1 files changed, 5 insertions, 3 deletions

diff --git a/lib/idr.c b/lib/idr.c
index ed055b297c81..12499ba7967e 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -595,8 +595,10 @@ EXPORT_SYMBOL(idr_for_each);
  * Returns pointer to registered object with id, which is next number to
  * given id. After being looked up, *@nextidp will be updated for the next
  * iteration.
+ *
+ * This function can be called under rcu_read_lock(), given that the leaf
+ * pointers lifetimes are correctly managed.
  */
-
 void *idr_get_next(struct idr *idp, int *nextidp)
 {
         struct idr_layer *p, *pa[MAX_LEVEL];
@@ -605,11 +607,11 @@ void *idr_get_next(struct idr *idp, int *nextidp)
         int n, max;
 
         /* find first ent */
-        n = idp->layers * IDR_BITS;
-        max = 1 << n;
         p = rcu_dereference_raw(idp->top);
         if (!p)
                 return NULL;
+        n = (p->layer + 1) * IDR_BITS;
+        max = 1 << n;
 
         while (id < max) {
                 while (n > 0 && p) {