1 files changed, 23 insertions, 15 deletions

diff --git a/lib/idr.c b/lib/idr.c
index 2d016f5c410e..63dda62131b3 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -43,6 +43,14 @@ static DEFINE_PER_CPU(struct idr_layer *, idr_preload_head);
 static DEFINE_PER_CPU(int, idr_preload_cnt);
 static DEFINE_SPINLOCK(simple_ida_lock);
 
+/* the maximum ID which can be allocated given idr->layers */
+static int idr_max(int layers)
+{
+        int bits = min_t(int, layers * IDR_BITS, MAX_IDR_SHIFT);
+
+        return (1 << bits) - 1;
+}
+
 static struct idr_layer *get_from_free_list(struct idr *idp)
 {
         struct idr_layer *p;
@@ -290,7 +298,7 @@ build_up:
          * Add a new layer to the top of the tree if the requested
          * id is larger than the currently allocated space.
          */
-        while ((layers < (MAX_IDR_LEVEL - 1)) && (id >= (1 << (layers*IDR_BITS)))) {
+        while (id > idr_max(layers)) {
                 layers++;
                 if (!p->count) {
                         /* special case: if the tree is currently empty,
@@ -361,7 +369,7 @@ static void idr_fill_slot(void *ptr, int id, struct idr_layer **pa)
  */
 int idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id)
 {
-        struct idr_layer *pa[MAX_IDR_LEVEL];
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         int rv;
 
         rv = idr_get_empty_slot(idp, starting_id, pa, 0, idp);
@@ -457,7 +465,7 @@ EXPORT_SYMBOL(idr_preload);
 int idr_alloc(struct idr *idr, void *ptr, int start, int end, gfp_t gfp_mask)
 {
         int max = end > 0 ? end - 1 : INT_MAX;  /* inclusive upper limit */
-        struct idr_layer *pa[MAX_IDR_LEVEL];
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         int id;
 
         might_sleep_if(gfp_mask & __GFP_WAIT);
@@ -490,7 +498,7 @@ static void idr_remove_warning(int id)
 static void sub_remove(struct idr *idp, int shift, int id)
 {
         struct idr_layer *p = idp->top;
-        struct idr_layer **pa[MAX_IDR_LEVEL];
+        struct idr_layer **pa[MAX_IDR_LEVEL + 1];
         struct idr_layer ***paa = &pa[0];
         struct idr_layer *to_free;
         int n;
@@ -571,16 +579,16 @@ void __idr_remove_all(struct idr *idp)
         int n, id, max;
         int bt_mask;
         struct idr_layer *p;
-        struct idr_layer *pa[MAX_IDR_LEVEL];
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         struct idr_layer **paa = &pa[0];
 
         n = idp->layers * IDR_BITS;
         p = idp->top;
         rcu_assign_pointer(idp->top, NULL);
-        max = 1 << n;
+        max = idr_max(idp->layers);
 
         id = 0;
-        while (id < max) {
+        while (id >= 0 && id <= max) {
                 while (n > IDR_BITS && p) {
                         n -= IDR_BITS;
                         *paa++ = p;
@@ -650,7 +658,7 @@ void *idr_find(struct idr *idp, int id)
         /* Mask off upper bits we don't use for the search. */
         id &= MAX_IDR_MASK;
 
-        if (id >= (1 << n))
+        if (id > idr_max(p->layer + 1))
                 return NULL;
         BUG_ON(n == 0);
 
@@ -686,15 +694,15 @@ int idr_for_each(struct idr *idp,
 {
         int n, id, max, error = 0;
         struct idr_layer *p;
-        struct idr_layer *pa[MAX_IDR_LEVEL];
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         struct idr_layer **paa = &pa[0];
 
         n = idp->layers * IDR_BITS;
         p = rcu_dereference_raw(idp->top);
-        max = 1 << n;
+        max = idr_max(idp->layers);
 
         id = 0;
-        while (id < max) {
+        while (id >= 0 && id <= max) {
                 while (n > 0 && p) {
                         n -= IDR_BITS;
                         *paa++ = p;
@@ -732,7 +740,7 @@ EXPORT_SYMBOL(idr_for_each);
  */
 void *idr_get_next(struct idr *idp, int *nextidp)
 {
-        struct idr_layer *p, *pa[MAX_IDR_LEVEL];
+        struct idr_layer *p, *pa[MAX_IDR_LEVEL + 1];
         struct idr_layer **paa = &pa[0];
         int id = *nextidp;
         int n, max;
@@ -742,9 +750,9 @@ void *idr_get_next(struct idr *idp, int *nextidp)
         if (!p)
                 return NULL;
         n = (p->layer + 1) * IDR_BITS;
-        max = 1 << n;
+        max = idr_max(p->layer + 1);
 
-        while (id < max) {
+        while (id >= 0 && id <= max) {
                 while (n > 0 && p) {
                         n -= IDR_BITS;
                         *paa++ = p;
@@ -918,7 +926,7 @@ EXPORT_SYMBOL(ida_pre_get);
  */
 int ida_get_new_above(struct ida *ida, int starting_id, int *p_id)
 {
-        struct idr_layer *pa[MAX_IDR_LEVEL];
+        struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         struct ida_bitmap *bitmap;
         unsigned long flags;
         int idr_id = starting_id / IDA_BITMAP_BITS;