idr: fix a critical misallocation bug

[safe/jmp/linux-2.6] / lib / idr.c

diff --git a/lib/idr.c b/lib/idr.c
index dab4bca..ba7d37c 100644 (file)
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -140,8 +140,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
        id = *starting_id;
  restart:
        p = idp->top;
-       l = idp->layers;
-       pa[l--] = NULL;
+       l = p->layer;
        while (1) {
                /*
                 * We run around this while until we reach the leaf node...
@@ -155,8 +154,8 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
                        oid = id;
                        id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
 
-                       /* if already at the top layer, we need to grow */
-                       if (!(p = pa[l])) {
+                       /* did id go over the limit? */
+                       if (id >= (1 << (idp->layers * IDR_BITS))) {
                                *starting_id = id;
                                return IDR_NEED_TO_GROW;
                        }
@@ -281,7 +280,7 @@ static int idr_get_new_above_int(struct idr *idp, void *ptr, int starting_id)
 /**
  * idr_get_new_above - allocate new idr entry above or equal to a start id
  * @idp: idr handle
- * @ptr: pointer you want associated with the ide
+ * @ptr: pointer you want associated with the id
  * @start_id: id to start search at
  * @id: pointer to the allocated handle
  *
@@ -313,7 +312,7 @@ EXPORT_SYMBOL(idr_get_new_above);
 /**
  * idr_get_new - allocate new idr entry
  * @idp: idr handle
- * @ptr: pointer you want associated with the ide
+ * @ptr: pointer you want associated with the id
  * @id: pointer to the allocated handle
  *
  * This is the allocate id function.  It should be called with any
@@ -579,6 +578,52 @@ int idr_for_each(struct idr *idp,
 EXPORT_SYMBOL(idr_for_each);
 
 /**
+ * idr_get_next - lookup next object of id to given id.
+ * @idp: idr handle
+ * @id:  pointer to lookup key
+ *
+ * Returns pointer to registered object with id, which is next number to
+ * given id.
+ */
+
+void *idr_get_next(struct idr *idp, int *nextidp)
+{
+       struct idr_layer *p, *pa[MAX_LEVEL];
+       struct idr_layer **paa = &pa[0];
+       int id = *nextidp;
+       int n, max;
+
+       /* find first ent */
+       n = idp->layers * IDR_BITS;
+       max = 1 << n;
+       p = rcu_dereference(idp->top);
+       if (!p)
+               return NULL;
+
+       while (id < max) {
+               while (n > 0 && p) {
+                       n -= IDR_BITS;
+                       *paa++ = p;
+                       p = rcu_dereference(p->ary[(id >> n) & IDR_MASK]);
+               }
+
+               if (p) {
+                       *nextidp = id;
+                       return p;
+               }
+
+               id += 1 << n;
+               while (n < fls(id)) {
+                       n += IDR_BITS;
+                       p = *--paa;
+               }
+       }
+       return NULL;
+}
+
+
+
+/**
  * idr_replace - replace pointer for given id
  * @idp: idr handle
  * @ptr: pointer you want associated with the id