--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 16 22:22:11 2008
+From: Oliver Hartkopp <oliver@hartkopp.net>
+Date: Tue, 08 Jul 2008 18:34:50 +0200
+Subject: can: add sanity checks
+To: stable@kernel.org, Greg KH <greg@kroah.com>
+Cc: Linux Netdev List <netdev@vger.kernel.org>, Oliver Hartkopp <oliver.hartkopp@volkswagen.de>, Andre Naujoks <nautsch@gmail.com>, David Miller <davem@davemloft.net>, Urs Thuermann <urs.thuermann@volkswagen.de>
+Message-ID: <4873972A.3000404@hartkopp.net>
+
+From: Oliver Hartkopp <oliver@hartkopp.net>
+
+commit 7f2d38eb7a42bea1c1df51bbdaa2ca0f0bdda07f upstream
+
+Even though the CAN netlayer only deals with CAN netdevices, the
+netlayer interface to the userspace and to the device layer should
+perform some sanity checks.
+
+This patch adds several sanity checks that mainly prevent userspace apps
+to send broken content into the system that may be misinterpreted by
+some other userspace application.
+
+Signed-off-by: Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
+Signed-off-by: Urs Thuermann <urs.thuermann@volkswagen.de>
+Acked-by: Andre Naujoks <nautsch@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/can/af_can.c | 10 ++++++++++
+ net/can/bcm.c | 23 +++++++++++++++++++----
+ net/can/raw.c | 3 +++
+ 3 files changed, 32 insertions(+), 4 deletions(-)
+
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -205,12 +205,19 @@ static int can_create(struct net *net, s
+ * -ENOBUFS on full driver queue (see net_xmit_errno())
+ * -ENOMEM when local loopback failed at calling skb_clone()
+ * -EPERM when trying to send on a non-CAN interface
++ * -EINVAL when the skb->data does not contain a valid CAN frame
+ */
+ int can_send(struct sk_buff *skb, int loop)
+ {
+ struct sk_buff *newskb = NULL;
++ struct can_frame *cf = (struct can_frame *)skb->data;
+ int err;
+
++ if (skb->len != sizeof(struct can_frame) || cf->can_dlc > 8) {
++ kfree_skb(skb);
++ return -EINVAL;
++ }
++
+ if (skb->dev->type != ARPHRD_CAN) {
+ kfree_skb(skb);
+ return -EPERM;
+@@ -605,6 +612,7 @@ static int can_rcv(struct sk_buff *skb,
+ struct packet_type *pt, struct net_device *orig_dev)
+ {
+ struct dev_rcv_lists *d;
++ struct can_frame *cf = (struct can_frame *)skb->data;
+ int matches;
+
+ if (dev->type != ARPHRD_CAN || dev->nd_net != &init_net) {
+@@ -612,6 +620,8 @@ static int can_rcv(struct sk_buff *skb,
+ return 0;
+ }
+
++ BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8);
++
+ /* update statistics */
+ can_stats.rx_frames++;
+ can_stats.rx_frames_delta++;
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -326,7 +326,7 @@ static void bcm_send_to_user(struct bcm_
+
+ if (head->nframes) {
+ /* can_frames starting here */
+- firstframe = (struct can_frame *) skb_tail_pointer(skb);
++ firstframe = (struct can_frame *)skb_tail_pointer(skb);
+
+ memcpy(skb_put(skb, datalen), frames, datalen);
+
+@@ -818,6 +818,10 @@ static int bcm_tx_setup(struct bcm_msg_h
+ for (i = 0; i < msg_head->nframes; i++) {
+ err = memcpy_fromiovec((u8 *)&op->frames[i],
+ msg->msg_iov, CFSIZ);
++
++ if (op->frames[i].can_dlc > 8)
++ err = -EINVAL;
++
+ if (err < 0)
+ return err;
+
+@@ -850,6 +854,10 @@ static int bcm_tx_setup(struct bcm_msg_h
+ for (i = 0; i < msg_head->nframes; i++) {
+ err = memcpy_fromiovec((u8 *)&op->frames[i],
+ msg->msg_iov, CFSIZ);
++
++ if (op->frames[i].can_dlc > 8)
++ err = -EINVAL;
++
+ if (err < 0) {
+ if (op->frames != &op->sframe)
+ kfree(op->frames);
+@@ -1161,9 +1169,12 @@ static int bcm_tx_send(struct msghdr *ms
+
+ skb->dev = dev;
+ skb->sk = sk;
+- can_send(skb, 1); /* send with loopback */
++ err = can_send(skb, 1); /* send with loopback */
+ dev_put(dev);
+
++ if (err)
++ return err;
++
+ return CFSIZ + MHSIZ;
+ }
+
+@@ -1182,6 +1193,10 @@ static int bcm_sendmsg(struct kiocb *ioc
+ if (!bo->bound)
+ return -ENOTCONN;
+
++ /* check for valid message length from userspace */
++ if (size < MHSIZ || (size - MHSIZ) % CFSIZ)
++ return -EINVAL;
++
+ /* check for alternative ifindex for this bcm_op */
+
+ if (!ifindex && msg->msg_name) {
+@@ -1256,8 +1271,8 @@ static int bcm_sendmsg(struct kiocb *ioc
+ break;
+
+ case TX_SEND:
+- /* we need at least one can_frame */
+- if (msg_head.nframes < 1)
++ /* we need exactly one can_frame behind the msg head */
++ if ((msg_head.nframes != 1) || (size != CFSIZ + MHSIZ))
+ ret = -EINVAL;
+ else
+ ret = bcm_tx_send(msg, ifindex, sk);
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -632,6 +632,9 @@ static int raw_sendmsg(struct kiocb *ioc
+ } else
+ ifindex = ro->ifindex;
+
++ if (size != sizeof(struct can_frame))
++ return -EINVAL;
++
+ dev = dev_get_by_index(&init_net, ifindex);
+ if (!dev)
+ return -ENXIO;
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 16 22:20:22 2008
+From: Mike Miller <mike.miller@hp.com>
+Date: Fri, 4 Jul 2008 20:05:25 GMT
+Subject: cciss: read config to obtain max outstanding commands per controller
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807042005.m64K5PTl030132@hera.kernel.org>
+
+From: Mike Miller <mike.miller@hp.com>
+
+commit 491539982aa01fa71de93c2a06ac5d890d4cf1e2 upstream
+
+This patch changes the way we determine the maximum number of outstanding
+commands for each controller.
+
+Most Smart Array controllers can support up to 1024 commands, the notable
+exceptions are the E200 and E200i.
+
+The next generation of controllers which were just added support a mode of
+operation called Zero Memory Raid (ZMR). In this mode they only support
+64 outstanding commands. In Full Function Raid (FFR) mode they support
+1024.
+
+We have been setting the queue depth by arbitrarily assigning some value
+for each controller. We needed a better way to set the queue depth to
+avoid lots of annoying "fifo full" messages. So we made the driver a
+little smarter. We now read the config table and subtract 4 from the
+returned value. The -4 is to allow some room for ioctl calls which are
+not tracked the same way as io commands are tracked.
+
+Please consider this for inclusion.
+
+Signed-off-by: Mike Miller <mike.miller@hp.com>
+Cc: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/cciss.c | 66 ++++++++++++++++++++++++++++----------------------
+ 1 file changed, 37 insertions(+), 29 deletions(-)
+
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -106,35 +106,34 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_devic
+ /* board_id = Subsystem Device ID & Vendor ID
+ * product = Marketing Name for the board
+ * access = Address of the struct of function pointers
+- * nr_cmds = Number of commands supported by controller
+ */
+ static struct board_type products[] = {
+- {0x40700E11, "Smart Array 5300", &SA5_access, 512},
+- {0x40800E11, "Smart Array 5i", &SA5B_access, 512},
+- {0x40820E11, "Smart Array 532", &SA5B_access, 512},
+- {0x40830E11, "Smart Array 5312", &SA5B_access, 512},
+- {0x409A0E11, "Smart Array 641", &SA5_access, 512},
+- {0x409B0E11, "Smart Array 642", &SA5_access, 512},
+- {0x409C0E11, "Smart Array 6400", &SA5_access, 512},
+- {0x409D0E11, "Smart Array 6400 EM", &SA5_access, 512},
+- {0x40910E11, "Smart Array 6i", &SA5_access, 512},
+- {0x3225103C, "Smart Array P600", &SA5_access, 512},
+- {0x3223103C, "Smart Array P800", &SA5_access, 512},
+- {0x3234103C, "Smart Array P400", &SA5_access, 512},
+- {0x3235103C, "Smart Array P400i", &SA5_access, 512},
+- {0x3211103C, "Smart Array E200i", &SA5_access, 120},
+- {0x3212103C, "Smart Array E200", &SA5_access, 120},
+- {0x3213103C, "Smart Array E200i", &SA5_access, 120},
+- {0x3214103C, "Smart Array E200i", &SA5_access, 120},
+- {0x3215103C, "Smart Array E200i", &SA5_access, 120},
+- {0x3237103C, "Smart Array E500", &SA5_access, 512},
+- {0x323D103C, "Smart Array P700m", &SA5_access, 512},
+- {0x3241103C, "Smart Array P212", &SA5_access, 384},
+- {0x3243103C, "Smart Array P410", &SA5_access, 384},
+- {0x3245103C, "Smart Array P410i", &SA5_access, 384},
+- {0x3247103C, "Smart Array P411", &SA5_access, 384},
+- {0x3249103C, "Smart Array P812", &SA5_access, 384},
+- {0xFFFF103C, "Unknown Smart Array", &SA5_access, 120},
++ {0x40700E11, "Smart Array 5300", &SA5_access},
++ {0x40800E11, "Smart Array 5i", &SA5B_access},
++ {0x40820E11, "Smart Array 532", &SA5B_access},
++ {0x40830E11, "Smart Array 5312", &SA5B_access},
++ {0x409A0E11, "Smart Array 641", &SA5_access},
++ {0x409B0E11, "Smart Array 642", &SA5_access},
++ {0x409C0E11, "Smart Array 6400", &SA5_access},
++ {0x409D0E11, "Smart Array 6400 EM", &SA5_access},
++ {0x40910E11, "Smart Array 6i", &SA5_access},
++ {0x3225103C, "Smart Array P600", &SA5_access},
++ {0x3223103C, "Smart Array P800", &SA5_access},
++ {0x3234103C, "Smart Array P400", &SA5_access},
++ {0x3235103C, "Smart Array P400i", &SA5_access},
++ {0x3211103C, "Smart Array E200i", &SA5_access},
++ {0x3212103C, "Smart Array E200", &SA5_access},
++ {0x3213103C, "Smart Array E200i", &SA5_access},
++ {0x3214103C, "Smart Array E200i", &SA5_access},
++ {0x3215103C, "Smart Array E200i", &SA5_access},
++ {0x3237103C, "Smart Array E500", &SA5_access},
++ {0x323D103C, "Smart Array P700m", &SA5_access},
++ {0x3241103C, "Smart Array P212", &SA5_access},
++ {0x3243103C, "Smart Array P410", &SA5_access},
++ {0x3245103C, "Smart Array P410i", &SA5_access},
++ {0x3247103C, "Smart Array P411", &SA5_access},
++ {0x3249103C, "Smart Array P812", &SA5_access},
++ {0xFFFF103C, "Unknown Smart Array", &SA5_access},
+ };
+
+ /* How long to wait (in milliseconds) for board to go into simple mode */
+@@ -3082,11 +3081,20 @@ static int __devinit cciss_pci_init(ctlr
+ print_cfg_table(c->cfgtable);
+ #endif /* CCISS_DEBUG */
+
++ /* Some controllers support Zero Memory Raid (ZMR).
++ * When configured in ZMR mode the number of supported
++ * commands drops to 64. So instead of just setting an
++ * arbitrary value we make the driver a little smarter.
++ * We read the config table to tell us how many commands
++ * are supported on the controller then subtract 4 to
++ * leave a little room for ioctl calls.
++ */
++ c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
+ for (i = 0; i < ARRAY_SIZE(products); i++) {
+ if (board_id == products[i].board_id) {
+ c->product_name = products[i].product_name;
+ c->access = *(products[i].access);
+- c->nr_cmds = products[i].nr_cmds;
++ c->nr_cmds = c->max_commands - 4;
+ break;
+ }
+ }
+@@ -3106,7 +3114,7 @@ static int __devinit cciss_pci_init(ctlr
+ if (subsystem_vendor_id == PCI_VENDOR_ID_HP) {
+ c->product_name = products[i-1].product_name;
+ c->access = *(products[i-1].access);
+- c->nr_cmds = products[i-1].nr_cmds;
++ c->nr_cmds = c->max_commands - 4;
+ printk(KERN_WARNING "cciss: This is an unknown "
+ "Smart Array controller.\n"
+ "cciss: Please update to the latest driver "
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 16 22:25:46 2008
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 10 Jul 2008 18:15:04 GMT
+Subject: md: ensure all blocks are uptodate or locked when syncing
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807101815.m6AIF4Fb012849@hera.kernel.org>
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 7a1fc53c5adb910751a9b212af90302eb4ffb527 upstream
+
+Remove the dubious attempt to prefer 'compute' over 'read'. Not only is it
+wrong given commit c337869d (md: do not compute parity unless it is on a failed
+drive), but it can trigger a BUG_ON in handle_parity_checks5().
+
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid5.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1999,12 +1999,7 @@ static int __handle_issuing_new_read_req
+ */
+ s->uptodate++;
+ return 0; /* uptodate + compute == disks */
+- } else if ((s->uptodate < disks - 1) &&
+- test_bit(R5_Insync, &dev->flags)) {
+- /* Note: we hold off compute operations while checks are
+- * in flight, but we still prefer 'compute' over 'read'
+- * hence we only read if (uptodate < * disks-1)
+- */
++ } else if (test_bit(R5_Insync, &dev->flags)) {
+ set_bit(R5_LOCKED, &dev->flags);
+ set_bit(R5_Wantread, &dev->flags);
+ if (!test_and_set_bit(STRIPE_OP_IO, &sh->ops.pending))
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 16 22:28:33 2008
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Date: Mon, 07 Jul 2008 15:57:03 +0200
+Subject: netfilter: nf_conntrack_tcp: fixing to check the lower bound of valid ACK
+To: stable@kernel.org
+Cc: Netfilter Development Mailinglist <netfilter-devel@vger.kernel.org>, "David S. Miller" <davem@davemloft.net>
+Message-ID: <487220AF.5070204@trash.net>
+
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+
+Upstream commit 84ebe1c:
+
+Lost connections was reported by Thomas Bätzler (running 2.6.25 kernel) on
+the netfilter mailing list (see the thread "Weird nat/conntrack Problem
+with PASV FTP upload"). He provided tcpdump recordings which helped to
+find a long lingering bug in conntrack.
+
+In TCP connection tracking, checking the lower bound of valid ACK could
+lead to mark valid packets as INVALID because:
+
+ - We have got a "higher or equal" inequality, but the test checked
+ the "higher" condition only; fixed.
+ - If the packet contains a SACK option, it could occur that the ACK
+ value was before the left edge of our (S)ACK "window": if a previous
+ packet from the other party intersected the right edge of the window
+ of the receiver, we could move forward the window parameters beyond
+ accepting a valid ack. Therefore in this patch we check the rightmost
+ SACK edge instead of the ACK value in the lower bound of valid (S)ACK
+ test.
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ net/netfilter/nf_conntrack_proto_tcp.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -332,12 +332,13 @@ static unsigned int get_conntrack_index(
+
+ I. Upper bound for valid data: seq <= sender.td_maxend
+ II. Lower bound for valid data: seq + len >= sender.td_end - receiver.td_maxwin
+- III. Upper bound for valid ack: sack <= receiver.td_end
+- IV. Lower bound for valid ack: ack >= receiver.td_end - MAXACKWINDOW
++ III. Upper bound for valid (s)ack: sack <= receiver.td_end
++ IV. Lower bound for valid (s)ack: sack >= receiver.td_end - MAXACKWINDOW
+
+- where sack is the highest right edge of sack block found in the packet.
++ where sack is the highest right edge of sack block found in the packet
++ or ack in the case of packet without SACK option.
+
+- The upper bound limit for a valid ack is not ignored -
++ The upper bound limit for a valid (s)ack is not ignored -
+ we doesn't have to deal with fragments.
+ */
+
+@@ -607,12 +608,12 @@ static int tcp_in_window(const struct nf
+ before(seq, sender->td_maxend + 1),
+ after(end, sender->td_end - receiver->td_maxwin - 1),
+ before(sack, receiver->td_end + 1),
+- after(ack, receiver->td_end - MAXACKWINDOW(sender)));
++ after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
+
+ if (before(seq, sender->td_maxend + 1) &&
+ after(end, sender->td_end - receiver->td_maxwin - 1) &&
+ before(sack, receiver->td_end + 1) &&
+- after(ack, receiver->td_end - MAXACKWINDOW(sender))) {
++ after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
+ /*
+ * Take into account window scaling (RFC 1323).
+ */
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 16 22:20:59 2008
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Fri, 4 Jul 2008 20:05:29 GMT
+Subject: serial: fix serial_match_port() for dynamic major tty-device numbers
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807042005.m64K5TwN030220@hera.kernel.org>
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit 7ca796f492a11f9408e661c8f22cd8c4f486b8e5 upstream
+
+As reported by Vipul Gandhi, the current serial_match_port() doesn't work
+for tty-devices using dynamic major number allocation. Fix it.
+
+It oopses if you suspend a serial port with _dynamic_ major number. ATM,
+I think, there's only the drivers/serial/jsm/jsm_driver.c driver, that
+does it in-tree.
+
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Tested-by: Vipul Gandhi <vcgandhi1@aol.com>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/serial_core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/serial/serial_core.c
++++ b/drivers/serial/serial_core.c
+@@ -1950,7 +1950,9 @@ struct uart_match {
+ static int serial_match_port(struct device *dev, void *data)
+ {
+ struct uart_match *match = data;
+- dev_t devt = MKDEV(match->driver->major, match->driver->minor) + match->port->line;
++ struct tty_driver *tty_drv = match->driver->tty_driver;
++ dev_t devt = MKDEV(tty_drv->major, tty_drv->minor_start) +
++ match->port->line;
+
+ return dev->devt == devt; /* Actually, only one tty per port */
+ }
scsi-ses-fix-timeout.patch
mm-switch-node-meminfo-active-inactive-pages-to-kbytes.patch
reiserfs-discard-prealloc-in-reiserfs_delete_inode.patch
+cciss-read-config-to-obtain-max-outstanding-commands-per-controller.patch
+serial-fix-serial_match_port-for-dynamic-major-tty-device-numbers.patch
+can-add-sanity-checks.patch
+sisusbvga-fix-oops-on-disconnect.patch
+md-ensure-all-blocks-are-uptodate-or-locked-when-syncing.patch
+textsearch-fix-boyer-moore-text-search-bug.patch
+netfilter-nf_conntrack_tcp-fixing-to-check-the-lower-bound-of-valid-ack.patch
--- /dev/null
+From f15e39739a1d7dfaa2173a91707a74c11a246648 Mon Sep 17 00:00:00 2001
+From: Will Newton <will.newton@gmail.com>
+Date: Fri, 27 Jun 2008 13:08:08 +0100
+Subject: sisusbvga: Fix oops on disconnect.
+Message-Id: <20080709195321.4bc6dd4a.akpm@linux-foundation.org>
+
+From: Will Newton <will.newton@gmail.com>
+
+commit f15e39739a1d7dfaa2173a91707a74c11a246648 upstream
+
+Remove dev_info call on disconnect. The sisusb_dev pointer may have been
+set to zero by sisusb_delete at this point causing an oops.
+
+The message does not provide any extra information over the standard USB
+subsystem output so removing it does not affect functionality.
+
+Signed-off-by: Will Newton <will.newton@gmail.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/misc/sisusbvga/sisusb.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -3264,8 +3264,6 @@ static void sisusb_disconnect(struct usb
+
+ /* decrement our usage count */
+ kref_put(&sisusb->kref, sisusb_delete);
+-
+- dev_info(&sisusb->sisusb_dev->dev, "Disconnected\n");
+ }
+
+ static struct usb_device_id sisusb_table [] = {
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 16 22:27:41 2008
+From: Joonwoo Park <joonwpark81@gmail.com>
+Date: Mon, 07 Jul 2008 15:56:57 +0200
+Subject: textsearch: fix Boyer-Moore text search bug
+To: stable@kernel.org
+Cc: Netfilter Development Mailinglist <netfilter-devel@vger.kernel.org>, "David S. Miller" <davem@davemloft.net>
+Message-ID: <487220A9.7000606@trash.net>
+
+From: Joonwoo Park <joonwpark81@gmail.com>
+
+Upstream commit aebb6a849cfe7d89bcacaaecc20a480dfc1180e7
+
+The current logic has a bug which cannot find matching pattern, if the
+pattern is matched from the first character of target string.
+for example:
+ pattern=abc, string=abcdefg
+ pattern=a, string=abcdefg
+Searching algorithm should return 0 for those things.
+
+Signed-off-by: Joonwoo Park <joonwpark81@gmail.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ lib/ts_bm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/ts_bm.c
++++ b/lib/ts_bm.c
+@@ -63,7 +63,7 @@ static unsigned int bm_find(struct ts_co
+ struct ts_bm *bm = ts_config_priv(conf);
+ unsigned int i, text_len, consumed = state->offset;
+ const u8 *text;
+- int shift = bm->patlen, bs;
++ int shift = bm->patlen - 1, bs;
+
+ for (;;) {
+ text_len = conf->get_next_block(consumed, &text, conf, state);
projects / thirdparty / kernel / stable-queue.git / commitdiff
