Commit 934eed39 authored Nov 20, 2011 by Joern Engel Committed by Prasad Joshi Jan 28, 2012

logfs: Prevent memory corruption



This is a bad one.  I wonder whether we were so far protected by
no_free_segments(sb) usually being smaller than LOGFS_NO_AREAS.

Found by Dan Carpenter <dan.carpenter@oracle.com> using smatch.

Signed-off-by: Joern Engel <joern@logfs.org>
Signed-off-by: Prasad Joshi <prasadjoshi.linux@gmail.com>

parent 96150606

fs/logfs/gc.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -367,7 +367,7 @@ static struct gc_candidate get_candidate(struct super_block sb)
		int i, max_dist;
		struct gc_candidate cand = NULL, this;

		max_dist = min(no_free_segments(sb), LOGFS_NO_AREAS);
		max_dist = min(no_free_segments(sb), LOGFS_NO_AREAS - 1);

		for (i = max_dist; i >= 0; i--) {
		this = first_in_list(&super->s_low_list[i]);