1 files changed, 30 insertions, 5 deletions

diff --git a/ipc/util.c b/ipc/util.c
index cf5d1087409e..71f3f3982fc8 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -119,6 +119,7 @@ void ipc_init_ids(struct ipc_ids *ids)
         rhashtable_init(&ids->key_ht, &ipc_kht_params);
         idr_init(&ids->ipcs_idr);
         ids->max_idx = -1;
+        ids->last_idx = -1;
 #ifdef CONFIG_CHECKPOINT_RESTORE
         ids->next_id = -1;
 #endif
@@ -192,6 +193,10 @@ static struct kern_ipc_perm *ipc_findkey(struct ipc_ids *ids, key_t key)
  *
  * The caller must own kern_ipc_perm.lock.of the new object.
  * On error, the function returns a (negative) error code.
+ *
+ * To conserve sequence number space, especially with extended ipc_mni,
+ * the sequence number is incremented only when the returned ID is less than
+ * the last one.
  */
 static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new)
 {
@@ -215,17 +220,37 @@ static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new)
          */
 
         if (next_id < 0) { /* !CHECKPOINT_RESTORE or next_id is unset */
-                new->seq = ids->seq++;
-                if (ids->seq > IPCID_SEQ_MAX)
-                        ids->seq = 0;
-                idx = idr_alloc(&ids->ipcs_idr, new, 0, 0, GFP_NOWAIT);
+
+                /* allocate the idx, with a NULL struct kern_ipc_perm */
+                idx = idr_alloc(&ids->ipcs_idr, NULL, 0, 0, GFP_NOWAIT);
+
+                if (idx >= 0) {
+                        /*
+                         * idx got allocated successfully.
+                         * Now calculate the sequence number and set the
+                         * pointer for real.
+                         */
+                        if (idx <= ids->last_idx) {
+                                ids->seq++;
+                                if (ids->seq >= ipcid_seq_max())
+                                        ids->seq = 0;
+                        }
+                        ids->last_idx = idx;
+
+                        new->seq = ids->seq;
+                        /* no need for smp_wmb(), this is done
+                         * inside idr_replace, as part of
+                         * rcu_assign_pointer
+                         */
+                        idr_replace(&ids->ipcs_idr, new, idx);
+                }
         } else {
                 new->seq = ipcid_to_seqx(next_id);
                 idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id),
                                 0, GFP_NOWAIT);
         }
         if (idx >= 0)
-                new->id = (new->seq << IPCMNI_SEQ_SHIFT) + idx;
+                new->id = (new->seq << ipcmni_seq_shift()) + idx;
         return idx;
 }