Hi,

I found a few odd lines in the sysv sem undo implementation and wrote a 
patch to fix them:

- lock_undo() locks the list of undo structures. The lock is held 
throughout the semop() syscall, but that's unnecessary - we can drop it 
immediately after the lookup.
- undo structures are only allocated when necessary. The need for undo 
structures is only noticed in the middle of the semop operation, while 
holding the semaphore array spinlock. The result is a convoluted 
unlock&revalidate implementation. I've reordered the code, and now the 
undo allocation can happen before acquiring the semaphore array 
spinlock. As a bonus, less code runs under the semaphore array spinlock.
- sem_exit seems to be broken with CLONE_SYSVSEM: the reference count is 
never decremented if it's > 1.
- sysvsem.sleep_list looks like code to handle oopses: if an oops kills 
a thread that sleeps in sys_timedsemop(), then sem_exit tries to 
recover. I've removed that - too fragile.

Attached is my patch, not yet fully tested. What do you think?

--
    Manfred