xfs
[Top] [All Lists]

Re: [PATCH] xfs_repair: fix array overrun in do_inode_prefetch

To: Eric Sandeen <sandeen@xxxxxxxxxx>
Subject: Re: [PATCH] xfs_repair: fix array overrun in do_inode_prefetch
From: Dave Chinner <david@xxxxxxxxxxxxx>
Date: Tue, 4 Mar 2014 10:10:35 +1100
Cc: xfs-oss <xfs@xxxxxxxxxxx>
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <5314D476.7030503@xxxxxxxxxx>
References: <5314D476.7030503@xxxxxxxxxx>
User-agent: Mutt/1.5.21 (2010-09-15)
On Mon, Mar 03, 2014 at 01:13:58PM -0600, Eric Sandeen wrote:
> Coverity spotted this:
> 
> do_inode_prefetch() does a while loop, creating queues:
> 
>         for (i = 0; i < thread_count; i++) {
>               ...
>               create_work_queue(&queues[i], mp, 1);
>               ...
>       }
> 
> and then does this to wait for them all to complete:
> 
>       for (; i >= 0; i--)
>               destroy_work_queue(&queues[i]);
> 
> But we leave the first for loop with (i == thread_coun)t, and
> the second one will try to index queues[] one past the end.

ugh. My fault. Fix looks good.

Reviewed-by: Dave Chinner <dchinner@xxxxxxxxxx>

-- 
Dave Chinner
david@xxxxxxxxxxxxx

<Prev in Thread] Current Thread [Next in Thread>