greybus-dev

greybus-dev@lists.linaro.org

3 participants
578 discussions

[PATCH] staging: greybus: Fix the irq API abuse

by Thomas Gleixner

Nothing outside of low level architecture code is supposed to look up interrupt descriptors and fiddle with them. Replace the open coded abuse by calling generic_handle_irq(). This still does not explain why and in which context this connection magic is injecting interrupts in the first place and why this is correct and safe, but at least the API abuse is gone. Fixes: 036aad9d0224 ("greybus: gpio: add interrupt handling support") Fixes: 2611ebef8322 ("greybus: gpio: don't call irq-flow handler directly") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> --- drivers/staging/greybus/gpio.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) --- a/drivers/staging/greybus/gpio.c +++ b/drivers/staging/greybus/gpio.c @@ -364,8 +364,7 @@ static int gb_gpio_request_handler(struc struct gb_message *request; struct gb_gpio_irq_event_request *event; u8 type = op->type; - int irq; - struct irq_desc *desc; + int irq, ret; if (type != GB_GPIO_TYPE_IRQ_EVENT) { dev_err(dev, "unsupported unsolicited request: %u\n", type); @@ -391,17 +390,15 @@ static int gb_gpio_request_handler(struc dev_err(dev, "failed to find IRQ\n"); return -EINVAL; } - desc = irq_to_desc(irq); - if (!desc) { - dev_err(dev, "failed to look up irq\n"); - return -EINVAL; - } local_irq_disable(); - generic_handle_irq_desc(desc); + ret = generic_handle_irq(irq); local_irq_enable(); - return 0; + if (ret) + dev_err(dev, "failed to invoke irq handler\n"); + + return ret; } static int gb_gpio_request(struct gpio_chip *chip, unsigned int offset)

5 years, 3 months

[PATCH] staging: greybus: match parenthesis alignment

by Kaaira Gupta

Fix checkpatch.pl warning of alignment should match open parenthesis in audio_codec.c Signed-off-by: Kaaira Gupta <kgupta(a)es.iitr.ac.in> --- drivers/staging/greybus/audio_codec.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c index 08746c85dea6..d62f91f4e9a2 100644 --- a/drivers/staging/greybus/audio_codec.c +++ b/drivers/staging/greybus/audio_codec.c @@ -70,7 +70,7 @@ static int gbaudio_module_enable_tx(struct gbaudio_codec_info *codec, i2s_port = 0; /* fixed for now */ cportid = data->connection->hd_cport_id; ret = gb_audio_apbridgea_register_cport(data->connection, - i2s_port, cportid, + i2s_port, cportid, AUDIO_APBRIDGEA_DIRECTION_TX); if (ret) { dev_err_ratelimited(module->dev, @@ -160,7 +160,7 @@ static int gbaudio_module_disable_tx(struct gbaudio_module_info *module, int id) i2s_port = 0; /* fixed for now */ cportid = data->connection->hd_cport_id; ret = gb_audio_apbridgea_unregister_cport(data->connection, - i2s_port, cportid, + i2s_port, cportid, AUDIO_APBRIDGEA_DIRECTION_TX); if (ret) { dev_err_ratelimited(module->dev, @@ -205,7 +205,7 @@ static int gbaudio_module_enable_rx(struct gbaudio_codec_info *codec, i2s_port = 0; /* fixed for now */ cportid = data->connection->hd_cport_id; ret = gb_audio_apbridgea_register_cport(data->connection, - i2s_port, cportid, + i2s_port, cportid, AUDIO_APBRIDGEA_DIRECTION_RX); if (ret) { dev_err_ratelimited(module->dev, @@ -295,7 +295,7 @@ static int gbaudio_module_disable_rx(struct gbaudio_module_info *module, int id) i2s_port = 0; /* fixed for now */ cportid = data->connection->hd_cport_id; ret = gb_audio_apbridgea_unregister_cport(data->connection, - i2s_port, cportid, + i2s_port, cportid, AUDIO_APBRIDGEA_DIRECTION_RX); if (ret) { dev_err_ratelimited(module->dev, -- 2.17.1

5 years, 4 months

[PATCH] staging: Replace zero-length array with flexible-array member

by Gustavo A. R. Silva

The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva <gustavo(a)embeddedor.com> --- drivers/staging/gdm724x/gdm_mux.h | 2 +- drivers/staging/gdm724x/hci_packet.h | 6 ++-- drivers/staging/greybus/audio_apbridgea.h | 2 +- drivers/staging/ks7010/ks_hostif.h | 4 +-- .../staging/media/allegro-dvt/allegro-core.c | 2 +- drivers/staging/octeon-usb/octeon-hcd.c | 2 +- drivers/staging/rtl8192e/rtllib.h | 30 +++++++++---------- .../staging/rtl8192u/ieee80211/ieee80211.h | 28 ++++++++--------- drivers/staging/rtl8712/ieee80211.h | 4 +-- drivers/staging/rtl8712/rtl871x_mp_ioctl.h | 4 +-- drivers/staging/wilc1000/cfg80211.c | 10 +++---- drivers/staging/wilc1000/spi.c | 2 +- drivers/staging/wlan-ng/hfa384x.h | 4 +-- drivers/staging/wlan-ng/p80211types.h | 4 +-- 14 files changed, 52 insertions(+), 52 deletions(-) diff --git a/drivers/staging/gdm724x/gdm_mux.h b/drivers/staging/gdm724x/gdm_mux.h index 51c22e3d8aeb..87b8d921fdc8 100644 --- a/drivers/staging/gdm724x/gdm_mux.h +++ b/drivers/staging/gdm724x/gdm_mux.h @@ -29,7 +29,7 @@ struct mux_pkt_header { __le32 seq_num; __le32 payload_size; __le16 packet_type; - unsigned char data[0]; + unsigned char data[]; }; struct mux_tx { diff --git a/drivers/staging/gdm724x/hci_packet.h b/drivers/staging/gdm724x/hci_packet.h index 6dea3694afdd..faecdfbc664f 100644 --- a/drivers/staging/gdm724x/hci_packet.h +++ b/drivers/staging/gdm724x/hci_packet.h @@ -28,7 +28,7 @@ struct hci_packet { __dev16 cmd_evt; __dev16 len; - u8 data[0]; + u8 data[]; } __packed; struct tlv { @@ -51,7 +51,7 @@ struct sdu { __dev32 dft_eps_ID; __dev32 bearer_ID; __dev32 nic_type; - u8 data[0]; + u8 data[]; } __packed; struct multi_sdu { @@ -59,7 +59,7 @@ struct multi_sdu { __dev16 len; __dev16 num_packet; __dev16 reserved; - u8 data[0]; + u8 data[]; } __packed; struct hci_pdn_table_ind { diff --git a/drivers/staging/greybus/audio_apbridgea.h b/drivers/staging/greybus/audio_apbridgea.h index 3f1f4dd2c61a..efec0f815efd 100644 --- a/drivers/staging/greybus/audio_apbridgea.h +++ b/drivers/staging/greybus/audio_apbridgea.h @@ -65,7 +65,7 @@ struct audio_apbridgea_hdr { __u8 type; __le16 i2s_port; - __u8 data[0]; + __u8 data[]; } __packed; struct audio_apbridgea_set_config_request { diff --git a/drivers/staging/ks7010/ks_hostif.h b/drivers/staging/ks7010/ks_hostif.h index ca7dc8f5166c..39138191a556 100644 --- a/drivers/staging/ks7010/ks_hostif.h +++ b/drivers/staging/ks7010/ks_hostif.h @@ -70,7 +70,7 @@ struct hostif_data_request { #define TYPE_DATA 0x0000 #define TYPE_AUTH 0x0001 __le16 reserved; - u8 data[0]; + u8 data[]; } __packed; #define TYPE_PMK1 0x0001 @@ -194,7 +194,7 @@ enum mib_data_type { struct hostif_mib_value { __le16 size; __le16 type; - u8 body[0]; + u8 body[]; } __packed; struct hostif_mib_get_confirm_t { diff --git a/drivers/staging/media/allegro-dvt/allegro-core.c b/drivers/staging/media/allegro-dvt/allegro-core.c index 3be41698df4c..0a09b3622e78 100644 --- a/drivers/staging/media/allegro-dvt/allegro-core.c +++ b/drivers/staging/media/allegro-dvt/allegro-core.c @@ -434,7 +434,7 @@ struct mcu_msg_push_buffers_internal_buffer { struct mcu_msg_push_buffers_internal { struct mcu_msg_header header; u32 channel_id; - struct mcu_msg_push_buffers_internal_buffer buffer[0]; + struct mcu_msg_push_buffers_internal_buffer buffer[]; } __attribute__ ((__packed__)); struct mcu_msg_put_stream_buffer { diff --git a/drivers/staging/octeon-usb/octeon-hcd.c b/drivers/staging/octeon-usb/octeon-hcd.c index 582c9187559d..61471a19d4e6 100644 --- a/drivers/staging/octeon-usb/octeon-hcd.c +++ b/drivers/staging/octeon-usb/octeon-hcd.c @@ -406,7 +406,7 @@ struct octeon_hcd { */ struct octeon_temp_buffer { void *orig_buffer; - u8 data[0]; + u8 data[]; }; static inline struct usb_hcd *octeon_to_hcd(struct octeon_hcd *p) diff --git a/drivers/staging/rtl8192e/rtllib.h b/drivers/staging/rtl8192e/rtllib.h index 328f410daa03..b84f00b8d18b 100644 --- a/drivers/staging/rtl8192e/rtllib.h +++ b/drivers/staging/rtl8192e/rtllib.h @@ -728,14 +728,14 @@ struct rtllib_pspoll_hdr { struct rtllib_hdr { __le16 frame_ctl; __le16 duration_id; - u8 payload[0]; + u8 payload[]; } __packed; struct rtllib_hdr_1addr { __le16 frame_ctl; __le16 duration_id; u8 addr1[ETH_ALEN]; - u8 payload[0]; + u8 payload[]; } __packed; struct rtllib_hdr_2addr { @@ -743,7 +743,7 @@ struct rtllib_hdr_2addr { __le16 duration_id; u8 addr1[ETH_ALEN]; u8 addr2[ETH_ALEN]; - u8 payload[0]; + u8 payload[]; } __packed; struct rtllib_hdr_3addr { @@ -753,7 +753,7 @@ struct rtllib_hdr_3addr { u8 addr2[ETH_ALEN]; u8 addr3[ETH_ALEN]; __le16 seq_ctl; - u8 payload[0]; + u8 payload[]; } __packed; struct rtllib_hdr_4addr { @@ -764,7 +764,7 @@ struct rtllib_hdr_4addr { u8 addr3[ETH_ALEN]; __le16 seq_ctl; u8 addr4[ETH_ALEN]; - u8 payload[0]; + u8 payload[]; } __packed; struct rtllib_hdr_3addrqos { @@ -775,7 +775,7 @@ struct rtllib_hdr_3addrqos { u8 addr3[ETH_ALEN]; __le16 seq_ctl; __le16 qos_ctl; - u8 payload[0]; + u8 payload[]; } __packed; struct rtllib_hdr_4addrqos { @@ -787,13 +787,13 @@ struct rtllib_hdr_4addrqos { __le16 seq_ctl; u8 addr4[ETH_ALEN]; __le16 qos_ctl; - u8 payload[0]; + u8 payload[]; } __packed; struct rtllib_info_element { u8 id; u8 len; - u8 data[0]; + u8 data[]; } __packed; struct rtllib_authentication { @@ -802,7 +802,7 @@ struct rtllib_authentication { __le16 transaction; __le16 status; /*challenge*/ - struct rtllib_info_element info_element[0]; + struct rtllib_info_element info_element[]; } __packed; struct rtllib_disauth { @@ -818,7 +818,7 @@ struct rtllib_disassoc { struct