greybus-dev

greybus-dev@lists.linaro.org

11 participants
866 discussions

[PATCH] staging: greybus: remove empty TODO file

by Ethan Nelson-Moore

drivers/staging/greybus/TODO has been empty since commit d85bef159923 ("staging: greybus: remove completed GPIO conversion task from TODO"). Remove it. Signed-off-by: Ethan Nelson-Moore <enelsonmoore(a)gmail.com> --- drivers/staging/greybus/TODO | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 drivers/staging/greybus/TODO diff --git a/drivers/staging/greybus/TODO b/drivers/staging/greybus/TODO deleted file mode 100644 index e69de29bb2d1..000000000000 -- 2.43.0

3 weeks, 1 day

[PATCH 0/2] mmc: core: Avoid export of mmc_alloc|free_host()

by Ulf Hansson

From: Ulf Hansson <ulfh(a)kernel.org> The only remaining user of mmc_alloc|free_host() is the greybus sdio driver. Let's convert it into using the resource managed variant so we can drop the export of mmc_alloc|free_host(). Ulf Hansson (2): staging: greybus: sdio: Convert to devm_mmc_alloc_host() mmc: core: Turn mmc_alloc|free_host() into static functions drivers/mmc/core/host.c | 35 +++++++++------------------------- drivers/staging/greybus/sdio.c | 11 +++-------- include/linux/mmc/host.h | 2 -- 3 files changed, 12 insertions(+), 36 deletions(-) -- 2.43.0

3 weeks, 2 days

[PATCH] staging: greybus: add newline to sysfs_emit return

by Omer PALA

Add a terminating newline character to sysfs_emit() format strings in audio_manager_module.c. Without a trailing newline, reading sysfs attributes directly from user space (e.g., using `cat`) appends the command prompt to the output string, leading to broken formatting. Including '\n' ensures compliance with sysfs single-value formatting standards and prevents parsing issues in user space tools and scripts. Signed-off-by: Omer PALA <palaomer100(a)gmail.com> --- drivers/staging/greybus/audio_manager_module.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2..5737f2a32 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute -- 2.55.0

3 weeks, 2 days

[PATCH] staging: greybus: add missing newlines to sysfs_emit

by Matthew Zvolsky

Add terminating newlines to sysfs_emit format strings to conform with kernel sysfs guidelines. Also clean up envp array declaration to be static const char * const. Signed-off-by: Matthew Zvolsky <matthew-kernel(a)post.cz> --- drivers/staging/greybus/audio_manager_module.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2308..16b688cfac75 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute @@ -158,7 +158,7 @@ static void send_add_uevent(struct gb_audio_manager_module *module) char ip_devices_string[64]; char op_devices_string[64]; - char *envp[] = { + static const char * const envp[] = { name_string, vid_string, pid_string, -- 2.39.5

4 weeks

[PATCH] staging: greybus: hid: fix off-by-one in SET_REPORT allocation

by Farhad Alemi

gb_hid_set_report() sizes its request payload as sizeof(*request) + len - 1, but report[] in struct gb_hid_set_report_request is a flexible array member that sizeof() already excludes. The buffer is therefore one byte too small, so memcpy(request->report, buf, len) writes one byte past its end, which KASAN reports as a slab-out-of-bounds write. Drop the stray - 1 so the allocation covers the whole report. Closes: https://lore.kernel.org/all/CA+0ovCgLrz4WhPKP5LGW5HZa8VOodgeo6pWuyQGgHE7UY5… Signed-off-by: Farhad Alemi <farhad.alemi(a)berkeley.edu> --- The device was emulated. --- a/drivers/staging/greybus/hid.c +++ b/drivers/staging/greybus/hid.c @@ -97,7 +97,8 @@ static int gb_hid_set_report(struct gb_hid *ghid, u8 report_type, u8 report_id, { struct gb_hid_set_report_request *request; struct gb_operation *operation; - int ret, size = sizeof(*request) + len - 1; + /* report[] is a flexible array, so sizeof() already excludes it. */ + int ret, size = sizeof(*request) + len; ret = gb_pm_runtime_get_sync(ghid->bundle); if (ret)

