2.6.24-git16

 ipc

diff --git a/ipc/sem.c b/ipc/sem.c
index 35952c0..d65e285 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -143,6 +143,7 @@ int sem_init_ns(struct ipc_namespace *ns)
 void sem_exit_ns(struct ipc_namespace *ns)
 {
    struct sem_array *sma;
+   struct kern_ipc_perm *perm;
    int next_id;
    int total, in_use;
 
@@ -151,10 +152,11 @@ void sem_exit_ns(struct ipc_namespace *ns)
    in_use = sem_ids(ns).in_use;
 
    for (total = 0, next_id = 0; total < in_use; next_id++) {
-      sma = idr_find(&sem_ids(ns).ipcs_idr, next_id);
-      if (sma == NULL)
+      perm = idr_find(&sem_ids(ns).ipcs_idr, next_id);
+      if (perm == NULL)
          continue;
-      ipc_lock_by_ptr(&sma->sem_perm);
+      ipc_lock_by_ptr(perm);
+      sma = container_of(perm, struct sem_array, sem_perm);
       freeary(ns, sma);
       total++;
    }
@@ -181,6 +183,9 @@ static inline struct sem_array *sem_lock_check_down(struct ipc_namespace *ns,
 {
    struct kern_ipc_perm *ipcp = ipc_lock_check_down(&sem_ids(ns), id);
 
+   if (IS_ERR(ipcp))
+      return (struct sem_array *)ipcp;
+
    return container_of(ipcp, struct sem_array, sem_perm);
 }
 
@@ -192,6 +197,9 @@ static inline struct sem_array *sem_lock(struct ipc_namespace *ns, int id)
 {
    struct kern_ipc_perm *ipcp = ipc_lock(&sem_ids(ns), id);
 
+   if (IS_ERR(ipcp))
+      return (struct sem_array *)ipcp;
+
    return container_of(ipcp, struct sem_array, sem_perm);
 }
 
@@ -200,6 +208,9 @@ static inline struct sem_array *sem_lock_check(struct ipc_namespace *ns,
 {
    struct kern_ipc_perm *ipcp = ipc_lock_check(&sem_ids(ns), id);
 
+   if (IS_ERR(ipcp))
+      return (struct sem_array *)ipcp;
+
    return container_of(ipcp, struct sem_array, sem_perm);
 }