Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 589777ea authored by Zaur Kambarov's avatar Zaur Kambarov Committed by Linus Torvalds
Browse files

[PATCH] coverity: idr_get_new_above_int() overrun fix 



This patch fixes overrun of array pa:
92   		struct idr_layer *pa[MAX_LEVEL];

in

98   		l = idp->layers;
99   		pa[l--] = NULL;

by passing idp->layers, set in
202  		idp->layers = layers;
to function  sub_alloc in
203  		v = sub_alloc(idp, ptr, &id);

Signed-off-by: default avatarZaur Kambarov <zkambarov@coverity.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 3a845099

lib/idr.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -175,7 +175,7 @@ static int idr_get_new_above_int(struct idr *idp, void *ptr, int starting_id) 
	 * Add a new layer to the top of the tree if the requested

	 * Add a new layer to the top of the tree if the requested

	 * id is larger than the currently allocated space.

	 * id is larger than the currently allocated space.

	 */

	 */

	while ((layers < MAX_LEVEL) && (id >= (1 << (layers*IDR_BITS)))) {

	while ((layers < (MAX_LEVEL - 1)) && (id >= (1 << (layers*IDR_BITS)))) {

		layers++;

		layers++;

		if (!p->count)

		if (!p->count)

			continue;

			continue;