greybus-dev

greybus-dev@lists.linaro.org

7 participants
862 discussions

[PATCH] staging: greybus: hid: fix off-by-one in SET_REPORT allocation

by Farhad Alemi

gb_hid_set_report() sizes its request payload as sizeof(*request) + len - 1, but report[] in struct gb_hid_set_report_request is a flexible array member that sizeof() already excludes. The buffer is therefore one byte too small, so memcpy(request->report, buf, len) writes one byte past its end, which KASAN reports as a slab-out-of-bounds write. Drop the stray - 1 so the allocation covers the whole report. Closes: https://lore.kernel.org/all/CA+0ovCgLrz4WhPKP5LGW5HZa8VOodgeo6pWuyQGgHE7UY5… Signed-off-by: Farhad Alemi <farhad.alemi(a)berkeley.edu> --- The device was emulated. --- a/drivers/staging/greybus/hid.c +++ b/drivers/staging/greybus/hid.c @@ -97,7 +97,8 @@ static int gb_hid_set_report(struct gb_hid *ghid, u8 report_type, u8 report_id, { struct gb_hid_set_report_request *request; struct gb_operation *operation; - int ret, size = sizeof(*request) + len - 1; + /* report[] is a flexible array, so sizeof() already excludes it. */ + int ret, size = sizeof(*request) + len; ret = gb_pm_runtime_get_sync(ghid->bundle); if (ret)