4 weeks, 1 day

[PATCH] staging: greybus: audio_codec.c: remove unnecessary parentheses

by YiCheng Lu

Remove unnecessary parentheses around simple boolean expressions in the if condition. The kernel coding style prefers not to use parentheses around simple conditions. Signed-off-by: YiCheng Lu <01luyicheng(a)gmail.com> --- drivers/staging/greybus/audio_codec.c | 1100 +++++++++++++++++++++++++ 1 file changed, 1100 insertions(+) create mode 100644 drivers/staging/greybus/audio_codec.c diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c new file mode 100644 index 0000000..44aee82 --- /dev/null +++ b/drivers/staging/greybus/audio_codec.c @@ -0,0 +1,1100 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * APBridge ALSA SoC dummy codec driver + * Copyright 2016 Google Inc. + * Copyright 2016 Linaro Ltd. + */ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/pm_runtime.h> +#include <sound/soc.h> +#include <sound/pcm_params.h> +#include <uapi/linux/input.h> + +#include "audio_codec.h" +#include "audio_apbridgea.h" +#include "audio_manager.h" +#include "audio_helper.h" + +static struct gbaudio_codec_info *gbcodec; + +static struct gbaudio_data_connection * +find_data(struct gbaudio_module_info *module, int id) +{ + struct gbaudio_data_connection *data; + + list_for_each_entry(data, &module->data_list, list) { + if (id == data->id) + return data; + } + return NULL; +} + +static struct gbaudio_stream_params * +find_dai_stream_params(struct gbaudio_codec_info *codec, int id, int stream) +{ + struct gbaudio_codec_dai *dai; + + list_for_each_entry(dai, &codec->dai_list, list) { + if (dai->id == id) + return &dai->params[stream]; + } + return NULL; +} + +static int gbaudio_module_enable_tx(struct gbaudio_codec_info *codec, + struct gbaudio_module_info *module, int id) +{ + int module_state, ret = 0; + u16 data_cport, i2s_port, cportid; + u8 sig_bits, channels; + u32 format, rate; + struct gbaudio_data_connection *data; + struct gbaudio_stream_params *params; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_PLAYBACK]; + + params = find_dai_stream_params(codec, id, SNDRV_PCM_STREAM_PLAYBACK); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + return -EINVAL; + } + + /* register cport */ + if (module_state < GBAUDIO_CODEC_STARTUP) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_register_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_TX); + if (ret) { + dev_err_ratelimited(module->dev, "reg_cport failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_STARTUP; + dev_dbg(module->dev, "Dynamic Register %d DAI\n", cportid); + } + + /* hw_params */ + if (module_state < GBAUDIO_CODEC_HWPARAMS) { + format = params->format; + channels = params->channels; + rate = params->rate; + sig_bits = params->sig_bits; + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_pcm(module->mgmt_connection, data_cport, + format, rate, channels, sig_bits); + if (ret) { + dev_err_ratelimited(module->dev, "set_pcm failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_HWPARAMS; + dev_dbg(module->dev, "Dynamic hw_params %d DAI\n", data_cport); + } + + /* prepare */ + if (module_state < GBAUDIO_CODEC_PREPARE) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_tx_data_size(module->mgmt_connection, + data_cport, 192); + if (ret) { + dev_err_ratelimited(module->dev, + "set_tx_data_size failed:%d\n", + ret); + return ret; + } + ret = gb_audio_gb_activate_tx(module->mgmt_connection, data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "activate_tx failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_PREPARE; + dev_dbg(module->dev, "Dynamic prepare %d DAI\n", data_cport); + } + + return 0; +} + +static int gbaudio_module_disable_tx(struct gbaudio_module_info *module, int id) +{ + int ret; + u16 data_cport, cportid, i2s_port; + int module_state; + struct gbaudio_data_connection *data; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_PLAYBACK]; + + if (module_state > GBAUDIO_CODEC_HWPARAMS) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_deactivate_tx(module->mgmt_connection, + data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "deactivate_tx failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic deactivate %d DAI\n", data_cport); + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_HWPARAMS; + } + + if (module_state > GBAUDIO_CODEC_SHUTDOWN) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_TX); + if (ret) { + dev_err_ratelimited(module->dev, + "unregister_cport failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic Unregister %d DAI\n", cportid); + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_SHUTDOWN; + } + + return 0; +} + +static int gbaudio_module_enable_rx(struct gbaudio_codec_info *codec, + struct gbaudio_module_info *module, int id) +{ + int module_state, ret = 0; + u16 data_cport, i2s_port, cportid; + u8 sig_bits, channels; + u32 format, rate; + struct gbaudio_data_connection *data; + struct gbaudio_stream_params *params; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_CAPTURE]; + + params = find_dai_stream_params(codec, id, SNDRV_PCM_STREAM_CAPTURE); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + return -EINVAL; + } + + /* register cport */ + if (module_state < GBAUDIO_CODEC_STARTUP) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_register_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_RX); + if (ret) { + dev_err_ratelimited(module->dev, "reg_cport failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_STARTUP; + dev_dbg(module->dev, "Dynamic Register %d DAI\n", cportid); + } + + /* hw_params */ + if (module_state < GBAUDIO_CODEC_HWPARAMS) { + format = params->format; + channels = params->channels; + rate = params->rate; + sig_bits = params->sig_bits; + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_pcm(module->mgmt_connection, data_cport, + format, rate, channels, sig_bits); + if (ret) { + dev_err_ratelimited(module->dev, "set_pcm failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_HWPARAMS; + dev_dbg(module->dev, "Dynamic hw_params %d DAI\n", data_cport); + } + + /* prepare */ + if (module_state < GBAUDIO_CODEC_PREPARE) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_rx_data_size(module->mgmt_connection, + data_cport, 192); + if (ret) { + dev_err_ratelimited(module->dev, + "set_rx_data_size failed:%d\n", + ret); + return ret; + } + ret = gb_audio_gb_activate_rx(module->mgmt_connection, + data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "activate_rx failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_PREPARE; + dev_dbg(module->dev, "Dynamic