* Re: [PATCH] staging: fbtft: fix unaligned vmem writes when txbuf is byte-offset
From: kernel test robot @ 2026-06-25 13:20 UTC (permalink / raw)
To: suryasaimadhu, andy
Cc: oe-kbuild-all, gregkh, dri-devel, linux-fbdev, linux-staging,
linux-kernel, suryasaimadhu
In-Reply-To: <20260625110237.304435-1-suryasaimadhu369@gmail.com>
Hi suryasaimadhu,
kernel test robot noticed the following build errors:
[auto build test ERROR on staging/staging-testing]
url: https://github.com/intel-lab-lkp/linux/commits/suryasaimadhu/staging-fbtft-fix-unaligned-vmem-writes-when-txbuf-is-byte-offset/20260625-190423
base: staging/staging-testing
patch link: https://lore.kernel.org/r/20260625110237.304435-1-suryasaimadhu369%40gmail.com
patch subject: [PATCH] staging: fbtft: fix unaligned vmem writes when txbuf is byte-offset
config: sh-allmodconfig (https://download.01.org/0day-ci/archive/20260625/202606252119.rClVa8On-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260625/202606252119.rClVa8On-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606252119.rClVa8On-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/staging/fbtft/fbtft-bus.c: In function 'fbtft_write_vmem16_bus8':
>> drivers/staging/fbtft/fbtft-bus.c:157:25: error: implicit declaration of function 'put_unaligned' [-Wimplicit-function-declaration]
157 | put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
| ^~~~~~~~~~~~~
vim +/put_unaligned +157 drivers/staging/fbtft/fbtft-bus.c
113
114 /*****************************************************************************
115 *
116 * int (*write_vmem)(struct fbtft_par *par);
117 *
118 *****************************************************************************/
119
120 /* 16 bit pixel over 8-bit databus */
121 int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
122 {
123 u16 *vmem16;
124 __be16 *txbuf16 = par->txbuf.buf;
125 size_t remain;
126 size_t to_copy;
127 size_t tx_array_size;
128 int i;
129 int ret = 0;
130 size_t startbyte_size = 0;
131
132 remain = len / 2;
133 vmem16 = (u16 *)(par->info->screen_buffer + offset);
134
135 gpiod_set_value(par->gpio.dc, 1);
136
137 /* non buffered write */
138 if (!par->txbuf.buf)
139 return par->fbtftops.write(par, vmem16, len);
140
141 /* buffered write */
142 tx_array_size = par->txbuf.len / 2;
143
144 if (par->startbyte) {
145 txbuf16 = par->txbuf.buf + 1;
146 tx_array_size -= 2;
147 *(u8 *)(par->txbuf.buf) = par->startbyte | 0x2;
148 startbyte_size = 1;
149 }
150
151 while (remain) {
152 to_copy = min(tx_array_size, remain);
153 dev_dbg(par->info->device, "to_copy=%zu, remain=%zu\n",
154 to_copy, remain - to_copy);
155
156 for (i = 0; i < to_copy; i++)
> 157 put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
158
159 vmem16 = vmem16 + to_copy;
160 ret = par->fbtftops.write(par, par->txbuf.buf,
161 startbyte_size + to_copy * 2);
162 if (ret < 0)
163 return ret;
164 remain -= to_copy;
165 }
166
167 return ret;
168 }
169 EXPORT_SYMBOL(fbtft_write_vmem16_bus8);
170
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH] staging: iio: frequency: ad9834: use guard() for mutex locking
From: Greg Kroah-Hartman @ 2026-06-25 12:40 UTC (permalink / raw)
To: Batu Ada Tutkun
Cc: Jonathan Cameron, David Lechner, Nuno Sá, Andy Shevchenko,
linux-iio, linux-staging, linux-kernel
In-Reply-To: <20260625120456.1267-1-batuadatutkun@gmail.com>
On Thu, Jun 25, 2026 at 03:04:55PM +0300, Batu Ada Tutkun wrote:
> Replace manual mutex_lock()/mutex_unlock() pairs with guard(mutex) in
> ad9834_write() and ad9834_store_wavetype(). The mutex is now released
> automatically when each function returns, removing the need for
> explicit unlock calls.
You only need to do this for new code, no need to change existing code
unless you are fixing a bug by using guard().
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] staging: iio: frequency: ad9834: use guard() for mutex locking
From: Joshua Crofts @ 2026-06-25 12:43 UTC (permalink / raw)
To: Batu Ada Tutkun
Cc: Jonathan Cameron, David Lechner, Nuno Sá, Andy Shevchenko,
Greg Kroah-Hartman, linux-iio, linux-staging, linux-kernel
In-Reply-To: <20260625120456.1267-1-batuadatutkun@gmail.com>
On Thu, 25 Jun 2026 15:04:55 +0300
Batu Ada Tutkun <batuadatutkun@gmail.com> wrote:
> @@ -17,6 +17,7 @@
> #include <linux/regulator/consumer.h>
> #include <linux/err.h>
> #include <linux/module.h>
> +#include <linux/mutex.h>
> #include <asm/div64.h>
You're definitely developing against an old tree - this won't
apply cleanly :( Please update your branch.
> #include <linux/iio/iio.h>
> @@ -152,7 +153,7 @@ static ssize_t ad9834_write(struct device *dev,
> if (ret)
> return ret;
>
> - mutex_lock(&st->lock);
> + guard(mutex)(&st->lock);
Blank line here.
> switch ((u32)this_attr->address) {
--
Kind regards
CJD
^ permalink raw reply
* [PATCH] staging: iio: frequency: ad9834: use guard() for mutex locking
From: Batu Ada Tutkun @ 2026-06-25 12:04 UTC (permalink / raw)
To: Jonathan Cameron
Cc: David Lechner, Nuno Sá, Andy Shevchenko, Greg Kroah-Hartman,
linux-iio, linux-staging, linux-kernel, Batu Ada Tutkun
Replace manual mutex_lock()/mutex_unlock() pairs with guard(mutex) in
ad9834_write() and ad9834_store_wavetype(). The mutex is now released
automatically when each function returns, removing the need for
explicit unlock calls.
Signed-off-by: Batu Ada Tutkun <batuadatutkun@gmail.com>
---
drivers/staging/iio/frequency/ad9834.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c
index bdb2580e2..f15819eaf 100644
--- a/drivers/staging/iio/frequency/ad9834.c
+++ b/drivers/staging/iio/frequency/ad9834.c
@@ -17,6 +17,7 @@
#include <linux/regulator/consumer.h>
#include <linux/err.h>
#include <linux/module.h>
+#include <linux/mutex.h>
#include <asm/div64.h>
#include <linux/iio/iio.h>
@@ -152,7 +153,7 @@ static ssize_t ad9834_write(struct device *dev,
if (ret)
return ret;
- mutex_lock(&st->lock);
+ guard(mutex)(&st->lock);
switch ((u32)this_attr->address) {
case AD9834_REG_FREQ0:
case AD9834_REG_FREQ1:
@@ -210,7 +211,6 @@ static ssize_t ad9834_write(struct device *dev,
default:
ret = -ENODEV;
}
- mutex_unlock(&st->lock);
return ret ? ret : len;
}
@@ -226,7 +226,7 @@ static ssize_t ad9834_store_wavetype(struct device *dev,
int ret = 0;
bool is_ad9833_7 = (st->devid == ID_AD9833) || (st->devid == ID_AD9837);
- mutex_lock(&st->lock);
+ guard(mutex)(&st->lock);
switch ((u32)this_attr->address) {
case 0:
@@ -269,7 +269,6 @@ static ssize_t ad9834_store_wavetype(struct device *dev,
st->data = cpu_to_be16(AD9834_REG_CMD | st->control);
ret = spi_sync(st->spi, &st->msg);
}
- mutex_unlock(&st->lock);
return ret ? ret : len;
}
--
2.53.0
^ permalink raw reply related
* Re: [PATCH] staging: fbtft: fix unaligned access and txbuf safety issues
From: Dan Carpenter @ 2026-06-25 12:00 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <20260625114215.325973-1-suryasaimadhu369@gmail.com>
On Thu, Jun 25, 2026 at 07:42:15PM +0800, suryasaimadhu wrote:
> This patch addresses several pre-existing issues in the fbtft driver:
>
> 1. define_fbtft_write_reg(): when par->startbyte is set, buf is
> advanced by one byte creating a misaligned pointer for 16-bit types.
> Use put_unaligned() for register writes and fix the SPI transfer
> size from len * (sizeof(data_type) + offset) to
> len * sizeof(data_type) + offset.
>
> 2. fbtft_write_vmem16_bus8() and fb_ra8875 write_vmem16_bus8(): same
> unaligned 16-bit stores when txbuf is byte-offset for a start
> prefix. Use put_unaligned() for pixel data copies.
>
> 3. tx_array_size underflow: both vmem helpers subtract 2 from
> tx_array_size when a startbyte prefix is used. A small txbuflen
> device property causes unsigned underflow and out-of-bounds heap
> writes. Fall back to the non-buffered write path when the buffer
> is too small.
>
> 4. fb_ra8875 write_vmem16_bus8(): missing NULL check for
> par->txbuf.buf, which remains NULL on big-endian when txbuflen is
> 0 because the PAGE_SIZE fallback is little-endian only. Fall back
> to direct write when the buffer is missing.
>
> Also replace empty modifier arguments in define_fbtft_write_reg() with
> a no-op macro to fix checkpatch warnings.
>
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
Is this how you would sign a legal document?
This patch does too many things at once. Split it up. Also please
a delay between sending us patches. Otherwise it's overwhelming to
deal with. Bunch them together in a patchset instead of sending them
one by one.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH] staging: vme_user: bound slave windows to DMA buffers
From: Dan Carpenter @ 2026-06-25 11:58 UTC (permalink / raw)
To: Yousef Alhouseen; +Cc: Greg Kroah-Hartman, linux-staging, linux-kernel
In-Reply-To: <aj0WWwiOzjLGbY5z@stanley.mountain>
On Thu, Jun 25, 2026 at 02:51:55PM +0300, Dan Carpenter wrote:
> There are two bug fixes in this patch:
>
> 1) The driver allows you to set any value for size.
> 2) The vme_get_size() function returns zero on error but nothing
> checks for error.
>
> There is a third bug as well which is not addressed.
>
> 3) The slave.vme_addr is not checked and it allows you to read/write
> to any memory.
>
> It sort of looks like bugs 1 and 2 only affect
> drivers/staging/vme_user/vme_fake.c.
Actually, no. The bugs seem to affect drivers/staging/vme_user/vme_tsi148.c
but the variables are stored to registers instead of variables so it
was a little more convoluted.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH] staging: vme_user: bound slave windows to DMA buffers
From: Dan Carpenter @ 2026-06-25 11:51 UTC (permalink / raw)
To: Yousef Alhouseen; +Cc: Greg Kroah-Hartman, linux-staging, linux-kernel
In-Reply-To: <20260625093137.6589-1-alhouseenyousef@gmail.com>
There are two bug fixes in this patch:
1) The driver allows you to set any value for size.
2) The vme_get_size() function returns zero on error but nothing
checks for error.
There is a third bug as well which is not addressed.
3) The slave.vme_addr is not checked and it allows you to read/write
to any memory.
It sort of looks like bugs 1 and 2 only affect
drivers/staging/vme_user/vme_fake.c. I feel like people hacked
together some debug code and weren't too worried about the security
since it wasn't intended to be used on real systems... The temptation
is to fix this by deleting at least vme_fake.c.
On Thu, Jun 25, 2026 at 11:31:37AM +0200, Yousef Alhouseen wrote:
> vme_user allocates a fixed PCI_BUF_SIZE coherent DMA buffer for each
> slave image, but VME_SET_SLAVE passes the user-supplied size to
> vme_slave_set() unchanged.
Obviously you meant checked instead of changed... There is some
checking in vme_check_window() but it's not suffient.
> An enabled window larger than PCI_BUF_SIZE lets
> the bridge expose DMA addresses beyond the allocation.
>
> The character device read/write paths also derive their bounds from
> vme_get_size(), so the oversized programmed window can make
> buffer_to_user() and buffer_from_user() access past
> image[minor].kern_buf.
>
> Reject enabled slave windows that do not fit in the backing buffer and use
> the same capped size for slave read/write/llseek bounds. Also convert the
> read/write limit checks to subtraction-based form so offset + count cannot
> wrap around the image size check.
An "also" in the commit message, means split it out into its own patch.
>
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
> ---
Fixes tag. Please say when you are using AI.
> drivers/staging/vme_user/vme_user.c | 38 ++++++++++++++++++++++-------
> 1 file changed, 29 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/staging/vme_user/vme_user.c b/drivers/staging/vme_user/vme_user.c
> index 11e25c2f6..24d3c6ec3 100644
> --- a/drivers/staging/vme_user/vme_user.c
> +++ b/drivers/staging/vme_user/vme_user.c
> @@ -175,11 +175,22 @@ static ssize_t buffer_from_user(unsigned int minor, const char __user *buf,
> return count;
> }
>
> +static size_t vme_user_get_image_size(unsigned int minor)
> +{
> + size_t image_size = vme_get_size(image[minor].resource);
> +
> + if (type[minor] == SLAVE_MINOR)
> + image_size = min_t(size_t, image_size, image[minor].size_buf);
> +
> + return image_size;
> +}
No, vme_get_size() should return the correct size. If it's really a
bug then fix that instead of adding a work-around here.
> +
> static ssize_t vme_user_read(struct file *file, char __user *buf, size_t count,
> loff_t *ppos)
> {
> unsigned int minor = iminor(file_inode(file));
> ssize_t retval;
> + size_t offset;
No need for this variable.
> size_t image_size;
>
> if (minor == CONTROL_MINOR)
> @@ -188,17 +199,19 @@ static ssize_t vme_user_read(struct file *file, char __user *buf, size_t count,
> mutex_lock(&image[minor].mutex);
>
> /* XXX Do we *really* want this helper - we can use vme_*_get ? */
> - image_size = vme_get_size(image[minor].resource);
> + image_size = vme_user_get_image_size(minor);
vme_get_size() returns zero on error. Just add an check for errors:
if (image_size == 0) {
mutex_unlock(&image[minor].mutex);
return 0;
}
>
> /* Ensure we are starting at a valid location */
> - if ((*ppos < 0) || (*ppos > (image_size - 1))) {
> + if ((*ppos < 0) || ((u64)*ppos >= image_size)) {
No need for this cast.
if ((*ppos < 0) || (*ppos >= image_size)) {
But actually if we check for zero then this is unnecesssary.
> mutex_unlock(&image[minor].mutex);
> return 0;
> }
>
> + offset = *ppos;
> +
> /* Ensure not reading past end of the image */
> - if (*ppos + count > image_size)
> - count = image_size - *ppos;
> + if (count > image_size - offset)
> + count = image_size - offset;
The kernel ensures that "*ppos + count" can't overflow in
rw_verify_area() so this change is unnecessary.
>
> switch (type[minor]) {
> case MASTER_MINOR:
> @@ -223,6 +236,7 @@ static ssize_t vme_user_write(struct file *file, const char __user *buf,
> {
> unsigned int minor = iminor(file_inode(file));
> ssize_t retval;
> + size_t offset;
> size_t image_size;
>
> if (minor == CONTROL_MINOR)
> @@ -230,17 +244,19 @@ static ssize_t vme_user_write(struct file *file, const char __user *buf,
>
> mutex_lock(&image[minor].mutex);
>
> - image_size = vme_get_size(image[minor].resource);
> + image_size = vme_user_get_image_size(minor);
>
> /* Ensure we are starting at a valid location */
> - if ((*ppos < 0) || (*ppos > (image_size - 1))) {
> + if ((*ppos < 0) || ((u64)*ppos >= image_size)) {
> mutex_unlock(&image[minor].mutex);
> return 0;
> }
>
> + offset = *ppos;
> +
> /* Ensure not reading past end of the image */
> - if (*ppos + count > image_size)
> - count = image_size - *ppos;
> + if (count > image_size - offset)
> + count = image_size - offset;
>
> switch (type[minor]) {
> case MASTER_MINOR:
> @@ -271,7 +287,7 @@ static loff_t vme_user_llseek(struct file *file, loff_t off, int whence)
> case MASTER_MINOR:
> case SLAVE_MINOR:
> mutex_lock(&image[minor].mutex);
> - image_size = vme_get_size(image[minor].resource);
> + image_size = vme_user_get_image_size(minor);
> res = fixed_size_llseek(file, off, whence, image_size);
> mutex_unlock(&image[minor].mutex);
> return res;
> @@ -394,6 +410,10 @@ static int vme_user_ioctl(struct inode *inode, struct file *file,
> return -EFAULT;
> }
>
> + if (slave.enable &&
> + (!slave.size || slave.size > image[minor].size_buf))
> + return -EINVAL;
This isn't the right place to check... It should probably be done in
vme_check_window()?
This code is quite tricky and I don't really understand it all. Why does
resource_to/from_user() check for buffer overflow but buffer_to/from_user()
does not? The checking in resource_to/from_user() is also insufficient
because it doesn't take *ppos into consideration but fortunately,
vme_master_read/write() does. This code would be safer if we added
bounds checking to buffer_to/from_user().
regards,
dan carpenter
> +
> /* XXX We do not want to push aspace, cycle and width
> * to userspace as they are
> */
> --
> 2.54.0
>
^ permalink raw reply
* [PATCH] staging: fbtft: fix unaligned access and txbuf safety issues
From: suryasaimadhu @ 2026-06-25 11:42 UTC (permalink / raw)
To: andy
Cc: gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
In-Reply-To: <20260625111602.438761F000E9@smtp.kernel.org>
This patch addresses several pre-existing issues in the fbtft driver:
1. define_fbtft_write_reg(): when par->startbyte is set, buf is
advanced by one byte creating a misaligned pointer for 16-bit types.
Use put_unaligned() for register writes and fix the SPI transfer
size from len * (sizeof(data_type) + offset) to
len * sizeof(data_type) + offset.
2. fbtft_write_vmem16_bus8() and fb_ra8875 write_vmem16_bus8(): same
unaligned 16-bit stores when txbuf is byte-offset for a start
prefix. Use put_unaligned() for pixel data copies.
3. tx_array_size underflow: both vmem helpers subtract 2 from
tx_array_size when a startbyte prefix is used. A small txbuflen
device property causes unsigned underflow and out-of-bounds heap
writes. Fall back to the non-buffered write path when the buffer
is too small.
4. fb_ra8875 write_vmem16_bus8(): missing NULL check for
par->txbuf.buf, which remains NULL on big-endian when txbuflen is
0 because the PAGE_SIZE fallback is little-endian only. Fall back
to direct write when the buffer is missing.
Also replace empty modifier arguments in define_fbtft_write_reg() with
a no-op macro to fix checkpatch warnings.
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/fbtft/fb_ra8875.c | 10 +++++++++-
drivers/staging/fbtft/fbtft-bus.c | 25 +++++++++++++++++--------
2 files changed, 26 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/fbtft/fb_ra8875.c b/drivers/staging/fbtft/fb_ra8875.c
index 0ab1de664..06f650aac 100644
--- a/drivers/staging/fbtft/fb_ra8875.c
+++ b/drivers/staging/fbtft/fb_ra8875.c
@@ -10,6 +10,7 @@
#include <linux/delay.h>
#include <linux/gpio/consumer.h>
+#include <linux/unaligned.h>
#include "fbtft.h"
#define DRVNAME "fb_ra8875"
@@ -250,7 +251,14 @@ static int write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
remain = len / 2;
vmem16 = (u16 *)(par->info->screen_buffer + offset);
+
+ if (!par->txbuf.buf)
+ return par->fbtftops.write(par, vmem16, len);
+
tx_array_size = par->txbuf.len / 2;
+ if (tx_array_size <= 2)
+ return par->fbtftops.write(par, vmem16, len);
+
txbuf16 = par->txbuf.buf + 1;
tx_array_size -= 2;
*(u8 *)(par->txbuf.buf) = 0x00;
@@ -262,7 +270,7 @@ static int write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
to_copy, remain - to_copy);
for (i = 0; i < to_copy; i++)
- txbuf16[i] = cpu_to_be16(vmem16[i]);
+ put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
vmem16 = vmem16 + to_copy;
ret = par->fbtftops.write(par, par->txbuf.buf,
diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index 30e436ff1..52a0c5c0c 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -4,6 +4,7 @@
#include <linux/gpio/consumer.h>
#include <linux/spi/spi.h>
#include "fbtft.h"
+#include <linux/unaligned.h>
/*****************************************************************************
*
@@ -11,6 +12,7 @@
*
*****************************************************************************/
+#define fbtft_write_reg_no_modifier(x) (x)
#define define_fbtft_write_reg(func, buffer_type, data_type, modifier) \
void func(struct fbtft_par *par, int len, ...) \
{ \
@@ -39,7 +41,7 @@ void func(struct fbtft_par *par, int len, ...) \
offset = 1; \
} \
\
- *buf = modifier((data_type)va_arg(args, unsigned int)); \
+ put_unaligned(modifier((data_type)va_arg(args, unsigned int)), buf); \
ret = fbtft_write_buf_dc(par, par->buf, sizeof(data_type) + offset, \
0); \
if (ret < 0) \
@@ -51,20 +53,22 @@ void func(struct fbtft_par *par, int len, ...) \
\
if (len) { \
i = len; \
- while (i--) \
- *buf++ = modifier((data_type)va_arg(args, \
- unsigned int)); \
+ while (i--) { \
+ put_unaligned(modifier((data_type)va_arg(args, \
+ unsigned int)), buf); \
+ buf++; \
+ } \
fbtft_write_buf_dc(par, par->buf, \
- len * (sizeof(data_type) + offset), 1); \
+ len * sizeof(data_type) + offset, 1); \
} \
out: \
va_end(args); \
} \
EXPORT_SYMBOL(func);
-define_fbtft_write_reg(fbtft_write_reg8_bus8, u8, u8, )
+define_fbtft_write_reg(fbtft_write_reg8_bus8, u8, u8, fbtft_write_reg_no_modifier)
define_fbtft_write_reg(fbtft_write_reg16_bus8, __be16, u16, cpu_to_be16)
-define_fbtft_write_reg(fbtft_write_reg16_bus16, u16, u16, )
+define_fbtft_write_reg(fbtft_write_reg16_bus16, u16, u16, fbtft_write_reg_no_modifier)
void fbtft_write_reg8_bus9(struct fbtft_par *par, int len, ...)
{
@@ -142,19 +146,24 @@ int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
tx_array_size = par->txbuf.len / 2;
if (par->startbyte) {
+ if (tx_array_size <= 2)
+ return par->fbtftops.write(par, vmem16, len);
txbuf16 = par->txbuf.buf + 1;
tx_array_size -= 2;
*(u8 *)(par->txbuf.buf) = par->startbyte | 0x2;
startbyte_size = 1;
}
+ if (!tx_array_size)
+ return par->fbtftops.write(par, vmem16, len);
+
while (remain) {
to_copy = min(tx_array_size, remain);
dev_dbg(par->info->device, "to_copy=%zu, remain=%zu\n",
to_copy, remain - to_copy);
for (i = 0; i < to_copy; i++)
- txbuf16[i] = cpu_to_be16(vmem16[i]);
+ put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
vmem16 = vmem16 + to_copy;
ret = par->fbtftops.write(par, par->txbuf.buf,
--
2.47.3
^ permalink raw reply related
* [PATCH] staging: greybus: add meaningful comments to mutex declarations
From: suryasaimadhu @ 2026-06-25 11:16 UTC (permalink / raw)
To: error27
Cc: vaibhav.sr, mgreer, johan, elder, gregkh, greybus-dev,
linux-staging, linux-kernel, suryasaimadhu
In-Reply-To: <aj0CZOUlYlJydfPd@stanley.mountain>
The gbaudio_codec_info struct has two mutexes whose purpose was
not documented:
- lock: serializes DAI stream enable/disable operations and
module_list/dai_list access in gbaudio_module_update() and
gbcodec DAI ops
- register_mutex: serializes module register/unregister operations
including DAPM controls, widgets and routes in
gbaudio_register_module() and gbaudio_unregister_module()
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/greybus/audio_codec.h | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/staging/greybus/audio_codec.h b/drivers/staging/greybus/audio_codec.h
index f3f7a7ec6..3d92ac8a0 100644
--- a/drivers/staging/greybus/audio_codec.h
+++ b/drivers/staging/greybus/audio_codec.h
@@ -70,7 +70,15 @@ struct gbaudio_codec_info {
struct list_head module_list;
/* to maintain runtime stream params for each DAI */
struct list_head dai_list;
+ /*
+ * held during DAI stream ops and module_list/dai_list
+ * access (gbaudio_module_update, gbcodec DAI ops)
+ */
struct mutex lock;
+ /*
+ * held during module register/unregister including
+ * DAPM controls, widgets and routes
+ */
struct mutex register_mutex;
};
--
2.47.3
^ permalink raw reply related
* [PATCH] staging: fbtft: fix unaligned vmem writes when txbuf is byte-offset
From: suryasaimadhu @ 2026-06-25 11:02 UTC (permalink / raw)
To: andy
Cc: gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
In-Reply-To: <20260625104220.21E5A1F00A3D@smtp.kernel.org>
fbtft_write_vmem16_bus8() and fb_ra8875's write_vmem16_bus8() offset
txbuf16 by one byte for a command/start prefix, then store 16-bit pixel
data via txbuf16[i]. On strict-alignment architectures this can fault
the same way as the write_reg path fixed in the previous patch.
Use put_unaligned() for these stores.
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/fbtft/fb_ra8875.c | 3 ++-
drivers/staging/fbtft/fbtft-bus.c | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/fbtft/fb_ra8875.c b/drivers/staging/fbtft/fb_ra8875.c
index 0ab1de664..5b95b0095 100644
--- a/drivers/staging/fbtft/fb_ra8875.c
+++ b/drivers/staging/fbtft/fb_ra8875.c
@@ -10,6 +10,7 @@
#include <linux/delay.h>
#include <linux/gpio/consumer.h>
+#include <linux/unaligned.h>
#include "fbtft.h"
#define DRVNAME "fb_ra8875"
@@ -262,7 +263,7 @@ static int write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
to_copy, remain - to_copy);
for (i = 0; i < to_copy; i++)
- txbuf16[i] = cpu_to_be16(vmem16[i]);
+ put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
vmem16 = vmem16 + to_copy;
ret = par->fbtftops.write(par, par->txbuf.buf,
diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index cfcf4d7e7..fc3faab7d 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -158,7 +158,7 @@ int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
to_copy, remain - to_copy);
for (i = 0; i < to_copy; i++)
- txbuf16[i] = cpu_to_be16(vmem16[i]);
+ put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
vmem16 = vmem16 + to_copy;
ret = par->fbtftops.write(par, par->txbuf.buf,
--
2.47.3
^ permalink raw reply related
* Re: [PATCH v2] staging: greybus: add comments to mutex declarations
From: Sai Madhu @ 2026-06-25 10:48 UTC (permalink / raw)
To: error27
Cc: vaibhav.sr, mgreer, johan, elder, gregkh, greybus-dev,
linux-staging, linux-kernel
In-Reply-To: <20260625104520.288129-1-suryasaimadhu369@gmail.com>
syr for duplicate patch,
please ignore .
On Thu, 25 Jun 2026 at 16:16, suryasaimadhu <suryasaimadhu369@gmail.com> wrote:
>
> Add comments to mutex members in gbaudio_codec_info struct
> to describe what each mutex protects, as recommended by checkpatch.
>
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> ---
> drivers/staging/greybus/audio_codec.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/staging/greybus/audio_codec.h b/drivers/staging/greybus/audio_codec.h
> index f3f7a7ec6..326770b99 100644
> --- a/drivers/staging/greybus/audio_codec.h
> +++ b/drivers/staging/greybus/audio_codec.h
> @@ -70,8 +70,8 @@ struct gbaudio_codec_info {
> struct list_head module_list;
> /* to maintain runtime stream params for each DAI */
> struct list_head dai_list;
> - struct mutex lock;
> - struct mutex register_mutex;
> + struct mutex lock; /* protects module_list and dai_list */
> + struct mutex register_mutex; /* protects module registration */
> };
>
> struct gbaudio_widget {
> --
> 2.47.3
>
^ permalink raw reply
* [PATCH v2] staging: greybus: add comments to mutex declarations
From: suryasaimadhu @ 2026-06-25 10:45 UTC (permalink / raw)
To: error27
Cc: vaibhav.sr, mgreer, johan, elder, gregkh, greybus-dev,
linux-staging, linux-kernel, suryasaimadhu
In-Reply-To: <aj0CZOUlYlJydfPd@stanley.mountain>
Add comments to mutex members in gbaudio_codec_info struct
to describe what each mutex protects, as recommended by checkpatch.
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/greybus/audio_codec.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/greybus/audio_codec.h b/drivers/staging/greybus/audio_codec.h
index f3f7a7ec6..326770b99 100644
--- a/drivers/staging/greybus/audio_codec.h
+++ b/drivers/staging/greybus/audio_codec.h
@@ -70,8 +70,8 @@ struct gbaudio_codec_info {
struct list_head module_list;
/* to maintain runtime stream params for each DAI */
struct list_head dai_list;
- struct mutex lock;
- struct mutex register_mutex;
+ struct mutex lock; /* protects module_list and dai_list */
+ struct mutex register_mutex; /* protects module registration */
};
struct gbaudio_widget {
--
2.47.3
^ permalink raw reply related
* [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used
From: suryasaimadhu @ 2026-06-25 10:30 UTC (permalink / raw)
To: andy
Cc: gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
When par->startbyte is non-zero, buf is advanced by one byte creating
an unaligned pointer for 16-bit types (u16, __be16). Dereferencing this
unaligned pointer can cause a kernel panic on strict-alignment
architectures.
Fix by using put_unaligned() instead of direct pointer dereference.
Also fix incorrect buffer size calculation in fbtft_write_buf_dc() call:
len * (sizeof(data_type) + offset) /* wrong: multiplies offset by len */
len * sizeof(data_type) + offset /* correct: one startbyte +
len items */
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/fbtft/fbtft-bus.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index 2169f8d1d..cfcf4d7e7 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -4,6 +4,7 @@
#include <linux/gpio/consumer.h>
#include <linux/spi/spi.h>
#include "fbtft.h"
+#include <linux/unaligned.h>
/*****************************************************************************
*
@@ -40,7 +41,7 @@ void func(struct fbtft_par *par, int len, ...) \
offset = 1; \
} \
\
- *buf = modifier((data_type)va_arg(args, unsigned int)); \
+ put_unaligned(modifier((data_type)va_arg(args, unsigned int)), buf); \
ret = fbtft_write_buf_dc(par, par->buf, sizeof(data_type) + offset, \
0); \
if (ret < 0) \
@@ -52,11 +53,13 @@ void func(struct fbtft_par *par, int len, ...) \
\
if (len) { \
i = len; \
- while (i--) \
- *buf++ = modifier((data_type)va_arg(args, \
- unsigned int)); \
+ while (i--) { \
+ put_unaligned(modifier((data_type)va_arg(args, \
+ unsigned int)), buf); \
+ buf++; \
+ } \
fbtft_write_buf_dc(par, par->buf, \
- len * (sizeof(data_type) + offset), 1); \
+ len * sizeof(data_type) + offset, 1); \
} \
out: \
va_end(args); \
--
2.47.3
^ permalink raw reply related
* Re: [PATCH] staging: fbtft: replace empty modifier argument with no-op macro
From: Sai Madhu @ 2026-06-25 10:30 UTC (permalink / raw)
To: Dan Carpenter
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <aj0Cv0Wzb3rieNqW@stanley.mountain>
Hi Dan,
Thank you for the feedback. I understand and will drop this patch.
I have also noticed two pre-existing bugs in the same file
(unaligned access and buffer size calculation when startbyte is used)
and have sent a separate patch to fix those.
Regards,
suryasaimadhu
On Thu, 25 Jun 2026 at 15:58, Dan Carpenter <error27@gmail.com> wrote:
>
> On Thu, Jun 25, 2026 at 05:27:21PM +0800, suryasaimadhu wrote:
> > Define fbtft_write_reg_no_modifier() as an identity function and
> > use it in place of empty modifier arguments in define_fbtft_write_reg()
> > calls to fix checkpatch errors.
> >
> > Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> > ---
>
> I don't hate this patch, but I think we've decided to leave this
> as-is.
>
> regards,
> dan carpenter
>
^ permalink raw reply
* Re: [PATCH] staging: fbtft: replace empty modifier argument with no-op macro
From: Dan Carpenter @ 2026-06-25 10:28 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <20260625092721.238366-1-suryasaimadhu369@gmail.com>
On Thu, Jun 25, 2026 at 05:27:21PM +0800, suryasaimadhu wrote:
> Define fbtft_write_reg_no_modifier() as an identity function and
> use it in place of empty modifier arguments in define_fbtft_write_reg()
> calls to fix checkpatch errors.
>
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> ---
I don't hate this patch, but I think we've decided to leave this
as-is.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH] staging: greybus: add missing newlines in sysfs_emit calls
From: Dan Carpenter @ 2026-06-25 10:27 UTC (permalink / raw)
To: suryasaimadhu
Cc: vaibhav.sr, mgreer, johan, elder, gregkh, greybus-dev,
linux-staging, linux-kernel
In-Reply-To: <20260625091416.230920-1-suryasaimadhu369@gmail.com>
On Thu, Jun 25, 2026 at 05:14:16PM +0800, suryasaimadhu wrote:
> Add missing terminating newlines to sysfs_emit format strings
> in audio_manager_module.c as required by sysfs ABI.
>
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> ---
This changes the user space API so it's a bit risky. Only make this
sort of change for new code.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH] staging: greybus: add comments to mutex declarations
From: Dan Carpenter @ 2026-06-25 10:26 UTC (permalink / raw)
To: suryasaimadhu
Cc: vaibhav.sr, mgreer, johan, elder, gregkh, greybus-dev,
linux-staging, linux-kernel
In-Reply-To: <20260625085740.222486-1-suryasaimadhu369@gmail.com>
On Thu, Jun 25, 2026 at 04:57:40PM +0800, suryasaimadhu wrote:
> Add comments to mutex members in gbaudio_codec_info struct
> to describe what each mutex protects, as recommended by checkpatch.
