[PATCH] coverity: idr_get_new_above_int() overrun fix
Zaur Kambarov [Wed, 22 Jun 2005 00:14:31 +0000 (17:14 -0700)]
This patch fixes overrun of array pa:
92    struct idr_layer *pa[MAX_LEVEL];

in

98    l = idp->layers;
99    pa[l--] = NULL;

by passing idp->layers, set in
202   idp->layers = layers;
to function  sub_alloc in
203   v = sub_alloc(idp, ptr, &id);

Signed-off-by: Zaur Kambarov <zkambarov@coverity.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

lib/idr.c

index 81fc430..c5be889 100644 (file)
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -175,7 +175,7 @@ build_up:
         * Add a new layer to the top of the tree if the requested
         * id is larger than the currently allocated space.
         */
-       while ((layers < MAX_LEVEL) && (id >= (1 << (layers*IDR_BITS)))) {
+       while ((layers < (MAX_LEVEL - 1)) && (id >= (1 << (layers*IDR_BITS)))) {
                layers++;
                if (!p->count)
                        continue;