wireguard-linux/drivers/w1/slaves, branch stable

w1: ds28e17: reject an oversize length on an I2C block read

2026-07-04T08:21:38Z

w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. The downstream slave puts a length byte in buf[0]. The driver then reads that many bytes into buf[1] with w1_f19_i2c_read(). buf[0] is controlled by the device and can be 0 to 255. w1_f19_i2c_read() only rejects a zero count. The caller buffer is I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That check runs after master_xfer returns. By then the write is already done. i2c-algo-bit rejects an oversize length before it copies, and returns -EPROTO. Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the same way i2c-algo-bit does. Fixes: ebc4768ac497 ("add w1_ds28e17 driver for the DS28E17 Onewire to I2C master bridge") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie Reviewed-by: Andi Shyti Link: https://patch.msgid.link/20260629121043.199487-1-maoyixie.tju@gmail.com Signed-off-by: Krzysztof Kozlowski

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51Z

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28Z

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

w1: therm: Fix off-by-one buffer overflow in alarms_store

2025-12-18T16:01:42Z

The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'. Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code. Cc: stable@vger.kernel.org Fixes: e2c94d6f5720 ("w1_therm: adding alarm sysfs entry") Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20251216145007.44328-2-thorsten.blum@linux.dev Signed-off-by: Krzysztof Kozlowski

w1: ds28e17: Replace deprecated strcpy + strcat in w1_f19_add_slave

2025-10-13T00:19:03Z

strcpy() is deprecated and using strcat() is discouraged. Replace them with scnprintf(). No functional changes. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Krzysztof Kozlowski

sysfs: treewide: switch back to attribute_group::bin_attrs

2025-06-17T08:44:15Z

The normal bin_attrs field can now handle const pointers. This makes the _new variant unnecessary. Switch all users back. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250530-sysfs-const-bin_attr-final-v3-4-724bfcf05b99@weissschuh.net Signed-off-by: Greg Kroah-Hartman

sysfs: treewide: switch back to bin_attribute::read()/write()

2025-06-17T08:44:13Z

The bin_attribute argument of bin_attribute::read() is now const. This makes the _new() callbacks unnecessary. Switch all users back. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250530-sysfs-const-bin_attr-final-v3-3-724bfcf05b99@weissschuh.net Signed-off-by: Greg Kroah-Hartman

w1: ds2406: use crc16() instead of crc16_byte() loop

2025-05-14T03:37:16Z

Instead of looping through each byte and calling crc16_byte(), instead just call crc16() on the whole buffer. No functional change. Acked-by: Krzysztof Kozlowski Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250513022115.39109-2-ebiggers@kernel.org Signed-off-by: Eric Biggers

w1: w1_therm: w1: Use HWMON_CHANNEL_INFO macro to simplify code

2025-02-03T11:54:18Z

Use HWMON_CHANNEL_INFO macro to simplify code. Signed-off-by: Huisong Li Link: https://lore.kernel.org/r/20250124022635.16647-9-lihuisong@huawei.com Signed-off-by: Krzysztof Kozlowski

w1: core: use sysfs_emit() instead of sprintf()

2024-12-22T14:42:15Z

Follow the advice in Documentation/filesystems/sysfs.rst: show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: zhangheng Link: https://lore.kernel.org/r/20241220102337.295864-1-zhangheng@kylinos.cn Signed-off-by: Krzysztof Kozlowski