wireguard-linux/drivers/staging/greybus, branch stable

treewide: refresh kmalloc_obj() conversions

2026-09-05T04:37:00Z

This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook

greybus: audio: Split gb_audio_gb_get_topology() into size query and data fetch

2026-07-28T07:24:56Z

`gb_audio_gb_get_topology()` combined three separate responsibilities into a single call: querying the topology size, allocating a buffer for it, and fetching the topology data into that buffer. This left callers with no way to perform any of these steps independently, and forced the kzalloc() allocation to live inside the protocol‑layer driver rather than the caller, as already flagged by a FIXME comment at the call site in `audio_module.c`. Split the function into two: - `gb_audio_gb_get_topology_size()` – queries only the topology size - `gb_audio_gb_get_topology()` – fetches topology data into a caller‑supplied buffer of a given size Update the only caller, `gb_audio_probe()` in `audio_module.c`, to query the size first, allocate the topology buffer itself, then fetch the data into it, freeing the buffer via the existing `free_topology` error path on failure. The topology size is now stored as `size_t` and validated in the caller before allocation, addressing the earlier TODO and FIXME comments. This resolves both the "TODO: Split into separate calls" comment above the original function in `audio_gb.c` and the FIXME comment at the call site in `audio_module.c`, both of which are removed as part of this change. No functional change in behavior for the existing probe path. Signed-off-by: Aditya Chari S Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260725155108.7060-1-adi25charis@gmail.com Signed-off-by: Greg Kroah-Hartman

staging: greybus: uart: return tty_alloc_driver() errors

2026-07-17T12:18:36Z

gb_tty_init() maps any tty_alloc_driver() failure to -ENOMEM. tty_alloc_driver() currently always returns -ENOMEM on failure, so this does not change behavior in practice. However, returning PTR_ERR(gb_tty_driver) is more correct and consistent with kernel conventions, preserving any future error codes the function might return. Signed-off-by: Alfie Varghese Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260714134921.817-1-alfievarghese22@gmail.com Signed-off-by: Greg Kroah-Hartman

staging: greybus: hid: fix SET_REPORT return value

2026-07-07T09:20:55Z

__gb_hid_output_raw_report() stores the result of gb_hid_set_report() in ret and even adjusts it to account for the report ID byte, but then always returns 0. This hides Greybus transport errors from HID_REQ_SET_REPORT callers, and makes hidraw report zero bytes written to user space on success, although hid_hw_raw_request() is expected to return the number of bytes transferred or a negative errno. The sibling GET_REPORT path, __gb_hid_get_raw_report(), already follows this convention. Return ret like the other HID transport drivers do. Fixes: 96eab779e198 ("greybus: hid: add HID class driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Hao-Qun Huang Link: https://patch.msgid.link/20260704081613.434445-1-alvinhuang0603@gmail.com Signed-off-by: Greg Kroah-Hartman

staging: greybus: vibrator: return device_create() errors

2026-07-07T09:20:00Z

gb_vibrator_probe() maps any device_create() failure to -EINVAL. This loses the real errno returned by the driver core, such as -ENOMEM, and makes probe failures harder to diagnose correctly. Return PTR_ERR(dev) instead so callers receive the actual failure reason while preserving the existing cleanup path. Signed-off-by: Alfie Varghese Link: https://patch.msgid.link/20260618113439.569-1-alfievarghese22@gmail.com Signed-off-by: Greg Kroah-Hartman

staging: greybus: power_supply: remove unnecessary parentheses in return

2026-07-07T09:19:57Z

return is not a function, so the parentheses around the returned expressions are not needed. Remove them to follow kernel coding style and silence checkpatch.pl RETURN_PARENTHESES warnings. Verified with checkpatch.pl - no errors or warnings. Compiled the power_supply object successfully. Signed-off-by: Tomasz Unger Acked-by: Rui Miguel Silva Link: https://patch.msgid.link/20260615-greybus-power-supply-return-parens-v1-1-dcad9dabfe79@yahoo.pl Signed-off-by: Greg Kroah-Hartman

greybus: audio: bound the topology section sizes against the fetched size

2026-07-07T09:19:46Z

gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed. Fixes: 184992e305f1 ("greybus: audio: Add Greybus Audio Device Class Protocol helper routines") Signed-off-by: Bryam Vargas Link: https://patch.msgid.link/20260616-b4-disp-4352e8b0-v1-1-3e09f62e0ad5@proton.me Signed-off-by: Greg Kroah-Hartman

staging: greybus: Remove unused macro

2026-07-07T09:19:33Z

Remove unused macro as indicated by the compiler when building with make W=2 Signed-off-by: Michail Tatas Link: https://patch.msgid.link/ahdNZlYqnTO22tQq@michalis-linux Signed-off-by: Greg Kroah-Hartman

staging: greybus: audio_codec: remove redundant else-if check

2026-07-07T09:19:05Z

In gbaudio_module_update(), the widget id is validated earlier in the function to ensure it is either snd_soc_dapm_aif_in or snd_soc_dapm_aif_out. Remove the redundant else-if check for snd_soc_dapm_aif_out. The remaining branch can only handle snd_soc_dapm_aif_out, which avoids a compiler warning about a potentially uninitialized variable. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202606140347.gGVWDnbi-lkp@intel.com/ Signed-off-by: Abdelnasser Hussein Link: https://patch.msgid.link/20260614154329.5176-3-abdelnasserhussein11@gmail.com Signed-off-by: Greg Kroah-Hartman

staging: greybus: audio_codec: fix sscanf return value check

2026-07-07T09:18:52Z

Smatch static checker warns: drivers/staging/greybus/audio_codec.c:335 gbaudio_module_update() warn: sscanf doesn't return error codes The sscanf() function returns the number of successfully matched input items, not a negative error code. Compare the return value directly with the expected number of conversions (3) instead of storing it in 'ret' and returning it as an error code, which leads to returning a positive value on failure. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/YoOLnDkHgVltyXK7@kili/ Signed-off-by: Abdelnasser Hussein Link: https://patch.msgid.link/20260614154329.5176-2-abdelnasserhussein11@gmail.com Signed-off-by: Greg Kroah-Hartman