greybus-dev

greybus-dev@lists.linaro.org

21 participants
881 discussions

[PATCH] greybus: fix typo "registerd" in comment

by Hemanth Selam

Correct "registerd" to "registered", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam(a)gmail.com> --- drivers/greybus/greybus_trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/greybus/greybus_trace.h b/drivers/greybus/greybus_trace.h index 616a3bd61aa6..3c331e09ea83 100644 --- a/drivers/greybus/greybus_trace.h +++ b/drivers/greybus/greybus_trace.h @@ -339,7 +339,7 @@ DEFINE_INTERFACE_EVENT(gb_interface_create); DEFINE_INTERFACE_EVENT(gb_interface_release); /* - * Occurs after an interface been registerd. + * Occurs after an interface been registered. */ DEFINE_INTERFACE_EVENT(gb_interface_add); -- 2.48.1

1 month, 1 week

[PATCH v2] greybus: operation: fix out-of-bounds write in message allocation

by Adriano Cordova

The incoming message size from the device header (header.size) is trusted without checking that it is at least the size of the message header itself, but a value smaller than sizeof(struct gb_operation_msg_hdr) underflows request_size in gb_operation_create_incoming(), wraps around in gb_operation_message_alloc(), and results in a tiny buffer that is then written past its end in gb_operation_message_init(). Reject undersized messages before parsing the message header. Fixes: 87d208feb74f ("greybus: embed message buffer into message structure") Reported-by: syzbot+2fd6aefc361af86911d5(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=2fd6aefc361af86911d5 Cc: stable(a)vger.kernel.org Assisted-by: opencode:deepseek v4 pro Signed-off-by: Adriano Cordova <adrianox(a)gmail.com> --- v2: point the Fixes tag at the proper commit (87d208feb74f), and add an Assisted-by tag. drivers/greybus/operation.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/greybus/operation.c b/drivers/greybus/operation.c index 7e12ffb2dd..df6daee4fb 100644 --- a/drivers/greybus/operation.c +++ b/drivers/greybus/operation.c @@ -1047,6 +1047,14 @@ void gb_connection_recv(struct gb_connection *connection, /* Use memcpy as data may be unaligned */ memcpy(&header, data, sizeof(header)); msg_size = le16_to_cpu(header.size); + if (msg_size < sizeof(header)) { + dev_err_ratelimited(dev, + "%s: malformed message 0x%04x of type 0x%02x received (%zu < %zu)\n", + connection->name, + le16_to_cpu(header.operation_id), + header.type, msg_size, sizeof(header)); + return; + } if (size < msg_size) { dev_err_ratelimited(dev, "%s: incomplete message 0x%04x of type 0x%02x received (%zu < %zu)\n", -- 2.51.0

1 month, 1 week

Re: [PATCH v3] greybus: operation: fix NULL-deref on short request

by Johan Hovold

On Fri, Sep 04, 2026 at 04:08:20PM +0800, Yang Zi wrote: > gb_connection_recv() accepts a received message whose advertised size is > smaller than struct gb_operation_msg_hdr. In particular, a header with a > size of zero passes the incomplete-message check and reaches > gb_operation_create_incoming(). > > The subtraction used to derive the request payload size then underflows. > When gb_operation_message_alloc() adds the header size, the result wraps > to zero, bypassing the maximum-buffer-size check. kzalloc(0) returns > ZERO_SIZE_PTR and gb_operation_message_init() subsequently dereferences > it. > > Reject advertised sizes smaller than the message header. Also check the > payload size before adding the header size, so that the size calculation > cannot wrap and bypass the buffer-size limit. > > This issue was found using a locally modified syzkaller. The > analysis and fix were assisted by GPT-5.6. > > Fixes: d90c25b0a279 ("greybus: let operation layer examine incoming data") This one should also be backported: Cc: stable(a)vger.kernel.org > Assisted-by: Codex:gpt-5.6 > Signed-off-by: Yang Zi <2959243019(a)qq.com> > --- You should put a short change log here (after ---) when revising patches. No need to resend this time, but keep in mind for the future. Reviewed-by: Johan Hovold <johan(a)kernel.org> Johan