prepare %d DAI\n", data_cport); + } + + return 0; +} + +static int gbaudio_module_disable_rx(struct gbaudio_module_info *module, int id) +{ + int ret; + u16 data_cport, cportid, i2s_port; + int module_state; + struct gbaudio_data_connection *data; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_CAPTURE]; + + if (module_state > GBAUDIO_CODEC_HWPARAMS) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_deactivate_rx(module->mgmt_connection, + data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "deactivate_rx failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic deactivate %d DAI\n", data_cport); + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_HWPARAMS; + } + + if (module_state > GBAUDIO_CODEC_SHUTDOWN) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_RX); + if (ret) { + dev_err_ratelimited(module->dev, + "unregister_cport failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic Unregister %d DAI\n", cportid); + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_SHUTDOWN; + } + + return 0; +} + +int gbaudio_module_update(struct gbaudio_codec_info *codec, + struct snd_soc_dapm_widget *w, + struct gbaudio_module_info *module, int enable) +{ + int dai_id, ret; + char intf_name[NAME_SIZE], dir[NAME_SIZE]; + + dev_dbg(module->dev, "%s:Module update %s sequence\n", w->name, + enable ? "Enable" : "Disable"); + + if (w->id != snd_soc_dapm_aif_in && w->id != snd_soc_dapm_aif_out) { + dev_dbg(codec->dev, "No action required for %s\n", w->name); + return 0; + } + + /* parse dai_id from AIF widget's stream_name */ + ret = sscanf(w->sname, "%s %d %s", intf_name, &dai_id, dir); + if (ret < 3) { + dev_err(codec->dev, "Error while parsing dai_id for %s\n", w->name); + return -EINVAL; + } + + mutex_lock(&codec->lock); + if (w->id == snd_soc_dapm_aif_in) { + if (enable) + ret = gbaudio_module_enable_tx(codec, module, dai_id); + else + ret = gbaudio_module_disable_tx(module, dai_id); + } else if (w->id == snd_soc_dapm_aif_out) { + if (enable) + ret = gbaudio_module_enable_rx(codec, module, dai_id); + else + ret = gbaudio_module_disable_rx(module, dai_id); + } + + mutex_unlock(&codec->lock); + + return ret; +} +EXPORT_SYMBOL(gbaudio_module_update); + +/* + * codec DAI ops + */ +static int gbcodec_startup(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) +{ + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + params->state = GBAUDIO_CODEC_STARTUP; + mutex_unlock(&codec->lock); + /* to prevent suspend in case of active audio */ + pm_stay_awake(dai->dev); + + return 0; +} + +static void gbcodec_shutdown(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) +{ + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) + dev_info(codec->dev, "No codec module available during shutdown\n"); + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return; + } + params->state = GBAUDIO_CODEC_SHUTDOWN; + mutex_unlock(&codec->lock); + pm_relax(dai->dev); +} + +static int gbcodec_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *hwparams, + struct snd_soc_dai *dai) +{ + int ret; + u8 sig_bits, channels; + u32 format, rate; + struct gbaudio_module_info *module; + struct gbaudio_data_connection *data; + struct gb_bundle *bundle; + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + /* + * assuming, currently only 48000 Hz, 16BIT_LE, stereo + * is supported, validate params before configuring codec + */ + if (params_channels(hwparams) != 2) { + dev_err(dai->dev, "Invalid channel count:%d\n", + params_channels(hwparams)); + mutex_unlock(&codec->lock); + return -EINVAL; + } + channels = params_channels(hwparams); + + if (params_rate(hwparams) != 48000) { + dev_err(dai->dev, "Invalid sampling rate:%d\n", + params_rate(hwparams)); + mutex_unlock(&codec->lock); + return -EINVAL; + } + rate = GB_AUDIO_PCM_RATE_48000; + + if (params_format(hwparams) != SNDRV_PCM_FORMAT_S16_LE) { + dev_err(dai->dev, "Invalid format:%d\n", params_format(hwparams)); + mutex_unlock(&codec->lock); + return -EINVAL; + } + format = GB_AUDIO_PCM_FMT_S16_LE; + + /* find the data connection */ + list_for_each_entry(module, &codec->module_list, list) { + data = find_data(module, dai->id); + if (data) + break; + } + + if (!data) { + dev_err(dai->dev, "DATA connection missing\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + bundle = to_gb_bundle(module->dev); + ret = gb_pm_runtime_get_sync(bundle); + if (ret) { + mutex_unlock(&codec->lock); + return ret; + } + + ret = gb_audio_apbridgea_set_config(data->connection, 0, + AUDIO_APBRIDGEA_PCM_FMT_16, + AUDIO_APBRIDGEA_PCM_RATE_48000, + 6144000); + if (ret) { + dev_err_ratelimited(dai->dev, "%d: Error during set_config\n", + ret); + gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + return ret; + } + + gb_pm_runtime_put_noidle(bundle); + + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) + sig_bits = dai->driver->playback.sig_bits; + else + sig_bits = dai->driver->capture.sig_bits; + + params->state = GBAUDIO_CODEC_HWPARAMS; + params->format = format; + params->rate = rate; + params->channels = channels; + params->sig_bits = sig_bits; + + mutex_unlock(&codec->lock); + return 0; +} + +static int gbcodec_prepare(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) +{ + int ret; + struct gbaudio_module_info *module = NULL, *iter; + struct gbaudio_data_connection *data; + struct gb_bundle *bundle; + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + list_for_each_entry(iter, &codec->module_list, list) { + /* find the dai */ + data = find_data(iter, dai->id); + if (data) { + module = iter; + break; + } + } + if (!data) { + dev_err(dai->dev, "DATA connection missing\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + bundle = to_gb_bundle(module->dev); + ret = gb_pm_runtime_get_sync(bundle); + if (ret) { + mutex_unlock(&codec->lock); + return ret; + } + + switch (substream->stream) { + case SNDRV_PCM_STREAM_PLAYBACK: + ret = gb_audio_apbridgea_set_tx_data_size(data->connection, 0, 192); + break; + case SNDRV_PCM_STREAM_CAPTURE: + ret = gb_audio_apbridgea_set_rx_data_size(data->connection, 0, 192); + break; + } + if (ret) { + gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n", ret); + return ret; + } + + gb_pm_runtime_put_noidle(bundle); + + params->state = GBAUDIO_CODEC_PREPARE; + mutex_unlock(&codec->lock); + return 0; +} + +static int gbcodec_mute_stream(struct snd_soc_dai *dai, int mute, int stream) +{ + int ret; + struct gbaudio_data_connection *data; + struct gbaudio_module_info *module = NULL, *iter; + struct gb_bundle *bundle; + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + dev_dbg(dai->dev, "Mute:%d, Direction:%s\n", mute, + stream ? "CAPTURE" : "PLAYBACK"); + + mutex_lock(&codec->lock); + + params = find_dai_stream_params(codec, dai->id, stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + if (mute) { + params->state = GBAUDIO_CODEC_STOP; + ret = 0; + } else { + ret = -ENODEV; + } + mutex_unlock(&codec->lock); + return ret; + } + + list_for_each_entry(iter, &codec->module_list, list) { + /* find the dai */ + data = find_data(iter, dai->id); + if (data) { + module = iter; + break; + } + } + if (!data) { + dev_err(dai->dev, "%s DATA connection missing\n", + dai->name); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + bundle = to_gb_bundle(module->dev); + ret = gb_pm_runtime_get_sync(bundle); + if (ret) { + mutex_unlock(&codec->lock); + return ret; + } + + if (!mute && !stream) {/* start playback */ + ret = gb_audio_apbridgea_prepare_tx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_start_tx(data->connection, 0, 0); + params->state = GBAUDIO_CODEC_START; + } else if (!mute && stream) {/* start capture */ + ret = gb_audio_apbridgea_prepare_rx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_start_rx(data->connection, 0); + params->state = GBAUDIO_CODEC_START; + } else if (mute && !stream) {/* stop playback */ + ret = gb_audio_apbridgea_stop_tx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_shutdown_tx(data->connection, 0); + params->state = GBAUDIO_CODEC_STOP; + } else if (mute && stream) {/* stop capture */ + ret = gb_audio_apbridgea_stop_rx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_shutdown_rx(data->connection, 0); + params->state = GBAUDIO_CODEC_STOP; + } else { + ret = -EINVAL; + } + + if (ret) + dev_err_ratelimited(dai->dev, + "%s:Error during %s %s stream:%d\n", + module->name, mute ? "Mute" : "Unmute", + stream ? "Capture" : "Playback", ret); + + gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + return ret; +} + +static const struct snd_soc_dai_ops gbcodec_dai_ops = { + .startup = gbcodec_startup, + .shutdown = gbcodec_shutdown, + .hw_params = gbcodec_hw_params, + .prepare = gbcodec_prepare, + .mute_stream = gbcodec_mute_stream, +}; + +static struct snd_soc_dai_driver gbaudio_dai[] = { + { + .name = "apb-i2s0", + .id = 0, + .playback = { + .stream_name = "I2S 0 Playback", + .rates = SNDRV_PCM_RATE_48000, + .formats = SNDRV_PCM_FMTBIT_S16_LE, + .rate_max = 48000, + .rate_min = 48000, + .channels_min = 1, + .channels_max = 2, + .sig_bits = 16, + }, + .capture = { + .stream_name = "I2S 0 Capture", + .rates = SNDRV_PCM_RATE_48000, + .formats = SNDRV_PCM_FMTBIT_S16_LE, + .rate_max = 48000, + .rate_min = 48000, + .channels_min = 1, + .channels_max = 2, + .sig_bits = 16, + }, + .ops = &gbcodec_dai_ops, + }, +}; + +static int gbaudio_init_jack(struct gbaudio_module_info *module, + struct snd_soc_card *card) +{ + int ret; + struct gbaudio_jack *jack, *n; + struct snd_soc_jack_pin *headset, *button; + + if (!module->jack_mask) + return 0; + + snprintf(module->jack_name, NAME_SIZE, "GB %d Headset Jack", + module->dev_id); + + headset = devm_kzalloc(module->dev, sizeof(*headset), GFP_KERNEL); + if (!headset) + return -ENOMEM; + + headset->pin = module->jack_name; + headset->mask = module->jack_mask; + ret = snd_soc_card_jack_new_pins(card, module->jack_name, + module->jack_mask, + &module->headset.jack, headset, 1); + if (ret) { + dev_err(module->dev, "Failed to create new jack\n"); + return ret; + } + + /* Add to module's jack list */ + list_add(&module->headset.list, &module->jack_list); + + if (!module->button_mask) + return 0; + + snprintf(module->button_name, NAME_SIZE, "GB %d Button Jack", + module->dev_id); + button = devm_kzalloc(module->dev, sizeof(*button), GFP_KERNEL); + if (!button) { + ret = -ENOMEM; + goto free_jacks; + } + + button->pin = module->button_name; + button->mask = module->button_mask; + ret = snd_soc_card_jack_new_pins(card, module->button_name, + module->button_mask, + &module->button.jack, + button, 1); + if (ret) { + dev_err(module->dev, "Failed to create button jack\n"); + goto free_jacks; + } + + /* Add to module's jack list */ + list_add(&module->button.list, &module->jack_list); + + /* + * Currently, max 4 buttons are supported with following key mapping + * BTN_0 = KEY_MEDIA + * BTN_1 = KEY_VOICECOMMAND + * BTN_2 = KEY_VOLUMEUP + * BTN_3 = KEY_VOLUMEDOWN + */ + + if (module->button_mask & SND_JACK_BTN_0) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_0, + KEY_MEDIA); + if (ret) { + dev_err(module->dev, "Failed to set BTN_0\n"); + goto free_jacks; + } + } + + if (module->button_mask & SND_JACK_BTN_1) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_1, + KEY_VOICECOMMAND); + if (ret) { + dev_err(module->dev, "Failed to set BTN_1\n"); + goto free_jacks; + } + } + + if (module->button_mask & SND_JACK_BTN_2) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_2, + KEY_VOLUMEUP); + if (ret) { + dev_err(module->dev, "Failed to set BTN_2\n"); + goto free_jacks; + } + } + + if (module->button_mask & SND_JACK_BTN_3) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_3, + KEY_VOLUMEDOWN); + if (ret) { + dev_err(module->dev, "Failed to set BTN_0\n"); + goto free_jacks; + } + } + + /* FIXME + * verify if this is really required + set_bit(INPUT_PROP_NO_DUMMY_RELEASE, + module->button.jack.jack->input_dev->propbit); + */ + + return 0; + +free_jacks: + list_for_each_entry_safe(jack, n, &module->jack_list, list) { + snd_device_free(card->snd_card, jack->jack.jack); + list_del(&jack->list); + } + + return ret; +} + +int gbaudio_register_module(struct gbaudio_module_info *module) +{ + int ret; + struct snd_soc_component *comp; + struct snd_soc_dapm_context *dapm; + struct gbaudio_jack *jack = NULL; + + if (!gbcodec) { + dev_err(module->dev, "GB Codec not yet probed\n"); + return -EAGAIN; + } + + comp = gbcodec->component; + dapm = snd_soc_component_to_dapm(comp); + + mutex_lock(&gbcodec->register_mutex); + + if (module->num_dais) { + dev_err(gbcodec->dev, + "%d:DAIs not supported via gbcodec driver\n", + module->num_dais); + mutex_unlock(&gbcodec->register_mutex); + return -EINVAL; + } + + ret = gbaudio_init_jack(module, comp->card); + if (ret) { + mutex_unlock(&gbcodec->register_mutex); + return ret; + } + + if (module->dapm_widgets) + snd_soc_dapm_new_controls(dapm, module->dapm_widgets, + module->num_dapm_widgets); + if (module->controls) + snd_soc_add_component_controls(comp, module->controls, + module->num_controls); + if (module->dapm_routes) + snd_soc_dapm_add_routes(dapm, module->dapm_routes, + module->num_dapm_routes); + + /* card already instantiated, create widgets here only */ + if (comp->card->instantiated) { + gbaudio_dapm_link_component_dai_widgets(comp->card, dapm); +#ifdef CONFIG_SND_JACK + /* + * register jack devices for this module + * from codec->jack_list + */ + list_for_each_entry(jack, &module->jack_list, list) { + snd_device_register(comp->card->snd_card, + jack->jack.jack); + } +#endif + } + + mutex_lock(&gbcodec->lock); + list_add(&module->list, &gbcodec->module_list); + mutex_unlock(&gbcodec->lock); + + if (comp->card->instantiated) + ret = snd_soc_dapm_new_widgets(comp->card); + dev_dbg(comp->dev, "Registered %s module\n", module->name); + + mutex_unlock(&gbcodec->register_mutex); + return ret; +} +EXPORT_SYMBOL(gbaudio_register_module); + +static void gbaudio_codec_clean_data_tx(struct gbaudio_data_connection *data) +{ + u16 i2s_port, cportid; + int ret; + + if (list_is_singular(&gbcodec->module_list)) { + ret = gb_audio_apbridgea_stop_tx(data->connection, 0); + if (ret) + return; + ret = gb_audio_apbridgea_shutdown_tx(data->connection, 0); + if (ret) + return; + } + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_TX); + data->state[0] = GBAUDIO_CODEC_SHUTDOWN; +} + +static void gbaudio_codec_clean_data_rx(struct gbaudio_data_connection *data) +{ + u16 i2s_port, cportid; + int ret; + + if (list_is_singular(&gbcodec->module_list)) { + ret = gb_audio_apbridgea_stop_rx(data->connection, 0); + if (ret) + return; + ret = gb_audio_apbridgea_shutdown_rx(data->connection, 0); + if (ret) + return; + } + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_RX); + data->state[1] = GBAUDIO_CODEC_SHUTDOWN; +} + +static void gbaudio_codec_cleanup(struct gbaudio_module_info *module) +{ + struct gbaudio_data_connection *data; + int pb_state, cap_state; + + dev_dbg(gbcodec->dev, "%s: removed, cleanup APBridge\n", module->name); + list_for_each_entry(data, &module->data_list, list) { + pb_state = data->state[0]; + cap_state = data->state[1]; + + if (pb_state > GBAUDIO_CODEC_SHUTDOWN) + gbaudio_codec_clean_data_tx(data); + + if (cap_state > GBAUDIO_CODEC_SHUTDOWN) + gbaudio_codec_clean_data_rx(data); + } +} + +void gbaudio_unregister_module(struct gbaudio_module_info *module) +{ + struct snd_soc_component *comp = gbcodec->component; + struct gbaudio_jack *jack, *n; + int mask; + + dev_dbg(comp->dev, "Unregister %s module\n", module->name); + + mutex_lock(&gbcodec->register_mutex); + mutex_lock(&gbcodec->lock); + gbaudio_codec_cleanup(module); + list_del(&module->list); + dev_dbg(comp->dev, "Process Unregister %s module\n", module->name); + mutex_unlock(&gbcodec->lock); + +#ifdef CONFIG_SND_JACK + /* free jack devices for this module jack_list */ + list_for_each_entry_safe(jack, n, &module->jack_list, list) { + if (jack == &module->headset) + mask = GBCODEC_JACK_MASK; + else if (jack == &module->button) + mask = GBCODEC_JACK_BUTTON_MASK; + else + mask = 0; + if (mask) { + dev_dbg(module->dev, "Report %s removal\n", + jack->jack.jack->id); + snd_soc_jack_report(&jack->jack, 0, mask); + snd_device_free(comp->card->snd_card, + jack->jack.jack); + list_del(&jack->list); + } + } +#endif + + if (module->dapm_routes) { + struct snd_soc_dapm_context *dapm = snd_soc_component_to_dapm(comp); + + dev_dbg(comp->dev, "Removing %d routes\n", + module->num_dapm_routes); + snd_soc_dapm_del_routes(dapm, module->dapm_routes, + module->num_dapm_routes); + } + if (module->controls) { + dev_dbg(comp->dev, "Removing %d controls\n", + module->num_controls); + /* release control semaphore */ + gbaudio_remove_component_controls(comp, module->controls, + module->num_controls); + } + if (module->dapm_widgets) { + struct snd_soc_dapm_context *dapm = snd_soc_component_to_dapm(comp); + + dev_dbg(comp->dev, "Removing %d widgets\n", + module->num_dapm_widgets); + gbaudio_dapm_free_controls(dapm, module->dapm_widgets, + module->num_dapm_widgets); + } + + dev_dbg(comp->dev, "Unregistered %s module\n", module->name); + + mutex_unlock(&gbcodec->register_mutex); +} +EXPORT_SYMBOL(gbaudio_unregister_module); + +/* + * component driver ops + */ +static int gbcodec_probe(struct snd_soc_component *comp) +{ + int i; + struct gbaudio_codec_info *info; + struct gbaudio_codec_dai *dai; + + info = devm_kzalloc(comp->dev, sizeof(*info), GFP_KERNEL); + if (!info) + return -ENOMEM; + + info->dev = comp->dev; + INIT_LIST_HEAD(&info->module_list); + mutex_init(&info->lock); + mutex_init(&info->register_mutex); + INIT_LIST_HEAD(&info->dai_list); + + /* init dai_list used to maintain runtime stream info */ + for (i = 0; i < ARRAY_SIZE(gbaudio_dai); i++) { + dai = devm_kzalloc(comp->dev, sizeof(*dai), GFP_KERNEL); + if (!dai) + return -ENOMEM; + dai->id = gbaudio_dai[i].id; + list_add(&dai->list, &info->dai_list); + } + + info->component = comp; + snd_soc_component_set_drvdata(comp, info); + gbcodec = info; + + device_init_wakeup(comp->dev, 1); + return 0; +} + +static int gbcodec_write(struct snd_soc_component *comp, unsigned int reg, + unsigned int value) +{ + return 0; +} + +static unsigned int gbcodec_read(struct snd_soc_component *comp, + unsigned int reg) +{ + return 0; +} + +static const struct snd_soc_component_driver soc_codec_dev_gbaudio = { + .probe = gbcodec_probe, + .read = gbcodec_read, + .write = gbcodec_write, +}; + +#ifdef CONFIG_PM +static int gbaudio_codec_suspend(struct device *dev) +{ + dev_dbg(dev, "%s: suspend\n", __func__); + return 0; +} + +static int gbaudio_codec_resume(struct device *dev) +{ + dev_dbg(dev, "%s: resume\n", __func__); + return 0; +} + +static const struct dev_pm_ops gbaudio_codec_pm_ops = { + .suspend = gbaudio_codec_suspend, + .resume = gbaudio_codec_resume, +}; +#endif + +static int gbaudio_codec_probe(struct platform_device *pdev) +{ + return devm_snd_soc_register_component(&pdev->dev, + &soc_codec_dev_gbaudio, + gbaudio_dai, ARRAY_SIZE(gbaudio_dai)); +} + +static const struct of_device_id greybus_asoc_machine_of_match[] = { + { .compatible = "toshiba,apb-dummy-codec", }, + {}, +}; + +static struct platform_driver gbaudio_codec_driver = { + .driver = { + .name = "apb-dummy-codec", +#ifdef CONFIG_PM + .pm = &gbaudio_codec_pm_ops, +#endif + .of_match_table = greybus_asoc_machine_of_match, + }, + .probe = gbaudio_codec_probe, +}; +module_platform_driver(gbaudio_codec_driver); + +MODULE_DESCRIPTION("APBridge ALSA SoC dummy codec driver"); +MODULE_AUTHOR("Vaibhav Agarwal <vaibhav.agarwal(a)linaro.org>"); +MODULE_LICENSE("GPL v2"); +MODULE_ALIAS("platform:apb-dummy-codec"); -- 2.53.0

