The synchronization between adding messages and IPC_RMID is incomplete.

This creates a memory leak and use-after-free races

Affected: 3.0.10, 3.0.11, current head

Details:
Assume a preemptible kernel that is preempted just after
> sma = sem_obtain_object_check(ns, semid);
in semtimedop().
The only lock that is held is rcu_read_lock().

Now the other thread processes IPC_RMID.
When the first task is resumed, then it will happily wait for messages on a deleted queue (including use-after-free memory writes and whatever else).