Daily update · Oct 7–8, 2026
Device-mapper, Btrfs, and Qualcomm fixes lead today's mainline batch
A large set of fixes touches dm-integrity/dm-crypt, Btrfs io_uring and xattr paths, Qualcomm clocks and device trees, plus GPIO, TEE, and memory-management edge cases.
In brief
Today's mainline pull is dominated by bug fixes. Device-mapper gets several crash and memory-safety fixes, Btrfs gets a batch of io_uring encoded read/write fixes plus xattr corruption fixes, and Qualcomm platform code fixes clocks, power domains, and the Surface Pro 11 microphone configuration. GPIO, TEE, and memory-management subsystems also received smaller correctness fixes.
Device-mapper fixes
dm-integrity: avoid stack buffer overflow with large tag sizes
In inline mode, the checksum buffer was sized for the maximum hash digest, but the tag size can be larger; zero-padding overflowed the stack. The buffer now uses MAX_TAG_SIZE.
Why it matters: Prevents a kernel panic on first read when dm-integrity inline mode is used with a tag size larger than the default hash digest size.
dm-integrity: validate superblock on resume
Resume re-reads the superblock without checking it against constructor-time values, so a modified superblock could make journal indexing inconsistent with in-memory structures. Added validation.
Why it matters: Prevents possible memory corruption or crashes if the superblock is changed while the device is suspended.
dm-crypt: reject lmk IV with AEAD ciphers
The legacy lmk IV mode assumes 64 transforms, but AEAD allocation only creates one, leading to out-of-bounds reads. The combination is now rejected at table load.
Why it matters: Prevents an oops when loading a malformed dm-crypt table that pairs an AEAD cipher with lmk.
dm ioctl: fix out-of-bounds reads and a resume race
Two ioctl fixes: data_start could run past a short buffer, and do_resume could read a table's mode after it was freed by a concurrent ioctl. Both are now handled by validating buffer size and reading the mode before swapping.
Why it matters: Prevents KASAN-detected out-of-bounds reads and a use-after-free race in device-mapper ioctls.
dm-snap: reject transient exception store for snapshot-merge
The transient exception store lacks prepare_merge/commit_merge, so a directly constructed snapshot-merge would call NULL and oops. Now rejected at table load.
Why it matters: Prevents an oops from an invalid snapshot-merge configuration.
Btrfs fixes
btrfs: fix io_uring encoded read/write error handling
Several fixes in the io_uring encoded read/write path: avoid double cleanup after -EIOCBQUEUED, free iov on failure, unlock inode/extent locks in the caller, and don't stash allocations across -EAGAIN.
Why it matters: Prevents double-unlock/free, memory leaks, and lock leaks when io_uring encoded reads/writes fail or need reissue.
btrfs: fix xattr corruption and listxattr error handling
Replacing an xattr in a dir_item that packs multiple xattrs could leave a partially initialized item and trigger tree-checker corruption; listxattr could also lose -ERANGE when the buffer was too small.
Why it matters: Prevents metadata corruption during setxattr and fixes incorrect listxattr return codes.
btrfs: transaction and scrub reference fixes
An early exit in record_root_in_trans() left a flag set, causing unnecessary lock contention in the transaction hot path; scrub warning path leaked a root reference when path resolution failed.
Why it matters: Reduces transaction start contention and fixes a root reference leak during scrub warnings.
ARM64 device-tree fixes
Surface Pro 11 microphone fix
The DMIC clock divider was set to /2 instead of /4, causing distorted recordings. dmic-sample-rate was lowered to match the Windows configuration.
Why it matters: Makes the built-in microphones on the Surface Pro 11 usable.
NXP Layerscape and i.MX8MP board fixes
Three Layerscape pinmux fixes correct wrong offsets/values that pinctrl-single rejected or ignored; the Variscite Sonata board now references the LDO5 regulator for its SD I/O supply, keeping it enabled.
Why it matters: Fixes pinmux configuration on Layerscape boards and prevents SD card removal/IO errors on the Sonata board.
Qualcomm clock and power fixes
Qualcomm GCC: correct PCIE_RSCC clock enable bits
Three global clock controllers used BIT(0) to enable PCIE_RSCC clocks, but those clocks need BIT(20)/BIT(21). Corrected in gcc-eliza, gcc-hawi, and gcc-kaanapali.
Why it matters: Ensures PCIe-related RSCC clocks are enabled with the right bits on those platforms.
Qualcomm GPUCC: mark GPU CX GDSC as votable
The GPU CX power domain on Glymur and Kaanapali is votable, so polling for power-off status during disable was wrong. Added the VOTABLE flag and removed POLL_CFG_GDSCR.
Why it matters: Fixes GPU power-domain handling, matching other Qualcomm platforms.
GPIO and power sequencing
GPIO: runtime PM, IDA, and IRQ poll worker fixes
Xilinx GPIO leaked a runtime PM reference on request failure; Exar GPIO freed the wrong IDA ID if cleanup registration failed; MPSSE GPIO had a race where an IRQ poll worker could outlive the device.
Why it matters: Prevents power leaks, wrong IDA frees, and a use-after-free in those GPIO drivers.
Power sequencing: add ThinkPad T14s WCN7850 and fix leak
The pcie-m2 power-sequencing driver lost WCN7850 Bluetooth serdev creation on ThinkPad T14s gen6 after a subdevice-ID matching change; a new match restores it. It also now frees the regulator consumer array.
Why it matters: Fixes Bluetooth on the ThinkPad T14s gen6 and a memory leak in the M.2 power-sequencing path.
TEE, memory, and core kernel fixes
TEE/OP-TEE: zero-size rejection, device registration, FF-A offsets
TEE shared memory now rejects zero-sized allocations that caused an invalid page order; OP-TEE registers /dev/tee devices only after full initialization to avoid races; FF-A support handles shared-memory offsets on large-page kernels.
Why it matters: Prevents boot-time warnings/panics on panic_on_warn kernels, closes a device-registration race, and makes OP-TEE work with 64 KiB kernel pages.
mm/mremap: fix locked_vm leaks with MREMAP_DONTUNMAP
Two fixes for the MREMAP_DONTUNMAP path: a self-merge could leak locked_vm accounting, and partial copies could also leak it. The series splits VMAs where needed.
Why it matters: Fixes memory lock accounting for processes using mremap with MREMAP_DONTUNMAP.
Misc kernel fixes: boot-time page-table freeing, /dev/zero mapping, SRCU warning
Deferred kernel page-table freeing is skipped while booting to avoid a panic with boot-time function tracing; read-only MAP_SHARED /dev/zero now behaves like anonymous memory; SRCU cleanup no longer falsely warns when a barrier callback is still running.
Why it matters: Fixes a boot crash with function tracing, corrects an unexpected /dev/zero mmap behavior, and removes a spurious SRCU warning.
Source commits43 entries +
clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable
Taniya Das · Aug 1, 2026 · 1 files
clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable
Taniya Das · Aug 1, 2026 · 1 files
clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks
Luca Weiss · Aug 7, 2026 · 1 files
clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks
Luca Weiss · Aug 7, 2026 · 1 files
clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks
Luca Weiss · Aug 7, 2026 · 1 files
btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
Yang Xiuwei · Aug 19, 2026 · 1 files
btrfs: free iov when btrfs_uring_read_extent() fails
Yang Xiuwei · Aug 19, 2026 · 1 files
btrfs: unlock inode and extent in caller when io_uring read extent fails
Yang Xiuwei · Aug 19, 2026 · 1 files
btrfs: don't stash io_uring encoded data across -EAGAIN
Yang Xiuwei · Aug 19, 2026 · 1 files
tee: qcomtee: fix kernel-doc warnings
Babanpreet Singh · Aug 21, 2026 · 3 files
arm64: dts: lx2160a: fix incorrect pinmux
Vincent Jardin · Aug 24, 2026 · 1 files
arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
Vincent Jardin · Aug 24, 2026 · 1 files
arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
Vincent Jardin · Aug 24, 2026 · 1 files
srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()
Sunho Park · Aug 30, 2026 · 1 files
arm64: dts: qcom: x1-denali: Fix microphone distortion
Dale Whinham · Aug 30, 2026 · 1 files
arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply
Stefano Radaelli · Sep 2, 2026 · 1 files
tee: optee: ffa: support shared memory offsets on large-page kernels
Mahantesh Salimath · Sep 10, 2026 · 2 files
dm-integrity: fix buffer overflow in inline mode with large tag size
Ben Cressey · Sep 15, 2026 · 1 files
dm-crypt: reject the lmk IV mode with AEAD ciphers
Ben Cressey · Sep 15, 2026 · 1 files
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
Wentao Liang · Sep 16, 2026 · 1 files
power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids
Hans de Goede · Sep 18, 2026 · 1 files
optee: register TEE devices only once fully initialized
Shao-Fu Chen · Sep 18, 2026 · 2 files
btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()
Filipe Manana · Sep 18, 2026 · 1 files
dm ioctl: don't let data_start run past the buffer
Palla Raghunath · Sep 18, 2026 · 1 files
usb: mtu3: Fix double dereference in TP_printk
Vladimir Murzin · Sep 22, 2026 · 1 files
mailmap: update addresses for John Garry
John Garry · Sep 23, 2026 · 1 files
dm: fix reading free memory in do_resume
Mikulas Patocka · Sep 23, 2026 · 1 files
gpio: xilinx: fix runtime PM leak on request error path
Ridham Khurana · Sep 23, 2026 · 1 files
MAINTAINERS: update my email address
Imre Kaloz · Sep 24, 2026 · 2 files
mailmap: update entry for Andy Yan
Andy Yan · Sep 24, 2026 · 1 files
drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly
Lorenzo Stoakes (ARM) · Sep 24, 2026 · 1 files
dm-snap: reject the transient exception store for snapshot-merge
Ma Xinmeng · Sep 25, 2026 · 1 files
mm: don't schedule deferred kernel page table freeing while booting
Mikhail Gavrilov · Sep 25, 2026 · 1 files
btrfs: fix xattr replace when multiple xattrs are packed in the same item
Filipe Manana · Sep 25, 2026 · 1 files
btrfs: fix lost error return value in btrfs_listxattr()
Filipe Manana · Sep 25, 2026 · 1 files
selftests/mm: cleanup -Wformat issues in hugetlb-mmap
Carlos Llamas · Sep 27, 2026 · 1 files
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
Georgiy Osokin · Sep 28, 2026 · 1 files
gpio: mpsse: fix race when arming the IRQ poll worker
Fan Wu · Sep 29, 2026 · 1 files
gpio: exar: initialize the ID before registering its cleanup
Sang-Hoon Choi · Sep 29, 2026 · 1 files
power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()
Alexey Charkov · Sep 30, 2026 · 1 files
dm-integrity: validate the superblock on resume
Mikulas Patocka · Sep 30, 2026 · 1 files
mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
Lorenzo Stoakes (ARM) · Sep 30, 2026 · 4 files
mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
Lorenzo Stoakes (ARM) · Sep 30, 2026 · 3 files