SUNRPC: off by one in BUG_ON()
Subsystems (5)
PATCH 1/1 SUNRPC: off by one in BUG_ON()
The m->pool_to[] array has "maxpools" number of elements. It's allocated in svc_pool_map_alloc_arrays() which we called earlier in the function. This test should be >= instead of >.
Signed-off-by Dan Carpenter <[email protected]>
---
This is very old code, but hopefully the off by one doesn't affect runtime.
net/sunrpc/svc.c +1 -1
@@ -189,7 +189,7 @@ svc_pool_map_init_percpu(struct svc_pool_map *m)return err;for_each_online_cpu (cpu) { -BUG_ON (pidx > maxpools); +BUG_ON (pidx >= maxpools); m->to_pool[cpu] = pidx; m->pool_to[pidx] = cpu; pidx++;
Quoted 8 lines · Dan Carpenter
The m->pool_to[] array has "maxpools" number of elements. It's allocated in
svc_pool_map_alloc_arrays()which we called earlier in the function. This test should be >= instead of >.Signed-off-by Dan Carpenter <[email protected]>---
This is very old code, but hopefully the off by one doesn't affect runtime.
Yeah, doesn't look like a big deal, but thanks, applying for 3.19.--b.
Quoted 14 lines
net/sunrpc/svc.c +1
-1@@ -189,7 +189,7 @@ svc_pool_map_init_percpu(struct svc_pool_map *m)return err;for_each_online_cpu (cpu) { -BUG_ON (pidx > maxpools); +BUG_ON (pidx >= maxpools); m->to_pool[cpu] = pidx; m->pool_to[pidx] = cpu; pidx++;