1 files changed, 11 insertions, 9 deletions

diff --git a/fs/eventfd.c b/fs/eventfd.c
index 5de2c2db3aa2..91c0829a7035 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -28,6 +28,7 @@ struct eventfd_ctx {
          * issue a wakeup.
          */
         __u64 count;
+        unsigned int flags;
 };
 
 /*
@@ -87,22 +88,20 @@ static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
 {
         struct eventfd_ctx *ctx = file->private_data;
         ssize_t res;
-        __u64 ucnt;
+        __u64 ucnt = 0;
         DECLARE_WAITQUEUE(wait, current);
 
         if (count < sizeof(ucnt))
                 return -EINVAL;
         spin_lock_irq(&ctx->wqh.lock);
         res = -EAGAIN;
-        ucnt = ctx->count;
-        if (ucnt > 0)
+        if (ctx->count > 0)
                 res = sizeof(ucnt);
         else if (!(file->f_flags & O_NONBLOCK)) {
                 __add_wait_queue(&ctx->wqh, &wait);
                 for (res = 0;;) {
                         set_current_state(TASK_INTERRUPTIBLE);
                         if (ctx->count > 0) {
-                                ucnt = ctx->count;
                                 res = sizeof(ucnt);
                                 break;
                         }
@@ -117,8 +116,9 @@ static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
                 __remove_wait_queue(&ctx->wqh, &wait);
                 __set_current_state(TASK_RUNNING);
         }
-        if (res > 0) {
-                ctx->count = 0;
+        if (likely(res > 0)) {
+                ucnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count;
+                ctx->count -= ucnt;
                 if (waitqueue_active(&ctx->wqh))
                         wake_up_locked(&ctx->wqh);
         }
@@ -166,7 +166,7 @@ static ssize_t eventfd_write(struct file *file, const char __user *buf, size_t c
                 __remove_wait_queue(&ctx->wqh, &wait);
                 __set_current_state(TASK_RUNNING);
         }
-        if (res > 0) {
+        if (likely(res > 0)) {
                 ctx->count += ucnt;
                 if (waitqueue_active(&ctx->wqh))
                         wake_up_locked(&ctx->wqh);
@@ -207,7 +207,7 @@ SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
         BUILD_BUG_ON(EFD_CLOEXEC != O_CLOEXEC);
         BUILD_BUG_ON(EFD_NONBLOCK != O_NONBLOCK);
 
-        if (flags & ~(EFD_CLOEXEC | EFD_NONBLOCK))
+        if (flags & ~EFD_FLAGS_SET)
                 return -EINVAL;
 
         ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
@@ -216,13 +216,14 @@ SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
 
         init_waitqueue_head(&ctx->wqh);
         ctx->count = count;
+        ctx->flags = flags;
 
         /*
          * When we call this, the initialization must be complete, since
          * anon_inode_getfd() will install the fd.
          */
         fd = anon_inode_getfd("[eventfd]", &eventfd_fops, ctx,
-                              flags & (O_CLOEXEC | O_NONBLOCK));
+                              flags & EFD_SHARED_FCNTL_FLAGS);
         if (fd < 0)
                 kfree(ctx);
         return fd;
@@ -232,3 +233,4 @@ SYSCALL_DEFINE1(eventfd, unsigned int, count)
 {
         return sys_eventfd2(count, 0);
 }
+