restore_backup() throws core dump

restore_backup() throws core dump during releasing fdlist.
Loop for closing handlers checks next_spare variable,
but iterates disk_count.

Reported-by: Adam Kwolek <adam.kwolek@intel.com>
Signed-off-by: NeilBrown <neilb@suse.de>

diff --git a/Grow.c b/Grow.c
index de177d8c243863dcf3ad8deb0c346ca6653f14c7..9fa2d6b420aae39f37373c22f527e3e967610520 100644 (file)
--- a/Grow.c
+++ b/Grow.c
@@ -78,9 +78,9 @@ int restore_backup(struct supertype *st,
                                   backup_file, verbose > 0);
 
        while (next_spare > 0) {
-               disk_count--;
-               if (fdlist[disk_count] >= 0)
-                       close(fdlist[disk_count]);
+               next_spare--;
+               if (fdlist[next_spare] >= 0)
+                       close(fdlist[next_spare]);
        }
        free(fdlist);
        if (err) {