3 weeks

[PATCH] staging: greybus: audio_codec.c: remove unnecessary parentheses

by YiCheng Lu

Remove unnecessary parentheses around simple boolean expressions in the if condition. The kernel coding style prefers not to use parentheses around simple conditions. Signed-off-by: YiCheng Lu <01luyicheng(a)gmail.com> --- drivers/staging/greybus/audio_codec.c | 1100 +++++++++++++++++++++++++ 1 file changed, 1100 insertions(+) create mode 100644 drivers/staging/greybus/audio_codec.c diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c new file mode 100644 index 0000000..44aee82 --- /dev/null +++ b/drivers/staging/greybus/audio_codec.c @@ -0,0 +1,1100 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * APBridge ALSA SoC dummy codec driver + * Copyright 2016 Google Inc. + * Copyright 2016 Linaro Ltd. + */ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/pm_runtime.h> +#include <sound/soc.h> +#include <sound/pcm_params.h> +#include <uapi/linux/input.h> + +#include "audio_codec.h" +#include "audio_apbridgea.h" +#include "audio_manager.h" +#include "audio_helper.h" + +static struct gbaudio_codec_info *gbcodec; + +static struct gbaudio_data_connection * +find_data(struct gbaudio_module_info *module, int id) +{ + struct gbaudio_data_connection *data; + + list_for_each_entry(data, &module->data_list, list) { + if (id == data->id) + return data; + } + return NULL; +} + +static struct gbaudio_stream_params * +find_dai_stream_params(struct gbaudio_codec_info *codec, int id, int stream) +{ + struct gbaudio_codec_dai *dai; + + list_for_each_entry(dai, &codec->dai_list, list) { + if (dai->id == id) + return &dai->params[stream]; + } + return NULL; +} + +static int gbaudio_module_enable_tx(struct gbaudio_codec_info *codec, + struct gbaudio_module_info *module, int id) +{ + int module_state, ret = 0; + u16 data_cport, i2s_port, cportid; + u8 sig_bits, channels; + u32 format, rate; + struct gbaudio_data_connection *data; + struct gbaudio_stream_params *params; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_PLAYBACK]; + + params = find_dai_stream_params(codec, id, SNDRV_PCM_STREAM_PLAYBACK); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + return -EINVAL; + } + + /* register cport */ + if (module_state < GBAUDIO_CODEC_STARTUP) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_register_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_TX); + if (ret) { + dev_err_ratelimited(module->dev, "reg_cport failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_STARTUP; + dev_dbg(module->dev, "Dynamic Register %d DAI\n", cportid); + } + + /* hw_params */ + if (module_state < GBAUDIO_CODEC_HWPARAMS) { + format = params->format; + channels = params->channels; + rate = params->rate; + sig_bits = params->sig_bits; + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_pcm(module->mgmt_connection, data_cport, + format, rate, channels, sig_bits); + if (ret) { + dev_err_ratelimited(module->dev, "set_pcm failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_HWPARAMS; + dev_dbg(module->dev, "Dynamic hw_params %d DAI\n", data_cport); + } + + /* prepare */ + if (module_state < GBAUDIO_CODEC_PREPARE) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_tx_data_size(module->mgmt_connection, + data_cport, 192); + if (ret) { + dev_err_ratelimited(module->dev, + "set_tx_data_size failed:%d\n", + ret); + return ret; + } + ret = gb_audio_gb_activate_tx(module->mgmt_connection, data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "activate_tx failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_PREPARE; + dev_dbg(module->dev, "Dynamic prepare %d DAI\n", data_cport); + } + + return 0; +} + +static int gbaudio_module_disable_tx(struct gbaudio_module_info *module, int id) +{ + int ret; + u16 data_cport, cportid, i2s_port; + int module_state; + struct gbaudio_data_connection *data; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_PLAYBACK]; + + if (module_state > GBAUDIO_CODEC_HWPARAMS) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_deactivate_tx(module->mgmt_connection, + data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "deactivate_tx failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic deactivate %d DAI\n", data_cport); + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_HWPARAMS; + } + + if (module_state > GBAUDIO_CODEC_SHUTDOWN) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_TX); + if (ret) { + dev_err_ratelimited(module->dev, + "unregister_cport failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic Unregister %d DAI\n", cportid); + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_SHUTDOWN; + } + + return 0; +} + +static int gbaudio_module_enable_rx(struct gbaudio_codec_info *codec, + struct gbaudio_module_info *module, int id) +{ + int module_state, ret = 0; + u16 data_cport, i2s_port, cportid; + u8 sig_bits, channels; + u32 format, rate; + struct gbaudio_data_connection *data; + struct gbaudio_stream_params *params; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_CAPTURE]; + + params = find_dai_stream_params(codec, id, SNDRV_PCM_STREAM_CAPTURE); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + return -EINVAL; + } + + /* register cport */ + if (module_state < GBAUDIO_CODEC_STARTUP) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_register_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_RX); + if (ret) { + dev_err_ratelimited(module->dev, "reg_cport failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_STARTUP; + dev_dbg(module->dev, "Dynamic Register %d DAI\n", cportid); + } + + /* hw_params */ + if (module_state < GBAUDIO_CODEC_HWPARAMS) { + format = params->format; + channels = params->channels; + rate = params->rate; + sig_bits = params->sig_bits; + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_pcm(module->mgmt_connection, data_cport, + format, rate, channels, sig_bits); + if (ret) { + dev_err_ratelimited(module->dev, "set_pcm failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_HWPARAMS; + dev_dbg(module->dev, "Dynamic hw_params %d DAI\n", data_cport); + } + + /* prepare */ + if (module_state < GBAUDIO_CODEC_PREPARE) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_rx_data_size(module->mgmt_connection, + data_cport, 192); + if (ret) { + dev_err_ratelimited(module->dev, + "set_rx_data_size failed:%d\n", + ret); + return ret; + } + ret = gb_audio_gb_activate_rx(module->mgmt_connection, + data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "activate_rx failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_PREPARE; + dev_dbg(module->dev, "Dynamic