>
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
Capital letters? Is this how you would write your name on a legal
document?
I kind of hate this checkpatch warning. What I want is a document,
not part of sentence... The document could go in the commit message
if you want, but I really want some thought to go into it, otherwise
it's sort of useless.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH] staging: vme_user: bound slave windows to DMA buffers
From: Greg Kroah-Hartman @ 2026-06-25 9:47 UTC (permalink / raw)
To: Yousef Alhouseen; +Cc: linux-staging, linux-kernel
In-Reply-To: <20260625093137.6589-1-alhouseenyousef@gmail.com>
On Thu, Jun 25, 2026 at 11:31:37AM +0200, Yousef Alhouseen wrote:
> vme_user allocates a fixed PCI_BUF_SIZE coherent DMA buffer for each
> slave image, but VME_SET_SLAVE passes the user-supplied size to
> vme_slave_set() unchanged. An enabled window larger than PCI_BUF_SIZE lets
> the bridge expose DMA addresses beyond the allocation.
>
> The character device read/write paths also derive their bounds from
> vme_get_size(), so the oversized programmed window can make
> buffer_to_user() and buffer_from_user() access past
> image[minor].kern_buf.
>
> Reject enabled slave windows that do not fit in the backing buffer and use
> the same capped size for slave read/write/llseek bounds. Also convert the
> read/write limit checks to subtraction-based form so offset + count cannot
> wrap around the image size check.
>
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
> ---
> drivers/staging/vme_user/vme_user.c | 38 ++++++++++++++++++++++-------
> 1 file changed, 29 insertions(+), 9 deletions(-)
What tool did you use to find/make this change, and how was it tested?
thanks,
greg k-h
^ permalink raw reply
* [PATCH] staging: vme_user: bound slave windows to DMA buffers
From: Yousef Alhouseen @ 2026-06-25 9:31 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-staging, linux-kernel, Yousef Alhouseen
vme_user allocates a fixed PCI_BUF_SIZE coherent DMA buffer for each
slave image, but VME_SET_SLAVE passes the user-supplied size to
vme_slave_set() unchanged. An enabled window larger than PCI_BUF_SIZE lets
the bridge expose DMA addresses beyond the allocation.
The character device read/write paths also derive their bounds from
vme_get_size(), so the oversized programmed window can make
buffer_to_user() and buffer_from_user() access past
image[minor].kern_buf.
Reject enabled slave windows that do not fit in the backing buffer and use
the same capped size for slave read/write/llseek bounds. Also convert the
read/write limit checks to subtraction-based form so offset + count cannot
wrap around the image size check.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
drivers/staging/vme_user/vme_user.c | 38 ++++++++++++++++++++++-------
1 file changed, 29 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/vme_user/vme_user.c b/drivers/staging/vme_user/vme_user.c
index 11e25c2f6..24d3c6ec3 100644
--- a/drivers/staging/vme_user/vme_user.c
+++ b/drivers/staging/vme_user/vme_user.c
@@ -175,11 +175,22 @@ static ssize_t buffer_from_user(unsigned int minor, const char __user *buf,
return count;
}
+static size_t vme_user_get_image_size(unsigned int minor)
+{
+ size_t image_size = vme_get_size(image[minor].resource);
+
+ if (type[minor] == SLAVE_MINOR)
+ image_size = min_t(size_t, image_size, image[minor].size_buf);
+
+ return image_size;
+}
+
static ssize_t vme_user_read(struct file *file, char __user *buf, size_t count,
loff_t *ppos)
{
unsigned int minor = iminor(file_inode(file));
ssize_t retval;
+ size_t offset;
size_t image_size;
if (minor == CONTROL_MINOR)
@@ -188,17 +199,19 @@ static ssize_t vme_user_read(struct file *file, char __user *buf, size_t count,
mutex_lock(&image[minor].mutex);
/* XXX Do we *really* want this helper - we can use vme_*_get ? */
- image_size = vme_get_size(image[minor].resource);
+ image_size = vme_user_get_image_size(minor);
/* Ensure we are starting at a valid location */
- if ((*ppos < 0) || (*ppos > (image_size - 1))) {
+ if ((*ppos < 0) || ((u64)*ppos >= image_size)) {
mutex_unlock(&image[minor].mutex);
return 0;
}
+ offset = *ppos;
+
/* Ensure not reading past end of the image */
- if (*ppos + count > image_size)
- count = image_size - *ppos;
+ if (count > image_size - offset)
+ count = image_size - offset;
switch (type[minor]) {
case MASTER_MINOR:
@@ -223,6 +236,7 @@ static ssize_t vme_user_write(struct file *file, const char __user *buf,
{
unsigned int minor = iminor(file_inode(file));
ssize_t retval;
+ size_t offset;
size_t image_size;
if (minor == CONTROL_MINOR)
@@ -230,17 +244,19 @@ static ssize_t vme_user_write(struct file *file, const char __user *buf,
mutex_lock(&image[minor].mutex);
- image_size = vme_get_size(image[minor].resource);
+ image_size = vme_user_get_image_size(minor);
/* Ensure we are starting at a valid location */
- if ((*ppos < 0) || (*ppos > (image_size - 1))) {
+ if ((*ppos < 0) || ((u64)*ppos >= image_size)) {
mutex_unlock(&image[minor].mutex);
return 0;
}
+ offset = *ppos;
+
/* Ensure not reading past end of the image */
- if (*ppos + count > image_size)
- count = image_size - *ppos;
+ if (count > image_size - offset)
+ count = image_size - offset;
switch (type[minor]) {
case MASTER_MINOR:
@@ -271,7 +287,7 @@ static loff_t vme_user_llseek(struct file *file, loff_t off, int whence)
case MASTER_MINOR:
case SLAVE_MINOR:
mutex_lock(&image[minor].mutex);
- image_size = vme_get_size(image[minor].resource);
+ image_size = vme_user_get_image_size(minor);
res = fixed_size_llseek(file, off, whence, image_size);
mutex_unlock(&image[minor].mutex);
return res;
@@ -394,6 +410,10 @@ static int vme_user_ioctl(struct inode *inode, struct file *file,
return -EFAULT;
}
+ if (slave.enable &&
+ (!slave.size || slave.size > image[minor].size_buf))
+ return -EINVAL;
+
/* XXX We do not want to push aspace, cycle and width
* to userspace as they are
*/
--
2.54.0
^ permalink raw reply related
* [PATCH] staging: fbtft: replace empty modifier argument with no-op macro
From: suryasaimadhu @ 2026-06-25 9:27 UTC (permalink / raw)
To: andy
Cc: gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
Define fbtft_write_reg_no_modifier() as an identity function and
use it in place of empty modifier arguments in define_fbtft_write_reg()
calls to fix checkpatch errors.
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/fbtft/fbtft-bus.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index 30e436ff1..2169f8d1d 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -11,6 +11,7 @@
*
*****************************************************************************/
+#define fbtft_write_reg_no_modifier(x) (x)
#define define_fbtft_write_reg(func, buffer_type, data_type, modifier) \
void func(struct fbtft_par *par, int len, ...) \
{ \
@@ -62,9 +63,9 @@ out: \
} \
EXPORT_SYMBOL(func);
-define_fbtft_write_reg(fbtft_write_reg8_bus8, u8, u8, )
+define_fbtft_write_reg(fbtft_write_reg8_bus8, u8, u8, fbtft_write_reg_no_modifier)
define_fbtft_write_reg(fbtft_write_reg16_bus8, __be16, u16, cpu_to_be16)
-define_fbtft_write_reg(fbtft_write_reg16_bus16, u16, u16, )
+define_fbtft_write_reg(fbtft_write_reg16_bus16, u16, u16, fbtft_write_reg_no_modifier)
void fbtft_write_reg8_bus9(struct fbtft_par *par, int len, ...)
{
--
2.47.3
^ permalink raw reply related
* [PATCH] staging: greybus: add missing newlines in sysfs_emit calls
From: suryasaimadhu @ 2026-06-25 9:14 UTC (permalink / raw)
To: vaibhav.sr, mgreer
Cc: johan, elder, gregkh, greybus-dev, linux-staging, linux-kernel,
suryasaimadhu
Add missing terminating newlines to sysfs_emit format strings
in audio_manager_module.c as required by sysfs ABI.
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/greybus/audio_manager_module.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c
index dc90cc2d2..5737f2a32 100644
--- a/drivers/staging/greybus/audio_manager_module.c
+++ b/drivers/staging/greybus/audio_manager_module.c
@@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj)
static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module,
struct gb_audio_manager_module_attribute *attr, char *buf)
{
- return sysfs_emit(buf, "%s", module->desc.name);
+ return sysfs_emit(buf, "%s\n", module->desc.name);
}
static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute =
@@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute =
static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module,
struct gb_audio_manager_module_attribute *attr, char *buf)
{
- return sysfs_emit(buf, "%d", module->desc.vid);
+ return sysfs_emit(buf, "%d\n", module->desc.vid);
}
static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute =
@@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute =
static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module,
struct gb_audio_manager_module_attribute *attr, char *buf)
{
- return sysfs_emit(buf, "%d", module->desc.pid);
+ return sysfs_emit(buf, "%d\n", module->desc.pid);
}
static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute =
@@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu
struct gb_audio_manager_module_attribute *attr,
char *buf)
{
- return sysfs_emit(buf, "%d", module->desc.intf_id);
+ return sysfs_emit(buf, "%d\n", module->desc.intf_id);
}
static struct gb_audio_manager_module_attribute
@@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m
struct gb_audio_manager_module_attribute *attr,
char *buf)
{
- return sysfs_emit(buf, "0x%X", module->desc.ip_devices);
+ return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices);
}
static struct gb_audio_manager_module_attribute
@@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m
struct gb_audio_manager_module_attribute *attr,
char *buf)
{
- return sysfs_emit(buf, "0x%X", module->desc.op_devices);
+ return sysfs_emit(buf, "0x%X\n", module->desc.op_devices);
}
static struct gb_audio_manager_module_attribute
--
2.47.3
^ permalink raw reply related
* Re: [PATCH] staging: sm750fb: fix const pointer declaration
From: Sai Madhu @ 2026-06-25 9:03 UTC (permalink / raw)
To: ahmet
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <f5be5a78-a649-447c-8145-b32a530194c2@sezginduran.net>
Hi Ahmet,
Thank you for the review.
I compiled the patch with CONFIG_FB_SM750 enabled and it fails
with the following errors:
sm750.c:773: error: assignment of read-only location 'g_fbmode[index]'
sm750.c:775: error: assignment of read-only location 'g_fbmode[index]'
sm750.c:884: error: assignment of read-only location 'g_fbmode[0]'
sm750.c:888: error: assignment of read-only location 'g_fbmode[1]'
The array elements are assigned at runtime in lynxfb_set_fbinfo()
and sm750fb_setup(), so making them const is incorrect.
The checkpatch warning is a false positive in this case.
I will drop this patch.
Regards,
suryasaimadhu
On Thu, 25 Jun 2026 at 12:58, Ahmet Sezgin Duran <ahmet@sezginduran.net> wrote:
>
> On 6/25/26 10:13 AM, suryasaimadhu wrote:
> > Make g_fbmode a constant pointer array by adding const qualifier
> > after the asterisk, as recommended by checkpatch.
> >
> > Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> > ---
> > drivers/staging/sm750fb/sm750.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
> > index 89c811e08..8f533f3b1 100644
> > --- a/drivers/staging/sm750fb/sm750.c
> > +++ b/drivers/staging/sm750fb/sm750.c
> > @@ -21,7 +21,7 @@
> > static int g_hwcursor = 1;
> > static int g_noaccel __ro_after_init;
> > static int g_nomtrr __ro_after_init;
> > -static const char *g_fbmode[] = {NULL, NULL};
> > +static const char * const g_fbmode[] = {NULL, NULL};
> > static const char *g_def_fbmode = "1024x768-32@60";
> > static char *g_settings;
> > static int g_dualview __ro_after_init;
>
> Did you compile this patch while sm750fb module is enabled?
>
> Regards,
> Ahmet Sezgin Duran
^ permalink raw reply
* [PATCH] staging: greybus: add comments to mutex declarations
From: suryasaimadhu @ 2026-06-25 8:57 UTC (permalink / raw)
To: vaibhav.sr, mgreer
Cc: johan, elder, gregkh, greybus-dev, linux-staging, linux-kernel,
suryasaimadhu
Add comments to mutex members in gbaudio_codec_info struct
to describe what each mutex protects, as recommended by checkpatch.
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/greybus/audio_codec.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/greybus/audio_codec.h b/drivers/staging/greybus/audio_codec.h
index f3f7a7ec6..326770b99 100644
--- a/drivers/staging/greybus/audio_codec.h
+++ b/drivers/staging/greybus/audio_codec.h
@@ -70,8 +70,8 @@ struct gbaudio_codec_info {
struct list_head module_list;
/* to maintain runtime stream params for each DAI */
struct list_head dai_list;
- struct mutex lock;
- struct mutex register_mutex;
+ struct mutex lock; /* protects module_list and dai_list */
+ struct mutex register_mutex; /* protects module registration */
};
struct gbaudio_widget {
--
2.47.3
^ permalink raw reply related
* [PATCH v2 1/1 RESEND] staging: media: tegra-video: vi: Improve media graph building logic
From: Svyatoslav Ryhel @ 2026-06-25 8:33 UTC (permalink / raw)
To: Thierry Reding, Jonathan Hunter, Sowjanya Komatineni,
Luca Ceresoli, Mauro Carvalho Chehab, Hans Verkuil,
Greg Kroah-Hartman, Svyatoslav Ryhel
Cc: linux-media, linux-tegra, linux-staging, linux-kernel
In-Reply-To: <20260625083302.71651-1-clamor95@gmail.com>
The existing tegra_vi_graph_build function relies heavily on a one-to-one
match between Device Tree nodes and media pad links. While this works for
simpler configurations, it causes issues when Device Tree nodes do not
match media pad link logic (e.g., mt9m114). Switch to the
media_entity_get_fwnode_pad helper to verify and retrieve the correct pad
linked to an endpoint, rather than assuming the endpoint ID matches the
pad ID.
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # tegra20, parallel camera
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
drivers/staging/media/tegra-video/vi.c | 78 ++++++++++++--------------
1 file changed, 35 insertions(+), 43 deletions(-)
diff --git a/drivers/staging/media/tegra-video/vi.c b/drivers/staging/media/tegra-video/vi.c
index f14cdc7b5211..24e4bd438678 100644
--- a/drivers/staging/media/tegra-video/vi.c
+++ b/drivers/staging/media/tegra-video/vi.c
@@ -1468,7 +1468,6 @@ static int tegra_vi_graph_build(struct tegra_vi_channel *chan,
struct tegra_vi *vi = chan->vi;
struct tegra_vi_graph_entity *ent;
struct fwnode_handle *ep = NULL;
- struct v4l2_fwnode_link link;
struct media_entity *local = entity->entity;
struct media_entity *remote;
struct media_pad *local_pad;
@@ -1478,70 +1477,64 @@ static int tegra_vi_graph_build(struct tegra_vi_channel *chan,
dev_dbg(vi->dev, "creating links for entity %s\n", local->name);
- while (1) {
- ep = fwnode_graph_get_next_endpoint(entity->asd.match.fwnode,
- ep);
- if (!ep)
- break;
+ fwnode_graph_for_each_endpoint(entity->asd.match.fwnode, ep) {
+ struct fwnode_handle *remote_parent __free(fwnode_handle) = NULL;
+ struct fwnode_handle *sink_ep __free(fwnode_handle) = NULL;
+ int src_idx, sink_idx;
- ret = v4l2_fwnode_parse_link(ep, &link);
- if (ret < 0) {
- dev_err(vi->dev, "failed to parse link for %pOF: %d\n",
- to_of_node(ep), ret);
+ src_idx = media_entity_get_fwnode_pad(local, ep,
+ MEDIA_PAD_FL_SOURCE);
+ if (src_idx < 0) {
+ dev_dbg(vi->dev, "no source pad found for %pfw\n", ep);
continue;
}
- if (link.local_port >= local->num_pads) {
- dev_err(vi->dev, "invalid port number %u on %pOF\n",
- link.local_port, to_of_node(link.local_node));
- v4l2_fwnode_put_link(&link);
- ret = -EINVAL;
- break;
+ remote_parent = fwnode_graph_get_remote_port_parent(ep);
+ if (!remote_parent) {
+ dev_dbg(vi->dev, "no remote parent found for %pfw\n",
+ ep);
+ continue;
}
- local_pad = &local->pads[link.local_port];
+ local_pad = &local->pads[src_idx];
/* Remote node is vi node. So use channel video entity and pad
* as remote/sink.
*/
- if (link.remote_node == of_fwnode_handle(vi->dev->of_node)) {
+ if (remote_parent == of_fwnode_handle(vi->dev->of_node)) {
remote = &chan->video.entity;
remote_pad = &chan->pad;
goto create_link;
}
- /*
- * Skip sink ports, they will be processed from the other end
- * of the link.
- */
- if (local_pad->flags & MEDIA_PAD_FL_SINK) {
- dev_dbg(vi->dev, "skipping sink port %pOF:%u\n",
- to_of_node(link.local_node), link.local_port);
- v4l2_fwnode_put_link(&link);
- continue;
- }
-
/* find the remote entity from notifier list */
ent = tegra_vi_graph_find_entity(&chan->notifier.done_list,
- link.remote_node);
+ remote_parent);
if (!ent) {
- dev_err(vi->dev, "no entity found for %pOF\n",
- to_of_node(link.remote_node));
- v4l2_fwnode_put_link(&link);
+ fwnode_handle_put(ep);
+ dev_err(vi->dev, "no entity found for %pfw\n",
+ remote_parent);
ret = -ENODEV;
break;
}
remote = ent->entity;
- if (link.remote_port >= remote->num_pads) {
- dev_err(vi->dev, "invalid port number %u on %pOF\n",
- link.remote_port,
- to_of_node(link.remote_node));
- v4l2_fwnode_put_link(&link);
- ret = -EINVAL;
- break;
+
+ sink_ep = fwnode_graph_get_remote_endpoint(ep);
+ if (!sink_ep) {
+ dev_dbg(vi->dev, "no sink ep found for %pfw\n",
+ ep);
+ continue;
+ }
+
+ sink_idx = media_entity_get_fwnode_pad(remote, sink_ep,
+ MEDIA_PAD_FL_SINK);
+ if (sink_idx < 0) {
+ dev_dbg(vi->dev, "no sink pad found for %pfw\n",
+ sink_ep);
+ continue;
}
- remote_pad = &remote->pads[link.remote_port];
+ remote_pad = &remote->pads[sink_idx];
create_link:
dev_dbg(vi->dev, "creating %s:%u -> %s:%u link\n",
@@ -1551,8 +1544,8 @@ static int tegra_vi_graph_build(struct tegra_vi_channel *chan,
ret = media_create_pad_link(local, local_pad->index,
remote, remote_pad->index,
link_flags);
- v4l2_fwnode_put_link(&link);
if (ret < 0) {
+ fwnode_handle_put(ep);
dev_err(vi->dev,
"failed to create %s:%u -> %s:%u link: %d\n",
local->name, local_pad->index,
@@ -1561,7 +1554,6 @@ static int tegra_vi_graph_build(struct tegra_vi_channel *chan,
}
}
- fwnode_handle_put(ep);
return ret;
}
--
2.51.0
^ permalink raw reply related
* [PATCH v2 0/1 RESEND] staging: media: tegra-video: vi: improve VI graph building logic
From: Svyatoslav Ryhel @ 2026-06-25 8:33 UTC (permalink / raw)
To: Thierry Reding, Jonathan Hunter, Sowjanya Komatineni,
Luca Ceresoli, Mauro Carvalho Chehab, Hans Verkuil,
Greg Kroah-Hartman, Svyatoslav Ryhel
Cc: linux-media, linux-tegra, linux-staging, linux-kernel
The existing tegra_vi_graph_build function relies heavily on a one-to-one
match between Device Tree nodes and media pad links. While this works for
simpler configurations, it causes issues when Device Tree nodes do not
match media pad link logic (e.g., mt9m114). Switch to the
media_entity_get_fwnode_pad helper to verify and retrieve the correct pad
linked to an endpoint, rather than assuming the endpoint ID matches the
pad ID.
---
Changes in v2:
- fixed use of NULL fw pointers in debug prints
---
Svyatoslav Ryhel (1):
staging: media: tegra-video: vi: Improve media graph building logic
drivers/staging/media/tegra-video/vi.c | 78 ++++++++++++--------------
1 file changed, 35 insertions(+), 43 deletions(-)
--
2.51.0
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox