -148,6 +161,7 @@ static int cap_authenticate(struct gb_cap *cap, u32 auth_type, u8 *uid, struct gb_cap_authenticate_request *request; struct gb_cap_authenticate_response *response; size_t max_size = gb_operation_get_payload_size_max(connection); + size_t sig_size; struct gb_operation *op; int ret; @@ -170,10 +184,22 @@ static int cap_authenticate(struct gb_cap *cap, u32 auth_type, u8 *uid, } response = op->response->payload; + + if (op->response->payload_size < sizeof(*response)) { + ret = -EPROTO; + goto done; + } + + sig_size = op->response->payload_size - sizeof(*response); + if (sig_size > CAP_SIGNATURE_MAX_SIZE) { + ret = -EMSGSIZE; + goto done; + } + *result = response->result_code; - *signature_size = op->response->payload_size - sizeof(*response); + *signature_size = (u32)sig_size; memcpy(auth_response, response->response, sizeof(response->response)); - memcpy(signature, response->signature, *signature_size); + memcpy(signature, response->signature, sig_size); done: gb_operation_put(op); -- 2.54.0

2 weeks, 3 days

[PATCH] staging: greybus: split gb_audio_gb_get_topology()

by Khaled Saleh

Split gb_audio_gb_get_topology() into smaller helper functions to improve readability and maintainability. No functional change intended. Signed-off-by: Khaled Saleh <khaled.saleh.req(a)gmail.com> --- drivers/staging/greybus/audio_gb.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/drivers/staging/greybus/audio_gb.c b/drivers/staging/greybus/audio_gb.c index 9d8994fdb41a..b5ead09532c8 100644 --- a/drivers/staging/greybus/audio_gb.c +++ b/drivers/staging/greybus/audio_gb.c @@ -8,13 +8,10 @@ #include <linux/greybus.h> #include "audio_codec.h" -/* TODO: Split into separate calls */ -int gb_audio_gb_get_topology(struct gb_connection *connection, - struct gb_audio_topology **topology) +static int gb_audio_gb_get_topology_size(struct gb_connection *connection, + u16 *size) { struct gb_audio_get_topology_size_response size_resp; - struct gb_audio_topology *topo; - u16 size; int ret; ret = gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY_SIZE, @@ -22,10 +19,24 @@ int gb_audio_gb_get_topology(struct gb_connection *connection, if (ret) return ret; - size = le16_to_cpu(size_resp.size); - if (size < sizeof(*topo)) + *size = le16_to_cpu(size_resp.size); + if (*size < sizeof(struct gb_audio_topology)) return -ENODATA; + return 0; +} + +int gb_audio_gb_get_topology(struct gb_connection *connection, + struct gb_audio_topology **topology) +{ + struct gb_audio_topology *topo; + u16 size; + int ret; + + ret = gb_audio_gb_get_topology_size(connection, &size); + if (ret) + return ret; + topo = kzalloc(size, GFP_KERNEL); if (!topo) return -ENOMEM; -- 2.34.1

2 weeks, 3 days

[PATCH v3] staging: greybus: bootrom: replace dev_info with dev_dbg for firmware name

by Bentley Blacketer

The original dev_info call was intentionally temporary, with a FIXME comment noting it should be downgraded to dev_dbg once modules with valid VID/PID values were common. Project Ara was cancelled in 2016, so that time has long passed. Remove the FIXME comment and downgrade to dev_dbg as originally intended. Tested via code inspection only, as Project Ara hardware is no longer available. Signed-off-by: Bentley Blacketer <sonionwhat(a)gmail.com> Signed-off-by: Bentley Blacketer <sonionwhat(a)gmail.com> --- drivers/staging/greybus/bootrom.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index 83921d90c..058044ba7 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -163,18 +163,13 @@ static int find_firmware(struct gb_bootrom *bootrom, u8 stage) * * XXX Name it properly.. */ - snprintf(firmware_name, sizeof(firmware_name), +snprintf(firmware_name, sizeof(firmware_name), FW_NAME_PREFIX "%08x_%08x_%08x_%08x_s2l.tftf", intf->ddbl1_manufacturer_id, intf->ddbl1_product_id, intf->vendor_id, intf->product_id); - // FIXME: - // Turn to dev_dbg later after everyone has valid bootloaders with good - // ids, but leave this as dev_info for now to make it easier to track - // down "empty" vid/pid modules. - dev_info(&connection->bundle->dev, "Firmware file '%s' requested\n", + dev_dbg(&connection->bundle->dev, "Firmware file '%s' requested\n", firmware_name); - rc = request_firmware(&bootrom->fw, firmware_name, &connection->bundle->dev); if (rc) { -- 2.54.0

3 weeks, 2 days

[PATCH] staging: greybus: add missing newline to sysfs_emit

by Ajith P V

The sysfs attribute is missing a terminating newline. According to the kernel documentation for sysfs, attributes should be terminated by a newline to follow standard userspace conventions. Fix the formatting by adding a '\n' to the sysfs_emit string. This resolves the checkpatch warning: "return sysfs_emit(...) formats should include a terminating newline" Signed-off-by: Ajith P V <ajithpv.linux(a)gmail.com> --- drivers/staging/greybus/audio_manager_module.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2308..5737f2a32f5a 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute -- 2.43.0

