diff options
| author | Joern Engel <joern@logfs.org> | 2011-11-20 17:59:01 +0100 |
|---|---|---|
| committer | Prasad Joshi <prasadjoshi.linux@gmail.com> | 2012-01-28 06:54:21 +0100 |
| commit | 934eed395d201bf0901ca0c0cc3703b18729d0ce (patch) | |
| tree | 27847639b14a0fc16b850bd39c0ace939694d8f2 /fs | |
| parent | logfs: update page reference count for pined pages (diff) | |
| download | linux-934eed395d201bf0901ca0c0cc3703b18729d0ce.tar.xz linux-934eed395d201bf0901ca0c0cc3703b18729d0ce.zip | |
logfs: Prevent memory corruption
This is a bad one. I wonder whether we were so far protected by
no_free_segments(sb) usually being smaller than LOGFS_NO_AREAS.
Found by Dan Carpenter <dan.carpenter@oracle.com> using smatch.
Signed-off-by: Joern Engel <joern@logfs.org>
Signed-off-by: Prasad Joshi <prasadjoshi.linux@gmail.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/logfs/gc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/logfs/gc.c b/fs/logfs/gc.c index caa4419285dc..d4efb061bdc5 100644 --- a/fs/logfs/gc.c +++ b/fs/logfs/gc.c @@ -367,7 +367,7 @@ static struct gc_candidate *get_candidate(struct super_block *sb) int i, max_dist; struct gc_candidate *cand = NULL, *this; - max_dist = min(no_free_segments(sb), LOGFS_NO_AREAS); + max_dist = min(no_free_segments(sb), LOGFS_NO_AREAS - 1); for (i = max_dist; i >= 0; i--) { this = first_in_list(&super->s_low_list[i]); |