1 files changed, 16 insertions, 11 deletions

diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 69185ae6b701..6edbb2c55c22 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -552,24 +552,22 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
                 return -EAGAIN;
 
         spin_lock_init(&new_timer->it_lock);
- retry:
-        if (unlikely(!idr_pre_get(&posix_timers_id, GFP_KERNEL))) {
-                error = -EAGAIN;
-                goto out;
-        }
+
+        idr_preload(GFP_KERNEL);
         spin_lock_irq(&idr_lock);
-        error = idr_get_new(&posix_timers_id, new_timer, &new_timer_id);
+        error = idr_alloc(&posix_timers_id, new_timer, 0, 0, GFP_NOWAIT);
         spin_unlock_irq(&idr_lock);
-        if (error) {
-                if (error == -EAGAIN)
-                        goto retry;
+        idr_preload_end();
+        if (error < 0) {
                 /*
                  * Weird looking, but we return EAGAIN if the IDR is
                  * full (proper POSIX return value for this)
                  */
-                error = -EAGAIN;
+                if (error == -ENOSPC)
+                        error = -EAGAIN;
                 goto out;
         }
+        new_timer_id = error;
 
         it_id_set = IT_ID_SET;
         new_timer->it_id = (timer_t) new_timer_id;
@@ -639,6 +637,13 @@ static struct k_itimer *__lock_timer(timer_t timer_id, unsigned long *flags)
 {
         struct k_itimer *timr;
 
+        /*
+         * timer_t could be any type >= int and we want to make sure any
+         * @timer_id outside positive int range fails lookup.
+         */
+        if ((unsigned long long)timer_id > INT_MAX)
+                return NULL;
+
         rcu_read_lock();
         timr = idr_find(&posix_timers_id, (int)timer_id);
         if (timr) {
@@ -997,7 +1002,7 @@ SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
 
         err = kc->clock_adj(which_clock, &ktx);
 
-        if (!err && copy_to_user(utx, &ktx, sizeof(ktx)))
+        if (err >= 0 && copy_to_user(utx, &ktx, sizeof(ktx)))
                 return -EFAULT;
 
         return err;