3 weeks, 3 days

[PATCH v2] staging: greybus:add missing newline in sysfs show() output

by Shyam Sunder Reddy Padira

Sysfs show() functions should return newline-terminated strings.Add missing newline to sysfs_emit() format string. Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> ---- v2: -Remove "no functional changes" from the description as per Greg's feedback. --- drivers/staging/greybus/audio_manager_module.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2308..5737f2a32f5a 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute -- 2.43.0

3 weeks, 5 days

[PATCH] staging: greybus:add missing newline in sysfs show() output

by Shyam Sunder Reddy Padira

Sysfs show() functions should return newline-terminated strings.Add missing newline to sysfs_emit() format string. No functional changes. Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> --- drivers/staging/greybus/audio_manager_module.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2308..5737f2a32f5a 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute -- 2.43.0

3 weeks, 6 days

[PATCH v4] staging: greybus: bootrom: replace dev_info with dev_dbg for firmware name

by Bentley Blacketer

The original dev_info call was intentionally temporary, with a FIXME comment noting it should be downgraded to dev_dbg once modules with valid VID/PID values were common. Project Ara was cancelled in 2016, so that time has long passed. Remove the FIXME comment and downgrade to dev_dbg as originally intended. Tested via code inspection only, as Project Ara hardware is no longer available. Signed-off-by: Bentley Blacketer <sonionwhat(a)gmail.com> --- Changes in v4: - Fixed duplicate Signed-off-by - Fixed missing tab on snprintf line Changes in v3: - Fixed author name mismatch Changes in v2: - Fixed whitespace issues - Moved testing note below --- line drivers/staging/greybus/bootrom.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index 83921d90c..9e0f24d6d 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -168,13 +168,8 @@ static int find_firmware(struct gb_bootrom *bootrom, u8 stage) intf->ddbl1_manufacturer_id, intf->ddbl1_product_id, intf->vendor_id, intf->product_id); - // FIXME: - // Turn to dev_dbg later after everyone has valid bootloaders with good - // ids, but leave this as dev_info for now to make it easier to track - // down "empty" vid/pid modules. - dev_info(&connection->bundle->dev, "Firmware file '%s' requested\n", + dev_dbg(&connection->bundle->dev, "Firmware file '%s' requested\n", firmware_name); - rc = request_firmware(&bootrom->fw, firmware_name, &connection->bundle->dev); if (rc) { -- 2.54.0

3 weeks, 6 days

[PATCH v2] staging: greybus: bootrom: replace dev_info with dev_dbg for firmware name

by kernelcoredev

The original dev_info call was intentionally temporary, with a FIXME comment noting it should be downgraded to dev_dbg once modules with valid VID/PID values were common. Project Ara was cancelled in 2016, so that time has long passed. Remove the FIXME comment and downgrade to dev_dbg as originally intended. Tested via code inspection only, as Project Ara hardware is no longer available. Signed-off-by: Bentley Blacketer <sonionwhat(a)gmail.com> --- drivers/staging/greybus/bootrom.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index 83921d90c..058044ba7 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -163,18 +163,13 @@ static int find_firmware(struct gb_bootrom *bootrom, u8 stage) * * XXX Name it properly.. */ - snprintf(firmware_name, sizeof(firmware_name), +snprintf(firmware_name, sizeof(firmware_name), FW_NAME_PREFIX "%08x_%08x_%08x_%08x_s2l.tftf", intf->ddbl1_manufacturer_id, intf->ddbl1_product_id, intf->vendor_id, intf->product_id); - // FIXME: - // Turn to dev_dbg later after everyone has valid bootloaders with good - // ids, but leave this as dev_info for now to make it easier to track - // down "empty" vid/pid modules. - dev_info(&connection->bundle->dev, "Firmware file '%s' requested\n", + dev_dbg(&connection->bundle->dev, "Firmware file '%s' requested\n", firmware_name); - rc = request_firmware(&bootrom->fw, firmware_name, &connection->bundle->dev); if (rc) { -- 2.54.0

4 weeks

[PATCH] staging: greybus: bootrom: replace dev_info with dev_dbg for firmware name

by kernelcoredev

The original dev_info call was intentionally temporary, with a FIXME comment noting it should be downgraded to dev_dbg once modules with valid VID/PID values were common. Project Ara was cancelled in 2016, so that time has long passed. Remove the FIXME comment and downgrade to dev_dbg as originally intended. Tested via code inspection only, as Project Ara hardware is no longer available. Signed-off-by: Bentley Blacketer <sonionwhat(a)gmail.com> --- drivers/staging/greybus/bootrom.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index 83921d90c..757460c8b 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -168,12 +168,9 @@ static int find_firmware(struct gb_bootrom *bootrom, u8 stage) intf->ddbl1_manufacturer_id, intf->ddbl1_product_id, intf->vendor_id, intf->product_id); - // FIXME: - // Turn to dev_dbg later after everyone has valid bootloaders with good - // ids, but leave this as dev_info for now to make it easier to track - // down "empty" vid/pid modules. - dev_info(&connection->bundle->dev, "Firmware file '%s' requested\n", - firmware_name); + + dev_dbg(&connection->bundle->dev, "Firmware file '%s' requested\n", + firmware_name); rc = request_firmware(&bootrom->fw, firmware_name, &connection->bundle->dev); -- 2.54.0

4 weeks

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev