commit 88ed594f5d431d855256edbe7e886c8cf4b575dc
Author: Roland McGrath <roland@hack.frob.com>
Date:   Tue May 19 15:04:41 2015 -0700

    BZ#18434: Fix sem_post EOVERFLOW check for [!__HAVE_64B_ATOMICS].

Index: glibc-2.17-c758a686/nptl/Makefile
===================================================================
--- glibc-2.17-c758a686.orig/nptl/Makefile
+++ glibc-2.17-c758a686/nptl/Makefile
@@ -224,6 +224,7 @@ tests = tst-typesizes \
 	tst-key1 tst-key2 tst-key3 tst-key4 \
 	tst-sem1 tst-sem2 tst-sem3 tst-sem4 tst-sem5 tst-sem6 tst-sem7 \
 	tst-sem8 tst-sem9 tst-sem10 tst-sem11 tst-sem12 tst-sem13 tst-sem14 \
+	tst-sem15 \
 	tst-barrier1 tst-barrier2 tst-barrier3 tst-barrier4 \
 	tst-align tst-align2 tst-align3 \
 	tst-basic1 tst-basic2 tst-basic3 tst-basic4 tst-basic5 tst-basic6 \
Index: glibc-2.17-c758a686/nptl/tst-sem15.c
===================================================================
--- /dev/null
+++ glibc-2.17-c758a686/nptl/tst-sem15.c
@@ -0,0 +1,99 @@
+/* Test for SEM_VALUE_MAX overflow detection: BZ #18434.
+   Copyright (C) 2015 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <errno.h>
+#include <limits.h>
+#include <semaphore.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+
+static int
+do_test (void)
+{
+  sem_t s;
+
+  if (sem_init (&s, 0, SEM_VALUE_MAX))
+    {
+      printf ("sem_init: %m\n");
+      return 1;
+    }
+
+  int result = 0;
+
+  int value = 0xdeadbeef;
+  if (sem_getvalue (&s, &value))
+    {
+      printf ("sem_getvalue: %m\n");
+      result = 1;
+    }
+  else
+    {
+      printf ("sem_getvalue after init: %d\n", value);
+      if (value != SEM_VALUE_MAX)
+	{
+	  printf ("\tshould be %d\n", SEM_VALUE_MAX);
+	  result = 1;
+	}
+    }
+
+  errno = 0;
+  if (sem_post(&s) == 0)
+    {
+      puts ("sem_post at SEM_VALUE_MAX succeeded!");
+      result = 1;
+    }
+  else
+    {
+      printf ("sem_post at SEM_VALUE_MAX: %m (%d)\n", errno);
+      if (errno != EOVERFLOW)
+	{
+	  printf ("\tshould be %s (EOVERFLOW = %d)\n",
+		  strerror (EOVERFLOW), EOVERFLOW);
+	  result = 1;
+	}
+    }
+
+  value = 0xbad1d00d;
+  if (sem_getvalue (&s, &value))
+    {
+      printf ("sem_getvalue: %m\n");
+      result = 1;
+    }
+  else
+    {
+      printf ("sem_getvalue after post: %d\n", value);
+      if (value != SEM_VALUE_MAX)
+	{
+	  printf ("\tshould be %d\n", SEM_VALUE_MAX);
+	  result = 1;
+	}
+    }
+
+  if (sem_destroy (&s))
+    {
+      printf ("sem_destroy: %m\n");
+      result = 1;
+    }
+
+  return result;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
Index: glibc-2.17-c758a686/nptl/sysdeps/unix/sysv/linux/sem_post.c
===================================================================
--- glibc-2.17-c758a686.orig/nptl/sysdeps/unix/sysv/linux/sem_post.c
+++ glibc-2.17-c758a686/nptl/sysdeps/unix/sysv/linux/sem_post.c
@@ -83,14 +83,14 @@ __new_sem_post (sem_t *sem)
   unsigned int v = atomic_load_relaxed (&isem->value);
   do
     {
-      if ((v << SEM_VALUE_SHIFT) == SEM_VALUE_MAX)
+      if ((v >> SEM_VALUE_SHIFT) == SEM_VALUE_MAX)
 	{
 	  __set_errno (EOVERFLOW);
 	  return -1;
 	}
     }
-  while (!atomic_compare_exchange_weak_release (&isem->value,
-      &v, v + (1 << SEM_VALUE_SHIFT)));
+  while (!atomic_compare_exchange_weak_release
+	 (&isem->value, &v, v + (1 << SEM_VALUE_SHIFT)));
 
   /* If there is any potentially blocked waiter, wake one of them.  */
   if ((v & SEM_NWAITERS_MASK) != 0)