rtllib_probe_request { struct rtllib_hdr_3addr header; /* SSID, supported rates */ - struct rtllib_info_element info_element[0]; + struct rtllib_info_element info_element[]; } __packed; struct rtllib_probe_response { @@ -829,7 +829,7 @@ struct rtllib_probe_response { /* SSID, supported rates, FH params, DS params, * CF params, IBSS params, TIM (if beacon), RSN */ - struct rtllib_info_element info_element[0]; + struct rtllib_info_element info_element[]; } __packed; /* Alias beacon for probe_response */ @@ -840,7 +840,7 @@ struct rtllib_assoc_request_frame { __le16 capability; __le16 listen_interval; /* SSID, supported rates, RSN */ - struct rtllib_info_element info_element[0]; + struct rtllib_info_element info_element[]; } __packed; struct rtllib_assoc_response_frame { @@ -848,7 +848,7 @@ struct rtllib_assoc_response_frame { __le16 capability; __le16 status; __le16 aid; - struct rtllib_info_element info_element[0]; /* supported rates */ + struct rtllib_info_element info_element[]; /* supported rates */ } __packed; struct rtllib_txb { @@ -859,7 +859,7 @@ struct rtllib_txb { u16 reserved; __le16 frag_size; __le16 payload_size; - struct sk_buff *fragments[0]; + struct sk_buff *fragments[]; }; #define MAX_SUBFRAME_COUNT 64 @@ -1792,7 +1792,7 @@ struct rtllib_device { /* This must be the last item so that it points to the data * allocated beyond this structure by alloc_rtllib */ - u8 priv[0]; + u8 priv[]; }; #define IEEE_A (1<<0) diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211.h b/drivers/staging/rtl8192u/ieee80211/ieee80211.h index 9576b647f6b1..39f4ddd86796 100644 --- a/drivers/staging/rtl8192u/ieee80211/ieee80211.h +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211.h @@ -886,14 +886,14 @@ enum ieee80211_mfie { struct rtl_80211_hdr { __le16 frame_ctl; __le16 duration_id; - u8 payload[0]; + u8 payload[]; } __packed; struct rtl_80211_hdr_1addr { __le16 frame_ctl; __le16 duration_id; u8 addr1[ETH_ALEN]; - u8 payload[0]; + u8 payload[]; } __packed; struct rtl_80211_hdr_2addr { @@ -901,7 +901,7 @@ struct rtl_80211_hdr_2addr { __le16 duration_id; u8 addr1[ETH_ALEN]; u8 addr2[ETH_ALEN]; - u8 payload[0]; + u8 payload[]; } __packed; struct rtl_80211_hdr_3addr { @@ -911,7 +911,7 @@ struct rtl_80211_hdr_3addr { u8 addr2[ETH_ALEN]; u8 addr3[ETH_ALEN]; __le16 seq_ctl; - u8 payload[0]; + u8 payload[]; } __packed; struct rtl_80211_hdr_4addr { @@ -922,7 +922,7 @@ struct rtl_80211_hdr_4addr { u8 addr3[ETH_ALEN]; __le16 seq_ctl; u8 addr4[ETH_ALEN]; - u8 payload[0]; + u8 payload[]; } __packed; struct rtl_80211_hdr_3addrqos { @@ -951,7 +951,7 @@ struct rtl_80211_hdr_4addrqos { struct ieee80211_info_element { u8 id; u8 len; - u8 data[0]; + u8 data[]; } __packed; struct ieee80211_authentication { @@ -960,7 +960,7 @@ struct ieee80211_authentication { __le16 transaction; __le16 status; /*challenge*/ - struct ieee80211_info_element info_element[0]; + struct ieee80211_info_element info_element[]; } __packed; struct ieee80211_disassoc { @@ -971,7 +971,7 @@ struct ieee80211_disassoc { struct ieee80211_probe_request { struct rtl_80211_hdr_3addr header; /* SSID, supported rates */ - struct ieee80211_info_element info_element[0]; + struct ieee80211_info_element info_element[]; } __packed; struct ieee80211_probe_response { @@ -982,7 +982,7 @@ struct ieee80211_probe_response { /* SSID, supported rates, FH params, DS params, * CF params, IBSS params, TIM (if beacon), RSN */ - struct ieee80211_info_element info_element[0]; + struct ieee80211_info_element info_element[]; } __packed; /* Alias beacon for probe_response */ @@ -993,7 +993,7 @@ struct ieee80211_assoc_request_frame { __le16 capability; __le16 listen_interval; /* SSID, supported rates, RSN */ - struct ieee80211_info_element info_element[0]; + struct ieee80211_info_element info_element[]; } __packed; struct ieee80211_reassoc_request_frame { @@ -1002,7 +1002,7 @@ struct ieee80211_reassoc_request_frame { __le16 listen_interval; u8 current_ap[ETH_ALEN]; /* SSID, supported rates, RSN */ - struct ieee80211_info_element info_element[0]; + struct ieee80211_info_element info_element[]; } __packed; struct ieee80211_assoc_response_frame { @@ -1010,7 +1010,7 @@ struct ieee80211_assoc_response_frame { __le16 capability; __le16 status; __le16 aid; - struct ieee80211_info_element info_element[0]; /* supported rates */ + struct ieee80211_info_element info_element[]; /* supported rates */ } __packed; struct ieee80211_txb { @@ -1021,7 +1021,7 @@ struct ieee80211_txb { u16 reserved; __le16 frag_size; __le16 payload_size; - struct sk_buff *fragments[0]; + struct sk_buff *fragments[]; }; #define MAX_TX_AGG_COUNT 16 @@ -2007,7 +2007,7 @@ struct ieee80211_device { /* This must be the last item so that it points to the data * allocated beyond this structure by alloc_ieee80211 */ - u8 priv[0]; + u8 priv[]; }; #define IEEE_A (1<<0) diff --git a/drivers/staging/rtl8712/ieee80211.h b/drivers/staging/rtl8712/ieee80211.h index 8098f6905554..dabaa8fd34fb 100644 --- a/drivers/staging/rtl8712/ieee80211.h +++ b/drivers/staging/rtl8712/ieee80211.h @@ -535,7 +535,7 @@ struct ieee80211_info_element_hdr { struct ieee80211_info_element { u8 id; u8 len; - u8 data[0]; + u8 data[]; } __packed; /* @@ -597,7 +597,7 @@ struct ieee80211_txb { u16 reserved; u16 frag_size; u16 payload_size; - struct sk_buff *fragments[0]; + struct sk_buff *fragments[]; }; /* SWEEP TABLE ENTRIES NUMBER*/ diff --git a/drivers/staging/rtl8712/rtl871x_mp_ioctl.h b/drivers/staging/rtl8712/rtl871x_mp_ioctl.h index 64e2ae436625..59fa6664d868 100644 --- a/drivers/staging/rtl8712/rtl871x_mp_ioctl.h +++ b/drivers/staging/rtl8712/rtl871x_mp_ioctl.h @@ -48,7 +48,7 @@ struct eeprom_rw_param { struct EFUSE_ACCESS_STRUCT { u16 start_addr; u16 cnts; - u8 data[0]; + u8 data[]; }; struct burst_rw_reg { @@ -324,7 +324,7 @@ struct mp_ioctl_handler { struct mp_ioctl_param { unsigned int subcode; unsigned int len; - unsigned char data[0]; + unsigned char data[]; }; #define GEN_MP_IOCTL_SUBCODE(code) _MP_IOCTL_ ## code ## _CMD_ diff --git a/drivers/staging/wilc1000/cfg80211.c b/drivers/staging/wilc1000/cfg80211.c index 995b1f306807..5d8faa01337d 100644 --- a/drivers/staging/wilc1000/cfg80211.c +++ b/drivers/staging/wilc1000/cfg80211.c @@ -62,7 +62,7 @@ struct wilc_p2p_pub_act_frame { u8 oui_type; u8 oui_subtype; u8 dialog_token; - u8 elem[0]; + u8 elem[]; } __packed; struct wilc_vendor_specific_ie { @@ -70,13 +70,13 @@ struct wilc_vendor_specific_ie { u8 tag_len; u8 oui[3]; u8 oui_type; - u8 attr[0]; + u8 attr[]; } __packed; struct wilc_attr_entry { u8 attr_type; __le16 attr_len; - u8 val[0]; + u8 val[]; } __packed; struct wilc_attr_oper_ch { @@ -91,13 +91,13 @@ struct wilc_attr_ch_list { u8 attr_type; __le16 attr_len; u8 country_code[IEEE80211_COUNTRY_STRING_LEN]; - u8 elem[0]; + u8 elem[]; } __packed; struct wilc_ch_list_elem { u8 op_class; u8 no_of_channels; - u8 ch_list[0]; + u8 ch_list[]; } __packed; static void cfg_scan_result(enum scan_event scan_event, diff --git a/drivers/staging/wilc1000/spi.c b/drivers/staging/wilc1000/spi.c index 44f7d48851b5..11653ac118cd 100644 --- a/drivers/staging/wilc1000/spi.c +++ b/drivers/staging/wilc1000/spi.c @@ -139,7 +139,7 @@ struct wilc_spi_read_rsp_data { u8 status; u8 resp_header; u8 resp_data[4]; - u8 crc[0]; + u8 crc[]; } __packed; struct wilc_spi_rsp_data { diff --git a/drivers/staging/wlan-ng/hfa384x.h b/drivers/staging/wlan-ng/hfa384x.h index bdd7f414fdbb..88e894dd3568 100644 --- a/drivers/staging/wlan-ng/hfa384x.h +++ b/drivers/staging/wlan-ng/hfa384x.h @@ -355,7 +355,7 @@ /* Commonly used basic types */ struct hfa384x_bytestr { __le16 len; - u8 data[0]; + u8 data[]; } __packed; struct hfa384x_bytestr32 { @@ -421,7 +421,7 @@ struct hfa384x_authenticate_station_data { /*-- Configuration Record: WPAData (data portion only) --*/ struct hfa384x_wpa_data { __le16 datalen; - u8 data[0]; /* max 80 */ + u8 data[]; /* max 80 */ } __packed; /*-------------------------------------------------------------------- diff --git a/drivers/staging/wlan-ng/p80211types.h b/drivers/staging/wlan-ng/p80211types.h index ac254542fde6..3dcdd022da61 100644 --- a/drivers/staging/wlan-ng/p80211types.h +++ b/drivers/staging/wlan-ng/p80211types.h @@ -204,7 +204,7 @@ struct p80211pstr { struct p80211pstrd { u8 len; - u8 data[0]; + u8 data[]; } __packed; /* Maximum pascal string */ @@ -249,7 +249,7 @@ struct p80211itemd { u32 did; u16 status; u16 len; - u8 data[0]; + u8 data[]; } __packed; /* message data item for int, BOUNDEDINT, ENUMINT */ -- 2.25.0

5 years, 4 months

[PATCH] staging: greybus: Replace zero-length array with flexible-array member

by Gustavo A. R. Silva

5 years, 4 months

[PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()

by Dan Carpenter

When we call kobject_put() and it's the last reference to the kobject then it calls gb_audio_module_release() and frees module. We dereference "module" on the next line which is a use after free. Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> --- drivers/staging/greybus/audio_manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c index 9b19ea9d3fa1..9a3f7c034ab4 100644 --- a/drivers/staging/greybus/audio_manager.c +++ b/drivers/staging/greybus/audio_manager.c @@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void) list_for_each_entry_safe(module, next, &modules_list, list) { list_del(&module->list); - kobject_put(&module->kobj); ida_simple_remove(&module_id, module->id); + kobject_put(&module->kobj); } is_empty = list_empty(&modules_list); -- 2.11.0

5 years, 4 months

[PATCH] staging: greybus: bootrom: fix uninitialized variables

by Saurav Girepunje

fix uninitialized variables issue found using static code analysis tool (error) Uninitialized variable: offset (error) Uninitialized variable: size Signed-off-by: Saurav Girepunje <saurav.girepunje(a)gmail.com> --- drivers/staging/greybus/bootrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index a8efb86..9eabeb3 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -245,7 +245,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op) struct gb_bootrom_get_firmware_request *firmware_request; struct gb_bootrom_get_firmware_response *firmware_response; struct device *dev = &op->connection->bundle->dev; - unsigned int offset, size; + unsigned int offset = 0, size = 0; enum next_request_type next_request; int ret = 0; -- 1.9.1

5 years, 5 months

[PATCH] staging: greybus: fix fw is NULL but dereferenced.

by Saurav Girepunje

Fix the warning reported by cocci check. Changes: In queue_work fw dereference before it actually get assigned. move queue_work before gb_bootrom_set_timeout. As gb_bootrom_get_firmware () return NEXT_REQ_READY_TO_BOOT only when there is no error and offset + size is actually equal to fw->size. So initialized next_request to NEXT_REQ_GET_FIRMWARE for return in other case. Signed-off-by: Saurav Girepunje <saurav.girepunje(a)gmail.com> --- drivers/staging/greybus/bootrom.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index a8efb86..f54514e 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -246,7 +246,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op) struct gb_bootrom_get_firmware_response *firmware_response; struct device *dev = &op->connection->bundle->dev; unsigned int offset, size; - enum next_request_type next_request; + enum next_request_type next_request = NEXT_REQ_GET_FIRMWARE; int ret = 0; /* Disable timeouts */ @@ -296,13 +296,11 @@ static int gb_bootrom_get_firmware(struct gb_operation *op) unlock: mutex_unlock(&bootrom->mutex); -queue_work: /* Refresh timeout */ if (!ret && (offset + size == fw->size)) next_request = NEXT_REQ_READY_TO_BOOT; - else - next_request = NEXT_REQ_GET_FIRMWARE; +queue_work: gb_bootrom_set_timeout(bootrom, next_request, NEXT_REQ_TIMEOUT_MS); return ret; -- 1.9.1

5 years, 5 months

[PATCH AUTOSEL 4.9 193/251] staging: greybus: light: fix a couple double frees

by Sasha Levin

From: Dan Carpenter <dan.carpenter(a)oracle.com> [ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ] The problem is in gb_lights_request_handler(). If we get a request to change the config then we release the light with gb_lights_light_release() and re-allocated it. However, if the allocation fails part way through then we call gb_lights_light_release() again. This can lead to a couple different double frees where we haven't cleared out the original values: gb_lights_light_v4l2_unregister(light); ... kfree(light->channels); kfree(light->name); I also made a small change to how we set "light->channels_count = 0;". The original code handled this part fine and did not cause a use after free but it was sort of complicated to read. Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Rui Miguel Silva <rmfrfs(a)gmail.com> Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/staging/greybus/light.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index 9f01427f35f9..1cb82cc28aa7 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -1102,21 +1102,21 @@ static void gb_lights_channel_release(struct gb_channel *channel) static void gb_lights_light_release(struct gb_light *light) { int i; - int count; light->ready = false; - count = light->channels_count; - if (light->has_flash) gb_lights_light_v4l2_unregister(light); + light->has_flash = false; - for (i = 0; i < count; i++) { + for (i = 0; i < light->channels_count; i++) gb_lights_channel_release(&light->channels[i]); - light->channels_count--; - } + light->channels_count = 0; + kfree(light->channels); + light->channels = NULL; kfree(light->name); + light->name = NULL; } static void gb_lights_release(struct gb_lights *glights) -- 2.20.1

5 years, 5 months

[PATCH AUTOSEL 4.14 283/371] staging: greybus: light: fix a couple double frees

by Sasha Levin

From: Dan Carpenter <dan.carpenter(a)oracle.com> [ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ] The problem is in gb_lights_request_handler(). If we get a request to change the config then we release the light with gb_lights_light_release() and re-allocated it. However, if the allocation fails part way through then we call gb_lights_light_release() again. This can lead to a couple different double frees where we haven't cleared out the original values: gb_lights_light_v4l2_unregister(light); ... kfree(light->channels); kfree(light->name); I also made a small change to how we set "light->channels_count = 0;". The original code handled this part fine and did not cause a use after free but it was sort of complicated to read. Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Rui Miguel Silva <rmfrfs(a)gmail.com> Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/staging/greybus/light.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index 0f538b8c3a07..4e7575147775 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -1103,21 +1103,21 @@ static void gb_lights_channel_release(struct gb_channel *channel) static void gb_lights_light_release(struct gb_light *light) { int i; - int count; light->ready = false; - count = light->channels_count; - if (light->has_flash) gb_lights_light_v4l2_unregister(light); + light->has_flash = false; - for (i = 0; i < count; i++) { + for (i = 0; i < light->channels_count; i++) gb_lights_channel_release(&light->channels[i]); - light->channels_count--; - } + light->channels_count = 0; + kfree(light->channels); + light->channels = NULL; kfree(light->name); + light->name = NULL; } static void gb_lights_release(struct gb_lights *glights) -- 2.20.1

5 years, 5 months

[PATCH AUTOSEL 4.19 518/671] staging: greybus: light: fix a couple double frees

by Sasha Levin

From: Dan Carpenter <dan.carpenter(a)oracle.com> [ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ] The problem is in gb_lights_request_handler(). If we get a request to change the config then we release the light with gb_lights_light_release() and re-allocated it. However, if the allocation fails part way through then we call gb_lights_light_release() again. This can lead to a couple different double frees where we haven't cleared out the original values: gb_lights_light_v4l2_unregister(light); ... kfree(light->channels); kfree(light->name); I also made a small change to how we set "light->channels_count = 0;". The original code handled this part fine and did not cause a use after free but it was sort of complicated to read. Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Rui Miguel Silva <rmfrfs(a)gmail.com> Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/staging/greybus/light.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c index 010ae1e9c7fb..40680eaf3974 100644 --- a/drivers/staging/greybus/light.c +++ b/drivers/staging/greybus/light.c @@ -1098,21 +1098,21 @@ static void gb_lights_channel_release(struct gb_channel *channel) static void gb_lights_light_release(struct gb_light *light) { int i; - int count; light->ready = false; - count = light->channels_count; - if (light->has_flash) gb_lights_light_v4l2_unregister(light); + light->has_flash = false; - for (i = 0; i < count; i++) { + for (i = 0; i < light->channels_count; i++) gb_lights_channel_release(&light->channels[i]); - light->channels_count--; - } + light->channels_count = 0; + kfree(light->channels); + light->channels = NULL; kfree(light->name); + light->name = NULL; } static void gb_lights_release(struct gb_lights *glights) -- 2.20.1

5 years, 5 months

← Newer
1
...
37
38
39
40
41
42
43
...
58
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev