[PATCH] xfs_repair: fix array overrun in do_inode_prefetch
Dave Chinner
david at fromorbit.com
Mon Mar 3 17:10:35 CST 2014
On Mon, Mar 03, 2014 at 01:13:58PM -0600, Eric Sandeen wrote:
> Coverity spotted this:
>
> do_inode_prefetch() does a while loop, creating queues:
>
> for (i = 0; i < thread_count; i++) {
> ...
> create_work_queue(&queues[i], mp, 1);
> ...
> }
>
> and then does this to wait for them all to complete:
>
> for (; i >= 0; i--)
> destroy_work_queue(&queues[i]);
>
> But we leave the first for loop with (i == thread_coun)t, and
> the second one will try to index queues[] one past the end.
ugh. My fault. Fix looks good.
Reviewed-by: Dave Chinner <dchinner at redhat.com>
--
Dave Chinner
david at fromorbit.com
More information about the xfs
mailing list