From 7178df8febf83366d4d6e1883eac45cf11ceab9f Mon Sep 17 00:00:00 2001
From: Hugh Dickins <hughd@google.com>
Date: Wed, 21 Mar 2012 16:34:20 -0700
Subject: [PATCH] --- yaml --- r: 292680 b: refs/heads/master c:
 9f7de8275b46d9d11b1505adbfe6c2bb48df4741 h: refs/heads/master v: v3

---
 [refs]          | 2 +-
 trunk/lib/idr.c | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/[refs] b/[refs]
index 76a6e9cf7c8b..fa71bc1c8063 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0e79dedde951e981612ed4e6d74873d61d2a113b
+refs/heads/master: 9f7de8275b46d9d11b1505adbfe6c2bb48df4741
diff --git a/trunk/lib/idr.c b/trunk/lib/idr.c
index ed055b297c81..12499ba7967e 100644
--- a/trunk/lib/idr.c
+++ b/trunk/lib/idr.c
@@ -595,8 +595,10 @@ EXPORT_SYMBOL(idr_for_each);
  * Returns pointer to registered object with id, which is next number to
  * given id. After being looked up, *@nextidp will be updated for the next
  * iteration.
+ *
+ * This function can be called under rcu_read_lock(), given that the leaf
+ * pointers lifetimes are correctly managed.
  */
-
 void *idr_get_next(struct idr *idp, int *nextidp)
 {
 	struct idr_layer *p, *pa[MAX_LEVEL];
@@ -605,11 +607,11 @@ void *idr_get_next(struct idr *idp, int *nextidp)
 	int n, max;
 
 	/* find first ent */
-	n = idp->layers * IDR_BITS;
-	max = 1 << n;
 	p = rcu_dereference_raw(idp->top);
 	if (!p)
 		return NULL;
+	n = (p->layer + 1) * IDR_BITS;
+	max = 1 << n;
 
 	while (id < max) {
 		while (n > 0 && p) {