Re: [PATCH] greybus: usb: fix response buffer size for fixed-length hub requests

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Mon, Aug 03, 2026 at 06:32:48AM +0530, Aditya Chari S wrote:
> hub_control() sized the Greybus operation's response buffer purely
> off the caller-supplied wLength. However, per the USB hub class spec,
> GetHubDescriptor, GetHubStatus, and GetPortStatus have a response
> length that is fixed by the request type itself, and can be larger
> than (or independent of) whatever wLength the USB core happens to
> pass down. This could under-allocate the response buffer for these
> request types.
> 
> Special-case these three request types so the response buffer is
> always large enough for the data the module will actually send back,
> matching the equivalent handling in usbcore's rh_call_control(). Fall
> back to wLength for all other request types, as before.
> 
> Compile-tested with 'make M=drivers/staging/greybus C=1', including
> sparse, with no warnings. checkpatch --strict is also clean.
> 
> Note: this driver's hub_control() is currently unreachable at runtime
> since gb_usb_probe() unconditionally disables USB support pending
> separate USB core changes. As Project Ara hardware is no longer
> available, this change has not been tested on physical hardware or
> with a Greybus module; it was verified only by compilation, sparse,
> and code review against the equivalent logic in usbcore.
> 
> Signed-off-by: Aditya Chari S <adi25charis@gmail.com>
> ---
>  drivers/staging/greybus/usb.c | 31 +++++++++++++++++++++++++++----
>  1 file changed, 27 insertions(+), 4 deletions(-)

Cool, what tool was used to find this?  Did you forget the Assisted-by:
tag?

thanks,

greg k-h