sem_revalidate checks that a semaphore array didn't disappear while the
code was running without the semaphore array spinlock. If the array
disappeared, then it will return without holding a lock. find_undo calls
sem_revalidate and then sem_unlock, even if sem_revalidate failed. The
sem_unlock call must be removed.
Mingming Cao reported a spinlock deadlock with sysv semaphores. A
superflous unlock doesn't explain the deadlock, but it's obviously a bug.