ipc/sem.c: convert undo structures to struct list_head

The undo structures contain two linked lists, the attached patch replaces
them with generic struct list_head lists.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Cc: Nadia Derbey <Nadia.Derbey@bull.net>
Cc: Pierre Peiffer <peifferp@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 89 insertions, 74 deletions

diff --git a/ipc/sem.c b/ipc/sem.c
index e9418df5ff3e..4f26c7157356 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -274,7 +274,7 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
         sma->sem_base = (struct sem *) &sma[1];
         /* sma->sem_pending = NULL; */
         sma->sem_pending_last = &sma->sem_pending;
-        /* sma->undo = NULL; */
+        INIT_LIST_HEAD(&sma->list_id);
         sma->sem_nsems = nsems;
         sma->sem_ctime = get_seconds();
         sem_unlock(sma);
@@ -536,7 +536,8 @@ static void freeary(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
          * (They will be freed without any further action in exit_sem()
          * or during the next semop.)
          */
-        for (un = sma->undo; un; un = un->id_next)
+        assert_spin_locked(&sma->sem_perm.lock);
+        list_for_each_entry(un, &sma->list_id, list_id)
                 un->semid = -1;
 
         /* Wake up all pending processes and let them fail with EIDRM. */
@@ -763,9 +764,12 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
 
                 for (i = 0; i < nsems; i++)
                         sma->sem_base[i].semval = sem_io[i];
-                for (un = sma->undo; un; un = un->id_next)
+
+                assert_spin_locked(&sma->sem_perm.lock);
+                list_for_each_entry(un, &sma->list_id, list_id) {
                         for (i = 0; i < nsems; i++)
                                 un->semadj[i] = 0;
+                }
                 sma->sem_ctime = get_seconds();
                 /* maybe some queued-up processes were waiting for this */
                 update_queue(sma);
@@ -797,12 +801,15 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
         {
                 int val = arg.val;
                 struct sem_undo *un;
+
                 err = -ERANGE;
                 if (val > SEMVMX || val < 0)
                         goto out_unlock;
 
-                for (un = sma->undo; un; un = un->id_next)
+                assert_spin_locked(&sma->sem_perm.lock);
+                list_for_each_entry(un, &sma->list_id, list_id)
                         un->semadj[semnum] = 0;
+
                 curr->semval = val;
                 curr->sempid = task_tgid_vnr(current);
                 sma->sem_ctime = get_seconds();
@@ -952,6 +959,8 @@ static inline int get_undo_list(struct sem_undo_list **undo_listp)
                         return -ENOMEM;
                 spin_lock_init(&undo_list->lock);
                 atomic_set(&undo_list->refcnt, 1);
+                INIT_LIST_HEAD(&undo_list->list_proc);
+
                 current->sysvsem.undo_list = undo_list;
         }
         *undo_listp = undo_list;
@@ -960,25 +969,30 @@ static inline int get_undo_list(struct sem_undo_list **undo_listp)
 
 static struct sem_undo *lookup_undo(struct sem_undo_list *ulp, int semid)
 {
-        struct sem_undo **last, *un;
-
-        last = &ulp->proc_list;
-        un = *last;
-        while(un != NULL) {
-                if(un->semid==semid)
-                        break;
-                if(un->semid==-1) {
-                        *last=un->proc_next;
-                        kfree(un);
-                } else {
-                        last=&un->proc_next;
+        struct sem_undo *walk, *tmp;
+
+        assert_spin_locked(&ulp->lock);
+        list_for_each_entry_safe(walk, tmp, &ulp->list_proc, list_proc) {
+                if (walk->semid == semid)
+                        return walk;
+                if (walk->semid == -1) {
+                        list_del(&walk->list_proc);
+                        kfree(walk);
                 }
-                un=*last;
         }
-        return un;
+        return NULL;
 }
 
-static struct sem_undo *find_undo(struct ipc_namespace *ns, int semid)
+/**
+ * find_alloc_undo - Lookup (and if not present create) undo array
+ * @ns: namespace
+ * @semid: semaphore array id
+ *
+ * The function looks up (and if not present creates) the undo structure.
+ * The size of the undo structure depends on the size of the semaphore
+ * array, thus the alloc path is not that straightforward.
+ */
+static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
 {
         struct sem_array *sma;
         struct sem_undo_list *ulp;
@@ -997,6 +1011,7 @@ static struct sem_undo *find_undo(struct ipc_namespace *ns, int semid)
                 goto out;
 
         /* no undo structure around - allocate one. */
+        /* step 1: figure out the size of the semaphore array */
         sma = sem_lock_check(ns, semid);
         if (IS_ERR(sma))
                 return ERR_PTR(PTR_ERR(sma));
@@ -1004,15 +1019,19 @@ static struct sem_undo *find_undo(struct ipc_namespace *ns, int semid)
         nsems = sma->sem_nsems;
         sem_getref_and_unlock(sma);
 
+        /* step 2: allocate new undo structure */
         new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
         if (!new) {
                 sem_putref(sma);
                 return ERR_PTR(-ENOMEM);
         }
-        new->semadj = (short *) &new[1];
-        new->semid = semid;
 
+        /* step 3: Acquire the lock on the undo list pointer */
         spin_lock(&ulp->lock);
+
+        /* step 4: check for races: someone else allocated the undo struct,
+         *         semaphore array was destroyed.
+         */
         un = lookup_undo(ulp, semid);
         if (un) {
                 spin_unlock(&ulp->lock);
@@ -1028,13 +1047,17 @@ static struct sem_undo *find_undo(struct ipc_namespace *ns, int semid)
                 un = ERR_PTR(-EIDRM);
                 goto out;
         }
-        new->proc_next = ulp->proc_list;
-        ulp->proc_list = new;
-        new->id_next = sma->undo;
-        sma->undo = new;
+        /* step 5: initialize & link new undo structure */
+        new->semadj = (short *) &new[1];
+        new->semid = semid;
+        assert_spin_locked(&ulp->lock);
+        list_add(&new->list_proc, &ulp->list_proc);
+        assert_spin_locked(&sma->sem_perm.lock);
+        list_add(&new->list_id, &sma->list_id);
+
         sem_unlock(sma);
-        un = new;
         spin_unlock(&ulp->lock);
+        un = new;
 out:
         return un;
 }
@@ -1090,9 +1113,8 @@ asmlinkage long sys_semtimedop(int semid, struct sembuf __user *tsops,
                         alter = 1;
         }
 
-retry_undos:
         if (undos) {
-                un = find_undo(ns, semid);
+                un = find_alloc_undo(ns, semid);
                 if (IS_ERR(un)) {
                         error = PTR_ERR(un);
                         goto out_free;
@@ -1107,14 +1129,14 @@ retry_undos:
         }
 
         /*