From: Eric Sandeen Date: Tue, 20 May 2014 08:30:44 +0000 (+1000) Subject: xfs_repair: don't let bplist index go negative in prefetch X-Git-Tag: v3.2.1~43 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2c350101393f7effcdce815f20d97f239bf2a78c;p=thirdparty%2Fxfsprogs-dev.git xfs_repair: don't let bplist index go negative in prefetch After: bbd3275 repair: don't unlock prefetch tree to read discontig buffers Coverity spotted that it's possible for us to arrive at the loop below with num == 1, and then we decrement it to 0, and try to index bplist[num-1]. I think this was possible before the change, i.e. it's probably not a regression. Fix this by not trying to shrink the window unless we have more than one buffer in the array. Signed-off-by: Eric Sandeen Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner --- diff --git a/repair/prefetch.c b/repair/prefetch.c index 4595310a2..65f845661 100644 --- a/repair/prefetch.c +++ b/repair/prefetch.c @@ -505,7 +505,7 @@ pf_batch_read( first_off = LIBXFS_BBTOOFF64(XFS_BUF_ADDR(bplist[0])); last_off = LIBXFS_BBTOOFF64(XFS_BUF_ADDR(bplist[num-1])) + XFS_BUF_SIZE(bplist[num-1]); - while (last_off - first_off > pf_max_bytes) { + while (num > 1 && last_off - first_off > pf_max_bytes) { num--; last_off = LIBXFS_BBTOOFF64(XFS_BUF_ADDR(bplist[num-1])) + XFS_BUF_SIZE(bplist[num-1]);