From: Milan Broz The table is indexed from 0, so an index equal to t->num_targets should be rejected. However, there is currently no code in the tree that can exercise this bug. Signed-Off-By: Milan Broz Signed-Off-By: Alasdair G Kergon Index: linux-2.6.17/drivers/md/dm-table.c =================================================================== --- linux-2.6.17.orig/drivers/md/dm-table.c 2006-06-20 21:02:41.000000000 +0100 +++ linux-2.6.17/drivers/md/dm-table.c 2006-06-21 14:45:16.000000000 +0100 @@ -802,7 +802,7 @@ sector_t dm_table_get_size(struct dm_tab struct dm_target *dm_table_get_target(struct dm_table *t, unsigned int index) { - if (index > t->num_targets) + if (index >= t->num_targets) return NULL; return t->targets + index;