xfs_repair: fix array overrun in do_inode_prefetch
PATCH 1/1 xfs_repair: fix array overrun in do_inode_prefetch
Coverity spotted this:
do_inode_prefetch() does a while loop, creating queues:
for (i = 0; i < thread_count; i++) {
...
create_work_queue(&queues[i], mp, 1);
...
}and then does this to wait for them all to complete:
for (; i >= 0; i--)
destroy_work_queue(&queues[i]);
But we leave the first for loop with (i == thread_coun)t, and the second one will try to index queues[] one past the end.
---
repair/prefetch.c +1 -1
@@ -995,7 +995,7 @@ do_inode_prefetch(/* * wait for workers to complete */ -for (; i >=0 ; i--) +while (i--)destroy_work_queue (&queues[i]);free (queues); }
_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
Quoted 10 lines · Eric Sandeen
Coverity spotted this:
do_inode_prefetch()does a while loop, creating queues:for (i = 0; i < thread_count; i++) { ... create_work_queue(&queues[i], mp, 1); ... }
Quoted 7 lines
and then does this to wait for them all to complete:
for (; i >= 0; i--)
destroy_work_queue(&queues[i]);But we leave the first for loop with (i == thread_coun)t, and the second one will try to index queues[] one past the end.
ugh. My fault. Fix looks good.
Signature · 7 lines
Dave Chinner [email protected] _______________________________________________ xfs mailing list [email protected] http://oss.sgi.com/mailman/listinfo/xfs