- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 V1] Bluetooth: SCO: hold sk properly in sco_conn_ready
by Yao Yiqi 22 Sep '26

22 Sep '26

From: Pauli Virtanen <pav(a)iki.fi> stable inclusion from stable-v6.6.145 commit d141d9b769bcd1b747898528c5023270cda040f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19595 CVE: CVE-2026-89774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4e37f6452d586b95c346a9abdd2fb80b67794f39 upstream. sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state: [Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UAF on sk deref and similarly for access to sco_get_sock_listen() return value. Fix possible UAF by holding sk refcount in sco_conn_ready() and making sco_get_sock_listen() increase refcount. Also recheck after lock_sock that the socket is still valid. Adjust conn->sk locking so it's protected also by lock_sock() of the associated socket if any. Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/bluetooth/sco.c [ Context conflicts ] Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- net/bluetooth/sco.c | 42 ++++++++++++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 5dbd7e6e1481..33480cc5e853 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -372,9 +372,13 @@ static struct sock *sco_get_sock_listen(bdaddr_t *src) sk1 = sk; } + sk = sk ? sk : sk1; + if (sk) + sock_hold(sk); + read_unlock(&sco_sk_list.lock); - return sk ? sk : sk1; + return sk; } static void sco_sock_destruct(struct sock *sk) @@ -1108,17 +1112,28 @@ static int sco_sock_release(struct socket *sock) static void sco_conn_ready(struct sco_conn *conn) { - struct sock *parent; - struct sock *sk = conn->sk; + struct sock *parent, *sk; + + sco_conn_lock(conn); + sk = sco_sock_hold(conn); + sco_conn_unlock(conn); BT_DBG("conn %p", conn); if (sk) { - sco_sock_clear_timer(sk); lock_sock(sk); - sk->sk_state = BT_CONNECTED; - sk->sk_state_change(sk); + + /* conn->sk may have become NULL if racing with sk close, but + * due to held hdev->lock, it can't become different sk. + */ + if (conn->sk) { + sco_sock_clear_timer(sk); + sk->sk_state = BT_CONNECTED; + sk->sk_state_change(sk); + } + release_sock(sk); + sock_put(sk); } else { sco_conn_lock(conn); @@ -1135,13 +1150,15 @@ static void sco_conn_ready(struct sco_conn *conn) lock_sock(parent); + /* hdev->lock guarantees conn->sk == NULL still here */ + + if (parent->sk_state != BT_LISTEN) + goto release; + sk = sco_sock_alloc(sock_net(parent), NULL, BTPROTO_SCO, GFP_ATOMIC, 0); - if (!sk) { - release_sock(parent); - sco_conn_unlock(conn); - return; - } + if (!sk) + goto release; sco_sock_init(sk, parent); @@ -1159,9 +1176,10 @@ static void sco_conn_ready(struct sco_conn *conn) /* Wake up parent */ parent->sk_data_ready(parent); +release: release_sock(parent); - sco_conn_unlock(conn); + sock_put(parent); } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] nvme: add missing SRCU grace period in error path
by Luo Gengkun 22 Sep '26

22 Sep '26

From: Tristan Madani <tristan(a)talencesecurity.com> mainline inclusion from mainline-v7.3-rc2 commit ef248d5de4469fb6bbaf8dbe0c4c47800080d648 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19101 CVE: CVE-2026-89972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs. The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path. Fixes: ed754e5deeb1 ("nvme: track shared namespaces") Cc: stable(a)vger.kernel.org Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: John Garry <john.g.garry(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/core.c [Adjusted patch context to account for missing last_path reference-counting code.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/nvme/host/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index b4d8aa84b744..614e8ead1ed5 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -3452,6 +3452,9 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) if (list_empty(&ns->head->list)) list_del_init(&ns->head->entry); mutex_unlock(&ctrl->subsys->lock); + + /* guarantee not available in head->list */ + synchronize_srcu(&ns->head->srcu); nvme_put_ns_head(ns->head); out_free_id: kfree(id); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-80978
by JiangJieHua 22 Sep '26

