1 files changed, 14 insertions, 3 deletions

diff --git a/ipc/sem.c b/ipc/sem.c
index 35952c0bae46..d65e285b7e30 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -143,6 +143,7 @@ int sem_init_ns(struct ipc_namespace *ns)
 void sem_exit_ns(struct ipc_namespace *ns)
 {
         struct sem_array *sma;
+        struct kern_ipc_perm *perm;
         int next_id;
         int total, in_use;
 
@@ -151,10 +152,11 @@ void sem_exit_ns(struct ipc_namespace *ns)
         in_use = sem_ids(ns).in_use;
 
         for (total = 0, next_id = 0; total < in_use; next_id++) {
-                sma = idr_find(&sem_ids(ns).ipcs_idr, next_id);
-                if (sma == NULL)
+                perm = idr_find(&sem_ids(ns).ipcs_idr, next_id);
+                if (perm == NULL)
                         continue;
-                ipc_lock_by_ptr(&sma->sem_perm);
+                ipc_lock_by_ptr(perm);
+                sma = container_of(perm, struct sem_array, sem_perm);
                 freeary(ns, sma);
                 total++;
         }
@@ -181,6 +183,9 @@ static inline struct sem_array *sem_lock_check_down(struct ipc_namespace *ns,
 {
         struct kern_ipc_perm *ipcp = ipc_lock_check_down(&sem_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct sem_array *)ipcp;
+
         return container_of(ipcp, struct sem_array, sem_perm);
 }
 
@@ -192,6 +197,9 @@ static inline struct sem_array *sem_lock(struct ipc_namespace *ns, int id)
 {
         struct kern_ipc_perm *ipcp = ipc_lock(&sem_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct sem_array *)ipcp;
+
         return container_of(ipcp, struct sem_array, sem_perm);
 }
 
@@ -200,6 +208,9 @@ static inline struct sem_array *sem_lock_check(struct ipc_namespace *ns,
 {
         struct kern_ipc_perm *ipcp = ipc_lock_check(&sem_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct sem_array *)ipcp;
+
         return container_of(ipcp, struct sem_array, sem_perm);
 }