greybus-dev August 2026

greybus-dev@lists.linaro.org

30 participants
34 discussions

[PATCH v2 0/7] Add Greybus Sotfsvc and UART Node drivers

by Ayush Singh

A Greybus network needs an SVC (Supervisory Controller) to bring interfaces up, assign device IDs and connect CPorts to the AP. On a UniPro network the SVC is a real entity on the bus. On transports that merely carry Greybus messages - a UART, an I2C bus, a network link - nothing on the wire plays that role, so the SVC has to be emulated somewhere: in a user-space bridge (gbridge), in coprocessor firmware (cc1352p7 in gb-beagleplay), or open-coded inside the host driver itself. This series moves the emulation into the kernel and makes it shared. This was discussed in a prior RFC as well [2], but to keep things short, removing the need for an external SVC greatly simplifies the greybus network setup when nodes are directly connected over common transports such as UART, I2C etc. gb-uart-node gb-softsvc greybus core (transport, serdev) <-> (SVC + host device) <-> (bundles, protocols) NodeOps module_insert() submit_message() module_remove() gb-softsvc registers itself as a Greybus host device and answers the SVC-side operations the core expects during interface bring-up and teardown. A host driver implements the NodeOps trait to push data towards its node, calls module_insert() to announce a new node, submit_message() to hand incoming Greybus messages back to the core, and module_remove() on disconnect. The first user is gb-uart-node, a driver for Greybus nodes attached over a plain serial port. Framing is HDLC, with a one-byte address (0x01 for Greybus) and control byte, followed by the 16-bit CPort ID and the Greybus message. No SVC firmware is required on the far end, so the node can be a bare microcontroller speaking Greybus - a BeagleConnect Freedom over its serial link, in this case. The testing is performed with greybus-zephyr [0] implementation. Both drivers are written in Rust, which is why the middle of the series is abstractions rather than drivers. Only the APIs these two drivers need are covered: protocols.rs abstracts the SVC-facing parts of greybus_protocols.h, and types such as Greybus Interface do not implement AlwaysRefCounted yet. The intent is to grow this as more Rust host drivers appear rather than to abstract the whole subsystem up front. Patches 1 and 2 are small C-side preparations to the Greybus core: exporting gb_connection_get()/gb_connection_put() and adding gb_connection_hd_find_by_intf(), a lookup by remote interface and CPort id for callers that only know the far end of a connection. Patch 3 adds a CRC-CCITT abstraction, needed for HDLC frame checks. Patch 4 adds the Greybus abstractions, patches 5 and 6 the two drivers, and patch 7 the device tree binding for BeagleConnect Freedom. Open questions *************** - gb-uart-node imports types from gb-softsvc, so the series carries the Rust-to-Rust cross-module calling setup from nova-core [1]: gb_softsvc_exports.c plus the Makefile plumbing that emits crate metadata and generates the export list. This is a workaround for the build system not supporting Rust cross-module dependencies natively, and it should go away once that lands. - Connection create/destroy and interface activate/resume in gb-softsvc currently just acknowledge the request. Callbacks into NodeOps can be added when a transport actually needs to act on them; I did not want to invent an interface without a user. - Zerocopy is currently not being used in grebeybus/protocols.rs. They cannot be derived yet since types generated by bindgen do not have them, and it seems explicitly forbindden to manually impl the traits. So using old traits from transmute. - The bindings are supposed to be created for actual device, but any MCU that supports Zephyr, can run the greybus-zephyr firmware with UART transport. So not sure if adding a beagle,beagleconnect-freedom compatible is the correct choice here. - The individual patches can be spun off into independent patch series if required. The reason for this single patch series is to provide a complete picture of usage. - Since gb-softsvc currently is not being used from a C driver, no C API is provided. However, if required, it can be added. - Writing to UART from gb-uart-node is currently a bit broken. I am not quite sure what the safe way is to go from a non-bound device to a bound device. Any suggestions on this front are welcome. - I am not sure if Rust abstractions should have a seperate entry in MAINTAINERS with me as the maintainer, or if they should just be added to the respective subsystem entries. [0]: https://github.com/beagleboard/greybus-zephyr [1]: https://lore.kernel.org/all/20260622-nova-exports-v5-0-6191773fc977@nvidia.… [2]: https://lore.kernel.org/all/ecca8eb2-8e5a-4770-bcf6-3fb49773088b@beagleboar… Signed-off-by: Ayush Singh <ayush(a)beagleboard.org> --- Changes in v2: - Fix possible null pointer dereference in gb_connection_hd_find_by_intf. Flagged by sashiko-bot. - Remove prompt CONFIG_RUST_CRC_CCITT_ABSTRACTIONS Kconfig symbol. - Add CONFIG_RUST_GREYBUS_ABSTRACTIONS to ensure that greybus is built-in for rust abstractions to work. - Use gfp_mask in message_send callback. - Only provide a Message reference in message_cancel callback. - Add invariant comment for Registration. - Call Registration->add directly in new, before constructing Registration. - Add Send and Sync bounds to T in Registration<T> - Set endo_id as 0. Is not used anywhere. - Fix module_insert intf_count. Was hardcoded to 1 by mistake. Flagged by sashiko-bot. - Check for empty intfs slice in Module::new. - Remove module in serdev::Driver::unbind instead of on drop. - Make gb_uart_node write atomic. Using temp buffer to build frame. - Fix import style. - Reorder beagleconnect-freedom dtbinding patch to be before gb_uart_node. - Add vbat-supply and reg properties to beagleconnect-freedom dtbinding. - Reference spi-peripheral-props in beagleconnect-freedom dtbinding. - Link to v1: https://lore.kernel.org/r/20260820-gb-uart-transport-v1-0-282da14ab7b7@beag… --- Ayush Singh (7): greybus: connection: Export gb_connection_get() and gb_connection_put() greybus: connection: Add gb_connection_hd_find_by_intf() rust: crc_ccitt: add CRC-CCITT abstraction rust: kernel: Add greybus abstractions drivers: greybus: Add software SVC implementation dt-bindings: beagle: Add BeagleConnect Freedom greybus: Add Rust UART node driver .../beagle/beagle,beagleconnect-freedom.yaml | 39 ++ MAINTAINERS | 15 + drivers/greybus/.gitignore | 1 + drivers/greybus/Kconfig | 34 ++ drivers/greybus/Makefile | 50 ++ drivers/greybus/connection.c | 29 +- drivers/greybus/gb_softsvc.rs | 504 +++++++++++++++++++++ drivers/greybus/gb_softsvc_exports.c | 15 + drivers/greybus/gb_uart_node.rs | 245 ++++++++++ include/linux/greybus/connection.h | 6 + lib/crc/Kconfig | 7 + rust/bindings/bindings_helper.h | 2 + rust/kernel/alloc.rs | 5 + rust/kernel/crc_ccitt.rs | 26 ++ rust/kernel/greybus/hd.rs | 333 ++++++++++++++ rust/kernel/greybus/mod.rs | 232 ++++++++++ rust/kernel/greybus/protocols.rs | 392 ++++++++++++++++ rust/kernel/lib.rs | 4 + 18 files changed, 1937 insertions(+), 2 deletions(-) --- base-commit: 6b8c8af514d739d0335f5579b585e02babe8a727 change-id: 20260810-gb-uart-transport-9255d6557c4c Best regards, -- Ayush Singh <ayush(a)beagleboard.org>

2 months

[PATCH] staging: greybus: remove unused loopback macro

by André Moreira

The gb_loopback_attr macro is no longer used in the Greybus loopback driver. Remove the unused macro to avoid keeping dead code in the driver. Signed-off-by: André Moreira <andrem.33333(a)gmail.com> --- drivers/staging/greybus/loopback.c | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/drivers/staging/greybus/loopback.c b/drivers/staging/greybus/loopback.c index ea57b1f5d156..2a623fc2e99b 100644 --- a/drivers/staging/greybus/loopback.c +++ b/drivers/staging/greybus/loopback.c @@ -167,32 +167,6 @@ static DEVICE_ATTR_RO(name##_avg) gb_loopback_ro_stats_attr(field, max, u); \ gb_loopback_ro_avg_attr(field) -#define gb_loopback_attr(field, type) \ -static ssize_t field##_show(struct device *dev, \ - struct device_attribute *attr, \ - char *buf) \ -{ \ - struct gb_loopback *gb = dev_get_drvdata(dev); \ - return sysfs_emit(buf, "%" #type "\n", gb->field); \ -} \ -static ssize_t field##_store(struct device *dev, \ - struct device_attribute *attr, \ - const char *buf, \ - size_t len) \ -{ \ - int ret; \ - struct gb_loopback *gb = dev_get_drvdata(dev); \ - mutex_lock(&gb->mutex); \ - ret = sscanf(buf, "%"#type, &gb->field); \ - if (ret != 1) \ - len = -EINVAL; \ - else \ - gb_loopback_check_attr(gb, bundle); \ - mutex_unlock(&gb->mutex); \ - return len; \ -} \ -static DEVICE_ATTR_RW(field) - #define gb_dev_loopback_ro_attr(field) \ static ssize_t field##_show(struct device *dev, \ struct device_attribute *attr, \ -- 2.43.0

2 months, 1 week

[PATCH] staging: greybus: spilib: Handle SPI device types with a switch statement

by singh.supreet14＠gmail.com

From: Supreet <singh.supreet14(a)gmail.com> Replaced the if/else chain with switch statement. makes it easier to extend support for additional device types. Remove the temporary spidev variable since it is only used to test the return value of spi_new_device(). Call spi_new_device() directly in the conditional instead. checkpatch was run, had no warnings and errors. Signed-off-by: Supreet <singh.supreet14(a)gmail.com> --- drivers/staging/greybus/spilib.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/staging/greybus/spilib.c b/drivers/staging/greybus/spilib.c index e4d1ae8308aa..53fc0c124754 100644 --- a/drivers/staging/greybus/spilib.c +++ b/drivers/staging/greybus/spilib.c @@ -444,7 +444,6 @@ static int gb_spi_setup_device(struct gb_spilib *spi, u8 cs) struct gb_spi_device_config_request request; struct gb_spi_device_config_response response; struct spi_board_info spi_board = { {0} }; - struct spi_device *spidev; int ret; u8 dev_type; @@ -458,25 +457,29 @@ static int gb_spi_setup_device(struct gb_spilib *spi, u8 cs) dev_type = response.device_type; - if (dev_type == GB_SPI_SPI_DEV) + switch (dev_type) { + case GB_SPI_SPI_DEV: strscpy(spi_board.modalias, "spidev", sizeof(spi_board.modalias)); - else if (dev_type == GB_SPI_SPI_NOR) + break; + case GB_SPI_SPI_NOR: strscpy(spi_board.modalias, "spi-nor", sizeof(spi_board.modalias)); - else if (dev_type == GB_SPI_SPI_MODALIAS) + break; + case GB_SPI_SPI_MODALIAS: memcpy(spi_board.modalias, response.name, - sizeof(spi_board.modalias)); - else + sizeof(spi_board.modalias)); + break; + default: return -EINVAL; + } spi_board.mode = le16_to_cpu(response.mode); spi_board.bus_num = ctlr->bus_num; spi_board.chip_select = cs; spi_board.max_speed_hz = le32_to_cpu(response.max_speed_hz); - spidev = spi_new_device(ctlr, &spi_board); - if (!spidev) + if (!spi_new_device(ctlr, &spi_board)) return -EINVAL; return 0; -- 2.55.0

2 months, 1 week

[PATCH] staging: greybus: use sysfs_emit instead of sprintf in light.c

by Tomasz Unger

Per Documentation/filesystems/sysfs.rst, new implementations of show() methods should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space, since it is aware of the sysfs PAGE_SIZE buffer and includes sanity checks that sprintf() lacks. This fixes fade_in_show() and fade_out_show() (both generated by the gb_lights_fade_attr() macro) and color_show(). Signed-off-by: Tomasz Unger <tomasz.unger(a)yahoo.pl> --- Verified with checkpatch.pl - no errors or warnings. Compiled the gb-light module successfully with CONFIG_GREYBUS_LIGHT=m and CONFIG_LEDS_CLASS_FLASH=m (both previously disabled). greybus.ko, led-class-flash.ko and gb-light.ko all load without errors in a QEMU environment (verified via insmod and lsmod, dmesg shows no errors). This confirms the modules load cleanly but does not exercise the changed sysfs show() code paths, which would require an actual Greybus light device bound to the driver. --- drivers/staging/greybus/light.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index cab02b5da867..2689f9a7524a 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -173,7 +173,7 @@ static ssize_t fade_##__dir##_show(struct device *dev, \ struct led_classdev *cdev = dev_get_drvdata(dev); \ struct gb_channel *channel = get_channel_from_cdev(cdev); \ \ - return sprintf(buf, "%u\n", channel->fade_##__dir); \ + return sysfs_emit(buf, "%u\n", channel->fade_##__dir); \ } \ \ static ssize_t fade_##__dir##_store(struct device *dev, \ @@ -220,7 +220,7 @@ static ssize_t color_show(struct device *dev, struct device_attribute *attr, struct led_classdev *cdev = dev_get_drvdata(dev); struct gb_channel *channel = get_channel_from_cdev(cdev); - return sprintf(buf, "0x%08x\n", channel->color); + return sysfs_emit(buf, "0x%08x\n", channel->color); } static ssize_t color_store(struct device *dev, struct device_attribute *attr, --- base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f change-id: 20260819-greybus-light-sysfs-emit-4b8beab74fcc Best regards, -- Tomasz Unger <tomasz.unger(a)yahoo.pl>

2 months, 1 week

[PATCH] staging: greybus: use sysfs_emit instead of sprintf in gbphy.c

by Tomasz Unger

Per Documentation/filesystems/sysfs.rst, new implementations of show() methods should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space, since it is aware of the sysfs PAGE_SIZE buffer and includes sanity checks that sprintf() lacks. Signed-off-by: Tomasz Unger <tomasz.unger(a)yahoo.pl> --- Verified with checkpatch.pl - no errors or warnings. Compiled the gb-gbphy module successfully with CONFIG_GREYBUS=m and CONFIG_GREYBUS_BRIDGED_PHY=m (both previously disabled). Both greybus.ko and gb-gbphy.ko load without errors in a QEMU environment (verified via insmod and lsmod). This confirms the modules load cleanly but does not exercise the changed sysfs show() code path, which would require an actual Greybus device (or a userspace simulator such as gbsim) bound to the driver. --- drivers/staging/greybus/gbphy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/gbphy.c b/drivers/staging/greybus/gbphy.c index bdb0f5164a6f..bb9a5b538e6e 100644 --- a/drivers/staging/greybus/gbphy.c +++ b/drivers/staging/greybus/gbphy.c @@ -31,7 +31,7 @@ static ssize_t protocol_id_show(struct device *dev, { struct gbphy_device *gbphy_dev = to_gbphy_dev(dev); - return sprintf(buf, "0x%02x\n", gbphy_dev->cport_desc->protocol_id); + return sysfs_emit(buf, "0x%02x\n", gbphy_dev->cport_desc->protocol_id); } static DEVICE_ATTR_RO(protocol_id); --- base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f change-id: 20260818-greybus-gbphy-sysfs-emit-69739912458e Best regards, -- Tomasz Unger <tomasz.unger(a)yahoo.pl>

2 months, 1 week

[PATCH] staging: greybus: audio_manager_module: add missing newlines to sysfs_emit() calls

by Avhi M.

sysfs attributes are expected to be terminated with a newline. Add the missing '\n' to the sysfs_emit() format strings in the module attribute show functions, fixing the checkpatch --strict warning: WARNING: return sysfs_emit(...) formats should include a terminating newline Signed-off-by: Avhi M. <dev(a)avhi.in> --- drivers/staging/greybus/audio_manager_module.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2..5737f2a32 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute -- 2.43.0