22 Sep '26

Zhiling Zou (2): ip6_gre: fix hardware header length for NBMA tunnels net: cap advertised IP tunnel headroom include/net/ip_tunnels.h | 11 +++++++++-- net/ipv4/ip_tunnel.c | 2 +- net/ipv6/ip6_gre.c | 14 ++++++-------- net/ipv6/ip6_tunnel.c | 7 +++++-- net/ipv6/sit.c | 2 +- 5 files changed, 22 insertions(+), 14 deletions(-) -- 2.33.8

2 3

[PATCH OLK-6.6 00/24] arm64: support BBML2 noabort feature
by Jinjiang Tu 22 Sep '26

22 Sep '26

This series adds support for the BBML2 noabort feature. The arm64 architecture requires following the BBM2 (Break-Before-Make) convention when modifying page table entries: the entry must first be cleared and the TLB flushed before writing the new value, otherwise a TLB conflict may occur. CPUs that support the BBML2 noabort feature are permitted to change the mapping granularity of a page table entry without a TLB flush, which enables the following two optimizations: 1. Performance optimization for user-space contpte folding and unfolding. 2. Dynamic splitting of kernel page tables. Anshuman Khandual (1): arm64/mm: Rename pte_mkpresent() as pte_mkvalid() Ard Biesheuvel (1): arm64: Avoid enabling KPTI unnecessarily Catalin Marinas (1): arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type Dev Jain (2): arm64: Enable permission change on arm64 kernel block mappings arm64/pageattr: Propagate return value from __change_memory_common Jeremy Linton (1): arm64: cpufeature: Display the set of cores with a feature Jinjiang Tu (1): arm64: cpufeature: add HISI_HIP13 to BBML3 allow list Kevin Brodsky (1): arm64: mm: Simplify check in arch_kfence_init_pool() Linu Cherian (3): arm64: sysreg: Add BBM_3 arm64: cpufeature: Rename BBML2_NOABORT as BBML3 arm64: cpufeature: Detect BBML3 based on ID_AA64MMFR2_EL1.BBM Lorenzo Stoakes (1): mm/pagewalk: split walk_page_range_novma() into kernel/user parts Mark Rutland (1): arm64: Split kpti_install_ng_mappings() Mikołaj Lenczewski (2): arm64: Add BBM Level 2 cpu feature arm64/mm: Elide tlbi in contpte_convert() under BBML2 Muchun Song (1): mm: pagewalk: assert write mmap lock only for walking the user page tables Ryan Roberts (7): arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context arm64: mm: Optimize range_split_to_ptes() arm64: mm: Tidy up force_pte_mapping() arm64: mm: Fix rodata=full block mapping support for realm guests arm64/mm: generalize PMD_PRESENT_INVALID for all levels arm64: mm: Handle invalid large leaf mappings correctly Yang Shi (1): arm64: mm: support large block mapping when rodata=full arch/arm64/include/asm/cpufeature.h | 32 ++ arch/arm64/include/asm/kfence.h | 3 +- arch/arm64/include/asm/mmu.h | 5 + arch/arm64/include/asm/pgtable-prot.h | 10 +- arch/arm64/include/asm/pgtable.h | 35 +- arch/arm64/kernel/cpufeature.c | 161 +++++++-- arch/arm64/mm/contpte.c | 134 +++++++- arch/arm64/mm/init.c | 6 +- arch/arm64/mm/mmu.c | 474 +++++++++++++++++++++++++- arch/arm64/mm/pageattr.c | 166 ++++++--- arch/arm64/mm/pfn_range_alloc.c | 6 +- arch/arm64/mm/proc.S | 27 +- arch/arm64/mm/trans_pgd.c | 40 +-- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 1 + arch/openrisc/kernel/dma.c | 4 +- arch/riscv/mm/pageattr.c | 8 +- arch/sw_64/mm/pageattr.c | 2 +- include/linux/pagewalk.h | 10 +- mm/internal.h | 5 + mm/pagewalk.c | 82 ++++- mm/ptdump.c | 3 +- 22 files changed, 1047 insertions(+), 169 deletions(-) -- 2.43.0

2 25

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2026-80976
by JiangJieHua 22 Sep '26

22 Sep '26

Kyle Zeng (1): ipv6: seg6: clear IPv4 control block on IPIP decapsulation Zhiling Zou (1): seg6: reset IP6CB after IPv6 decapsulation net/ipv6/seg6_local.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) -- 2.33.8

2 3

[PATCH OLK-6.6] nvme: add missing SRCU grace period in error path
by Luo Gengkun 22 Sep '26

22 Sep '26

From: Tristan Madani <tristan(a)talencesecurity.com> mainline inclusion from mainline-v7.3-rc2 commit ef248d5de4469fb6bbaf8dbe0c4c47800080d648 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19101 CVE: CVE-2026-89972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs. The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path. Fixes: ed754e5deeb1 ("nvme: track shared namespaces") Cc: stable(a)vger.kernel.org Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: John Garry <john.g.garry(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/core.c [Adjusted patch context to account for missing last_path reference-counting code.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/nvme/host/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index f49ffa8daff5..6a60515e62b4 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -3757,6 +3757,9 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info) if (list_empty(&ns->head->list)) list_del_init(&ns->head->entry); mutex_unlock(&ctrl->subsys->lock); + + /* guarantee not available in head->list */ + synchronize_srcu(&ns->head->srcu); nvme_put_ns_head(ns->head); out_cleanup_disk: put_disk(disk); -- 2.34.1

2 1

[PATCH OLK-5.10] nvme: add missing SRCU grace period in error path
by Luo Gengkun 22 Sep '26

22 Sep '26

From: Tristan Madani <tristan(a)talencesecurity.com> mainline inclusion from mainline-v7.3-rc2 commit ef248d5de4469fb6bbaf8dbe0c4c47800080d648 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19101 CVE: CVE-2026-89972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs. The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path. Fixes: ed754e5deeb1 ("nvme: track shared namespaces") Cc: stable(a)vger.kernel.org Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: John Garry <john.g.garry(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/core.c [Adjusted patch context to account for missing last_path reference-counting code.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/nvme/host/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index cd2858916b64..caa0f1e900a0 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -4029,6 +4029,9 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid, if (list_empty(&ns->head->list)) list_del_init(&ns->head->entry); mutex_unlock(&ctrl->subsys->lock); + + /* guarantee not available in head->list */ + synchronize_srcu(&ns->head->srcu); nvme_put_ns_head(ns->head); out_cleanup_disk: blk_cleanup_disk(disk); -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] arm64: Fix NMI/DAIF handling in hibernate,
by Qinxin Xia 22 Sep '26

22 Sep '26

From: Xia Qinxin <xiaqinxin(a)opencode.com> arm64: Fix NMI/DAIF handling in hibernate, suspend and kprobes Ada Couprie Diaz (2): arm64: hibernate: mask DAIF before restoring hibernated kernel arm64: irq: Report FEAT_NMI masking local IRQs Vladimir Murzin (3): arm64: hibernate: Restore DAIF state on error arm64: suspend: Always initialise PSTATE.ALLINT arm64: kprobes: Disable NMIs arch/arm64/include/asm/irqflags.h | 21 +++++++++++++++++---- arch/arm64/include/asm/ptrace.h | 8 +++++--- arch/arm64/include/uapi/asm/ptrace.h | 1 + arch/arm64/kernel/hibernate.c | 16 +++++++++++++++- arch/arm64/kernel/probes/kprobes.c | 12 +++++++----- 5 files changed, 45 insertions(+), 13 deletions(-) -- 2.25.1

2 6

[OLK-5.10 v2] fuse: fix invalidate lock leak on open O_TRUNC DAX failure
by Yang Erkun 22 Sep '26

22 Sep '26

From: Baokun Li <libaokun(a)linux.alibaba.com> mainline inclusion from mainline-v7.3-rc1 commit a927f1867e61b78f39f9da0bbba3c98c2ca151fe category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18697 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- fuse_open() takes filemap_invalidate_lock() for a DAX truncate (dax_truncate = true) and releases it before the out_inode_unlock label. But when fuse_dax_break_layouts() fails, the goto out_inode_unlock skips the unlock and leaks the rwsem, so any later fault or truncate on the file stalls on the stale lock. fuse_dax_break_layouts() can fail with -ERESTARTSYS when a signal interrupts the wait for busy DAX pages to drain: open("file", O_RDWR | O_TRUNC) └─ fuse_open() ├─ filemap_invalidate_lock() # dax_truncate └─ fuse_dax_break_layouts() └─ dax_break_layout() └─ wait_page_idle() # TASK_INTERRUPTIBLE └─ fuse_wait_dax_page() # unlock, schedule, re-lock └─ signal → -ERESTARTSYS goto out_inode_unlock # <- lock leaked Fix this by moving filemap_invalidate_unlock() below the label so that all error paths release the lock, and rename the label to out_unlock as it now covers more than just the inode lock. Fixes: 2fdbb8dd0155 ("fuse: fix deadlock between atomic O_TRUNC and page invalidation") Cc: stable(a)vger.kernel.org # v6.0+ Signed-off-by: Baokun Li <libaokun(a)linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflicts: fs/fuse/file.c [The target tree still uses i_mmap_sem instead of filemap_invalidate_lock(), so relocate up_write(&i_mmap_sem) below the renamed out_unlock label.] Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/fuse/file.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 87c8272d0e17..91fb1f67d6af 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -245,7 +245,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) down_write(&get_fuse_inode(inode)->i_mmap_sem); err = fuse_dax_break_layouts(inode, 0, 0); if (err) - goto out_inode_unlock; + goto out_unlock; } if (is_wb_truncate || dax_truncate) @@ -265,10 +265,10 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) invalidate_inode_pages2(inode->i_mapping); } +out_unlock: if (dax_truncate) up_write(&get_fuse_inode(inode)->i_mmap_sem); -out_inode_unlock: if (is_wb_truncate || dax_truncate) inode_unlock(inode); -- 2.52.0

1 0

[PATCH OLK-6.6] nvmet-tcp: reject unsolicited H2CData PDUs
by Luo Gengkun 22 Sep '26

22 Sep '26

From: Shivam Kumar <kumar.shivam43666(a)gmail.com> stable inclusion from stable-v6.6.157 commit 9fb527103e53fd43a8e802c2eca407869c204f7a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19098 CVE: CVE-2026-89968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit db62b35cbca052860c519cbcabe7650708528738 upstream. nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that the target has actually solicited that data by sending an R2T for the command. A remote host can abuse this. It submits a write command that takes the R2T path and, before the target transmits the R2T, sends an H2CData PDU for that command's tag. The data completes the command early, and when the command then fails synchronously (e.g. a length mismatch caught by nvmet_check_transfer_len()), it is completed a second time. Each completion calls nvmet_tcp_queue_response(), so the same command is added to queue->resp_list twice while it is still linked; the second llist_add() makes the node point to itself (lentry->next == lentry). nvmet_tcp_process_resp_list() then walks that self-referential node and adds the command to resp_send_list twice. With CONFIG_DEBUG_LIST this trips the "list_add double add" check (kernel BUG); without it the loop never terminates and the nvmet_tcp workqueue wedges (soft-lockup). It is remotely triggerable and needs no authentication on an allow_any_host subsystem. Track whether an R2T has been transmitted for a command and reject an H2CData PDU that arrives before it. The flag is cleared on command reuse (nvmet_tcp_get_cmd() zeroes cmd->flags) and stays set across the multiple H2CData PDUs of a single solicited transfer. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Cc: stable(a)vger.kernel.org Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Shivam Kumar <kumar.shivam43666(a)gmail.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/nvme/target/tcp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 01da7c497c93..3af4c9e99571 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -88,6 +88,7 @@ enum nvmet_tcp_recv_state { enum { NVMET_TCP_F_INIT_FAILED = (1 << 0), + NVMET_TCP_F_R2T_SENT = (1 << 1), }; struct nvmet_tcp_cmd { @@ -761,6 +762,7 @@ static int nvmet_try_send_r2t(struct nvmet_tcp_cmd *cmd, bool last_in_batch) return -EAGAIN; cmd->queue->snd_cmd = NULL; + cmd->flags |= NVMET_TCP_F_R2T_SENT; return 1; } @@ -1029,6 +1031,12 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) cmd = &queue->connect; } + if (unlikely(!(cmd->flags & NVMET_TCP_F_R2T_SENT))) { + pr_err("queue %d: unsolicited H2CData (ttag %u)\n", + queue->idx, data->ttag); + goto err_proto; + } + if (le32_to_cpu(data->data_offset) != cmd->rbytes_done) { pr_err("ttag %u unexpected data offset %u (expected %u)\n", data->ttag, le32_to_cpu(data->data_offset), -- 2.34.1

2 1