From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51FD616A395 for ; Sat, 25 Jul 2026 14:37:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784990257; cv=none; b=j1M4wYbeTzS+SSedG+XaAuudzk4X/7NxWS0gjp78BwPHqbUUSktxFl4M7sSBexo9+XZetdJgNaYQTMCpSISGAP28FlXJHg0BVjRqsSF4sDTihKYS3VEWTe5TKxqDWiK3W4kOd1ab3cZiROOaBQhpEfXpJoxO3K9B6l0Eht1VAHI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784990257; c=relaxed/simple; bh=DUl951sgjAJRqc+JSCBkh++fLgbIO3zDuDknNUDq6UA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=GEIj8wE4A/ra/ZZqcBXT2994xLM0lzTBqMMaIVPsbFslEDNNVNWBiLig9adS2yOjElguHGBVr6VrIRnl4KNPqXDorLTsyHZq/JcULdoZ3xjhyohyCMx2nlaFaWmDeo8CTuC8yHinifsdfOm7ElwcebIETEI7eH8HOofibdNuyKk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kdQ566L5; arc=none smtp.client-ip=209.85.215.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kdQ566L5" Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-c9e30214d8fso1090371a12.3 for ; Sat, 25 Jul 2026 07:37:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784990256; x=1785595056; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=9dd0ULAJidWvfKczgVlSDcsUwkjhQY32lLZUZXriyL8=; b=kdQ566L5ic83CE5oCZTYB9rzuwlUO2HviTsKz6oM6AKzM0IGr/+ja3RKQhdt86orwe ySvOlY/3EFaouV/gQftyEEnfC618VUdlSo4iLTL18Iqcvy7bo+KhhV8qL5Ez8ygc/UMK gcg/50AZpge49vYdAhF7Xes/4GKKdgai6E3xwHujWRlGQ/Zy9Auk4xnTZeAUMzUciy0I 88gNKGESTKfq5DBOtFTe+dyfQ6d1KIiCeNplkCFhluebNPF+sN+gzuY/ArsRCmHhS+DS Tz5Z8h4+cXP+q8qoYbvMDFPeu9WvxnEEp3IXrRGXb6a9ff0SPcmzxRBd03zeWyW9Dln1 EoRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784990256; x=1785595056; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=9dd0ULAJidWvfKczgVlSDcsUwkjhQY32lLZUZXriyL8=; b=KbocLfbzh4tP6hTbs+P0WGz+6g577CaJpjZEuFUuTZMREU6VVDlAPN8B0N6no22qCd BaKX124iZLk8gmpsiB0d2CPo/8s2xdOTnG4Q4O84heFmB1fH4HgzoKGemX3cbgeKFFyq 6NzJfqQdwdKa49uGnwSESkxPKxb1bDDKUjXfPe9bCKnZ4GST0M04Uu89w2EGuyegtiSN oK6KkdTlP2pADMk5bE6EXlS28twECDWhuC1kyhx1yHjPZXY2k6++u9cDtq+N8hDiJ/Am gKxSONRmsFSccw79vLaI768XFHhN5Nx9lZEYt6Zzr+e1XF80KKkT2cT/w8kDsyLnWlQA dWAQ== X-Forwarded-Encrypted: i=1; AHgh+RqeNPOa/ncTe9akyMRCLrVhfothQZb2CIu12lilx7mf0ytNC5AewW7ypX7x/KGaJ2AjkiksUGheb2H2bzc=@vger.kernel.org X-Gm-Message-State: AOJu0YysssWjGBlsnXrm1R1+1ewPzyVVPK6kirPck7i2yW8RKlbgnwO5 SvimOeG+3rHXVIzCgYLXiSdPAq+Uy6eXyAX33lLsY9yRqqIK3itDoi4T X-Gm-Gg: AR+sD100fc57lo4cg0LcOYf5uFAhvl5dPHAVEViEgMA1YzeeRP4oVnUSsCJ2wqYSMSL Vp3R6I70cSrUJVoNiSGjmmogqxitztDvTh571QXiJyp3vr9POXusgMQ1tLdpumgJ2YuQX7iTauD Fp5lsiHguTPOo0n5sggppXHky+nbDO6je7UVpNfDnKNJ1P6strAPJddoJztw6A3RZ0FBGNChWip 50G8cGwWZ5bQ/W9uu3rvvnSqtB6W3gqeM86K+nifF2WMNIFJD/d6o+2kw5r8ls/ri2It308v0Py rGeS+5VgZirnakVTC6EdNEIjGOmLzOTssods760+58zLLmUn/JWclNMb0nmQdsS2skzBz8MXLkm B31+p9kxi0yfSsUplOh8rH2UnIWQt95OTq8xIlpMBHroxcKZbtzvE/Qogc9RBa5DSvvWhaytrRP 3xwMK43vb5NoMd7uC6B+qQk/kC0TsZjMs= X-Received: by 2002:a05:6a21:60c4:b0:3c4:320f:42f4 with SMTP id adf61e73a8af0-3c67df86a42mr2326561637.56.1784990254188; Sat, 25 Jul 2026 07:37:34 -0700 (PDT) Received: from kernel-dev ([49.36.97.234]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-314bc413766sm12027086eec.8.2026.07.25.07.37.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 25 Jul 2026 07:37:33 -0700 (PDT) From: Aditya Chari To: gregkh@linuxfoundation.org Cc: vaibhav.sr@gmail.com, mgreer@animalcreek.com, johan@kernel.org, elder@kernel.org, error27@gmail.com, greybus-dev@lists.linaro.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Aditya Chari Subject: [PATCH v3] greybus: audio: Split gb_audio_gb_get_topology() into size query and data fetch Date: Sat, 25 Jul 2026 20:07:21 +0530 Message-ID: <20260725143721.5908-1-adi25charis@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `gb_audio_gb_get_topology()` combined three separate responsibilities into a single call: querying the topology size, allocating a buffer for it, and fetching the topology data into that buffer. This left callers with no way to perform any of these steps independently, and forced the kzalloc() allocation to live inside the protocol‑layer driver rather than the caller, as already flagged by a FIXME comment at the call site in `audio_module.c`. Split the function into two: - `gb_audio_gb_get_topology_size()` – queries only the topology size - `gb_audio_gb_get_topology()` – fetches topology data into a caller‑supplied buffer of a given size Update the only caller, `gb_audio_probe()` in `audio_module.c`, to query the size first, allocate the topology buffer itself, then fetch the data into it, freeing the buffer via the existing `free_topology` error path on failure. The topology size is now stored as `size_t` and validated in the caller before allocation, addressing the earlier TODO and FIXME comments. This resolves both the "TODO: Split into separate calls" comment above the original function in `audio_gb.c` and the FIXME comment at the call site in `audio_module.c`, both of which are removed as part of this change. No functional change in behavior for the existing probe path. Reviewed-by: Dan Carpenter Signed-off-by: Aditya Chari --- drivers/staging/greybus/audio_codec.h | 4 ++- drivers/staging/greybus/audio_gb.c | 45 +++++++------------------- drivers/staging/greybus/audio_module.c | 27 ++++++++++++---- 3 files changed, 35 insertions(+), 41 deletions(-) diff --git a/drivers/staging/greybus/audio_codec.h b/drivers/staging/greybus/audio_codec.h index f3f7a7ec6..b45cd257d 100644 --- a/drivers/staging/greybus/audio_codec.h +++ b/drivers/staging/greybus/audio_codec.h @@ -178,8 +178,10 @@ int gbaudio_register_module(struct gbaudio_module_info *module); void gbaudio_unregister_module(struct gbaudio_module_info *module); /* protocol related */ +int gb_audio_gb_get_topology_size(struct gb_connection *connection, + size_t *size); int gb_audio_gb_get_topology(struct gb_connection *connection, - struct gb_audio_topology **topology); + struct gb_audio_topology *topology, size_t size); int gb_audio_gb_get_control(struct gb_connection *connection, u8 control_id, u8 index, struct gb_audio_ctl_elem_value *value); diff --git a/drivers/staging/greybus/audio_gb.c b/drivers/staging/greybus/audio_gb.c index 144591f1a..2e6f155d8 100644 --- a/drivers/staging/greybus/audio_gb.c +++ b/drivers/staging/greybus/audio_gb.c @@ -8,13 +8,10 @@ #include #include "audio_codec.h" -/* TODO: Split into separate calls */ -int gb_audio_gb_get_topology(struct gb_connection *connection, - struct