ipc,sem: fix semctl(..., GETZCNT)

The semctl GETZCNT returns the number of semops waiting for the
specified semaphore to become zero.  After commit 9f1bc2c9022c
("ipc,sem: have only one list in struct sem_queue"), the semops waiting
on just one semaphore are waiting on that semaphore's list.

In order to return the correct count, we have to walk that list too, in
addition to the sem_array's list for complex operations.

This bug broke dbench; it works again with this patch applied.

Signed-off-by: Rik van Riel <riel@redhat.com>
Reported-by: Kent Overstreet <koverstreet@google.com>
Tested-by: Kent Overstreet <koverstreet@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 7 insertions, 0 deletions

diff --git a/ipc/sem.c b/ipc/sem.c
index 899b598b63be..04b264dbf141 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -815,6 +815,13 @@ static int count_semzcnt (struct sem_array * sma, ushort semnum)
         struct sem_queue * q;
 
         semzcnt = 0;
+        list_for_each_entry(q, &sma->sem_base[semnum].sem_pending, list) {
+                struct sembuf * sops = q->sops;
+                BUG_ON(sops->sem_num != semnum);
+                if ((sops->sem_op == 0) && !(sops->sem_flg & IPC_NOWAIT))
+                        semzcnt++;
+        }
+
         list_for_each_entry(q, &sma->sem_pending, list) {
                 struct sembuf * sops = q->sops;
                 int nsops = q->nsops;