From b038575f1a343002864fa42372e7adbfefbd27af Mon Sep 17 00:00:00 2001
From: Al Viro <viro@ZenIV.linux.org.uk>
Date: Fri, 3 May 2013 00:30:49 +0100
Subject: [PATCH] --- yaml --- r: 371681 b: refs/heads/master c:
 ce857229e0c3adc211944a13a5579ef84fd7b4af h: refs/heads/master i:   371679:
 74502a2476fc0d24e048743907d7bc908277f1d7 v: v3

---
 [refs]          |  2 +-
 trunk/ipc/sem.c | 29 ++++++++---------------------
 2 files changed, 9 insertions(+), 22 deletions(-)

diff --git a/[refs] b/[refs]
index 88046914baa0..7a99e08162b8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 20a2078ce7705a6e0722ef5184336eb8657a58d8
+refs/heads/master: ce857229e0c3adc211944a13a5579ef84fd7b4af
diff --git a/trunk/ipc/sem.c b/trunk/ipc/sem.c
index e78ee3186d1f..4734e9c2a98a 100644
--- a/trunk/ipc/sem.c
+++ b/trunk/ipc/sem.c
@@ -328,28 +328,12 @@ static inline void sem_lock_and_putref(struct sem_array *sma)
 	ipc_rcu_putref(sma);
 }
 
-static inline void sem_getref_and_unlock(struct sem_array *sma)
-{
-	WARN_ON_ONCE(!ipc_rcu_getref(sma));
-	sem_unlock(sma, -1);
-}
-
 static inline void sem_putref(struct sem_array *sma)
 {
 	sem_lock_and_putref(sma);
 	sem_unlock(sma, -1);
 }
 
-/*
- * Call inside the rcu read section.
- */
-static inline void sem_getref(struct sem_array *sma)
-{
-	sem_lock(sma, NULL, -1);
-	WARN_ON_ONCE(!ipc_rcu_getref(sma));
-	sem_unlock(sma, -1);
-}
-
 static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s)
 {
 	ipc_rmid(&sem_ids(ns), &s->sem_perm);
@@ -1116,9 +1100,14 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
 		ushort __user *array = p;
 		int i;
 
+		sem_lock(sma, NULL, -1);
 		if(nsems > SEMMSL_FAST) {
-			sem_getref(sma);
-
+			if (!ipc_rcu_getref(sma)) {
+				sem_unlock(sma, -1);
+				err = -EIDRM;
+				goto out_free;
+			}
+			sem_unlock(sma, -1);
 			sem_io = ipc_alloc(sizeof(ushort)*nsems);
 			if(sem_io == NULL) {
 				sem_putref(sma);
@@ -1131,9 +1120,7 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
 				err = -EIDRM;
 				goto out_free;
 			}
-		} else
-			sem_lock(sma, NULL, -1);
-
+		}
 		for (i = 0; i < sma->sem_nsems; i++)
 			sem_io[i] = sma->sem_base[i].semval;
 		sem_unlock(sma, -1);