ipc/sem.c: bugfix for semctl(,,GETZCNT)

GETZCNT is supposed to return the number of threads that wait until a
semaphore value becomes 0.

The current implementation overlooks complex operations that contain
both wait-for-zero operation and operations that alter at least one
semaphore.

The patch fixes that.  It's intentionally copy&paste, this will be
cleaned up in the next patch.

Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Cc: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 10 insertions, 0 deletions

diff --git a/ipc/sem.c b/ipc/sem.c
index fe0928a3d08b..4321fa420fe1 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1047,6 +1047,16 @@ static int count_semzcnt(struct sem_array *sma, ushort semnum)
                             && !(sops[i].sem_flg & IPC_NOWAIT))
                                 semzcnt++;
         }
+        list_for_each_entry(q, &sma->pending_alter, list) {
+                struct sembuf *sops = q->sops;
+                int nsops = q->nsops;
+                int i;
+                for (i = 0; i < nsops; i++)
+                        if (sops[i].sem_num == semnum
+                            && (sops[i].sem_op == 0)
+                            && !(sops[i].sem_flg & IPC_NOWAIT))
+                                semzcnt++;
+        }
         return semzcnt;
 }