Linux 3.2.102

[pandora-kernel.git] / ipc / sem.c

diff --git a/ipc/sem.c b/ipc/sem.c
index c8e00f8..b31c3ef 100644 (file)
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -90,6 +90,52 @@
 #include <asm/uaccess.h>
 #include "util.h"
 
+/* One semaphore structure for each semaphore in the system. */
+struct sem {
+       int     semval;         /* current value */
+       int     sempid;         /* pid of last operation */
+       struct list_head sem_pending; /* pending single-sop operations */
+};
+
+/* One queue for each sleeping process in the system. */
+struct sem_queue {
+       struct list_head        simple_list; /* queue of pending operations */
+       struct list_head        list;    /* queue of pending operations */
+       struct task_struct      *sleeper; /* this process */
+       struct sem_undo         *undo;   /* undo structure */
+       int                     pid;     /* process id of requesting process */
+       int                     status;  /* completion status of operation */
+       struct sembuf           *sops;   /* array of pending operations */
+       int                     nsops;   /* number of operations */
+       int                     alter;   /* does *sops alter the array? */
+};
+
+/* Each task has a list of undo requests. They are executed automatically
+ * when the process exits.
+ */
+struct sem_undo {
+       struct list_head        list_proc;      /* per-process list: *
+                                                * all undos from one process
+                                                * rcu protected */
+       struct rcu_head         rcu;            /* rcu struct for sem_undo */
+       struct sem_undo_list    *ulp;           /* back ptr to sem_undo_list */
+       struct list_head        list_id;        /* per semaphore array list:
+                                                * all undos for one array */
+       int                     semid;          /* semaphore set identifier */
+       short                   *semadj;        /* array of adjustments */
+                                               /* one per semaphore */
+};
+
+/* sem_undo_list controls shared access to the list of sem_undo structures
+ * that may be shared among all a CLONE_SYSVSEM task group.
+ */
+struct sem_undo_list {
+       atomic_t                refcnt;
+       spinlock_t              lock;
+       struct list_head        list_proc;
+};
+
+
 #define sem_ids(ns)    ((ns)->ids[IPC_SEM_IDS])
 
 #define sem_unlock(sma)                ipc_unlock(&(sma)->sem_perm)
@@ -268,14 +314,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
                return retval;
        }
 
-       id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
-       if (id < 0) {
-               security_sem_free(sma);
-               ipc_rcu_putref(sma);
-               return id;
-       }
-       ns->used_sems += nsems;
-
        sma->sem_base = (struct sem *) &sma[1];
 
        for (i = 0; i < nsems; i++)
@@ -286,6 +324,15 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
        INIT_LIST_HEAD(&sma->list_id);
        sma->sem_nsems = nsems;
        sma->sem_ctime = get_seconds();
+
+       id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
+       if (id < 0) {
+               security_sem_free(sma);
+               ipc_rcu_putref(sma);
+               return id;
+       }
+       ns->used_sems += nsems;
+
        sem_unlock(sma);
 
        return sma->sem_perm.id;
@@ -1426,6 +1473,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
 
        queue.status = -EINTR;
        queue.sleeper = current;
+
+sleep_again:
        current->state = TASK_INTERRUPTIBLE;
        sem_unlock(sma);
 
@@ -1460,7 +1509,6 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
         * Array removed? If yes, leave without sem_unlock().
         */
        if (IS_ERR(sma)) {
-               error = -EIDRM;
                goto out_free;
        }
 
@@ -1479,6 +1527,13 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
         */
        if (timeout && jiffies_left == 0)
                error = -EAGAIN;
+
+       /*
+        * If the wakeup was spurious, just retry
+        */
+       if (error == -EINTR && !signal_pending(current))
+               goto sleep_again;
+
        unlink_queue(sma, &queue);
 
 out_unlock_free:
@@ -1552,16 +1607,27 @@ void exit_sem(struct task_struct *tsk)
                rcu_read_lock();
                un = list_entry_rcu(ulp->list_proc.next,
                                    struct sem_undo, list_proc);
-               if (&un->list_proc == &ulp->list_proc)
-                       semid = -1;
-                else
-                       semid = un->semid;
+               if (&un->list_proc == &ulp->list_proc) {
+                       /*
+                        * We must wait for freeary() before freeing this ulp,
+                        * in case we raced with last sem_undo. There is a small
+                        * possibility where we exit while freeary() didn't
+                        * finish unlocking sem_undo_list.
+                        */
+                       spin_unlock_wait(&ulp->lock);
+                       rcu_read_unlock();
+                       break;
+               }
+               spin_lock(&ulp->lock);
+               semid = un->semid;
+               spin_unlock(&ulp->lock);
                rcu_read_unlock();
 
+               /* exit_sem raced with IPC_RMID, nothing to do */
                if (semid == -1)
-                       break;
+                       continue;
 
-               sma = sem_lock_check(tsk->nsproxy->ipc_ns, un->semid);
+               sma = sem_lock_check(tsk->nsproxy->ipc_ns, semid);
 
                /* exit_sem raced with IPC_RMID, nothing to do */
                if (IS_ERR(sma))