xfs
[Top] [All Lists]

[PATCH] xfs_repair: fix array overrun in do_inode_prefetch

To: xfs-oss <xfs@xxxxxxxxxxx>
Subject: [PATCH] xfs_repair: fix array overrun in do_inode_prefetch
From: Eric Sandeen <sandeen@xxxxxxxxxx>
Date: Mon, 03 Mar 2014 13:13:58 -0600
Delivered-to: xfs@xxxxxxxxxxx
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.3.0
Coverity spotted this:

do_inode_prefetch() does a while loop, creating queues:

        for (i = 0; i < thread_count; i++) {
                ...
                create_work_queue(&queues[i], mp, 1);
                ...
        }

and then does this to wait for them all to complete:

        for (; i >= 0; i--)
                destroy_work_queue(&queues[i]);

But we leave the first for loop with (i == thread_coun)t, and
the second one will try to index queues[] one past the end.

Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxx>
---

diff --git a/repair/prefetch.c b/repair/prefetch.c
index 0f9e3fe..e47a48e 100644
--- a/repair/prefetch.c
+++ b/repair/prefetch.c
@@ -995,7 +995,7 @@ do_inode_prefetch(
        /*
         * wait for workers to complete
         */
-       for (; i >= 0; i--)
+       while (i--)
                destroy_work_queue(&queues[i]);
        free(queues);
 }

<Prev in Thread] Current Thread [Next in Thread>