[PATCH] xfs_repair: fix array overrun in do_inode_prefetch

[PATCH] xfs_repair: fix array overrun in do_inode_prefetch

[Eric Sandeen]

Coverity spotted this:

do_inode_prefetch() does a while loop, creating queues:

        for (i = 0; i < thread_count; i++) {
		...
		create_work_queue(&queues[i], mp, 1);
		...
	}

and then does this to wait for them all to complete:

	for (; i >= 0; i--)
 		destroy_work_queue(&queues[i]);

But we leave the first for loop with (i == thread_coun)t, and
the second one will try to index queues[] one past the end.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---

diff --git a/repair/prefetch.c b/repair/prefetch.c
index 0f9e3fe..e47a48e 100644
--- a/repair/prefetch.c
+++ b/repair/prefetch.c
@@ -995,7 +995,7 @@ do_inode_prefetch(
 	/*
 	 * wait for workers to complete
 	 */
-	for (; i >= 0; i--)
+	while (i--)
 		destroy_work_queue(&queues[i]);
 	free(queues);
 }

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: [PATCH] xfs_repair: fix array overrun in do_inode_prefetch

[Dave Chinner]

On Mon, Mar 03, 2014 at 01:13:58PM -0600, Eric Sandeen wrote:
> Coverity spotted this:
> 
> do_inode_prefetch() does a while loop, creating queues:
> 
>         for (i = 0; i < thread_count; i++) {
> 		...
> 		create_work_queue(&queues[i], mp, 1);
> 		...
> 	}
> 
> and then does this to wait for them all to complete:
> 
> 	for (; i >= 0; i--)
>  		destroy_work_queue(&queues[i]);
> 
> But we leave the first for loop with (i == thread_coun)t, and
> the second one will try to index queues[] one past the end.

ugh. My fault. Fix looks good.

Reviewed-by: Dave Chinner <dchinner@redhat.com>

-- 
Dave Chinner
david@fromorbit.com

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs