greybus-dev July 2026

greybus-dev@lists.linaro.org

21 participants
22 discussions

[PATCH] staging: greybus: fix coccinelle false positive on potential NULL dereference

by Pei Xiao

In gb_bootrom_get_firmware(), when fw is NULL, ret is already set to ERRNO before jumping to the queue_work label, so !ret is always false and fw->size is never dereferenced. Add an explicit NULL check to silence a coccinelle false positive warning. Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> --- drivers/staging/greybus/bootrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index 83921d90c322..50c80475d241 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -298,7 +298,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op) queue_work: /* Refresh timeout */ - if (!ret && (offset + size == fw->size)) + if (!ret && fw && (offset + size == fw->size)) next_request = NEXT_REQ_READY_TO_BOOT; else next_request = NEXT_REQ_GET_FIRMWARE; -- 2.25.1

1 week, 1 day

[PATCH] staging: greybus: light: fix leak of cdev->name

by Cong Nguyen

gb_lights_channel_config() builds the LED classdev name with kasprintf() and stores it in cdev->name for every channel during the configuration phase, which runs before the channel is registered. That name was only released by __gb_lights_led_unregister(), i.e. only for a normal LED channel that was actually registered. It was therefore leaked in two cases: - a channel that is configured but never registered, e.g. channel_attr_groups_set() fails, the flash configuration fails, or a later channel in the same light fails to configure and the whole light is torn down; the release path calls gb_lights_channel_unregister() (which returns early because the channel is not registered) and then gb_lights_channel_free(); - a flash, torch or indicator channel, whose unregister path (__gb_lights_flash_led_unregister()) never releases cdev->name at all, so the name leaks even on a successful teardown. cdev->name is a configuration-phase allocation, like channel->color_name and channel->mode_name. Free it in gb_lights_channel_free() next to those, since that runs unconditionally on every teardown path, and drop the special case free from __gb_lights_led_unregister(). gb_lights_channel_unregister() is only ever called from gb_lights_channel_release(), immediately followed by gb_lights_channel_free(), so the name is still released on the registered path and is freed exactly once. Commit 04820da21050 ("staging: greybus: light: Release memory obtained by kasprintf") fixed the leak for the registered normal-LED path only; this covers the remaining cases. Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") Signed-off-by: Cong Nguyen <congnt264(a)gmail.com> --- drivers/staging/greybus/light.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index cab02b5da867..1ecca479b5f4 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -905,8 +905,6 @@ static void __gb_lights_led_unregister(struct gb_channel *channel) return; led_classdev_unregister(cdev); - kfree(cdev->name); - cdev->name = NULL; channel->led = NULL; } @@ -1063,6 +1061,9 @@ static int gb_lights_light_register(struct gb_light *light) static void gb_lights_channel_free(struct gb_channel *channel) { + struct led_classdev *cdev = get_channel_cdev(channel); + + kfree(cdev->name); kfree(channel->attrs); kfree(channel->attr_group); kfree(channel->attr_groups); -- 2.25.1

1 week, 2 days

[PATCH] staging: greybus: raw: add comment for list_lock mutex

by Mirza Ishan Beg

Add a comment for list_lock mutex to document what it protects, fixing the following checkpatch warning: CHECK: struct mutex definition without comment Signed-off-by: Mirza Ishan Beg <seedandsyntax(a)gmail.com> --- drivers/staging/greybus/raw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/raw.c b/drivers/staging/greybus/raw.c index 459aed0f1240..17c88778c30c 100644 --- a/drivers/staging/greybus/raw.c +++ b/drivers/staging/greybus/raw.c @@ -20,7 +20,7 @@ struct gb_raw { struct list_head list; int list_data; - struct mutex list_lock; + struct mutex list_lock; /* protect list and list_data */ struct rw_semaphore disconnect_lock; bool disconnected; struct cdev cdev; -- 2.47.3

1 week, 3 days

[PATCH] staging: greybus: audio_manager: add missing newline in sysfs_emit

by Joyeta Modak

sysfs should return a newline at the end of the output buffer. The missing '\n' is added to all sysfs_emit() calls in audio_manager_module.c to follow the sysfs convention in Documentation/ filesystems/sysfs.rst Found using ./scripts/checkpatch.pl --strict Signed-off-by: Joyeta Modak <joyetamdk(a)gmail.com> --- drivers/staging/greybus/audio_manager_module.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2308..5737f2a32f5a 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute -- 2.53.0

2 weeks

[PATCH] greybus: audio_manager: fix sysfs_emit newline and const warnings

by Shivesh

From 5e0bcb4920bcb9e0ef6c03a91730fe45f643f3a4 Mon Sep 17 00:00:00 2001 From: Shivesh <shivesh(a)example.com> Date: Sat, 25 Jul 2026 13:44:36 +0000 Subject: [PATCH] greybus: audio_manager: fix sysfs_emit newline and const warnings Add terminating newlines to sysfs_emit() format strings as required by the kernel sysfs convention. Also make envp[] array const to fix checkpatch warning about char* array declaration. Signed-off-by: Shivesh <chanelshivesh(a)gmail.com> Signed-off-by: Shivesh <shivesh(a)example.com> --- drivers/staging/greybus/audio_manager_module.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2308..74ea495e1c19 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute @@ -158,7 +158,7 @@ static void send_add_uevent(struct gb_audio_manager_module *module) char ip_devices_string[64]; char op_devices_string[64]; - char *envp[] = { + const char *const envp[] = { name_string, vid_string, pid_string, -- 2.53.0

2 weeks

[PATCH v2 0/3] Bring includes in linux/kmod.h up to date

by Petr Pavlu

The usermode helper declarations were previously provided by linux/kmod.h but commit c1f3fa2a4fde ("kmod: split off umh headers into its own file") moved them to linux/umh.h in 2017. Add explicit includes of linux/umh.h to files that use usermode helpers and remove linux/kmod.h where it is no longer needed. Also add a missing include of linux/sysctl.h to kernel/time/jiffies.c. Finally, clean up linux/kmod.h so that it includes only the headers that it actually requires, importantly removing the compat linux/umh.h include. This cleanup is motivated by trying to reduce the preprocessed size of linux/module.h, which includes linux/kmod.h. The linux/module.h header is included by every *.mod.c file to provide `struct module` and other related definitions, so it should avoid pulling in unnecessary dependencies. Note that this series doesn't immediately improve the situation, since most of the files included by linux/kmod.h are, for now, also included by linux/module.h through other paths. Apologies for the wide distribution. Acked-bys are appreciated. Changes in v2: - Remove the linux/kmod.h include from kernel/cgroup/cgroup-v1.c. - Add a missing include of linux/sysctl.h to kernel/time/jiffies.c. - Link to v1: https://lore.kernel.org/linux-modules/20260708154510.6794-1-petr.pavlu@suse… Petr Pavlu (3): umh, treewide: Explicitly include linux/umh.h where needed time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ... module: Bring includes in linux/kmod.h up to date arch/x86/kernel/cpu/mce/dev-mcelog.c | 2 +- drivers/block/drbd/drbd_nl.c | 1 + drivers/greybus/svc_watchdog.c | 1 + drivers/macintosh/windfarm_core.c | 1 + drivers/pnp/pnpbios/core.c | 2 +- drivers/video/fbdev/uvesafb.c | 1 + fs/coredump.c | 2 +- fs/nfs/cache_lib.c | 2 +- fs/nfsd/nfs4layouts.c | 2 +- fs/nfsd/nfs4recover.c | 1 + fs/ocfs2/stackglue.c | 1 + include/linux/kmod.h | 12 ++---------- kernel/cgroup/cgroup-v1.c | 2 +- kernel/module/kmod.c | 1 + kernel/power/process.c | 2 +- kernel/reboot.c | 2 +- kernel/time/jiffies.c | 1 + kernel/umh.c | 2 +- lib/kobject_uevent.c | 2 +- net/bridge/br_stp_if.c | 2 +- security/keys/request_key.c | 2 +- security/tomoyo/common.h | 2 +- 22 files changed, 23 insertions(+), 23 deletions(-) -- 2.54.0

2 weeks

[PATCH v4] greybus: audio: Split gb_audio_gb_get_topology() into size query and data fetch

by Aditya Chari

`gb_audio_gb_get_topology()` combined three separate responsibilities into a single call: querying the topology size, allocating a buffer for it, and fetching the topology data into that buffer. This left callers with no way to perform any of these steps independently, and forced the kzalloc() allocation to live inside the protocol‑layer driver rather than the caller, as already flagged by a FIXME comment at the call site in `audio_module.c`. Split the function into two: - `gb_audio_gb_get_topology_size()` – queries only the topology size - `gb_audio_gb_get_topology()` – fetches topology data into a caller‑supplied buffer of a given size Update the only caller, `gb_audio_probe()` in `audio_module.c`, to query the size first, allocate the topology buffer itself, then fetch the data into it, freeing the buffer via the existing `free_topology` error path on failure. The topology size is now stored as `size_t` and validated in the caller before allocation, addressing the earlier TODO and FIXME comments. This resolves both the "TODO: Split into separate calls" comment above the original function in `audio_gb.c` and the FIXME comment at the call site in `audio_module.c`, both of which are removed as part of this change. No functional change in behavior for the existing probe path. Signed-off-by: Aditya Chari S <adi25charis(a)gmail.com> Reviewed-by: Dan Carpenter <error27(a)gmail.com> --- v4: - Reorder tags (Signed-off-by before Reviewed-by) as suggested by Dan. v3: - Rebased against latest staging-next. v2: - Fold in review feedback from Dan Carpenter. - Store topology size as size_t instead of u16. - Move topology size validation into gb_audio_probe() before kzalloc(). - Use -EINVAL for invalid topology size. - Drop unrelated dev_err() formatting cleanup. - Compile-tested with `make M=drivers/staging/greybus`. - Run checkpatch.pl on the updated patch; no issues reported. --- drivers/staging/greybus/audio_codec.h | 4 ++- drivers/staging/greybus/audio_gb.c | 45 +++++++------------------- drivers/staging/greybus/audio_module.c | 27 ++++++++++++---- 3 files changed, 35 insertions(+), 41 deletions(-) diff --git a/drivers/staging/greybus/audio_codec.h b/drivers/staging/greybus/audio_codec.h index f3f7a7ec6..b45cd257d 100644 --- a/drivers/staging/greybus/audio_codec.h +++ b/drivers/staging/greybus/audio_codec.h @@ -178,8 +178,10 @@ int gbaudio_register_module(struct gbaudio_module_info *module); void gbaudio_unregister_module(struct gbaudio_module_info *module); /* protocol related */ +int gb_audio_gb_get_topology_size(struct gb_connection *connection, + size_t *size); int gb_audio_gb_get_topology(struct gb_connection *connection, - struct gb_audio_topology **topology); + struct gb_audio_topology *topology, size_t size); int gb_audio_gb_get_control(struct gb_connection *connection, u8 control_id, u8 index, struct gb_audio_ctl_elem_value *value); diff --git a/drivers/staging/greybus/audio_gb.c b/drivers/staging/greybus/audio_gb.c index 144591f1a..2e6f155d8 100644 --- a/drivers/staging/greybus/audio_gb.c +++ b/drivers/staging/greybus/audio_gb.c @@ -8,13 +8,10 @@ #include <linux/greybus.h> #include "audio_codec.h" -/* TODO: Split into separate calls */ -int gb_audio_gb_get_topology(struct gb_connection *connection, - struct gb_audio_topology **topology) +int gb_audio_gb_get_topology_size(struct gb_connection *connection, + size_t *size) { struct gb_audio_get_topology_size_response size_resp; - struct gb_audio_topology *topo; - u16 size; int ret; ret = gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY_SIZE, @@ -22,38 +19,18 @@ int gb_audio_gb_get_topology(struct gb_connection *connection, if (ret) return ret; - size = le16_to_cpu(size_resp.size); - if (size < sizeof(*topo)) - return -ENODATA; - - topo = kzalloc(size, GFP_KERNEL); - if (!topo) - return -ENOMEM; - - ret = gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY, NULL, 0, - topo, size); - if (ret) { - kfree(topo); - return ret; - } - - /* - * The size_* fields are supplied by the module and are used by - * gbaudio_tplg_parse_data() to compute offsets into the blob; make - * sure the sections fit within the fetched topology, so walking it - * cannot read out of bounds. - */ - if ((u64)le32_to_cpu(topo->size_dais) + le32_to_cpu(topo->size_controls) + - le32_to_cpu(topo->size_widgets) + le32_to_cpu(topo->size_routes) > - size - sizeof(*topo)) { - kfree(topo); - return -EINVAL; - } - - *topology = topo; + *size = le16_to_cpu(size_resp.size); return 0; } +EXPORT_SYMBOL_GPL(gb_audio_gb_get_topology_size); + +int gb_audio_gb_get_topology(struct gb_connection *connection, + struct gb_audio_topology *topology, size_t size) +{ + return gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY, NULL, 0, + topology, size); +} EXPORT_SYMBOL_GPL(gb_audio_gb_get_topology); int gb_audio_gb_get_control(struct gb_connection *connection, diff --git a/drivers/staging/greybus/audio_module.c b/drivers/staging/greybus/audio_module.c index 12c376c47..4cd1f42c1 100644 --- a/drivers/staging/greybus/audio_module.c +++ b/drivers/staging/greybus/audio_module.c @@ -239,6 +239,7 @@ static int gb_audio_probe(struct gb_bundle *bundle, struct gb_audio_manager_module_descriptor desc; struct gbaudio_data_connection *dai, *_dai; int ret, i; + size_t size; struct gb_audio_topology *topology; /* There should be at least one Management and one Data cport */ @@ -304,16 +305,30 @@ static int gb_audio_probe(struct gb_bundle *bundle, } gbmodule->dev_id = gbmodule->mgmt_connection->intf->interface_id; - /* - * FIXME: malloc for topology happens via audio_gb driver - * should be done within codec driver itself - */ - ret = gb_audio_gb_get_topology(gbmodule->mgmt_connection, &topology); + ret = gb_audio_gb_get_topology_size(gbmodule->mgmt_connection, &size); if (ret) { - dev_err(dev, "%d:Error while fetching topology\n", ret); + dev_err(dev, "%d:Error while fetching topology size\n", ret); + goto disable_connection; + } + + if (size < sizeof(*topology)) { + dev_err(dev, "Invalid topology size: %zu\n", size); + ret = -EINVAL; goto disable_connection; } + topology = kzalloc(size, GFP_KERNEL); + if (!topology) { + ret = -ENOMEM; + goto disable_connection; + } + + ret = gb_audio_gb_get_topology(gbmodule->mgmt_connection, topology, size); + if (ret) { + dev_err(dev, "%d:Error while fetching topology\n", ret); + goto free_topology; + } + /* process topology data */ ret = gbaudio_tplg_parse_data(gbmodule, topology); if (ret) { -- 2.53.0

2 weeks, 2 days

[PATCH v3] greybus: audio: Split gb_audio_gb_get_topology() into size query and data fetch

by Aditya Chari

`gb_audio_gb_get_topology()` combined three separate responsibilities into a single call: querying the topology size, allocating a buffer for it, and fetching the topology data into that buffer. This left callers with no way to perform any of these steps independently, and forced the kzalloc() allocation to live inside the protocol‑layer driver rather than the caller, as already flagged by a FIXME comment at the call site in `audio_module.c`. Split the function into two: - `gb_audio_gb_get_topology_size()` – queries only the topology size - `gb_audio_gb_get_topology()` – fetches topology data into a caller‑supplied buffer of a given size Update the only caller, `gb_audio_probe()` in `audio_module.c`, to query the size first, allocate the topology buffer itself, then fetch the data into it, freeing the buffer via the existing `free_topology` error path on failure. The topology size is now stored as `size_t` and validated in the caller before allocation, addressing the earlier TODO and FIXME comments. This resolves both the "TODO: Split into separate calls" comment above the original function in `audio_gb.c` and the FIXME comment at the call site in `audio_module.c`, both of which are removed as part of this change. No functional change in behavior for the existing probe path. Reviewed-by: Dan Carpenter <error27(a)gmail.com> Signed-off-by: Aditya Chari <adi25charis(a)gmail.com> --- drivers/staging/greybus/audio_codec.h | 4 ++- drivers/staging/greybus/audio_gb.c | 45 +++++++------------------- drivers/staging/greybus/audio_module.c | 27 ++++++++++++---- 3 files changed, 35 insertions(+), 41 deletions(-) diff --git a/drivers/staging/greybus/audio_codec.h b/drivers/staging/greybus/audio_codec.h index f3f7a7ec6..b45cd257d 100644 --- a/drivers/staging/greybus/audio_codec.h +++ b/drivers/staging/greybus/audio_codec.h @@ -178,8 +178,10 @@ int gbaudio_register_module(struct gbaudio_module_info *module); void gbaudio_unregister_module(struct gbaudio_module_info *module); /* protocol related */ +int gb_audio_gb_get_topology_size(struct gb_connection *connection, + size_t *size); int gb_audio_gb_get_topology(struct gb_connection *connection, - struct gb_audio_topology **topology); + struct gb_audio_topology *topology, size_t size); int gb_audio_gb_get_control(struct gb_connection *connection, u8 control_id, u8 index, struct gb_audio_ctl_elem_value *value); diff --git a/drivers/staging/greybus/audio_gb.c b/drivers/staging/greybus/audio_gb.c index 144591f1a..2e6f155d8 100644 --- a/drivers/staging/greybus/audio_gb.c +++ b/drivers/staging/greybus/audio_gb.c @@ -8,13 +8,10 @@ #include <linux/greybus.h> #include "audio_codec.h" -/* TODO: Split into separate calls */ -int gb_audio_gb_get_topology(struct gb_connection *connection, - struct gb_audio_topology **topology) +int gb_audio_gb_get_topology_size(struct gb_connection *connection, + size_t *size) { struct gb_audio_get_topology_size_response size_resp; - struct gb_audio_topology *topo; - u16 size; int ret; ret = gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY_SIZE, @@ -22,38 +19,18 @@ int gb_audio_gb_get_topology(struct gb_connection *connection, if (ret) return ret; - size = le16_to_cpu(size_resp.size); - if (size < sizeof(*topo)) - return -ENODATA; - - topo = kzalloc(size, GFP_KERNEL); - if (!topo) - return -ENOMEM; - - ret = gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY, NULL, 0, - topo, size); - if (ret) { - kfree(topo); - return ret; - } - - /* - * The size_* fields are supplied by the module and are used by - * gbaudio_tplg_parse_data() to compute offsets into the blob; make - * sure the sections fit within the fetched topology, so walking it - * cannot read out of bounds. - */ - if ((u64)le32_to_cpu(topo->size_dais) + le32_to_cpu(topo->size_controls) + - le32_to_cpu(topo->size_widgets) + le32_to_cpu(topo->size_routes) > - size - sizeof(*topo)) { - kfree(topo); - return -EINVAL; - } - - *topology = topo; + *size = le16_to_cpu(size_resp.size); return 0; } +EXPORT_SYMBOL_GPL(gb_audio_gb_get_topology_size); + +int gb_audio_gb_get_topology(struct gb_connection *connection, + struct gb_audio_topology *topology, size_t size) +{ + return gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY, NULL, 0, + topology, size); +} EXPORT_SYMBOL_GPL(gb_audio_gb_get_topology); int gb_audio_gb_get_control(struct gb_connection *connection, diff --git a/drivers/staging/greybus/audio_module.c b/drivers/staging/greybus/audio_module.c index 12c376c47..4cd1f42c1 100644 --- a/drivers/staging/greybus/audio_module.c +++ b/drivers/staging/greybus/audio_module.c @@ -239,6 +239,7 @@ static int gb_audio_probe(struct gb_bundle *bundle, struct gb_audio_manager_module_descriptor desc; struct gbaudio_data_connection *dai, *_dai; int ret, i; + size_t size; struct gb_audio_topology *topology; /* There should be at least one Management and one Data cport */ @@ -304,16 +305,30 @@ static int gb_audio_probe(struct gb_bundle *bundle, } gbmodule->dev_id = gbmodule->mgmt_connection->intf->interface_id; - /* - * FIXME: malloc for topology happens via audio_gb driver - * should be done within codec driver itself - */ - ret = gb_audio_gb_get_topology(gbmodule->mgmt_connection, &topology); + ret = gb_audio_gb_get_topology_size(gbmodule->mgmt_connection, &size); if (ret) { - dev_err(dev, "%d:Error while fetching topology\n", ret); + dev_err(dev, "%d:Error while fetching topology size\n", ret); + goto disable_connection; + } + + if (size < sizeof(*topology)) { + dev_err(dev, "Invalid topology size: %zu\n", size); + ret = -EINVAL; goto disable_connection; } + topology = kzalloc(size, GFP_KERNEL); + if (!topology) { + ret = -ENOMEM; + goto disable_connection; + } + + ret = gb_audio_gb_get_topology(gbmodule->mgmt_connection, topology, size); + if (ret) { + dev_err(dev, "%d:Error while fetching topology\n", ret); + goto free_topology; + } + /* process topology data */ ret = gbaudio_tplg_parse_data(gbmodule, topology); if (ret) { -- 2.53.0

2 weeks, 2 days

[PATCH 0/7] staging: Remove redundant error messages on IRQ request failure

by Pan Chuang

devm_request_threaded_irq() and devm_request_any_context_irq() automatically log detailed error messages on failure via the devm_request_result() helper, which prints device name, IRQ number, handler functions, and error code. Since devm_request_irq() is a static inline wrapper around devm_request_threaded_irq(), it also benefits from this automatic logging. Remove the now-redundant dev_err() and dev_err_probe() calls in staging drivers that follow these devm_request_*_irq() functions, as the core now provides more detailed diagnostic information on failure. Pan Chuang (7): staging: axis-fifo: Remove redundant dev_err() staging: fbtft: Remove redundant dev_err_probe() staging: greybus: arche-platform: Remove redundant dev_err() staging: iio: adt7316: Remove redundant dev_err() media: atomisp: Remove redundant dev_err() staging: most: dim2: Remove redundant dev_err() staging: nvec: Remove redundant dev_err_probe() drivers/staging/axis-fifo/axis-fifo.c | 5 +---- drivers/staging/fbtft/fb_st7789v.c | 2 +- drivers/staging/greybus/arche-platform.c | 4 +--- drivers/staging/iio/addac/adt7316.c | 5 +---- drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 4 +--- drivers/staging/most/dim2/dim2.c | 8 ++------ drivers/staging/nvec/nvec.c | 2 +- 7 files changed, 8 insertions(+), 22 deletions(-) -- 2.34.1

3 weeks

[PATCH] staging: greybus: audio: split topology get into size and data calls

by adi25charis＠gmail.com

From: Aditya Chari S <adi25charis(a)gmail.com> gb_audio_gb_get_topology() combined three separate responsibilities into a single call: querying the topology size, allocating a buffer for it, and fetching the topology data into that buffer. This left callers with no way to perform any of these steps independently, and forced the kzalloc() allocation to live inside the protocol-layer driver rather than the caller, as already flagged by a FIXME comment at the call site in audio_module.c. Split the function into two: gb_audio_gb_get_topology_size() - queries only the topology size gb_audio_gb_get_topology() - fetches topology data into a caller-supplied buffer of a given size Update the only caller, gb_audio_probe() in audio_module.c, to query the size first, allocate the topology buffer itself, then fetch the data into it, freeing the buffer via the existing free_topology error path on failure. This resolves both the "TODO: Split into separate calls" comment above the original function in audio_gb.c and the FIXME comment at the call site in audio_module.c, both of which are removed as part of this change. No functional change in behavior for the existing probe path. Compile-tested with W=1, sparse (C=2), and checkpatch.pl; all clean on the three changed files (audio_gb.c, audio_module.c, audio_codec.h). Signed-off-by: Aditya Chari S <adi25charis(a)gmail.com> --- drivers/staging/greybus/audio_codec.h | 4 +++- drivers/staging/greybus/audio_gb.c | 33 ++++++++++---------------- drivers/staging/greybus/audio_module.c | 21 +++++++++++----- 3 files changed, 31 insertions(+), 27 deletions(-) diff --git a/drivers/staging/greybus/audio_codec.h b/drivers/staging/greybus/audio_codec.h index f3f7a7ec6..be5a2a86b 100644 --- a/drivers/staging/greybus/audio_codec.h +++ b/drivers/staging/greybus/audio_codec.h @@ -178,8 +178,10 @@ int gbaudio_register_module(struct gbaudio_module_info *module); void gbaudio_unregister_module(struct gbaudio_module_info *module); /* protocol related */ +int gb_audio_gb_get_topology_size(struct gb_connection *connection, + u16 *size); int gb_audio_gb_get_topology(struct gb_connection *connection, - struct gb_audio_topology **topology); + struct gb_audio_topology *topology, u16 size); int gb_audio_gb_get_control(struct gb_connection *connection, u8 control_id, u8 index, struct gb_audio_ctl_elem_value *value); diff --git a/drivers/staging/greybus/audio_gb.c b/drivers/staging/greybus/audio_gb.c index 9d8994fdb..e6356643d 100644 --- a/drivers/staging/greybus/audio_gb.c +++ b/drivers/staging/greybus/audio_gb.c @@ -8,13 +8,10 @@ #include <linux/greybus.h> #include "audio_codec.h" -/* TODO: Split into separate calls */ -int gb_audio_gb_get_topology(struct gb_connection *connection, - struct gb_audio_topology **topology) +int gb_audio_gb_get_topology_size(struct gb_connection *connection, + u16 *size) { struct gb_audio_get_topology_size_response size_resp; - struct gb_audio_topology *topo; - u16 size; int ret; ret = gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY_SIZE, @@ -22,24 +19,20 @@ int gb_audio_gb_get_topology(struct gb_connection *connection, if (ret) return ret; - size = le16_to_cpu(size_resp.size); - if (size < sizeof(*topo)) - return -ENODATA; - - topo = kzalloc(size, GFP_KERNEL); - if (!topo) - return -ENOMEM; + *size = le16_to_cpu(size_resp.size); - ret = gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY, NULL, 0, - topo, size); - if (ret) { - kfree(topo); - return ret; - } + return 0; +} +EXPORT_SYMBOL_GPL(gb_audio_gb_get_topology_size); - *topology = topo; +int gb_audio_gb_get_topology(struct gb_connection *connection, + struct gb_audio_topology *topology, u16 size) +{ + if (size < sizeof(*topology)) + return -ENODATA; - return 0; + return gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY, NULL, 0, + topology, size); } EXPORT_SYMBOL_GPL(gb_audio_gb_get_topology); diff --git a/drivers/staging/greybus/audio_module.c b/drivers/staging/greybus/audio_module.c index 12c376c47..1163cf093 100644 --- a/drivers/staging/greybus/audio_module.c +++ b/drivers/staging/greybus/audio_module.c @@ -239,6 +239,7 @@ static int gb_audio_probe(struct gb_bundle *bundle, struct gb_audio_manager_module_descriptor desc; struct gbaudio_data_connection *dai, *_dai; int ret, i; + u16 size; struct gb_audio_topology *topology; /* There should be at least one Management and one Data cport */ @@ -304,16 +305,24 @@ static int gb_audio_probe(struct gb_bundle *bundle, } gbmodule->dev_id = gbmodule->mgmt_connection->intf->interface_id; - /* - * FIXME: malloc for topology happens via audio_gb driver - * should be done within codec driver itself - */ - ret = gb_audio_gb_get_topology(gbmodule->mgmt_connection, &topology); + ret = gb_audio_gb_get_topology_size(gbmodule->mgmt_connection, &size); if (ret) { - dev_err(dev, "%d:Error while fetching topology\n", ret); + dev_err(dev, "%d:Error while fetching topology size\n", ret); + goto disable_connection; + } + + topology = kzalloc(size, GFP_KERNEL); + if (!topology) { + ret = -ENOMEM; goto disable_connection; } + ret = gb_audio_gb_get_topology(gbmodule->mgmt_connection, topology, size); + if (ret) { + dev_err(dev, "%d:Error while fetching topology\n", ret); + goto free_topology; + } + /* process topology data */ ret = gbaudio_tplg_parse_data(gbmodule, topology); if (ret) { -- 2.53.0

3 weeks, 2 days

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev July 2026