From 97b1fcfd16157e2b8dba59f5f90f4aaa9704044b Mon Sep 17 00:00:00 2001 From: Eric Sandeen Date: Fri, 7 Mar 2014 10:33:04 +1100 Subject: [PATCH] xfs_repair: fix array overrun in do_inode_prefetch Coverity spotted this: do_inode_prefetch() does a while loop, creating queues: for (i = 0; i < thread_count; i++) { ... create_work_queue(&queues[i], mp, 1); ... } and then does this to wait for them all to complete: for (; i >= 0; i--) destroy_work_queue(&queues[i]); But we leave the first for loop with (i == thread_coun)t, and the second one will try to index queues[] one past the end. Signed-off-by: Eric Sandeen Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner --- repair/prefetch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/repair/prefetch.c b/repair/prefetch.c index 0f9e3fe50..e47a48e39 100644 --- a/repair/prefetch.c +++ b/repair/prefetch.c @@ -995,7 +995,7 @@ do_inode_prefetch( /* * wait for workers to complete */ - for (; i >= 0; i--) + while (i--) destroy_work_queue(&queues[i]); free(queues); } -- 2.47.2