2 months, 1 week

[PATCH] staging: greybus: gbphy: use sysfs_emit() instead of sprintf()

by Mohit Mishra

protocol_id_show() uses sprintf() to format sysfs output into the page buffer. Convert it to sysfs_emit(), which is the preferred helper for sysfs show() callbacks as it enforces page boundary checks. Similar conversions have already been made elsewhere in this subsystem (e.g. loopback.c, arche-platform.c). Signed-off-by: Mohit Mishra <mishraloopmohit(a)gmail.com> --- drivers/staging/greybus/gbphy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/gbphy.c b/drivers/staging/greybus/gbphy.c index bdb0f5164a6f..bb9a5b538e6e 100644 --- a/drivers/staging/greybus/gbphy.c +++ b/drivers/staging/greybus/gbphy.c @@ -31,7 +31,7 @@ static ssize_t protocol_id_show(struct device *dev, { struct gbphy_device *gbphy_dev = to_gbphy_dev(dev); - return sprintf(buf, "0x%02x\n", gbphy_dev->cport_desc->protocol_id); + return sysfs_emit(buf, "0x%02x\n", gbphy_dev->cport_desc->protocol_id); } static DEVICE_ATTR_RO(protocol_id); -- 2.43.0

2 months, 1 week

[PATCH] staging: greybus: loopback: Fix argument alignment

by Noah Techoueyres

Align function arguments to match the open parenthesis per the kernel coding style guidelines. Signed-off-by: Noah Techoueyres <noahtechoueyres(a)gmail.com> --- drivers/staging/greybus/loopback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/loopback.c b/drivers/staging/greybus/loopback.c index ea57b1f5d156..c33b8aa5871c 100644 --- a/drivers/staging/greybus/loopback.c +++ b/drivers/staging/greybus/loopback.c @@ -679,7 +679,7 @@ static int gb_loopback_request_handler(struct gb_operation *operation) } if (!gb_operation_response_alloc(operation, - len + sizeof(*response), GFP_KERNEL)) { + len + sizeof(*response), GFP_KERNEL)) { dev_err(dev, "error allocating response\n"); return -ENOMEM; } -- 2.43.0

2 months, 1 week

[PATCH v2] staging: greybus: light: fix leak of cdev->name

by Cong Nguyen

gb_lights_channel_config() builds the LED classdev name with kasprintf() and stores it in cdev->name for every channel during the configuration phase, which runs before the channel is registered. That name was only released by __gb_lights_led_unregister(), i.e. only for a normal LED channel that was actually registered. It was therefore leaked in two cases: - a channel that is configured but never registered, e.g. channel_attr_groups_set() fails, the flash configuration fails, or a later channel in the same light fails to configure and the whole light is torn down; the release path calls gb_lights_channel_unregister() (which returns early because the channel is not registered) and then gb_lights_channel_free(); - a flash, torch or indicator channel, whose unregister path (__gb_lights_flash_led_unregister()) never releases cdev->name at all, so the name leaks even on a successful teardown. cdev->name is a configuration-phase allocation, like channel->color_name and channel->mode_name. Free it in gb_lights_channel_free() next to those, since that runs unconditionally on every teardown path, and drop the special case free from __gb_lights_led_unregister(). gb_lights_channel_unregister() is only ever called from gb_lights_channel_release(), immediately followed by gb_lights_channel_free(), so the name is still released on the registered path and is freed exactly once. Commit 04820da21050 ("staging: greybus: light: Release memory obtained by kasprintf") fixed the leak for the registered normal-LED path only; this covers the remaining cases. Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") Assisted-by: Claude:claude-opus-4 Signed-off-by: Cong Nguyen <congnt264(a)gmail.com> --- Changes in v2: - Add Assisted-by: tag to document AI assistance, per Documentation/process/coding-assistants.rst (Greg KH). - No functional change. drivers/staging/greybus/light.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index cab02b5da867..1ecca479b5f4 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -905,8 +905,6 @@ static void __gb_lights_led_unregister(struct gb_channel *channel) return; led_classdev_unregister(cdev); - kfree(cdev->name); - cdev->name = NULL; channel->led = NULL; } @@ -1063,6 +1061,9 @@ static int gb_lights_light_register(struct gb_light *light) static void gb_lights_channel_free(struct gb_channel *channel) { + struct led_classdev *cdev = get_channel_cdev(channel); + + kfree(cdev->name); kfree(channel->attrs); kfree(channel->attr_group); kfree(channel->attr_groups); -- 2.25.1

