Merge branch 'gpio/next' of git://git.secretlab.ca/git/linux-2.6

[karo-tx-linux.git] / ipc / sem.c

diff --git a/ipc/sem.c b/ipc/sem.c
index 34193ed69fbe03bcd6d5514f557e5eed5865b96f..c8e00f8b4be1b79bd49bf841924d8d8ea5945b8c 100644 (file)
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -689,12 +689,6 @@ static int count_semzcnt (struct sem_array * sma, ushort semnum)
        return semzcnt;
 }
 
-static void free_un(struct rcu_head *head)
-{
-       struct sem_undo *un = container_of(head, struct sem_undo, rcu);
-       kfree(un);
-}
-
 /* Free a semaphore set. freeary() is called with sem_ids.rw_mutex locked
  * as a writer and the spinlock for this semaphore set hold. sem_ids.rw_mutex
  * remains locked on exit.
@@ -714,7 +708,7 @@ static void freeary(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
                un->semid = -1;
                list_del_rcu(&un->list_proc);
                spin_unlock(&un->ulp->lock);
-               call_rcu(&un->rcu, free_un);
+               kfree_rcu(un, rcu);
        }
 
        /* Wake up all pending processes and let them fail with EIDRM. */
@@ -1456,15 +1450,24 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
        }
 
        sma = sem_lock(ns, semid);
+
+       /*
+        * Wait until it's guaranteed that no wakeup_sem_queue_do() is ongoing.
+        */
+       error = get_queue_result(&queue);
+
+       /*
+        * Array removed? If yes, leave without sem_unlock().
+        */
        if (IS_ERR(sma)) {
                error = -EIDRM;
                goto out_free;
        }
 
-       error = get_queue_result(&queue);
 
        /*
-        * If queue.status != -EINTR we are woken up by another process
+        * If queue.status != -EINTR we are woken up by another process.
+        * Leave without unlink_queue(), but with sem_unlock().
         */
 
        if (error != -EINTR) {
@@ -1612,7 +1615,7 @@ void exit_sem(struct task_struct *tsk)
                sem_unlock(sma);
                wake_up_sem_queue_do(&tasks);
 
-               call_rcu(&un->rcu, free_un);
+               kfree_rcu(un, rcu);
        }
        kfree(ulp);
 }