From cc7f63e55319b5c372af20ce528e7e7230746d92 Mon Sep 17 00:00:00 2001
From: NeilBrown <neilb@suse.de>
Date: Wed, 5 Oct 2011 13:29:16 +1100
Subject: [PATCH] restore_backup() throws core dump

restore_backup() throws core dump during releasing fdlist.
Loop for closing handlers checks next_spare variable,
but iterates disk_count.

Reported-by: Adam Kwolek <adam.kwolek@intel.com>
Signed-off-by: NeilBrown <neilb@suse.de>
---
 Grow.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Grow.c b/Grow.c
index de177d8..9fa2d6b 100644
--- a/Grow.c
+++ b/Grow.c
@@ -78,9 +78,9 @@ int restore_backup(struct supertype *st,
 				   backup_file, verbose > 0);
 
 	while (next_spare > 0) {
-		disk_count--;
-		if (fdlist[disk_count] >= 0)
-			close(fdlist[disk_count]);
+		next_spare--;
+		if (fdlist[next_spare] >= 0)
+			close(fdlist[next_spare]);
 	}
 	free(fdlist);
 	if (err) {