[PATCH] ipc,sem: fix semctl(..., GETZCNT)

[Rik van Riel <riel@redhat.com>]

The semctl GETZCNT returns the number of semops waiting for the
specified semaphore to become zero.  After changeset 9f1bc2c,
the semops waiting on just one semaphore are waiting on that
semaphore's list.

In order to return the correct count, we have to walk that list
too, in addition to the sem_array's list for complex operations.

This bug broke dbench; it works again with this patch applied.

Signed-off-by: Rik van Riel <riel@redhat.com>
Reported-by: Kent Overstreet <koverstreet@google.com>
Tested-by: Kent Overstreet <koverstreet@google.com>
---
 ipc/sem.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ipc/sem.c b/ipc/sem.c
index 899b598..04b264d 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -815,6 +815,13 @@ static int count_semzcnt (struct sem_array * sma, ushort semnum)
 	struct sem_queue * q;
 
 	semzcnt = 0;
+	list_for_each_entry(q, &sma->sem_base[semnum].sem_pending, list) {
+		struct sembuf * sops = q->sops;
+		BUG_ON(sops->sem_num != semnum);
+		if ((sops->sem_op == 0) && !(sops->sem_flg & IPC_NOWAIT))
+			semzcnt++;
+	}
+
 	list_for_each_entry(q, &sma->sem_pending, list) {
 		struct sembuf * sops = q->sops;
 		int nsops = q->nsops;