idr: fix a critical misallocation bug, take#2

[net-next-2.6.git] / lib / idr.c

diff --git a/lib/idr.c b/lib/idr.c
index 1cac726c44bc17cc6fa1a7b5ab6358279a0c9a5d..0dc782216d4b94dc423c2d62d1ac70a2b6d30ddc 100644 (file)
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -156,10 +156,12 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
                        id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
 
                        /* if already at the top layer, we need to grow */
-                       if (!(p = pa[l])) {
+                       if (id >= 1 << (idp->layers * IDR_BITS)) {
                                *starting_id = id;
                                return IDR_NEED_TO_GROW;
                        }
+                       p = pa[l];
+                       BUG_ON(!p);
 
                        /* If we need to go up one layer, continue the
                         * loop; otherwise, restart from the top.