xfs
[Top] [All Lists]

[PATCH] xfs_repair: don't let bplist index go negative in prefetch

To: xfs-oss <xfs@xxxxxxxxxxx>
Subject: [PATCH] xfs_repair: don't let bplist index go negative in prefetch
From: Eric Sandeen <sandeen@xxxxxxxxxx>
Date: Thu, 15 May 2014 13:59:43 -0500
Delivered-to: xfs@xxxxxxxxxxx
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
After:

bbd3275 repair: don't unlock prefetch tree to read discontig buffers

Coverity spotted that it's possible for us to arrive at the loop
below with num == 1, and then we decrement it to 0, and try to
index bplist[num-1].

I think this was possible before the change, i.e. it's probably
not a regression.

Fix this by not trying to shrink the window unless we have
more than one buffer in the array.

Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxx>
---


diff --git a/repair/prefetch.c b/repair/prefetch.c
index 4595310..b6d4755 100644
--- a/repair/prefetch.c
+++ b/repair/prefetch.c
@@ -505,7 +505,7 @@ pf_batch_read(
                first_off = LIBXFS_BBTOOFF64(XFS_BUF_ADDR(bplist[0]));
                last_off = LIBXFS_BBTOOFF64(XFS_BUF_ADDR(bplist[num-1])) +
                        XFS_BUF_SIZE(bplist[num-1]);
-               while (last_off - first_off > pf_max_bytes) {
+               while (num > 1 && last_off - first_off > pf_max_bytes) {
                        num--;
                        last_off = 
LIBXFS_BBTOOFF64(XFS_BUF_ADDR(bplist[num-1])) +
                                XFS_BUF_SIZE(bplist[num-1]);

<Prev in Thread] Current Thread [Next in Thread>