4 weeks, 1 day

[PATCH] staging: greybus: camera: fix potential overflow in debugfs buffers

by contectforbusiness＠proton.me

The debugfs buffers in gb_camera (data[PAGE_SIZE], length) are written with sprintf without any bounds checking. The four places in gb_camera_debugfs_capabilities, gb_camera_debugfs_configure_streams and gb_camera_debugfs_flush do: buffer->length += sprintf(buffer->data + buffer->length, ...); buffer->length = sprintf(buffer->data, ...); If the formatted data ever grows (e.g., more streams, larger hex dump) or if length is already close to PAGE_SIZE, this will overrun the PAGE_SIZE buffer and corrupt memory. The driver is debugfs-only so the impact is limited, but it is still a real bug and the pattern is repeated in multiple places. Fix it by using scnprintf with the remaining size: scnprintf(buffer->data + buffer->length, PAGE_SIZE - buffer->length, ...) scnprintf(buffer->data, PAGE_SIZE, ...) This is the standard way to write to a fixed-size buffer in the kernel. It guarantees we never write past PAGE_SIZE and will truncate instead of overrunning, which is safe for debugfs output. The return value still accumulates in length, which matches the existing use with simple_read_from_buffer (it will just show truncated output rather than corrupting). I checked that this exact conversion has not been proposed before: the recent greybus conversions to sysfs_emit (light.c, gbphy.c) and fbtft/vme_tsi148 scnprintf patches do not touch camera.c at all, and a search of lore for "gb_camera_debugfs" shows no prior patch for these four sprintf sites. No functional change for normal sizes, just makes the code safe if the buffer ever fills up. Signed-off-by: Vaibhav Agarwal <contectforbusiness(a)proton.me> --- drivers/staging/greybus/camera.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c index 62b55bb28..efc83ceff 100644 --- a/drivers/staging/greybus/camera.c +++ b/drivers/staging/greybus/camera.c @@ -890,7 +890,8 @@ static ssize_t gb_camera_debugfs_capabilities(struct gb_camera *gcam, for (i = 0; i < size; i += 16) { unsigned int nbytes = min_t(unsigned int, size - i, 16); - buffer->length += sprintf(buffer->data + buffer->length, + buffer->length += scnprintf(buffer->data + buffer->length, + PAGE_SIZE - buffer->length, "%*ph\n", nbytes, caps + i); } @@ -973,12 +974,13 @@ static ssize_t gb_camera_debugfs_configure_streams(struct gb_camera *gcam, if (ret < 0) goto done; - buffer->length = sprintf(buffer->data, "%u;%u;", nstreams, flags); + buffer->length = scnprintf(buffer->data, PAGE_SIZE, "%u;%u;", nstreams, flags); for (i = 0; i < nstreams; ++i) { struct gb_camera_stream_config *stream = &streams[i]; - buffer->length += sprintf(buffer->data + buffer->length, + buffer->length += scnprintf(buffer->data + buffer->length, + PAGE_SIZE - buffer->length, "%u;%u;%u;%u;%u;%u;%u;", stream->width, stream->height, stream->format, stream->vc, @@ -1046,7 +1048,7 @@ static ssize_t gb_camera_debugfs_flush(struct gb_camera *gcam, if (ret < 0) return ret; - buffer->length = sprintf(buffer->data, "%u", req_id); + buffer->length = scnprintf(buffer->data, PAGE_SIZE, "%u", req_id); return len; }

1 month

[PATCH] staging: greybus: camera: Fix function declaration alignment

by S Tarun Kumar Lywait

Adhere to Linux kernel coding style. Reported by checkpatch: CHECK: Alignment should match open parenthesis Signed-off-by: S Tarun Kumar Lywait <tarun.k.lywait(a)gmail.com> --- drivers/staging/greybus/camera.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c index 62b55bb28408..9853bd60ff27 100644 --- a/drivers/staging/greybus/camera.c +++ b/drivers/staging/greybus/camera.c @@ -263,9 +263,10 @@ static int gb_camera_get_max_pkt_size(struct gb_camera *gcam, * Validate the stream configuration response verifying padding is correctly * set and the returned number of streams is supported */ -static const int gb_camera_configure_streams_validate_response(struct gb_camera *gcam, - struct gb_camera_configure_streams_response *resp, - unsigned int nstreams) +static const int gb_camera_configure_streams_validate_response + (struct gb_camera *gcam, + struct gb_camera_configure_streams_response *resp, + unsigned int nstreams) { unsigned int i; -- 2.47.3

1 month

[BUG] KASAN: slab-out-of-bounds Write in gb_hid_raw_request

by Farhad Alemi

Hello, We are reporting the following crash (reproducer and a proposed patch attached): Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713 Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1) [ 44.000772][ T804] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 44.163699][ T804] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 1.00 [ 44.169786][ T804] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.212054][ T12] greybus 1-svc: set power mode = 0 [ 44.212064][ T12] greybus 1-svc: power mode change failed on AP to switch link: -5 [ 44.213758][ C1] greybus greybus1: 0/0:0: short response 0x94 received (8 < 9) [ 44.215179][ T9337] greybus greybus1: 0/0:0: synchronous operation id 0x0003 of type 0x14 failed: -90 [ 44.215216][ T9337] greybus 1-svc: failed to get rail count: -90 [ 44.234071][ T9337] greybus 1-2.2: Interface added (greybus) [ 44.234080][ T9337] greybus 1-2.2: GMP VID=0x00000001, PID=0x00000001 [ 44.234087][ T9337] greybus 1-2.2: DDBL1 Manufacturer=0x00000126, Product=0x00000001 [ 44.256005][ T9337] hid-generic 0000:0001:0002.0001: hidraw0: <UNKNOWN> HID v1.11 Device [1-2.2.1 0001:0002] on [ 44.295710][ T9495] ================================================================== [ 44.295718][ T9495] BUG: KASAN: slab-out-of-bounds in gb_hid_raw_request+0x29c/0x860 [ 44.295741][ T9495] Write of size 2 at addr ffff88810d471a0a by task repro/9495 [ 44.295747][ T9495] [ 44.295758][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full) [ 44.295767][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014 [ 44.295775][ T9495] Call Trace: [ 44.295779][ T9495] <TASK> [ 44.295784][ T9495] dump_stack_lvl+0xe8/0x150 [ 44.295794][ T9495] print_address_description+0x55/0x1e0 [ 44.295802][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295809][ T9495] print_report+0x58/0x70 [ 44.295815][ T9495] kasan_report+0x117/0x150 [ 44.295826][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295834][ T9495] kasan_check_range+0x264/0x2c0 [ 44.295843][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295849][ T9495] __asan_memcpy+0x40/0x70 [ 44.295858][ T9495] gb_hid_raw_request+0x29c/0x860 [ 44.295865][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10 [ 44.295873][ T9495] ? __hid_hw_raw_request+0xa7/0x140 [ 44.295883][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.295892][ T9495] ? bpf_lsm_file_permission+0x9/0x20 [ 44.295901][ T9495] hidraw_write+0x91/0xd0 [ 44.295908][ T9495] ? __pfx_hidraw_write+0x10/0x10 [ 44.295916][ T9495] vfs_write+0x29a/0xb90 [ 44.295924][ T9495] ? __pfx_vfs_write+0x10/0x10 [ 44.295931][ T9495] ? __fget_files+0x2a/0x420 [ 44.295939][ T9495] ? __fget_files+0x2a/0x420 [ 44.295944][ T9495] ? __fget_files+0x3a0/0x420 [ 44.295950][ T9495] ? __fget_files+0x2a/0x420 [ 44.295958][ T9495] ksys_write+0x150/0x270 [ 44.295965][ T9495] ? __pfx_ksys_write+0x10/0x10 [ 44.295973][ T9495] do_syscall_64+0x155/0x510 [ 44.295984][ T9495] ? trace_irq_disable+0x3b/0x140 [ 44.295993][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296000][ T9495] ? clear_bhb_loop+0x30/0x80 [ 44.296007][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296014][ T9495] RIP: 0033:0x4521d2 [ 44.296024][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 44.296032][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 44.296042][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004521d2 [ 44.296046][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6 RDI: 0000000000000004 [ 44.296051][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000 R09: 0000000000000000 [ 44.296055][ T9495] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc5937c28 [ 44.296059][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002 R15: 00000000004cba40 [ 44.296066][ T9495] </TASK> [ 44.296068][ T9495] [ 44.296071][ T9495] Allocated by task 9495: [ 44.296075][ T9495] kasan_save_track+0x3e/0x80 [ 44.296082][ T9495] __kasan_kmalloc+0x93/0xb0 [ 44.296090][ T9495] __kmalloc_noprof+0x36f/0x720 [ 44.296097][ T9495] gb_operation_message_alloc+0x8c/0x280 [ 44.296104][ T9495] gb_operation_create_common+0xa9/0x650 [ 44.296111][ T9495] gb_operation_create_flags+0xa2/0x2d0 [ 44.296117][ T9495] gb_hid_raw_request+0x1e6/0x860 [ 44.296123][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.296130][ T9495] hidraw_write+0x91/0xd0 [ 44.296137][ T9495] vfs_write+0x29a/0xb90 [ 44.296142][ T9495] ksys_write+0x150/0x270 [ 44.296148][ T9495] do_syscall_64+0x155/0x510 [ 44.296156][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296162][ T9495] [ 44.296163][ T9495] The buggy address belongs to the object at ffff88810d471a00 [ 44.296163][ T9495] which belongs to the cache kmalloc-16 of size 16 [ 44.296170][ T9495] The buggy address is located 10 bytes inside of [ 44.296170][ T9495] allocated 11-byte region [ffff88810d471a00, ffff88810d471a0b) [ 44.296177][ T9495] [ 44.296179][ T9495] The buggy address belongs to the physical page: [ 44.296186][ T9495] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d471 [ 44.296193][ T9495] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 44.296202][ T9495] page_type: f5(slab) [ 44.296212][ T9495] raw: 057ff00000000000 ffff88801b041640 dead000000000100 dead000000000122 [ 44.296217][ T9495] raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000 [ 44.296220][ T9495] page dumped because: kasan: bad access detected [ 44.296226][ T9495] page_owner tracks the page as allocated [ 44.296229][ T9495] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3657058998 [ 44.296240][ T9495] post_alloc_hook+0x1f9/0x250 [ 44.296247][ T9495] get_page_from_freelist+0x235a/0x23e0 [ 44.296255][ T9495] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 44.296262][ T9495] allocate_slab+0x7d/0x610 [ 44.296267][ T9495] refill_objects+0x2d6/0x350 [ 44.296272][ T9495] __pcs_replace_empty_main+0x2c9/0x6c0 [ 44.296281][ T9495] __kmalloc_noprof+0x48b/0x720 [ 44.296288][ T9495] usb_hcd_submit_urb+0x7a3/0x1b40 [ 44.296301][ T9495] usb_start_wait_urb+0x13f/0x5b0 [ 44.296308][ T9495] usb_control_msg+0x234/0x3e0 [ 44.296314][ T9495] hub_power_on+0x1b6/0x460 [ 44.296320][ T9495] hub_activate+0x345/0x1a80 [ 44.296327][ T9495] hub_probe+0x291e/0x3c10 [ 44.296334][ T9495] usb_probe_interface+0x71f/0xe00 [ 44.296342][ T9495] really_probe+0x267/0xaf0 [ 44.296366][ T9495] __driver_probe_device+0x1e2/0x350 [ 44.296372][ T9495] page_owner free stack trace missing [ 44.296375][ T9495] [ 44.296377][ T9495] Memory state around the buggy address: [ 44.296381][ T9495] ffff88810d471900: 00 04 fc fc 00 07 fc fc 00 00 fc fc 00 01 fc fc [ 44.296385][ T9495] ffff88810d471980: 00 01 fc fc 00 01 fc fc fa fb fc fc 00 01 fc fc [ 44.296389][ T9495] >ffff88810d471a00: 00 03 fc fc fa fb fc fc fa fb fc fc 00 01 fc fc [ 44.296393][ T9495] ^ [ 44.296396][ T9495] ffff88810d471a80: fa fb fc fc fa fb fc fc 00 00 fc fc 00 01 fc fc [ 44.296400][ T9495] ffff88810d471b00: 00 01 fc fc 00 01 fc fc 00 05 fc fc 00 05 fc fc [ 44.296404][ T9495] ================================================================== [ 44.297569][ T9495] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 44.352486][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full) [ 44.353650][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014 [ 44.354609][ T9495] Call Trace: [ 44.354919][ T9495] <TASK> [ 44.355192][ T9495] vpanic+0x56d/0xa60 [ 44.355639][ T9495] ? __pfx_vpanic+0x10/0x10 [ 44.356061][ T9495] panic+0xc5/0xd0 [ 44.356407][ T9495] ? __pfx_panic+0x10/0x10 [ 44.356831][ T9495] ? preempt_schedule_thunk+0x16/0x40 [ 44.357323][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.357800][ T9495] ? preempt_schedule_thunk+0x16/0x40 [ 44.358291][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.358771][ T9495] check_panic_on_warn+0x89/0xb0 [ 44.359225][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.359702][ T9495] end_report+0x73/0x170 [ 44.360095][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.360566][ T9495] kasan_report+0x128/0x150 [ 44.360998][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.361471][ T9495] kasan_check_range+0x264/0x2c0 [ 44.361929][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.362430][ T9495] __asan_memcpy+0x40/0x70 [ 44.362863][ T9495] gb_hid_raw_request+0x29c/0x860 [ 44.363348][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10 [ 44.363865][ T9495] ? __hid_hw_raw_request+0xa7/0x140 [ 44.364348][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.364825][ T9495] ? bpf_lsm_file_permission+0x9/0x20 [ 44.365314][ T9495] hidraw_write+0x91/0xd0 [ 44.365786][ T9495] ? __pfx_hidraw_write+0x10/0x10 [ 44.366245][ T9495] vfs_write+0x29a/0xb90 [ 44.366636][ T9495] ? __pfx_vfs_write+0x10/0x10 [ 44.367076][ T9495] ? __fget_files+0x2a/0x420 [ 44.367500][ T9495] ? __fget_files+0x2a/0x420 [ 44.367924][ T9495] ? __fget_files+0x3a0/0x420 [ 44.368352][ T9495] ? __fget_files+0x2a/0x420 [ 44.368791][ T9495] ksys_write+0x150/0x270 [ 44.369188][ T9495] ? __pfx_ksys_write+0x10/0x10 [ 44.369633][ T9495] do_syscall_64+0x155/0x510 [ 44.370063][ T9495] ? trace_irq_disable+0x3b/0x140 [ 44.370523][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.371077][ T9495] ? clear_bhb_loop+0x30/0x80 [ 44.371509][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.372046][ T9495] RIP: 0033:0x4521d2 [ 44.372407][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 44.374131][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 44.374887][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004521d2 [ 44.375673][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6 RDI: 0000000000000004 [ 44.376381][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000 R09: 0000000000000000 [ 44.377101][ T9495] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc5937c28 [ 44.377812][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002 R15: 00000000004cba40 [ 44.378522][ T9495] </TASK> [ 44.379100][ T9495] Kernel Offset: disabled [ 44.379644][ T9495] Rebooting in 86400 seconds.. Regards, SEFCOM Lab @ ASU

1 month

[PATCH 2/2] staging: greybus: light: add comments to mutex definitions

by contectforbusiness＠proton.me

checkpatch complains about: CHECK: struct mutex definition without comment Add short comments describing what each mutex protects. The channel lock protects the channel state and lights_lock protects the lights array. No functional change, just quiets checkpatch. Signed-off-by: Vaibhav <contectforbusiness(a)proton.me> --- drivers/staging/greybus/light.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index cab02b5da..a036fa2a0 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -37,7 +37,7 @@ struct gb_channel { bool releasing; bool strobe_state; bool active; - struct mutex lock; + struct mutex lock; /* protects channel */ }; struct gb_light { @@ -59,7 +59,7 @@ struct gb_lights { struct gb_connection *connection; u8 lights_count; struct gb_light *lights; - struct mutex lights_lock; + struct mutex lights_lock; /* protects lights */ }; static void gb_lights_channel_free(struct gb_channel *channel);

1 month

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev