mac80211: fix station/driver powersave race

[pandora-kernel.git] / lib / idr.c

diff --git a/lib/idr.c b/lib/idr.c
index 2642fa8..39158ab 100644 (file)
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -18,12 +18,6 @@
  * pointer or what ever, we treat it as a (void *).  You can pass this
  * id to a user for him to pass back at a later time.  You then pass
  * that id to this code and it returns your pointer.
-
- * You can release ids at any time. When all ids are released, most of
- * the memory is returned (we keep MAX_IDR_FREE) in a local pool so we
- * don't need to go to the memory "store" during an id allocate, just
- * so you don't need to be too concerned about locking and conflicts
- * with the slab allocator.
  */
 
 #ifndef TEST                        // to test in user space...
@@ -151,7 +145,7 @@ static void idr_layer_rcu_free(struct rcu_head *head)
 
 static inline void free_layer(struct idr *idr, struct idr_layer *p)
 {
-       if (idr->hint && idr->hint == p)
+       if (idr->hint == p)
                RCU_INIT_POINTER(idr->hint, NULL);
        call_rcu(&p->rcu_head, idr_layer_rcu_free);
 }
@@ -249,7 +243,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa,
                        id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
 
                        /* if already at the top layer, we need to grow */
-                       if (id >= 1 << (idp->layers * IDR_BITS)) {
+                       if (id > idr_max(idp->layers)) {
                                *starting_id = id;
                                return -EAGAIN;
                        }
@@ -562,6 +556,11 @@ void idr_remove(struct idr *idp, int id)
        if (id < 0)
                return;
 
+       if (id > idr_max(idp->layers)) {
+               idr_remove_warning(id);
+               return;
+       }
+
        sub_remove(idp, (idp->layers - 1) * IDR_BITS, id);
        if (idp->top && idp->top->count == 1 && (idp->layers > 1) &&
            idp->top->ary[0]) {
@@ -579,16 +578,6 @@ void idr_remove(struct idr *idp, int id)
                bitmap_clear(to_free->bitmap, 0, IDR_SIZE);
                free_layer(idp, to_free);
        }
-       while (idp->id_free_cnt >= MAX_IDR_FREE) {
-               p = get_from_free_list(idp);
-               /*
-                * Note: we don't call the rcu callback here, since the only
-                * layers that fall into the freelist are those that have been
-                * preallocated.
-                */
-               kmem_cache_free(idr_layer_cache, p);
-       }
-       return;
 }
 EXPORT_SYMBOL(idr_remove);
 
@@ -809,14 +798,12 @@ void *idr_replace(struct idr *idp, void *ptr, int id)
 
        p = idp->top;
        if (!p)
-               return ERR_PTR(-EINVAL);
-
-       n = (p->layer+1) * IDR_BITS;
+               return ERR_PTR(-ENOENT);
 
-       if (id >= (1 << n))
-               return ERR_PTR(-EINVAL);
+       if (id > idr_max(p->layer + 1))
+               return ERR_PTR(-ENOENT);
 
-       n -= IDR_BITS;
+       n = p->layer * IDR_BITS;
        while ((n > 0) && p) {
                p = p->ary[(id >> n) & IDR_MASK];
                n -= IDR_BITS;
@@ -1027,6 +1014,9 @@ void ida_remove(struct ida *ida, int id)
        int n;
        struct ida_bitmap *bitmap;
 
+       if (idr_id > idr_max(ida->idr.layers))
+               goto err;
+
        /* clear full bits while looking up the leaf idr_layer */
        while ((shift > 0) && p) {
                n = (idr_id >> shift) & IDR_MASK;
@@ -1042,7 +1032,7 @@ void ida_remove(struct ida *ida, int id)
        __clear_bit(n, p->bitmap);
 
        bitmap = (void *)p->ary[n];
-       if (!test_bit(offset, bitmap->bitmap))
+       if (!bitmap || !test_bit(offset, bitmap->bitmap))
                goto err;
 
        /* update bitmap and remove it if empty */