gb_audio_topology **topology) +int gb_audio_gb_get_topology_size(struct gb_connection *connection, + size_t *size) { struct gb_audio_get_topology_size_response size_resp; - struct gb_audio_topology *topo; - u16 size; int ret; ret = gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY_SIZE, @@ -22,38 +19,18 @@ int gb_audio_gb_get_topology(struct gb_connection *connection, if (ret) return ret; - size = le16_to_cpu(size_resp.size); - if (size < sizeof(*topo)) - return -ENODATA; - - topo = kzalloc(size, GFP_KERNEL); - if (!topo) - return -ENOMEM; - - ret = gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY, NULL, 0, - topo, size); - if (ret) { - kfree(topo); - return ret; - } - - /* - * The size_* fields are supplied by the module and are used by - * gbaudio_tplg_parse_data() to compute offsets into the blob; make - * sure the sections fit within the fetched topology, so walking it - * cannot read out of bounds. - */ - if ((u64)le32_to_cpu(topo->size_dais) + le32_to_cpu(topo->size_controls) + - le32_to_cpu(topo->size_widgets) + le32_to_cpu(topo->size_routes) > - size - sizeof(*topo)) { - kfree(topo); - return -EINVAL; - } - - *topology = topo; + *size = le16_to_cpu(size_resp.size); return 0; } +EXPORT_SYMBOL_GPL(gb_audio_gb_get_topology_size); + +int gb_audio_gb_get_topology(struct gb_connection *connection, + struct gb_audio_topology *topology, size_t size) +{ + return gb_operation_sync(connection, GB_AUDIO_TYPE_GET_TOPOLOGY, NULL, 0, + topology, size); +} EXPORT_SYMBOL_GPL(gb_audio_gb_get_topology); int gb_audio_gb_get_control(struct gb_connection *connection, diff --git a/drivers/staging/greybus/audio_module.c b/drivers/staging/greybus/audio_module.c index 12c376c47..4cd1f42c1 100644 --- a/drivers/staging/greybus/audio_module.c +++ b/drivers/staging/greybus/audio_module.c @@ -239,6 +239,7 @@ static int gb_audio_probe(struct gb_bundle *bundle, struct gb_audio_manager_module_descriptor desc; struct gbaudio_data_connection *dai, *_dai; int ret, i; + size_t size; struct gb_audio_topology *topology; /* There should be at least one Management and one Data cport */ @@ -304,16 +305,30 @@ static int gb_audio_probe(struct gb_bundle *bundle, } gbmodule->dev_id = gbmodule->mgmt_connection->intf->interface_id; - /* - * FIXME: malloc for topology happens via audio_gb driver - * should be done within codec driver itself - */ - ret = gb_audio_gb_get_topology(gbmodule->mgmt_connection, &topology); + ret = gb_audio_gb_get_topology_size(gbmodule->mgmt_connection, &size); if (ret) { - dev_err(dev, "%d:Error while fetching topology\n", ret); + dev_err(dev, "%d:Error while fetching topology size\n", ret); + goto disable_connection; + } + + if (size < sizeof(*topology)) { + dev_err(dev, "Invalid topology size: %zu\n", size); + ret = -EINVAL; goto disable_connection; } + topology = kzalloc(size, GFP_KERNEL); + if (!topology) { + ret = -ENOMEM; + goto disable_connection; + } + + ret = gb_audio_gb_get_topology(gbmodule->mgmt_connection, topology, size); + if (ret) { + dev_err(dev, "%d:Error while fetching topology\n", ret); + goto free_topology; + } + /* process topology data */ ret = gbaudio_tplg_parse_data(gbmodule, topology); if (ret) { -- 2.53.0