On Mon, Aug 03, 2026 at 06:32:48AM +0530, Aditya Chari S wrote:
hub_control() sized the Greybus operation's response buffer purely off the caller-supplied wLength. However, per the USB hub class spec, GetHubDescriptor, GetHubStatus, and GetPortStatus have a response length that is fixed by the request type itself, and can be larger than (or independent of) whatever wLength the USB core happens to pass down. This could under-allocate the response buffer for these request types.
Special-case these three request types so the response buffer is always large enough for the data the module will actually send back, matching the equivalent handling in usbcore's rh_call_control(). Fall back to wLength for all other request types, as before.
Compile-tested with 'make M=drivers/staging/greybus C=1', including sparse, with no warnings. checkpatch --strict is also clean.
Note: this driver's hub_control() is currently unreachable at runtime since gb_usb_probe() unconditionally disables USB support pending separate USB core changes. As Project Ara hardware is no longer available, this change has not been tested on physical hardware or with a Greybus module; it was verified only by compilation, sparse, and code review against the equivalent logic in usbcore.
Signed-off-by: Aditya Chari S adi25charis@gmail.com
drivers/staging/greybus/usb.c | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-)
Cool, what tool was used to find this? Did you forget the Assisted-by: tag?
thanks,
greg k-h