From: "KAMBAROV, ZAUR" This patch fixes overrun of array pa: 92 struct idr_layer *pa[MAX_LEVEL]; in 98 l = idp->layers; 99 pa[l--] = NULL; by passing idp->layers, set in 202 idp->layers = layers; to function sub_alloc in 203 v = sub_alloc(idp, ptr, &id); Signed-off-by: Zaur Kambarov Signed-off-by: Andrew Morton --- lib/idr.c | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-) diff -puN lib/idr.c~coverity-idr_get_new_above_int-overrun-fix lib/idr.c --- 25/lib/idr.c~coverity-idr_get_new_above_int-overrun-fix 2005-06-15 17:10:52.000000000 -0700 +++ 25-akpm/lib/idr.c 2005-06-15 17:10:52.000000000 -0700 @@ -175,7 +175,7 @@ build_up: * Add a new layer to the top of the tree if the requested * id is larger than the currently allocated space. */ - while ((layers < MAX_LEVEL) && (id >= (1 << (layers*IDR_BITS)))) { + while ((layers < (MAX_LEVEL - 1)) && (id >= (1 << (layers*IDR_BITS)))) { layers++; if (!p->count) continue; _