1 month, 1 week

[PATCH] greybus: cap: bound IMS/auth memcpy to ioctl size

by Suraj Theekshana

cap_get_ims_certificate() and cap_authenticate() derive copy lengths from response payload sizes without checking the response header size or destination capacity. Reject responses smaller than their headers with -EMSGSIZE. Reject certificate and signature data larger than their fixed ioctl buffers with -E2BIG. Signed-off-by: Suraj Theekshana <surajtheekshana1111(a)gmail.com> --- drivers/staging/greybus/authentication.c | 27 ++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/staging/greybus/authentication.c b/drivers/staging/greybus/authentication.c index d8f2cd4..cbd28a3 100644 --- a/drivers/staging/greybus/authentication.c +++ b/drivers/staging/greybus/authentication.c @@ -128,9 +128,22 @@ static int cap_get_ims_certificate(struct gb_cap *cap, u32 class, u32 id, goto done; } + if (op->response->payload_size < sizeof(*response)) { + dev_err(cap->parent, + "invalid IMS certificate response size (%zu)\n", + op->response->payload_size); + ret = -EMSGSIZE; + goto done; + } + response = op->response->payload; *result = response->result_code; *size = op->response->payload_size - sizeof(*response); + if (*size > CAP_CERTIFICATE_MAX_SIZE) { + dev_err(cap->parent, "IMS certificate too large (%u)\n", *size); + ret = -E2BIG; + goto done; + } memcpy(certificate, response->certificate, *size); done: @@ -167,9 +180,23 @@ static int cap_authenticate(struct gb_cap *cap, u32 auth_type, u8 *uid, goto done; } + if (op->response->payload_size < sizeof(*response)) { + dev_err(cap->parent, + "invalid authenticate response size (%zu)\n", + op->response->payload_size); + ret = -EMSGSIZE; + goto done; + } + response = op->response->payload; *result = response->result_code; *signature_size = op->response->payload_size - sizeof(*response); + if (*signature_size > CAP_SIGNATURE_MAX_SIZE) { + dev_err(cap->parent, "authenticate signature too large (%u)\n", + *signature_size); + ret = -E2BIG; + goto done; + } memcpy(auth_response, response->response, sizeof(response->response)); memcpy(signature, response->signature, *signature_size); -- 2.43.0

1 month, 1 week

greybus: CAP IMS/auth memcpy not capped to ioctl buffer

by Suraj Theekshana

Hello, I am reporting an unbounded memcpy in the Greybus CAP driver. Product: Linux kernel File: drivers/staging/greybus/authentication.c Header: drivers/staging/greybus/greybus_authentication.h include/linux/greybus/greybus_protocols.h Tree: torvalds/linux 8ab1afb Observed ======== cap_get_ims_certificate() and cap_authenticate() do: *size = op->response->payload_size - sizeof(*response); memcpy(dest, src, *size); The response buffer is allocated with gb_operation_get_payload_size_max() and GB_OPERATION_FLAG_SHORT_RESPONSE. The ioctl destinations are fixed: certificate[CAP_CERTIFICATE_MAX_SIZE] /* 1600 */ signature[CAP_SIGNATURE_MAX_SIZE] /* 320 */ There is no check that payload_size >= sizeof(*response) and no cap to 1600 / 320. A 2048-byte payload therefore copies: IMS: 2048 - 1 = 2047 bytes into certificate[1600] AUTH: 2048 - 65 = 1983 bytes into signature[320] A payload shorter than the response header wraps the unsigned subtract and memcpy uses a huge length. Expected ======== Reject payload_size < sizeof(*response) (-EMSGSIZE). Reject copy length > CAP_CERTIFICATE_MAX_SIZE / CAP_SIGNATURE_MAX_SIZE (-E2BIG). Reproduce (no Greybus hardware) =============================== git clone --depth 1 https://github.com/torvalds/linux.git # tree used: 8ab1afb gcc -fsanitize=address -g -O0 -fno-builtin -U_FORTIFY_SOURCE \ -I gb-poc \ -I linux/drivers/staging/greybus \ -I linux/include/linux/greybus \ gb-poc/poc_cap_headers.c -o poc_cap_headers ./poc_cap_headers ./poc_cap_headers auth ASan excerpt (IMS) ================== CAP_CERTIFICATE_MAX_SIZE=1600 CAP_SIGNATURE_MAX_SIZE=320 [IMS] payload=2048 dest=1600 mode=ims ================================================================= ERROR: AddressSanitizer: stack-buffer-overflow WRITE of size 2047 #0 memcpy #1 cap_get_ims_certificate poc_cap_headers.c:18 #2 main poc_cap_headers.c:61 Address is located in stack of thread T0 This frame has 2 object(s): [48, 481) 'a' [560, 2173) 'ims' <== overflows certificate[1600] SUMMARY: AddressSanitizer: stack-buffer-overflow in memcpy ABORTING ASan excerpt (AUTH) =================== CAP_CERTIFICATE_MAX_SIZE=1600 CAP_SIGNATURE_MAX_SIZE=320 [AUTH] payload=2048 dest=320 ================================================================= ERROR: AddressSanitizer: stack-buffer-overflow WRITE of size 1983 #0 memcpy #1 cap_authenticate poc_cap_headers.c:26 #2 main poc_cap_headers.c:54 Address is located in stack of thread T0 This frame has 2 object(s): [48, 481) 'a' <== overflows signature[320] [560, 2173) 'ims' SUMMARY: AddressSanitizer: stack-buffer-overflow in memcpy ABORTING The PoC includes greybus_authentication.h and greybus_protocols.h from this tree. It is not a live CAP_IOC_* ioctl and there is no in-kernel KASAN frame. Impact ====== Local overflow in the CAP ioctl path if a CAP connection exists and a module answers GET_IMS_CERTIFICATE or AUTHENTICATE with an oversized or truncated payload. Not unauthenticated remote RCE. Same trust model as a malicious or buggy Greybus module. Files in the attached zip ========================= poc_cap_headers.c ktypes.h asan_ims.txt asan_auth.txt Regards, Suraj Theekshana

1 month, 1 week

[PATCH] rust: serdev: Synchronize receive callback before calling unbind

by Markus Probst

The receive callback and unbind callback now have exclusive access to the drivers private data. Provide mutable references in callbacks to avoid the need for locks in the private data. Remove the Sync requirement. Signed-off-by: Markus Probst <markus.probst(a)posteo.de> --- This patch avoids the need for a SpinLock in the patch series https://lore.kernel.org/rust-for-linux/20260827-gb-uart-transport-v2-7-a03b… . --- rust/kernel/serdev.rs | 51 ++++++++++++++++++++++---------------- samples/rust/rust_driver_serdev.rs | 2 +- 2 files changed, 31 insertions(+), 22 deletions(-) diff --git a/rust/kernel/serdev.rs b/rust/kernel/serdev.rs index 17ca504b7f8d..44f029ed93fd 100644 --- a/rust/kernel/serdev.rs +++ b/rust/kernel/serdev.rs @@ -106,7 +106,7 @@ pub struct PrivateData<'bound, T: Driver> { /// Whether `receive_buf_callback` is allowed to call `Driver::receive`. /// /// If locked, the receive_buf_callback will be blocked on data reception. - /// This is the case while the driver is being probed or while [`PrivateData`] is being dropped. + /// This is the case while the driver is being probed or removed. /// This is necessary, because we need to open the serdev device before the driver has been /// probed in order to allow it to be configured, which allows `receive_buf_callback` to be /// called. Thus we need to block data until probe completes and the driver data becomes @@ -127,16 +127,6 @@ pub struct PrivateData<'bound, T: Driver> { #[pinned_drop] impl<T: Driver> PinnedDrop for PrivateData<'_, T> { fn drop(self: Pin<&mut Self>) { - let mut active = self.active.lock(); - if *active { - // SAFETY: - // - We have exclusive access to `self.driver`. - // - `self.driver` is guaranteed to be initialized. - unsafe { (*self.driver.get()).assume_init_drop() }; - *active = false; - } - drop(active); - // SAFETY: We have exclusive access to `self.open`. if unsafe { *self.open.get() } { // SAFETY: `self.sdev.as_raw()` is guaranteed to be a pointer to a valid @@ -176,7 +166,20 @@ extern "C" fn probe_callback(sdev: *mut bindings::serdev_device) -> kernel::ffi: let private_data = unsafe { sdev.as_ref().drvdata_borrow::<PrivateData<'_, T>>() }; let private_data = ScopeGuard::new_with_data(private_data, |_| { // SAFETY: We just set drvdata to `PrivateData<'_, T>`. - drop(unsafe { sdev.as_ref().drvdata_obtain::<PrivateData<'_, T>>() }); + let private_data = unsafe { + sdev.as_ref() + .drvdata_obtain::<PrivateData<'_, T>>() + .unwrap_unchecked() + }; + + let mut active = private_data.active.lock(); + if *active { + // SAFETY: + // - We have exclusive access to `private_data.driver`. + // - `private_data.driver` is guaranteed to be initialized. + unsafe { (*private_data.driver.get()).assume_init_drop() }; + *active = false; + } }); let mut active = private_data.active.lock(); @@ -222,15 +225,21 @@ extern "C" fn remove_callback(sdev: *mut bindings::serdev_device) { // and stored a `Pin<KBox<PrivateData<'_, T>>>`. let private_data = unsafe { sdev.as_ref().drvdata_borrow::<PrivateData<'_, T>>() }; - // SAFETY: No one has exclusive access to `private_data.driver`. - let data = unsafe { &*private_data.driver.get() }; + let mut active = private_data.active.lock(); + + // SAFETY: We have exclusive access to `private_data.driver`. + let data = unsafe { &mut *private_data.driver.get() }; // SAFETY: // - `private_data.driver` is pinned. // - `remove_callback` is only ever called after a successful call to `probe_callback`, // hence it's guaranteed that `private_data.driver` was initialized. - let data_pinned = unsafe { Pin::new_unchecked(data.assume_init_ref()) }; + let data_pinned = unsafe { Pin::new_unchecked(data.assume_init_mut()) }; T::unbind(sdev, data_pinned); + + // SAFETY: We already established that `data` is guaranteed to be initialized. + unsafe { data.assume_init_drop() }; + *active = false; } extern "C" fn receive_buf_callback( @@ -254,13 +263,13 @@ extern "C" fn receive_buf_callback( return length; } - // SAFETY: No one has exclusive access to `private_data.driver`. - let data = unsafe { &*private_data.driver.get() }; + // SAFETY: We have exclusive access to `private_data.driver`. + let data = unsafe { &mut *private_data.driver.get() }; // SAFETY: // - `private_data.driver` is pinned. // - `receive_buf_callback` is only ever called after a successful call to `probe_callback`, // hence it's guaranteed that `private_data.driver` was initialized. - let data_pinned = unsafe { Pin::new_unchecked(data.assume_init_ref()) }; + let data_pinned = unsafe { Pin::new_unchecked(data.assume_init_mut()) }; // SAFETY: `buf` is guaranteed to be non-null and has the size of `length`. let buf = unsafe { core::slice::from_raw_parts(buf, length) }; @@ -365,7 +374,7 @@ pub trait Driver { type IdInfo: 'static; /// The type of the driver's bus device private data. - type Data<'bound>: Send + Sync + 'bound; + type Data<'bound>: Send + 'bound; /// The table of OF device ids supported by the driver. const OF_ID_TABLE: Option<of::IdTable<Self::IdInfo>> = None; @@ -391,7 +400,7 @@ fn probe<'bound>( /// `&Device<Core>` or `&Device<Bound>` reference. For instance. /// /// Otherwise, release operations for driver resources should be performed in `Drop`. - fn unbind<'bound>(sdev: &'bound Device<device::Core<'_>>, this: Pin<&Self::Data<'bound>>) { + fn unbind<'bound>(sdev: &'bound Device<device::Core<'_>>, this: Pin<&mut Self::Data<'bound>>) { let _ = (sdev, this); } @@ -402,7 +411,7 @@ fn unbind<'bound>(sdev: &'bound Device<device::Core<'_>>, this: Pin<&Self::Data< /// Returns the number of bytes accepted. fn receive<'bound>( sdev: &'bound Device<device::Bound>, - this: Pin<&Self::Data<'bound>>, + this: Pin<&mut Self::Data<'bound>>, data: &[u8], ) -> usize { let _ = (sdev, this, data); diff --git a/samples/rust/rust_driver_serdev.rs b/samples/rust/rust_driver_serdev.rs index 51b4898cd855..d00d547234c8 100644 --- a/samples/rust/rust_driver_serdev.rs +++ b/samples/rust/rust_driver_serdev.rs @@ -63,7 +63,7 @@ fn probe<'bound>( fn receive<'bound>( sdev: &'bound serdev::Device<Bound>, - _this: Pin<&Self>, + _this: Pin<&mut Self>, data: &[u8], ) -> usize { sdev.write(data).unwrap_or_default() as usize --- base-commit: e5e04726cdd043e309677071ab1b65a4b18f422b change-id: 20260903-rust_serdev_ref_mut-4d2285776ae1

1 month, 1 week

Re: [PATCH] staging: greybus: audio_codec: fix stack overflow in stream name parsing

by 2000jedi＠gmail.com

The content of this message was lost. It was probably cross-posted to multiple lists and previously handled on another list.

1 month, 2 weeks

[PATCH] greybus: operation: fix out-of-bounds write in message allocation

by Adriano Cordova

The incoming message size from the device header (header.size) is trusted without checking that it is at least the size of the message header itself, but a value smaller than sizeof(struct gb_operation_msg_hdr) underflows request_size in gb_operation_create_incoming(), wraps around in gb_operation_message_alloc(), and results in a tiny buffer that is then written past its end in gb_operation_message_init(). Reject undersized messages before parsing the message header. Fixes: d37b1db13f8b ("greybus: refactor gb_connection_recv()") Reported-by: syzbot+2fd6aefc361af86911d5(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=2fd6aefc361af86911d5 Cc: stable(a)vger.kernel.org Signed-off-by: Adriano Cordova <adrianox(a)gmail.com> --- drivers/greybus/operation.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/greybus/operation.c b/drivers/greybus/operation.c index 7e12ffb2dd..df6daee4fb 100644 --- a/drivers/greybus/operation.c +++ b/drivers/greybus/operation.c @@ -1047,6 +1047,14 @@ void gb_connection_recv(struct gb_connection *connection, /* Use memcpy as data may be unaligned */ memcpy(&header, data, sizeof(header)); msg_size = le16_to_cpu(header.size); + if (msg_size < sizeof(header)) { + dev_err_ratelimited(dev, + "%s: malformed message 0x%04x of type 0x%02x received (%zu < %zu)\n", + connection->name, + le16_to_cpu(header.operation_id), + header.type, msg_size, sizeof(header)); + return; + } if (size < msg_size) { dev_err_ratelimited(dev, "%s: incomplete message 0x%04x of type 0x%02x received (%zu < %zu)\n", -- 2.51.0

1 month, 2 weeks

[PATCH] staging: greybus: remove unused loopback macro

by André Moreira

The gb_loopback_attr macro is no longer used in the Greybus loopback driver. Remove the unused macro to avoid keeping dead code in the driver. Signed-off-by: André Moreira <andrem.33333(a)gmail.com> --- drivers/staging/greybus/loopback.c | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/drivers/staging/greybus/loopback.c b/drivers/staging/greybus/loopback.c index ea57b1f5d156..2a623fc2e99b 100644 --- a/drivers/staging/greybus/loopback.c +++ b/drivers/staging/greybus/loopback.c @@ -167,32 +167,6 @@ static DEVICE_ATTR_RO(name##_avg) gb_loopback_ro_stats_attr(field, max, u); \ gb_loopback_ro_avg_attr(field) -#define gb_loopback_attr(field, type) \ -static ssize_t field##_show(struct device *dev, \ - struct device_attribute *attr, \ - char *buf) \ -{ \ - struct gb_loopback *gb = dev_get_drvdata(dev); \ - return sysfs_emit(buf, "%" #type "\n", gb->field); \ -} \ -static ssize_t field##_store(struct device *dev, \ - struct device_attribute *attr, \ - const char *buf, \ - size_t len) \ -{ \ - int ret; \ - struct gb_loopback *gb = dev_get_drvdata(dev); \ - mutex_lock(&gb->mutex); \ - ret = sscanf(buf, "%"#type, &gb->field); \ - if (ret != 1) \ - len = -EINVAL; \ - else \ - gb_loopback_check_attr(gb, bundle); \ - mutex_unlock(&gb->mutex); \ - return len; \ -} \ -static DEVICE_ATTR_RW(field) - #define gb_dev_loopback_ro_attr(field) \ static ssize_t field##_show(struct device *dev, \ struct device_attribute *attr, \ -- 2.43.0

1 month, 2 weeks

[PATCH] staging: greybus: spilib: Handle SPI device types with a switch statement

by singh.supreet14＠gmail.com

From: Supreet <singh.supreet14(a)gmail.com> Replaced the if/else chain with switch statement. makes it easier to extend support for additional device types. Remove the temporary spidev variable since it is only used to test the return value of spi_new_device(). Call spi_new_device() directly in the conditional instead. checkpatch was run, had no warnings and errors. Signed-off-by: Supreet <singh.supreet14(a)gmail.com> --- drivers/staging/greybus/spilib.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/staging/greybus/spilib.c b/drivers/staging/greybus/spilib.c index e4d1ae8308aa..53fc0c124754 100644 --- a/drivers/staging/greybus/spilib.c +++ b/drivers/staging/greybus/spilib.c @@ -444,7 +444,6 @@ static int gb_spi_setup_device(struct gb_spilib *spi, u8 cs) struct gb_spi_device_config_request request; struct gb_spi_device_config_response response; struct spi_board_info spi_board = { {0} }; - struct spi_device *spidev; int ret; u8 dev_type; @@ -458,25 +457,29 @@ static int gb_spi_setup_device(struct gb_spilib *spi, u8 cs) dev_type = response.device_type; - if (dev_type == GB_SPI_SPI_DEV) + switch (dev_type) { + case GB_SPI_SPI_DEV: strscpy(spi_board.modalias, "spidev", sizeof(spi_board.modalias)); - else if (dev_type == GB_SPI_SPI_NOR) + break; + case GB_SPI_SPI_NOR: strscpy(spi_board.modalias, "spi-nor", sizeof(spi_board.modalias)); - else if (dev_type == GB_SPI_SPI_MODALIAS) + break; + case GB_SPI_SPI_MODALIAS: memcpy(spi_board.modalias, response.name, - sizeof(spi_board.modalias)); - else + sizeof(spi_board.modalias)); + break; + default: return -EINVAL; + } spi_board.mode = le16_to_cpu(response.mode); spi_board.bus_num = ctlr->bus_num; spi_board.chip_select = cs; spi_board.max_speed_hz = le32_to_cpu(response.max_speed_hz); - spidev = spi_new_device(ctlr, &spi_board); - if (!spidev) + if (!spi_new_device(ctlr, &spi_board)) return -EINVAL; return 0; -- 2.55.0

1 month, 2 weeks

← Newer
1
2
3
4
5
6
7
8
9
...
89
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev