Linux Kernel 5.10.265

The 120 most recent commits in this release — the full changelog is longer:

• Linux 5.10.265
• hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
• hwmon: (adt7470) Add missing dependency on REGMAP_I2C
• prestera: fix fallback to previous version on same major version
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• tipc: read le->link under the node lock in tipc_node_link_down()
• vhost: reset the vring metadata cache on vring reconfiguration
• vsock/virtio: avoid refilling the RX queue after teardown
• vxlan: do not arm the ageing timer on a device that is down
• net: atlantic: free RX pages of consumed but not refilled buffers
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• fscrypt: Replace mk_users keyring with simple list
• mips: sched: Fix CPUMASK_OFFSTACK memory corruption
• RDMA/rxe: Fix a use-after-free problem in rxe_mmap
• futex: Prevent robust futex exit race some more
• ima: fix out-of-bounds read in xattr_verify()
• Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
• Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• netfilter: ebt_nflog: pin the NFLOG backend
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: openvswitch: reallocate update replies for mismatched IDs
• net/packet: reset the MAC header on the packet-socket transmit path
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• ALSA: usb-audio: Evaluate packsize caps at the right place
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• tls: don't abort the connection on signal-interrupted sends
• sctp: extract sctp_v4_err_handle function from sctp_v4_err
• sctp: extract sctp_v6_err_handle function from sctp_v6_err
• sctp: remove the unessessary hold for idev in sctp_v6_err
• sctp: clear control chunk transport if it is being removed
• ata: pata_sl82c105: fix bridge revision use-after-free
• net: qrtr: ns: Raise lookup limit to 128
• net: remove WARN_ON_ONCE() from sk_mc_loop()
• net: prestera: validate firmware header length
• net: marvell: prestera: try to load previous fw version
• net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
• sctp: fix addip_serial increment on ASCONF_ACK allocation failure
• bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
• bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
• net/openvswitch: check Ethernet header length in key_extract()
• net: openvswitch: fix kernel-doc warnings in flow.c
• net: openvswitch: Fix kerneldoc warnings
• net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
• udp: fix potential use-after-free in tunnel segmentation
• counter: microchip-tcb-capture: Fix DT channel validation
• net/mlx5: fw_tracer, return NULL on create error
• net/mlx5: Remove second FW tracer check
• net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
• net/sched: cls_route: fix fastmap use-after-free on filter
• net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
• bpf: Preserve pointer state for commuted arithmetic
• bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
• ARM: npcm: Fix OF node refcount leaks in SMP setup
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
• nfs4: take a reference on the nfs_client when running FREE_STATEID
• s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
• mount: honour SB_NOUSER in the new mount API
• gpio: pch: use raw_spinlock_t for the register lock
• firmware: stratix10-svc: fix memory leaks and list corruption bugs
• net: openvswitch: fix skb leak on flow key update failure during recirculation
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
• Bluetooth: SCO: Fix UAF on sco_sock_timeout
• mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
• HID: logitech-dj: Fix maxfield check in DJ short report validation
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/vc4: Zero the tile state data array before each BIN job
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
• net: openvswitch: fix skb leak on flow key update failure during ct
• net: openvswitch: fix potential UAF on meter attach failure
• phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
• phy: zynqmp: use read-modify-write for SERDES scrambler bypass
• phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
• s390/zcrypt: Validate length for CCA ECC private key requests
• s390/zcrypt: Validate length for CCA AES cipher key requests
• s390/dasd: Fix potential NULL pointer dereference
• cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
• i2c: amd-mp2: Unregister callback on adapter add failure
• sctp: prevent peer transport count overflow
• sctp: reject stale cookies with mismatched verification tags
• selftests/clone3: fix wild pointer access of getline due to missing init
• tracing/filters: Fix false positive match in regex_match_full()
• tracing: Check return value of __register_event() in trace_module_add_events()
• vxlan: use pskb_network_may_pull() in route_shortcircuit()
• vxlan: use neigh_ha_snapshot() in route_shortcircuit()
• vxlan: unclone skb head before modifying eth header in route_shortcircuit()
• vxlan: re-fetch eth header after route_shortcircuit()
• um: vector: fix use-after-free in vector_mmsg_rx()