greybus-dev July 2026

greybus-dev@lists.linaro.org

21 participants
22 discussions

[PATCH] greybus: manifest: validate string descriptor header

by Pengpeng Hou

identify_descriptor() computes a string descriptor size from desc->string.length. Require the descriptor to contain the fixed string descriptor header before reading the variable string length. The existing descriptor-size check then reports the short descriptor. Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> --- drivers/greybus/manifest.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/greybus/manifest.c b/drivers/greybus/manifest.c index 9be5d95da587..3b685ace2036 100644 --- a/drivers/greybus/manifest.c +++ b/drivers/greybus/manifest.c @@ -122,6 +122,8 @@ static int identify_descriptor(struct gb_interface *intf, switch (desc_header->type) { case GREYBUS_TYPE_STRING: expected_size += sizeof(struct greybus_descriptor_string); + if (desc_size < expected_size) + break; expected_size += desc->string.length; /* String descriptors are padded to 4 byte boundaries */ -- 2.43.0

1 month

[PATCH] staging: greybus: bootrom: power off module on timeout

by adi25charis＠gmail.com

From: Aditya Chari S <adi25charis(a)gmail.com> Previously, when a firmware size request, get firmware request, or ready-to-boot request from a module timed out, the driver would log an error and free any firmware buffer, but left the module powered on in a potentially inconsistent state. Fix this by ejecting the module's interface via the SVC when a timeout occurs, forcing it to be power-cycled and re-detected rather than left in limbo. Signed-off-by: Aditya Chari S <adi25charis(a)gmail.com> --- drivers/staging/greybus/bootrom.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index 83921d90c..b564d2255 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -54,8 +54,12 @@ static void gb_bootrom_timedout(struct work_struct *work) struct delayed_work *dwork = to_delayed_work(work); struct gb_bootrom *bootrom = container_of(dwork, struct gb_bootrom, dwork); - struct device *dev = &bootrom->connection->bundle->dev; + struct gb_connection *connection = bootrom->connection; + struct device *dev = &connection->bundle->dev; + struct gb_interface *intf = connection->bundle->intf; + struct gb_svc *svc = connection->hd->svc; const char *reason; + int ret; switch (bootrom->next_request) { case NEXT_REQ_FIRMWARE_SIZE: @@ -82,7 +86,11 @@ static void gb_bootrom_timedout(struct work_struct *work) free_firmware(bootrom); mutex_unlock(&bootrom->mutex); - /* TODO: Power-off Module ? */ + /* Power-off Module */ + ret = gb_svc_intf_eject(svc, intf->interface_id); + if (ret) + dev_err(dev, "failed to eject interface %u (%d)\n", + intf->interface_id, ret); } static void gb_bootrom_set_timeout(struct gb_bootrom *bootrom, -- 2.53.0

1 month, 1 week

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev July 2026