From: Andrew Morton <akpm@linux-foundation.org>

As noted by Kevin, tipc's release() does down_interruptible() and ignores the
return value.  So if signal_pending() we'll end up doing up() on a non-downed
semaphore.  Fix.

Cc: Kevin Winchester <kjwinchester@gmail.com>
Cc: Per Liden <per.liden@ericsson.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Allan Stephens <allan.stephens@windriver.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 net/tipc/socket.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff -puN net/tipc/socket.c~tipc-fix-semaphore-handling net/tipc/socket.c
--- a/net/tipc/socket.c~tipc-fix-semaphore-handling
+++ a/net/tipc/socket.c
@@ -253,7 +253,7 @@ static int release(struct socket *sock)
 	dbg("sock_delete: %x\n",tsock);
 	if (!tsock)
 		return 0;
-	down_interruptible(&tsock->sem);
+	down(&tsock->sem);
 	if (!sock->sk) {
 		up(&tsock->sem);
 		return 0;
_