Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer

[pandora-kernel.git] / lib / idr.c

diff --git a/lib/idr.c b/lib/idr.c
index aadc525..2d3879b 100644 (file)
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -167,7 +167,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
                        id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
 
                        /* if already at the top layer, we need to grow */
-                       if (id >= 1 << (idp->layers * IDR_BITS)) {
+                       if (id > idr_max(idp->layers)) {
                                *starting_id = id;
                                return IDR_NEED_TO_GROW;
                        }
@@ -672,14 +672,12 @@ void *idr_replace(struct idr *idp, void *ptr, int id)
        if (!p)
                return ERR_PTR(-EINVAL);
 
-       n = (p->layer+1) * IDR_BITS;
-
        id &= MAX_ID_MASK;
 
-       if (id >= (1 << n))
+       if (id > idr_max(p->layer + 1))
                return ERR_PTR(-EINVAL);
 
-       n -= IDR_BITS;
+       n = p->layer * IDR_BITS;
        while ((n > 0) && p) {
                p = p->ary[(id >> n) & IDR_MASK];
                n -= IDR_BITS;