ipc/sem.c: bugfix for semctl(,,GETZCNT)

GETZCNT is supposed to return the number of threads that wait until a
semaphore value becomes 0.

The current implementation overlooks complex operations that contain
both wait-for-zero operation and operations that alter at least one
semaphore.

The patch fixes that.  It's intentionally copy&paste, this will be
cleaned up in the next patch.

Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Cc: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/ipc/sem.c b/ipc/sem.c
index fe0928a3d08bb8378ded33a7d287e9d5a7ab9dfd..4321fa420fe1906f46e36d15cc2f688769d81198 100644 (file)
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1047,6 +1047,16 @@ static int count_semzcnt(struct sem_array *sma, ushort semnum)
                            && !(sops[i].sem_flg & IPC_NOWAIT))
                                semzcnt++;
        }
+       list_for_each_entry(q, &sma->pending_alter, list) {
+               struct sembuf *sops = q->sops;
+               int nsops = q->nsops;
+               int i;
+               for (i = 0; i < nsops; i++)
+                       if (sops[i].sem_num == semnum
+                           && (sops[i].sem_op == 0)
+                           && !(sops[i].sem_flg & IPC_NOWAIT))
+                               semzcnt++;
+       }
        return semzcnt;
 }