Linux Kernel 5.15.216

The 113 most recent commits in this release — the full changelog is longer:

• Linux 5.15.216
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• tipc: read le->link under the node lock in tipc_node_link_down()
• vhost: reset the vring metadata cache on vring reconfiguration
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• net/sched: act_gact, act_police: range check the fallback control action
• net: atlantic: free RX pages of consumed but not refilled buffers
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• ALSA: usx2y: bound the hwdep mmap fault offset
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• fscrypt: Replace mk_users keyring with simple list
• RDMA/rxe: Fix a use-after-free problem in rxe_mmap
• pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
• futex: Prevent robust futex exit race some more
• Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
• Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• net: bridge: mrp: fix uninitialised bytes on the wire
• netfilter: ebt_nflog: pin the NFLOG backend
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: octeontx2-pf: Fix UB in shift operation
• net: openvswitch: reallocate update replies for mismatched IDs
• net/packet: reset the MAC header on the packet-socket transmit path
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• ima: fix out-of-bounds read in xattr_verify()
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: cdnsp: fix incorrect endian conversions for APB timeout register
• thunderbolt: icm: Preserve USB4 proxy data-valid bit
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
• tls: don't abort the connection on signal-interrupted sends
• sctp: clear control chunk transport if it is being removed
• ata: pata_sl82c105: fix bridge revision use-after-free
• net: thunderbolt: Tear down DMA paths before stopping the rings
• net: qrtr: ns: Raise lookup limit to 128
• net/smc: fix TOCTOU race between smc_listen_out() and listener close
• net: remove WARN_ON_ONCE() from sk_mc_loop()
• net: prestera: validate firmware header length
• net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
• tcp: fix TFO max_qlen accounting across reuseport migration
• sctp: fix addip_serial increment on ASCONF_ACK allocation failure
• bnxt_en: Fix PTP PPS setting bug
• bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
• bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
• selftests/ftrace: refactor eprobes test to fix argument checks
• selftests/ftrace: Add test case for GRP/ only input
• net/openvswitch: check Ethernet header length in key_extract()
• net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
• udp: fix potential use-after-free in tunnel segmentation
• vhost/vdpa: reject overflowing PA map page counts on 32-bit
• counter: microchip-tcb-capture: Fix DT channel validation
• net/mlx5: fw_tracer, return NULL on create error
• net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
• net/sched: cls_route: fix fastmap use-after-free on filter
• net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
• bpf: Preserve pointer state for commuted arithmetic
• bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
• ARM: npcm: Fix OF node refcount leaks in SMP setup
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
• nfs4: take a reference on the nfs_client when running FREE_STATEID
• s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
• mount: honour SB_NOUSER in the new mount API
• gpio: pch: use raw_spinlock_t for the register lock
• firmware: stratix10-svc: fix memory leaks and list corruption bugs
• net: openvswitch: fix skb leak on flow key update failure during recirculation
• mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
• HID: logitech-dj: Fix maxfield check in DJ short report validation
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/amdgpu: restore UMD profile pstate after runtime resume
• drm/vc4: Zero the tile state data array before each BIN job
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
• can: ems_usb: validate CPC message lengths
• can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
• i2c: imx: Cancel hrtimer before clearing slave pointer
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock