From: NeilBrown <neilb@suse.de>
Date: Wed, 5 Oct 2011 02:29:16 +0000 (+1100)
Subject: restore_backup() throws core dump
X-Git-Tag: mdadm-3.2.3~141
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cc7f63e55319b5c372af20ce528e7e7230746d92;p=thirdparty%2Fmdadm.git

restore_backup() throws core dump

restore_backup() throws core dump during releasing fdlist.
Loop for closing handlers checks next_spare variable,
but iterates disk_count.

Reported-by: Adam Kwolek <adam.kwolek@intel.com>
Signed-off-by: NeilBrown <neilb@suse.de>
---

diff --git a/Grow.c b/Grow.c
index de177d8c..9fa2d6b4 100644
--- a/Grow.c
+++ b/Grow.c
@@ -78,9 +78,9 @@ int restore_backup(struct supertype *st,
 				   backup_file, verbose > 0);
 
 	while (next_spare > 0) {
-		disk_count--;
-		if (fdlist[disk_count] >= 0)
-			close(fdlist[disk_count]);
+		next_spare--;
+		if (fdlist[next_spare] >= 0)
+			close(fdlist[next_spare]);
 	}
 	free(fdlist);
 	if (err) {