On Wed, Aug 12, 2026 at 09:03:54PM +0300, Batu Ada Tutkun wrote:
> linux/random.h, linux/sizes.h, linux/cdev.h, linux/fs.h, and
> linux/workqueue.h are not used anywhere in this file; none of their
> symbols appear in the source, and none are needed transitively either
> (debugfs helpers come from linux/debugfs.h, the async worker uses
> kthread_run()/kthread_stop() rather than the workqueue API).
>
> Verified by removing the five includes and rebuilding
> drivers/staging/greybus out-of-tree with W=1: no new warnings or
> errors, and checkpatch.pl reports the same warning/check count before
> and after.
>
> Assisted-by: Claude:claude-sonnet-4-6
> Signed-off-by: Batu Ada Tutkun <batuadatutkun(a)gmail.com>
> ---
> drivers/staging/greybus/loopback.c | 5 -----
> 1 file changed, 5 deletions(-)
Please read:
https://lore.kernel.org/all/2026080354-skater-urgent-31b2@gregkh
Hi Dan,
Thanks for explaining — I'm new to kernel development and didn't
realize this sysfs output format was already user-visible API. I
understand now, and I'll leave this one as is.
Thanks for the feedback,
Raushan kumar
hub_control() sized the Greybus operation's response buffer purely
off the caller-supplied wLength. However, per the USB hub class spec,
GetHubDescriptor, GetHubStatus, and GetPortStatus have a response
length that is fixed by the request type itself, and can be larger
than (or independent of) whatever wLength the USB core happens to
pass down. This could under-allocate the response buffer for these
request types.
Special-case these three request types so the response buffer is
always large enough for the data the module will actually send back,
matching the equivalent handling in usbcore's rh_call_control(). Fall
back to wLength for all other request types, as before.
Compile-tested with 'make M=drivers/staging/greybus C=1', including
sparse, with no warnings. checkpatch --strict is also clean.
Note: this driver's hub_control() is currently unreachable at runtime
since gb_usb_probe() unconditionally disables USB support pending
separate USB core changes. As Project Ara hardware is no longer
available, this change has not been tested on physical hardware or
with a Greybus module; it was verified only by compilation, sparse,
and code review against the equivalent logic in usbcore.
Signed-off-by: Aditya Chari S <adi25charis(a)gmail.com>
---
drivers/staging/greybus/usb.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/greybus/usb.c b/drivers/staging/greybus/usb.c
index 475f24f20..ea6c0800c 100644
--- a/drivers/staging/greybus/usb.c
+++ b/drivers/staging/greybus/usb.c
@@ -105,8 +105,29 @@ static int hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
size_t response_size;
int ret;
- /* FIXME: handle unspecified lengths */
- response_size = sizeof(*response) + wLength;
+ /*
+ * Several USB hub class requests have a response length that is
+ * fixed by the request type rather than by wLength (which may be
+ * zero, or otherwise smaller than the actual data the module will
+ * return). Make sure we always allocate enough room for those.
+ */
+ switch (typeReq) {
+ case GetHubDescriptor:
+ response_size = sizeof(*response) +
+ sizeof(struct usb_hub_descriptor);
+ break;
+ case GetHubStatus:
+ response_size = sizeof(*response) +
+ sizeof(struct usb_hub_status);
+ break;
+ case GetPortStatus:
+ response_size = sizeof(*response) +
+ sizeof(struct usb_port_status);
+ break;
+ default:
+ response_size = sizeof(*response) + wLength;
+ break;
+ }
operation = gb_operation_create(dev->connection,
GB_USB_TYPE_HUB_CONTROL,
@@ -126,10 +147,12 @@ static int hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
if (ret)
goto out;
- if (wLength) {
+ if (response_size > sizeof(*response)) {
+ size_t data_size = response_size - sizeof(*response);
+
/* Greybus core has verified response size */
response = operation->response->payload;
- memcpy(buf, response->buf, wLength);
+ memcpy(buf, response->buf, data_size);
}
out:
gb_operation_put(operation);
--
2.53.0