kern/43827: wapbl_replay_write() does not replay last index of wr_blkhash[]

[ryo%nerv.org@localhost]

>Number:         43827
>Category:       kern
>Synopsis:       wapbl_replay_write() does not replay last index of wr_blkhash[]
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Sep 02 06:35:00 +0000 2010
>Originator:     Ryo Shimizu
>Release:        NetBSD 5.99.39
>Organization:
>Environment:
System: NetBSD moveq 5.99.39 NetBSD 5.99.39 (MOVEQ) #0: Thu Sep 2 04:11:47 JST 
2010 ryo@moveq:/src/cvs/NetBSD/sys/arch/i386/compile/MOVEQ i386
Architecture: i386
Machine: i386
>Description:
        wapbl_replay_write() does not replay last index of wr_blkhash[].
        a size of wr_blkhash[] is wr->wr_blkhashmask + 1.

        See below patch.

>How-To-Repeat:
>Fix:
Index: vfs_wapbl.c
===================================================================
RCS file: /cvsroot/src/sys/kern/vfs_wapbl.c,v
retrieving revision 1.36
diff -a -u -r1.36 vfs_wapbl.c
--- vfs_wapbl.c 21 Apr 2010 19:50:57 -0000      1.36
+++ vfs_wapbl.c 2 Sep 2010 04:58:25 -0000
@@ -2648,7 +2648,7 @@
 
        scratch = wapbl_malloc(MAXBSIZE);
 
-       for (i = 0; i < wr->wr_blkhashmask; ++i) {
+       for (i = 0; i <= wr->wr_blkhashmask; ++i) {
                LIST_FOREACH(wb, &wr->wr_blkhash[i], wb_hash) {
                        off = wb->wb_off;
                        error = wapbl_circ_read(wr, scratch, fsblklen, &off);