2 months, 1 week

Re: [PATCH v2] greybus: operation: Fix NULL pointer dereference in gb_operation_message_alloc()

by Johan Hovold

On Fri, Aug 28, 2026 at 06:00:04PM +0800, Yang Zi wrote: > gb_connection_recv() accepts a received message whose advertised size is > smaller than struct gb_operation_msg_hdr. In particular, a header with a > size of zero passes the incomplete-message check and reaches > gb_operation_create_incoming(). Thanks for the fix. Please shorten the commit summary (Subject) to something less verbose, like: greybus: operation: fix NULL-deref on short request > This issue was found using a locally modified syzkaller. The > analysis and fix were assisted by GPT-5.6. This can go at the end of the commit message. > The subtraction used to derive the request payload size then underflows. > When gb_operation_message_alloc() adds the header size, the result wraps > to zero, bypassing the maximum-buffer-size check. kzalloc(0) returns > ZERO_SIZE_PTR and gb_operation_message_init() subsequently dereferences > it. > > Reject advertised sizes smaller than the message header. Also check the > payload size before adding the header size, so that the size calculation > cannot wrap and bypass the buffer-size limit. This is arguably two changes; a fix for the NULL-deref due to the missing header sanity check and a hardening against any further bugs like it. But I guess they can go in together in one patch like you do here. > Fixes: 87d208feb74f ("greybus: embed message buffer into message structure") This is not the commit that introduced the issue. This should be: Fixes: d90c25b0a279 ("greybus: let operation layer examine incoming data") as that's the commit that started acting on the header size field without first rejecting invalid headers (even if there was a WARN_ON() at that time). > Assisted-by: Codex:gpt-5.6 > Signed-off-by: Yang Zi <2959243019(a)qq.com> > --- > v2: > - Add the syzkaller provenance and Assisted-by trailer. > - Regenerate the patch for git-send-email. > - Verify the received patch with git am and checkpatch. > > drivers/greybus/operation.c | 18 +++++++++++++++--- > 1 file changed, 15 insertions(+), 3 deletions(-) > > diff --git a/drivers/greybus/operation.c b/drivers/greybus/operation.c > index 7e12ffb2dd60..c3d51176c373 100644 > --- a/drivers/greybus/operation.c > +++ b/drivers/greybus/operation.c > @@ -364,14 +364,21 @@ gb_operation_message_alloc(struct gb_host_device *hd, u8 type, > { > struct gb_message *message; > struct gb_operation_msg_hdr *header; > - size_t message_size = payload_size + sizeof(*header); > + size_t message_size; > > - if (message_size > hd->buffer_size_max) { > + /* > + * Reject a payload size that would make the total message size > + * overflow, before it wraps around and bypasses the maximum > + * buffer size check. > + */ I think you can drop the comment. > + if (payload_size > hd->buffer_size_max - sizeof(*header)) { > dev_warn(&hd->dev, "requested message size too big (%zu > %zu)\n", And this should now say "payload size". > - message_size, hd->buffer_size_max); > + payload_size, hd->buffer_size_max - sizeof(*header)); > return NULL; > } > > + message_size = payload_size + sizeof(*header); > + > /* Allocate the message structure and buffer. */ > message = kmem_cache_zalloc(gb_message_cache, gfp_flags); > if (!message) > @@ -1047,6 +1054,11 @@ void gb_connection_recv(struct gb_connection *connection, > /* Use memcpy as data may be unaligned */ > memcpy(&header, data, sizeof(header)); > msg_size = le16_to_cpu(header.size); > + if (msg_size < sizeof(header)) { > + dev_err_ratelimited(dev, "%s: short message received (%zu < %zu)\n", > + connection->name, msg_size, sizeof(header)); > + return; > + } > if (size < msg_size) { > dev_err_ratelimited(dev, > "%s: incomplete message 0x%04x of type 0x%02x received (%zu < %zu)\n", Johan

2 months, 1 week

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev August 2026