On Thursday 25 March 2004 09:57 pm, Manfred Spraul wrote:
> badari wrote:
> >--- linux/ipc/sem.c     2004-03-26 05:19:22.833959160 -0800
> >+++ linux.new/ipc/sem.c 2004-03-26 05:19:57.047757872 -0800
> >@@ -972,8 +972,10 @@ static struct sem_undo *find_undo(int se
> >        if(sma==NULL)
> >                goto out;
> >        un = ERR_PTR(-EIDRM);
> >-       if (sem_checkid(sma,semid))
> >+       if (sem_checkid(sma,semid)) {
> >+               sem_unlock(sma);
> >                goto out_unlock;
> >+       }
> >        nsems = sma->sem_nsems;
> >        sem_unlock(sma);
>
> [snip]
>
> > out_unlock:
> >         unlock_semundo();
> > out:
> >         return un;
> > }
>
> Thanks for finding the bug - out_unlock unlocks the wrong spinlock,
> that's why I didn't notice it while searching for the bug.
> But I think your fix is wrong: the "goto out_unlock" must be replaced
> with "goto out": the semundo spinlock is not held.

Yes. You are correct. semundo lock is not held. 
Here is the updated patch.

Thanks,
Badari