1 files changed, 15 insertions, 25 deletions

diff --git a/lib/idr.c b/lib/idr.c
index 2642fa8e424d..39158abebad1 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -18,12 +18,6 @@
  * pointer or what ever, we treat it as a (void *).  You can pass this
  * id to a user for him to pass back at a later time.  You then pass
  * that id to this code and it returns your pointer.
-
- * You can release ids at any time. When all ids are released, most of
- * the memory is returned (we keep MAX_IDR_FREE) in a local pool so we
- * don't need to go to the memory "store" during an id allocate, just
- * so you don't need to be too concerned about locking and conflicts
- * with the slab allocator.
  */
 
 #ifndef TEST                        // to test in user space...
@@ -151,7 +145,7 @@ static void idr_layer_rcu_free(struct rcu_head *head)
 
 static inline void free_layer(struct idr *idr, struct idr_layer *p)
 {
-        if (idr->hint && idr->hint == p)
+        if (idr->hint == p)
                 RCU_INIT_POINTER(idr->hint, NULL);
         call_rcu(&p->rcu_head, idr_layer_rcu_free);
 }
@@ -249,7 +243,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa,
                         id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
 
                         /* if already at the top layer, we need to grow */
-                        if (id >= 1 << (idp->layers * IDR_BITS)) {
+                        if (id > idr_max(idp->layers)) {
                                 *starting_id = id;
                                 return -EAGAIN;
                         }
@@ -562,6 +556,11 @@ void idr_remove(struct idr *idp, int id)
         if (id < 0)
                 return;
 
+        if (id > idr_max(idp->layers)) {
+                idr_remove_warning(id);
+                return;
+        }
+
         sub_remove(idp, (idp->layers - 1) * IDR_BITS, id);
         if (idp->top && idp->top->count == 1 && (idp->layers > 1) &&
             idp->top->ary[0]) {
@@ -579,16 +578,6 @@ void idr_remove(struct idr *idp, int id)
                 bitmap_clear(to_free->bitmap, 0, IDR_SIZE);
                 free_layer(idp, to_free);
         }
-        while (idp->id_free_cnt >= MAX_IDR_FREE) {
-                p = get_from_free_list(idp);
-                /*
-                 * Note: we don't call the rcu callback here, since the only
-                 * layers that fall into the freelist are those that have been
-                 * preallocated.
-                 */
-                kmem_cache_free(idr_layer_cache, p);
-        }
-        return;
 }
 EXPORT_SYMBOL(idr_remove);
 
@@ -809,14 +798,12 @@ void *idr_replace(struct idr *idp, void *ptr, int id)
 
         p = idp->top;
         if (!p)
-                return ERR_PTR(-EINVAL);
-
-        n = (p->layer+1) * IDR_BITS;
+                return ERR_PTR(-ENOENT);
 
-        if (id >= (1 << n))
-                return ERR_PTR(-EINVAL);
+        if (id > idr_max(p->layer + 1))
+                return ERR_PTR(-ENOENT);
 
-        n -= IDR_BITS;
+        n = p->layer * IDR_BITS;
         while ((n > 0) && p) {
                 p = p->ary[(id >> n) & IDR_MASK];
                 n -= IDR_BITS;
@@ -1027,6 +1014,9 @@ void ida_remove(struct ida *ida, int id)
         int n;
         struct ida_bitmap *bitmap;
 
+        if (idr_id > idr_max(ida->idr.layers))
+                goto err;
+
         /* clear full bits while looking up the leaf idr_layer */
         while ((shift > 0) && p) {
                 n = (idr_id >> shift) & IDR_MASK;
@@ -1042,7 +1032,7 @@ void ida_remove(struct ida *ida, int id)
         __clear_bit(n, p->bitmap);
 
         bitmap = (void *)p->ary[n];
-        if (!test_bit(offset, bitmap->bitmap))
+        if (!bitmap || !test_bit(offset, bitmap->bitmap))
                 goto err;
 
         /* update bitmap and remove it if empty */