prepare %d DAI\n", data_cport); + } + + return 0; +} + +static int gbaudio_module_disable_rx(struct gbaudio_module_info *module, int id) +{ + int ret; + u16 data_cport, cportid, i2s_port; + int module_state; + struct gbaudio_data_connection *data; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_CAPTURE]; + + if (module_state > GBAUDIO_CODEC_HWPARAMS) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_deactivate_rx(module->mgmt_connection, + data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "deactivate_rx failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic deactivate %d DAI\n", data_cport); + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_HWPARAMS; + } + + if (module_state > GBAUDIO_CODEC_SHUTDOWN) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_RX); + if (ret) { + dev_err_ratelimited(module->dev, + "unregister_cport failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic Unregister %d DAI\n", cportid); + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_SHUTDOWN; + } + + return 0; +} + +int gbaudio_module_update(struct gbaudio_codec_info *codec, + struct snd_soc_dapm_widget *w, + struct gbaudio_module_info *module, int enable) +{ + int dai_id, ret; + char intf_name[NAME_SIZE], dir[NAME_SIZE]; + + dev_dbg(module->dev, "%s:Module update %s sequence\n", w->name, + enable ? "Enable" : "Disable"); + + if (w->id != snd_soc_dapm_aif_in && w->id != snd_soc_dapm_aif_out) { + dev_dbg(codec->dev, "No action required for %s\n", w->name); + return 0; + } + + /* parse dai_id from AIF widget's stream_name */ + ret = sscanf(w->sname, "%s %d %s", intf_name, &dai_id, dir); + if (ret < 3) { + dev_err(codec->dev, "Error while parsing dai_id for %s\n", w->name); + return -EINVAL; + } + + mutex_lock(&codec->lock); + if (w->id == snd_soc_dapm_aif_in) { + if (enable) + ret = gbaudio_module_enable_tx(codec, module, dai_id); + else + ret = gbaudio_module_disable_tx(module, dai_id); + } else if (w->id == snd_soc_dapm_aif_out) { + if (enable) + ret = gbaudio_module_enable_rx(codec, module, dai_id); + else + ret = gbaudio_module_disable_rx(module, dai_id); + } + + mutex_unlock(&codec->lock); + + return ret; +} +EXPORT_SYMBOL(gbaudio_module_update); + +/* + * codec DAI ops + */ +static int gbcodec_startup(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) +{ + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + params->state = GBAUDIO_CODEC_STARTUP; + mutex_unlock(&codec->lock); + /* to prevent suspend in case of active audio */ + pm_stay_awake(dai->dev); + + return 0; +} + +static void gbcodec_shutdown(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) +{ + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) + dev_info(codec->dev, "No codec module available during shutdown\n"); + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return; + } + params->state = GBAUDIO_CODEC_SHUTDOWN; + mutex_unlock(&codec->lock); + pm_relax(dai->dev); +} + +static int gbcodec_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *hwparams, + struct snd_soc_dai *dai) +{ + int ret; + u8 sig_bits, channels; + u32 format, rate; + struct gbaudio_module_info *module; + struct gbaudio_data_connection *data; + struct gb_bundle *bundle; + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + /* + * assuming, currently only 48000 Hz, 16BIT_LE, stereo + * is supported, validate params before configuring codec + */ + if (params_channels(hwparams) != 2) { + dev_err(dai->dev, "Invalid channel count:%d\n", + params_channels(hwparams)); + mutex_unlock(&codec->lock); + return -EINVAL; + } + channels = params_channels(hwparams); + + if (params_rate(hwparams) != 48000) { + dev_err(dai->dev, "Invalid sampling rate:%d\n", + params_rate(hwparams)); + mutex_unlock(&codec->lock); + return -EINVAL; + } + rate = GB_AUDIO_PCM_RATE_48000; + + if (params_format(hwparams) != SNDRV_PCM_FORMAT_S16_LE) { + dev_err(dai->dev, "Invalid format:%d\n", params_format(hwparams)); + mutex_unlock(&codec->lock); + return -EINVAL; + } + format = GB_AUDIO_PCM_FMT_S16_LE; + + /* find the data connection */ + list_for_each_entry(module, &codec->module_list, list) { + data = find_data(module, dai->id); + if (data) + break; + } + + if (!data) { + dev_err(dai->dev, "DATA connection missing\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + bundle = to_gb_bundle(module->dev); + ret = gb_pm_runtime_get_sync(bundle); + if (ret) { + mutex_unlock(&codec->lock); + return ret; + } + + ret = gb_audio_apbridgea_set_config(data->connection, 0, + AUDIO_APBRIDGEA_PCM_FMT_16, + AUDIO_APBRIDGEA_PCM_RATE_48000, + 6144000); + if (ret) { + dev_err_ratelimited(dai->dev, "%d: Error during set_config\n", + ret); + gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + return ret; + } + + gb_pm_runtime_put_noidle(bundle); + + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) + sig_bits = dai->driver->playback.sig_bits; + else + sig_bits = dai->driver->capture.sig_bits; + + params->state = GBAUDIO_CODEC_HWPARAMS; + params->format = format; + params->rate = rate; + params->channels = channels; + params->sig_bits = sig_bits; + + mutex_unlock(&codec->lock); + return 0; +} + +static int gbcodec_prepare(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) +{ + int ret; + struct gbaudio_module_info *module = NULL, *iter; + struct gbaudio_data_connection *data; + struct gb_bundle *bundle; + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + list_for_each_entry(iter, &codec->module_list, list) { + /* find the dai */ + data = find_data(iter, dai->id); + if (data) { + module = iter; + break; + } + } + if (!data) { + dev_err(dai->dev, "DATA connection missing\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + bundle = to_gb_bundle(module->dev); + ret = gb_pm_runtime_get_sync(bundle); + if (ret) { + mutex_unlock(&codec->lock); + return ret; + } + + switch (substream->stream) { + case SNDRV_PCM_STREAM_PLAYBACK: + ret = gb_audio_apbridgea_set_tx_data_size(data->connection, 0, 192); + break; + case SNDRV_PCM_STREAM_CAPTURE: + ret = gb_audio_apbridgea_set_rx_data_size(data->connection, 0, 192); + break; + } + if (ret) { + gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n", ret); + return ret; + } + + gb_pm_runtime_put_noidle(bundle); + + params->state = GBAUDIO_CODEC_PREPARE; + mutex_unlock(&codec->lock); + return 0; +} + +static int gbcodec_mute_stream(struct snd_soc_dai *dai, int mute, int stream) +{ + int ret; + struct gbaudio_data_connection *data; + struct gbaudio_module_info *module = NULL, *iter; + struct gb_bundle *bundle; + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + dev_dbg(dai->dev, "Mute:%d, Direction:%s\n", mute, + stream ? "CAPTURE" : "PLAYBACK"); + + mutex_lock(&codec->lock); + + params = find_dai_stream_params(codec, dai->id, stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + if (mute) { + params->state = GBAUDIO_CODEC_STOP; + ret = 0; + } else { + ret = -ENODEV; + } + mutex_unlock(&codec->lock); + return ret; + } + + list_for_each_entry(iter, &codec->module_list, list) { + /* find the dai */ + data = find_data(iter, dai->id); + if (data) { + module = iter; + break; + } + } + if (!data) { + dev_err(dai->dev, "%s DATA connection missing\n", + dai->name); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + bundle = to_gb_bundle(module->dev); + ret = gb_pm_runtime_get_sync(bundle); + if (ret) { + mutex_unlock(&codec->lock); + return ret; + } + + if (!mute && !stream) {/* start playback */ + ret = gb_audio_apbridgea_prepare_tx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_start_tx(data->connection, 0, 0); + params->state = GBAUDIO_CODEC_START; + } else if (!mute && stream) {/* start capture */ + ret = gb_audio_apbridgea_prepare_rx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_start_rx(data->connection, 0); + params->state = GBAUDIO_CODEC_START; + } else if (mute && !stream) {/* stop playback */ + ret = gb_audio_apbridgea_stop_tx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_shutdown_tx(data->connection, 0); + params->state = GBAUDIO_CODEC_STOP; + } else if (mute && stream) {/* stop capture */ + ret = gb_audio_apbridgea_stop_rx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_shutdown_rx(data->connection, 0); + params->state = GBAUDIO_CODEC_STOP; + } else { + ret = -EINVAL; + } + + if (ret) + dev_err_ratelimited(dai->dev, + "%s:Error during %s %s stream:%d\n", + module->name, mute ? "Mute" : "Unmute", + stream ? "Capture" : "Playback", ret); + + gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + return ret; +} + +static const struct snd_soc_dai_ops gbcodec_dai_ops = { + .startup = gbcodec_startup, + .shutdown = gbcodec_shutdown, + .hw_params = gbcodec_hw_params, + .prepare = gbcodec_prepare, + .mute_stream = gbcodec_mute_stream, +}; + +static struct snd_soc_dai_driver gbaudio_dai[] = { + { + .name = "apb-i2s0", + .id = 0, + .playback = { + .stream_name = "I2S 0 Playback", + .rates = SNDRV_PCM_RATE_48000, + .formats = SNDRV_PCM_FMTBIT_S16_LE, + .rate_max = 48000, + .rate_min = 48000, + .channels_min = 1, + .channels_max = 2, + .sig_bits = 16, + }, + .capture = { + .stream_name = "I2S 0 Capture", + .rates = SNDRV_PCM_RATE_48000, + .formats = SNDRV_PCM_FMTBIT_S16_LE, + .rate_max = 48000, + .rate_min = 48000, + .channels_min = 1, + .channels_max = 2, + .sig_bits = 16, + }, + .ops = &gbcodec_dai_ops, + }, +}; + +static int gbaudio_init_jack(struct gbaudio_module_info *module, + struct snd_soc_card *card) +{ + int ret; + struct gbaudio_jack *jack, *n; + struct snd_soc_jack_pin *headset, *button; + + if (!module->jack_mask) + return 0; + + snprintf(module->jack_name, NAME_SIZE, "GB %d Headset Jack", + module->dev_id); + + headset = devm_kzalloc(module->dev, sizeof(*headset), GFP_KERNEL); + if (!headset) + return -ENOMEM; + + headset->pin = module->jack_name; + headset->mask = module->jack_mask; + ret = snd_soc_card_jack_new_pins(card, module->jack_name, + module->jack_mask, + &module->headset.jack, headset, 1); + if (ret) { + dev_err(module->dev, "Failed to create new jack\n"); + return ret; + } + + /* Add to module's jack list */ + list_add(&module->headset.list, &module->jack_list); + + if (!module->button_mask) + return 0; + + snprintf(module->button_name, NAME_SIZE, "GB %d Button Jack", + module->dev_id); + button = devm_kzalloc(module->dev, sizeof(*button), GFP_KERNEL); + if (!button) { + ret = -ENOMEM; + goto free_jacks; + } + + button->pin = module->button_name; + button->mask = module->button_mask; + ret = snd_soc_card_jack_new_pins(card, module->button_name, + module->button_mask, + &module->button.jack, + button, 1); + if (ret) { + dev_err(module->dev, "Failed to create button jack\n"); + goto free_jacks; + } + + /* Add to module's jack list */ + list_add(&module->button.list, &module->jack_list); + + /* + * Currently, max 4 buttons are supported with following key mapping + * BTN_0 = KEY_MEDIA + * BTN_1 = KEY_VOICECOMMAND + * BTN_2 = KEY_VOLUMEUP + * BTN_3 = KEY_VOLUMEDOWN + */ + + if (module->button_mask & SND_JACK_BTN_0) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_0, + KEY_MEDIA); + if (ret) { + dev_err(module->dev, "Failed to set BTN_0\n"); + goto free_jacks; + } + } + + if (module->button_mask & SND_JACK_BTN_1) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_1, + KEY_VOICECOMMAND); + if (ret) { + dev_err(module->dev, "Failed to set BTN_1\n"); + goto free_jacks; + } + } + + if (module->button_mask & SND_JACK_BTN_2) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_2, + KEY_VOLUMEUP); + if (ret) { + dev_err(module->dev, "Failed to set BTN_2\n"); + goto free_jacks; + } + } + + if (module->button_mask & SND_JACK_BTN_3) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_3, + KEY_VOLUMEDOWN); + if (ret) { + dev_err(module->dev, "Failed to set BTN_0\n"); + goto free_jacks; + } + } + + /* FIXME + * verify if this is really required + set_bit(INPUT_PROP_NO_DUMMY_RELEASE, + module->button.jack.jack->input_dev->propbit); + */ + + return 0; + +free_jacks: + list_for_each_entry_safe(jack, n, &module->jack_list, list) { + snd_device_free(card->snd_card, jack->jack.jack); + list_del(&jack->list); + } + + return ret; +} + +int gbaudio_register_module(struct gbaudio_module_info *module) +{ + int ret; + struct snd_soc_component *comp; + struct snd_soc_dapm_context *dapm; + struct gbaudio_jack *jack = NULL; + + if (!gbcodec) { + dev_err(module->dev, "GB Codec not yet probed\n"); + return -EAGAIN; + } + + comp = gbcodec->component; + dapm = snd_soc_component_to_dapm(comp); + + mutex_lock(&gbcodec->register_mutex); + + if (module->num_dais) { + dev_err(gbcodec->dev, + "%d:DAIs not supported via gbcodec driver\n", + module->num_dais); + mutex_unlock(&gbcodec->register_mutex); + return -EINVAL; + } + + ret = gbaudio_init_jack(module, comp->card); + if (ret) { + mutex_unlock(&gbcodec->register_mutex); + return ret; + } + + if (module->dapm_widgets) + snd_soc_dapm_new_controls(dapm, module->dapm_widgets, + module->num_dapm_widgets); + if (module->controls) + snd_soc_add_component_controls(comp, module->controls, + module->num_controls); + if (module->dapm_routes) + snd_soc_dapm_add_routes(dapm, module->dapm_routes, + module->num_dapm_routes); + + /* card already instantiated, create widgets here only */ + if (comp->card->instantiated) { + gbaudio_dapm_link_component_dai_widgets(comp->card, dapm); +#ifdef CONFIG_SND_JACK + /* + * register jack devices for this module + * from codec->jack_list + */ + list_for_each_entry(jack, &module->jack_list, list) { + snd_device_register(comp->card->snd_card, + jack->jack.jack); + } +#endif + } + + mutex_lock(&gbcodec->lock); + list_add(&module->list, &gbcodec->module_list); + mutex_unlock(&gbcodec->lock); + + if (comp->card->instantiated) + ret = snd_soc_dapm_new_widgets(comp->card); + dev_dbg(comp->dev, "Registered %s module\n", module->name); + + mutex_unlock(&gbcodec->register_mutex); + return ret; +} +EXPORT_SYMBOL(gbaudio_register_module); + +static void gbaudio_codec_clean_data_tx(struct gbaudio_data_connection *data) +{ + u16 i2s_port, cportid; + int ret; + + if (list_is_singular(&gbcodec->module_list)) { + ret = gb_audio_apbridgea_stop_tx(data->connection, 0); + if (ret) + return; + ret = gb_audio_apbridgea_shutdown_tx(data->connection, 0); + if (ret) + return; + } + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_TX); + data->state[0] = GBAUDIO_CODEC_SHUTDOWN; +} + +static void gbaudio_codec_clean_data_rx(struct gbaudio_data_connection *data) +{ + u16 i2s_port, cportid; + int ret; + + if (list_is_singular(&gbcodec->module_list)) { + ret = gb_audio_apbridgea_stop_rx(data->connection, 0); + if (ret) + return; + ret = gb_audio_apbridgea_shutdown_rx(data->connection, 0); + if (ret) + return; + } + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_RX); + data->state[1] = GBAUDIO_CODEC_SHUTDOWN; +} + +static void gbaudio_codec_cleanup(struct gbaudio_module_info *module) +{ + struct gbaudio_data_connection *data; + int pb_state, cap_state; + + dev_dbg(gbcodec->dev, "%s: removed, cleanup APBridge\n", module->name); + list_for_each_entry(data, &module->data_list, list) { + pb_state = data->state[0]; + cap_state = data->state[1]; + + if (pb_state > GBAUDIO_CODEC_SHUTDOWN) + gbaudio_codec_clean_data_tx(data); + + if (cap_state > GBAUDIO_CODEC_SHUTDOWN) + gbaudio_codec_clean_data_rx(data); + } +} + +void gbaudio_unregister_module(struct gbaudio_module_info *module) +{ + struct snd_soc_component *comp = gbcodec->component; + struct gbaudio_jack *jack, *n; + int mask; + + dev_dbg(comp->dev, "Unregister %s module\n", module->name); + + mutex_lock(&gbcodec->register_mutex); + mutex_lock(&gbcodec->lock); + gbaudio_codec_cleanup(module); + list_del(&module->list); + dev_dbg(comp->dev, "Process Unregister %s module\n", module->name); + mutex_unlock(&gbcodec->lock); + +#ifdef CONFIG_SND_JACK + /* free jack devices for this module jack_list */ + list_for_each_entry_safe(jack, n, &module->jack_list, list) { + if (jack == &module->headset) + mask = GBCODEC_JACK_MASK; + else if (jack == &module->button) + mask = GBCODEC_JACK_BUTTON_MASK; + else + mask = 0; + if (mask) { + dev_dbg(module->dev, "Report %s removal\n", + jack->jack.jack->id); + snd_soc_jack_report(&jack->jack, 0, mask); + snd_device_free(comp->card->snd_card, + jack->jack.jack); + list_del(&jack->list); + } + } +#endif + + if (module->dapm_routes) { + struct snd_soc_dapm_context *dapm = snd_soc_component_to_dapm(comp); + + dev_dbg(comp->dev, "Removing %d routes\n", + module->num_dapm_routes); + snd_soc_dapm_del_routes(dapm, module->dapm_routes, + module->num_dapm_routes); + } + if (module->controls) { + dev_dbg(comp->dev, "Removing %d controls\n", + module->num_controls); + /* release control semaphore */ + gbaudio_remove_component_controls(comp, module->controls, + module->num_controls); + } + if (module->dapm_widgets) { + struct snd_soc_dapm_context *dapm = snd_soc_component_to_dapm(comp); + + dev_dbg(comp->dev, "Removing %d widgets\n", + module->num_dapm_widgets); + gbaudio_dapm_free_controls(dapm, module->dapm_widgets, + module->num_dapm_widgets); + } + + dev_dbg(comp->dev, "Unregistered %s module\n", module->name); + + mutex_unlock(&gbcodec->register_mutex); +} +EXPORT_SYMBOL(gbaudio_unregister_module); + +/* + * component driver ops + */ +static int gbcodec_probe(struct snd_soc_component *comp) +{ + int i; + struct gbaudio_codec_info *info; + struct gbaudio_codec_dai *dai; + + info = devm_kzalloc(comp->dev, sizeof(*info), GFP_KERNEL); + if (!info) + return -ENOMEM; + + info->dev = comp->dev; + INIT_LIST_HEAD(&info->module_list); + mutex_init(&info->lock); + mutex_init(&info->register_mutex); + INIT_LIST_HEAD(&info->dai_list); + + /* init dai_list used to maintain runtime stream info */ + for (i = 0; i < ARRAY_SIZE(gbaudio_dai); i++) { + dai = devm_kzalloc(comp->dev, sizeof(*dai), GFP_KERNEL); + if (!dai) + return -ENOMEM; + dai->id = gbaudio_dai[i].id; + list_add(&dai->list, &info->dai_list); + } + + info->component = comp; + snd_soc_component_set_drvdata(comp, info); + gbcodec = info; + + device_init_wakeup(comp->dev, 1); + return 0; +} + +static int gbcodec_write(struct snd_soc_component *comp, unsigned int reg, + unsigned int value) +{ + return 0; +} + +static unsigned int gbcodec_read(struct snd_soc_component *comp, + unsigned int reg) +{ + return 0; +} + +static const struct snd_soc_component_driver soc_codec_dev_gbaudio = { + .probe = gbcodec_probe, + .read = gbcodec_read, + .write = gbcodec_write, +}; + +#ifdef CONFIG_PM +static int gbaudio_codec_suspend(struct device *dev) +{ + dev_dbg(dev, "%s: suspend\n", __func__); + return 0; +} + +static int gbaudio_codec_resume(struct device *dev) +{ + dev_dbg(dev, "%s: resume\n", __func__); + return 0; +} + +static const struct dev_pm_ops gbaudio_codec_pm_ops = { + .suspend = gbaudio_codec_suspend, + .resume = gbaudio_codec_resume, +}; +#endif + +static int gbaudio_codec_probe(struct platform_device *pdev) +{ + return devm_snd_soc_register_component(&pdev->dev, + &soc_codec_dev_gbaudio, + gbaudio_dai, ARRAY_SIZE(gbaudio_dai)); +} + +static const struct of_device_id greybus_asoc_machine_of_match[] = { + { .compatible = "toshiba,apb-dummy-codec", }, + {}, +}; + +static struct platform_driver gbaudio_codec_driver = { + .driver = { + .name = "apb-dummy-codec", +#ifdef CONFIG_PM + .pm = &gbaudio_codec_pm_ops, +#endif + .of_match_table = greybus_asoc_machine_of_match, + }, + .probe = gbaudio_codec_probe, +}; +module_platform_driver(gbaudio_codec_driver); + +MODULE_DESCRIPTION("APBridge ALSA SoC dummy codec driver"); +MODULE_AUTHOR("Vaibhav Agarwal <vaibhav.agarwal(a)linaro.org>"); +MODULE_LICENSE("GPL v2"); +MODULE_ALIAS("platform:apb-dummy-codec"); -- 2.53.0

3 weeks

[PATCH] staging: greybus: camera: fix potential overflow in debugfs buffers

by contectforbusiness＠proton.me

The debugfs buffers in gb_camera (data[PAGE_SIZE], length) are written with sprintf without any bounds checking. The four places in gb_camera_debugfs_capabilities, gb_camera_debugfs_configure_streams and gb_camera_debugfs_flush do: buffer->length += sprintf(buffer->data + buffer->length, ...); buffer->length = sprintf(buffer->data, ...); If the formatted data ever grows (e.g., more streams, larger hex dump) or if length is already close to PAGE_SIZE, this will overrun the PAGE_SIZE buffer and corrupt memory. The driver is debugfs-only so the impact is limited, but it is still a real bug and the pattern is repeated in multiple places. Fix it by using scnprintf with the remaining size: scnprintf(buffer->data + buffer->length, PAGE_SIZE - buffer->length, ...) scnprintf(buffer->data, PAGE_SIZE, ...) This is the standard way to write to a fixed-size buffer in the kernel. It guarantees we never write past PAGE_SIZE and will truncate instead of overrunning, which is safe for debugfs output. The return value still accumulates in length, which matches the existing use with simple_read_from_buffer (it will just show truncated output rather than corrupting). I checked that this exact conversion has not been proposed before: the recent greybus conversions to sysfs_emit (light.c, gbphy.c) and fbtft/vme_tsi148 scnprintf patches do not touch camera.c at all, and a search of lore for "gb_camera_debugfs" shows no prior patch for these four sprintf sites. No functional change for normal sizes, just makes the code safe if the buffer ever fills up. Signed-off-by: Vaibhav Agarwal <contectforbusiness(a)proton.me> --- drivers/staging/greybus/camera.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c index 62b55bb28..efc83ceff 100644 --- a/drivers/staging/greybus/camera.c +++ b/drivers/staging/greybus/camera.c @@ -890,7 +890,8 @@ static ssize_t gb_camera_debugfs_capabilities(struct gb_camera *gcam, for (i = 0; i < size; i += 16) { unsigned int nbytes = min_t(unsigned int, size - i, 16); - buffer->length += sprintf(buffer->data + buffer->length, + buffer->length += scnprintf(buffer->data + buffer->length, + PAGE_SIZE - buffer->length, "%*ph\n", nbytes, caps + i); } @@ -973,12 +974,13 @@ static ssize_t gb_camera_debugfs_configure_streams(struct gb_camera *gcam, if (ret < 0) goto done; - buffer->length = sprintf(buffer->data, "%u;%u;", nstreams, flags); + buffer->length = scnprintf(buffer->data, PAGE_SIZE, "%u;%u;", nstreams, flags); for (i = 0; i < nstreams; ++i) { struct gb_camera_stream_config *stream = &streams[i]; - buffer->length += sprintf(buffer->data + buffer->length, + buffer->length += scnprintf(buffer->data + buffer->length, + PAGE_SIZE - buffer->length, "%u;%u;%u;%u;%u;%u;%u;", stream->width, stream->height, stream->format, stream->vc, @@ -1046,7 +1048,7 @@ static ssize_t gb_camera_debugfs_flush(struct gb_camera *gcam, if (ret < 0) return ret; - buffer->length = sprintf(buffer->data, "%u", req_id); + buffer->length = scnprintf(buffer->data, PAGE_SIZE, "%u", req_id); return len; }

3 weeks

[PATCH] staging: greybus: camera: Fix function declaration alignment

by S Tarun Kumar Lywait

Adhere to Linux kernel coding style. Reported by checkpatch: CHECK: Alignment should match open parenthesis Signed-off-by: S Tarun Kumar Lywait <tarun.k.lywait(a)gmail.com> --- drivers/staging/greybus/camera.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c index 62b55bb28408..9853bd60ff27 100644 --- a/drivers/staging/greybus/camera.c +++ b/drivers/staging/greybus/camera.c @@ -263,9 +263,10 @@ static int gb_camera_get_max_pkt_size(struct gb_camera *gcam, * Validate the stream configuration response verifying padding is correctly * set and the returned number of streams is supported */ -static const int gb_camera_configure_streams_validate_response(struct gb_camera *gcam, - struct gb_camera_configure_streams_response *resp, - unsigned int nstreams) +static const int gb_camera_configure_streams_validate_response + (struct gb_camera *gcam, + struct gb_camera_configure_streams_response *resp, + unsigned int nstreams) { unsigned int i; -- 2.47.3

3 weeks, 1 day

[BUG] KASAN: slab-out-of-bounds Write in gb_hid_raw_request

by Farhad Alemi

Hello, We are reporting the following crash (reproducer and a proposed patch attached): Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713 Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1) [ 44.000772][ T804] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 44.163699][ T804] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 1.00 [ 44.169786][ T804] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.212054][ T12] greybus 1-svc: set power mode = 0 [ 44.212064][ T12] greybus 1-svc: power mode change failed on AP to switch link: -5 [ 44.213758][ C1] greybus greybus1: 0/0:0: short response 0x94 received (8 < 9) [ 44.215179][ T9337] greybus greybus1: 0/0:0: synchronous operation id 0x0003 of type 0x14 failed: -90 [ 44.215216][ T9337] greybus 1-svc: failed to get rail count: -90 [ 44.234071][ T9337] greybus 1-2.2: Interface added (greybus) [ 44.234080][ T9337] greybus 1-2.2: GMP VID=0x00000001, PID=0x00000001 [ 44.234087][ T9337] greybus 1-2.2: DDBL1 Manufacturer=0x00000126, Product=0x00000001 [ 44.256005][ T9337] hid-generic 0000:0001:0002.0001: hidraw0: <UNKNOWN> HID v1.11 Device [1-2.2.1 0001:0002] on [ 44.295710][ T9495] ================================================================== [ 44.295718][ T9495] BUG: KASAN: slab-out-of-bounds in gb_hid_raw_request+0x29c/0x860 [ 44.295741][ T9495] Write of size 2 at addr ffff88810d471a0a by task repro/9495 [ 44.295747][ T9495] [ 44.295758][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full) [ 44.295767][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014 [ 44.295775][ T9495] Call Trace: [ 44.295779][ T9495] <TASK> [ 44.295784][ T9495] dump_stack_lvl+0xe8/0x150 [ 44.295794][ T9495] print_address_description+0x55/0x1e0 [ 44.295802][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295809][ T9495] print_report+0x58/0x70 [ 44.295815][ T9495] kasan_report+0x117/0x150 [ 44.295826][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295834][ T9495] kasan_check_range+0x264/0x2c0 [ 44.295843][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295849][ T9495] __asan_memcpy+0x40/0x70 [ 44.295858][ T9495] gb_hid_raw_request+0x29c/0x860 [ 44.295865][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10 [ 44.295873][ T9495] ? __hid_hw_raw_request+0xa7/0x140 [ 44.295883][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.295892][ T9495] ? bpf_lsm_file_permission+0x9/0x20 [ 44.295901][ T9495] hidraw_write+0x91/0xd0 [ 44.295908][ T9495] ? __pfx_hidraw_write+0x10/0x10 [ 44.295916][ T9495] vfs_write+0x29a/0xb90 [ 44.295924][ T9495] ? __pfx_vfs_write+0x10/0x10 [ 44.295931][ T9495] ? __fget_files+0x2a/0x420 [ 44.295939][ T9495] ? __fget_files+0x2a/0x420 [ 44.295944][ T9495] ? __fget_files+0x3a0/0x420 [ 44.295950][ T9495] ? __fget_files+0x2a/0x420 [ 44.295958][ T9495] ksys_write+0x150/0x270 [ 44.295965][ T9495] ? __pfx_ksys_write+0x10/0x10 [ 44.295973][ T9495] do_syscall_64+0x155/0x510 [ 44.295984][ T9495] ? trace_irq_disable+0x3b/0x140 [ 44.295993][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296000][ T9495] ? clear_bhb_loop+0x30/0x80 [ 44.296007][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296014][ T9495] RIP: 0033:0x4521d2 [ 44.296024][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 44.296032][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 44.296042][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004521d2 [ 44.296046][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6 RDI: 0000000000000004 [ 44.296051][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000 R09: 0000000000000000 [ 44.296055][ T9495] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc5937c28 [ 44.296059][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002 R15: 00000000004cba40 [ 44.296066][ T9495] </TASK> [ 44.296068][ T9495] [ 44.296071][ T9495] Allocated by task 9495: [ 44.296075][ T9495] kasan_save_track+0x3e/0x80 [ 44.296082][ T9495] __kasan_kmalloc+0x93/0xb0 [ 44.296090][ T9495] __kmalloc_noprof+0x36f/0x720 [ 44.296097][ T9495] gb_operation_message_alloc+0x8c/0x280 [ 44.296104][ T9495] gb_operation_create_common+0xa9/0x650 [ 44.296111][ T9495] gb_operation_create_flags+0xa2/0x2d0 [ 44.296117][ T9495] gb_hid_raw_request+0x1e6/0x860 [ 44.296123][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.296130][ T9495] hidraw_write+0x91/0xd0 [ 44.296137][ T9495] vfs_write+0x29a/0xb90 [ 44.296142][ T9495] ksys_write+0x150/0x270 [ 44.296148][ T9495] do_syscall_64+0x155/0x510 [ 44.296156][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296162][ T9495] [ 44.296163][ T9495] The buggy address belongs to the object at ffff88810d471a00 [ 44.296163][ T9495] which belongs to the cache kmalloc-16 of size 16 [ 44.296170][ T9495] The buggy address is located 10 bytes inside of [ 44.296170][ T9495] allocated 11-byte region [ffff88810d471a00, ffff88810d471a0b) [ 44.296177][ T9495] [ 44.296179][ T9495] The buggy address belongs to the physical page: [ 44.296186][ T9495] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d471 [ 44.296193][ T9495] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 44.296202][ T9495] page_type: f5(slab) [ 44.296212][ T9495] raw: 057ff00000000000 ffff88801b041640 dead000000000100 dead000000000122 [ 44.296217][ T9495] raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000 [ 44.296220][ T9495] page dumped because: kasan: bad access detected [ 44.296226][ T9495] page_owner tracks the page as allocated [ 44.296229][ T9495] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3657058998 [ 44.296240][ T9495] post_alloc_hook+0x1f9/0x250 [ 44.296247][ T9495] get_page_from_freelist+0x235a/0x23e0 [ 44.296255][ T9495] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 44.296262][ T9495] allocate_slab+0x7d/0x610 [ 44.296267][ T9495] refill_objects+0x2d6/0x350 [ 44.296272][ T9495] __pcs_replace_empty_main+0x2c9/0x6c0 [ 44.296281][ T9495] __kmalloc_noprof+0x48b/0x720 [ 44.296288][ T9495] usb_hcd_submit_urb+0x7a3/0x1b40 [ 44.296301][ T9495] usb_start_wait_urb+0x13f/0x5b0 [ 44.296308][ T9495] usb_control_msg+0x234/0x3e0 [ 44.296314][ T9495] hub_power_on+0x1b6/0x460 [ 44.296320][ T9495] hub_activate+0x345/0x1a80 [ 44.296327][ T9495] hub_probe+0x291e/0x3c10 [ 44.296334][ T9495] usb_probe_interface+0x71f/0xe00 [ 44.296342][ T9495] really_probe+0x267/0xaf0 [ 44.296366][ T9495] __driver_probe_device+0x1e2/0x350 [ 44.296372][ T9495] page_owner free stack trace missing [ 44.296375][ T9495] [ 44.296377][ T9495] Memory state around the buggy address: [ 44.296381][ T9495] ffff88810d471900: 00 04 fc fc 00 07 fc fc 00 00 fc fc 00 01 fc fc [ 44.296385][ T9495] ffff88810d471980: 00 01 fc fc 00 01 fc fc fa fb fc fc 00 01 fc fc [ 44.296389][ T9495] >ffff88810d471a00: 00 03 fc fc fa fb fc fc fa fb fc fc 00 01 fc fc [ 44.296393][ T9495] ^ [ 44.296396][ T9495] ffff88810d471a80: fa fb fc fc fa fb fc fc 00 00 fc fc 00 01 fc fc [ 44.296400][ T9495] ffff88810d471b00: 00 01 fc fc 00 01 fc fc 00 05 fc fc 00 05 fc fc [ 44.296404][ T9495] ================================================================== [ 44.297569][ T9495] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 44.352486][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full) [ 44.353650][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014 [ 44.354609][ T9495] Call Trace: [ 44.354919][ T9495] <TASK> [ 44.355192][ T9495] vpanic+0x56d/0xa60 [ 44.355639][ T9495] ? __pfx_vpanic+0x10/0x10 [ 44.356061][ T9495] panic+0xc5/0xd0 [ 44.356407][ T9495] ? __pfx_panic+0x10/0x10 [ 44.356831][ T9495] ? preempt_schedule_thunk+0x16/0x40 [ 44.357323][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.357800][ T9495] ? preempt_schedule_thunk+0x16/0x40 [ 44.358291][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.358771][ T9495] check_panic_on_warn+0x89/0xb0 [ 44.359225][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.359702][ T9495] end_report+0x73/0x170 [ 44.360095][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.360566][ T9495] kasan_report+0x128/0x150 [ 44.360998][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.361471][ T9495] kasan_check_range+0x264/0x2c0 [ 44.361929][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.362430][ T9495] __asan_memcpy+0x40/0x70 [ 44.362863][ T9495] gb_hid_raw_request+0x29c/0x860 [ 44.363348][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10 [ 44.363865][ T9495] ? __hid_hw_raw_request+0xa7/0x140 [ 44.364348][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.364825][ T9495] ? bpf_lsm_file_permission+0x9/0x20 [ 44.365314][ T9495] hidraw_write+0x91/0xd0 [ 44.365786][ T9495] ? __pfx_hidraw_write+0x10/0x10 [ 44.366245][ T9495] vfs_write+0x29a/0xb90 [ 44.366636][ T9495] ? __pfx_vfs_write+0x10/0x10 [ 44.367076][ T9495] ? __fget_files+0x2a/0x420 [ 44.367500][ T9495] ? __fget_files+0x2a/0x420 [ 44.367924][ T9495] ? __fget_files+0x3a0/0x420 [ 44.368352][ T9495] ? __fget_files+0x2a/0x420 [ 44.368791][ T9495] ksys_write+0x150/0x270 [ 44.369188][ T9495] ? __pfx_ksys_write+0x10/0x10 [ 44.369633][ T9495] do_syscall_64+0x155/0x510 [ 44.370063][ T9495] ? trace_irq_disable+0x3b/0x140 [ 44.370523][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.371077][ T9495] ? clear_bhb_loop+0x30/0x80 [ 44.371509][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.372046][ T9495] RIP: 0033:0x4521d2 [ 44.372407][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 44.374131][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 44.374887][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004521d2 [ 44.375673][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6 RDI: 0000000000000004 [ 44.376381][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000 R09: 0000000000000000 [ 44.377101][ T9495] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc5937c28 [ 44.377812][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002 R15: 00000000004cba40 [ 44.378522][ T9495] </TASK> [ 44.379100][ T9495] Kernel Offset: disabled [ 44.379644][ T9495] Rebooting in 86400 seconds.. Regards, SEFCOM Lab @ ASU

3 weeks, 1 day

[PATCH 2/2] staging: greybus: light: add comments to mutex definitions

by contectforbusiness＠proton.me

checkpatch complains about: CHECK: struct mutex definition without comment Add short comments describing what each mutex protects. The channel lock protects the channel state and lights_lock protects the lights array. No functional change, just quiets checkpatch. Signed-off-by: Vaibhav <contectforbusiness(a)proton.me> --- drivers/staging/greybus/light.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index cab02b5da..a036fa2a0 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -37,7 +37,7 @@ struct gb_channel { bool releasing; bool strobe_state; bool active; - struct mutex lock; + struct mutex lock; /* protects channel */ }; struct gb_light { @@ -59,7 +59,7 @@ struct gb_lights { struct gb_connection *connection; u8 lights_count; struct gb_light *lights; - struct mutex lights_lock; + struct mutex lights_lock; /* protects lights */ }; static void gb_lights_channel_free(struct gb_channel *channel);

3 weeks, 2 days

[PATCH] staging: greybus: fix missing newline in sysfs_emit() format strings

by tuxdevv

From: Deniz Gözen <denizgozen61(a)gmail.com> The show functions for the audio module's name, vid, pid, intf_id, ip_devices and op_devices sysfs attributes pass format strings to sysfs_emit() without a trailing newline. Per sysfs conventions each attribute should return content terminated by '\n', and checkpatch.pl flags all six calls as missing the terminator. Add the missing '\n' to each format string. Signed-off-by: Deniz Gözen <denizgozen61(a)gmail.com> --- drivers/staging/greybus/audio_manager_module.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2..5737f2a32 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute -- 2.55.0

3 weeks, 3 days

[PATCH v2] staging: greybus: uart: fix racy TIOCMIWAIT implementation

by Johan Hovold

Check the wakeup condition after adding the task to the waitqueue and updating the task state to avoid missing a racing modem status update or disconnect. Store the old icount on entry and do not update it in the completion handler to avoid missing events or reporting spurious ones (due to modem status changes before TIOCMIWAIT was called). Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added") Cc: stable(a)vger.kernel.org # 4.9 Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- Changes in v2 - store old icount on entry only drivers/staging/greybus/uart.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c index 24b4dab069c3..d47f00751e7a 100644 --- a/drivers/staging/greybus/uart.c +++ b/drivers/staging/greybus/uart.c @@ -53,7 +53,6 @@ struct gb_tty { spinlock_t read_lock; spinlock_t write_lock; struct async_icount iocount; - struct async_icount oldcount; wait_queue_head_t wioctl; struct mutex mutex; u8 ctrlin; /* input control lines */ @@ -643,11 +642,16 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg) if (!(arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD))) return -EINVAL; - do { + spin_lock_irq(&gb_tty->read_lock); + old = gb_tty->iocount; + spin_unlock_irq(&gb_tty->read_lock); + + add_wait_queue(&gb_tty->wioctl, &wait); + for (;;) { + set_current_state(TASK_INTERRUPTIBLE); + spin_lock_irq(&gb_tty->read_lock); - old = gb_tty->oldcount; new = gb_tty->iocount; - gb_tty->oldcount = new; spin_unlock_irq(&gb_tty->read_lock); if ((arg & TIOCM_DSR) && (old.dsr != new.dsr)) @@ -657,18 +661,20 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg) if ((arg & TIOCM_RI) && (old.rng != new.rng)) break; - add_wait_queue(&gb_tty->wioctl, &wait); - set_current_state(TASK_INTERRUPTIBLE); - schedule(); - remove_wait_queue(&gb_tty->wioctl, &wait); if (gb_tty->disconnected) { - if (arg & TIOCM_CD) - break; retval = -ENODEV; - } else if (signal_pending(current)) { + break; + } + + schedule(); + + if (signal_pending(current)) { retval = -ERESTARTSYS; + break; } - } while (!retval); + } + __set_current_state(TASK_RUNNING); + remove_wait_queue(&gb_tty->wioctl, &wait); return retval; } -- 2.55.0

3 weeks, 4 days

[PATCH] staging: greybus: uart: fix racy TIOCMIWAIT implementation

by Johan Hovold

The wakeup condition needs to be checked after adding the task to the waitqueue and updating the task state to avoid missing a racing modem status update or disconnect. Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added") Cc: stable(a)vger.kernel.org # 4.9 Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/staging/greybus/uart.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c index 24b4dab069c3..bcfea0a02155 100644 --- a/drivers/staging/greybus/uart.c +++ b/drivers/staging/greybus/uart.c @@ -643,7 +643,10 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg) if (!(arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD))) return -EINVAL; - do { + add_wait_queue(&gb_tty->wioctl, &wait); + for (;;) { + set_current_state(TASK_INTERRUPTIBLE); + spin_lock_irq(&gb_tty->read_lock); old = gb_tty->oldcount; new = gb_tty->iocount; @@ -657,18 +660,20 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg) if ((arg & TIOCM_RI) && (old.rng != new.rng)) break; - add_wait_queue(&gb_tty->wioctl, &wait); - set_current_state(TASK_INTERRUPTIBLE); - schedule(); - remove_wait_queue(&gb_tty->wioctl, &wait); if (gb_tty->disconnected) { - if (arg & TIOCM_CD) - break; retval = -ENODEV; - } else if (signal_pending(current)) { + break; + } + + schedule(); + + if (signal_pending(current)) { retval = -ERESTARTSYS; + break; } - } while (!retval); + } + __set_current_state(TASK_RUNNING); + remove_wait_queue(&gb_tty->wioctl, &wait); return retval; } -- 2.55.0

3 weeks, 4 days

[PATCH 0/5] rust: serdev: Refactor

by Markus Probst

The following has been changed: - introduce a new C serdev API to fix race conditions and simplify rust code. Should also be useful on the C side. - fix race conditions - simplify rust code - add rust function to provide mutable references to driver's private data - provide mutable references in callbacks to avoid the need for a SpinLock in the greybus patch series [1] [1] https://lore.kernel.org/rust-for-linux/20260827-gb-uart-transport-v2-7-a03b… Signed-off-by: Markus Probst <markus.probst(a)posteo.de> --- Markus Probst (5): tty: serdev: Export functions to pause receive_buf callback calls rust: serdev: Replace `active` mutex with receive pause rust: serdev: Simplify callbacks rust: Add `Device::drvdata_borrow_mut` rust: serdev: Pause receive callback before calling unbind drivers/tty/serdev/core.c | 50 +++++++++- drivers/tty/serdev/serdev-ttyport.c | 32 ++++++ include/linux/serdev.h | 6 ++ rust/kernel/device.rs | 24 +++++ rust/kernel/serdev.rs | 189 +++++++++++++----------------------- samples/rust/rust_driver_serdev.rs | 2 +- 6 files changed, 180 insertions(+), 123 deletions(-) --- base-commit: e5e04726cdd043e309677071ab1b65a4b18f422b change-id: 20260905-rust_serdev_probe_refactor-0e2b044354a7

3 weeks, 4 days

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev