1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24#include <linux/slab.h>
25#include <linux/mm.h>
26#include <linux/hugetlb.h>
27#include <linux/shm.h>
28#include <linux/init.h>
29#include <linux/file.h>
30#include <linux/mman.h>
31#include <linux/shmem_fs.h>
32#include <linux/security.h>
33#include <linux/syscalls.h>
34#include <linux/audit.h>
35#include <linux/capability.h>
36#include <linux/ptrace.h>
37#include <linux/seq_file.h>
38#include <linux/rwsem.h>
39#include <linux/nsproxy.h>
40#include <linux/mount.h>
41#include <linux/ipc_namespace.h>
42
43#include <asm/uaccess.h>
44
45#include "util.h"
46
47struct shm_file_data {
48 int id;
49 struct ipc_namespace *ns;
50 struct file *file;
51 const struct vm_operations_struct *vm_ops;
52};
53
54#define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data))
55
56static const struct file_operations shm_file_operations;
57static struct vm_operations_struct shm_vm_ops;
58
59#define shm_ids(ns) ((ns)->ids[IPC_SHM_IDS])
60
61#define shm_unlock(shp) \
62 ipc_unlock(&(shp)->shm_perm)
63
64static int newseg(struct ipc_namespace *, struct ipc_params *);
65static void shm_open(struct vm_area_struct *vma);
66static void shm_close(struct vm_area_struct *vma);
67static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
68#ifdef CONFIG_PROC_FS
69static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
70#endif
71
72void shm_init_ns(struct ipc_namespace *ns)
73{
74 ns->shm_ctlmax = SHMMAX;
75 ns->shm_ctlall = SHMALL;
76 ns->shm_ctlmni = SHMMNI;
77 ns->shm_tot = 0;
78 ipc_init_ids(&ns->ids[IPC_SHM_IDS]);
79}
80
81
82
83
84
85static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
86{
87 struct shmid_kernel *shp;
88 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
89
90 if (shp->shm_nattch){
91 shp->shm_perm.mode |= SHM_DEST;
92
93 shp->shm_perm.key = IPC_PRIVATE;
94 shm_unlock(shp);
95 } else
96 shm_destroy(ns, shp);
97}
98
99#ifdef CONFIG_IPC_NS
100void shm_exit_ns(struct ipc_namespace *ns)
101{
102 free_ipcs(ns, &shm_ids(ns), do_shm_rmid);
103}
104#endif
105
106void __init shm_init (void)
107{
108 shm_init_ns(&init_ipc_ns);
109 ipc_init_proc_interface("sysvipc/shm",
110 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime\n",
111 IPC_SHM_IDS, sysvipc_shm_proc_show);
112}
113
114
115
116
117
118static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
119{
120 struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id);
121
122 if (IS_ERR(ipcp))
123 return (struct shmid_kernel *)ipcp;
124
125 return container_of(ipcp, struct shmid_kernel, shm_perm);
126}
127
128static inline struct shmid_kernel *shm_lock_check(struct ipc_namespace *ns,
129 int id)
130{
131 struct kern_ipc_perm *ipcp = ipc_lock_check(&shm_ids(ns), id);
132
133 if (IS_ERR(ipcp))
134 return (struct shmid_kernel *)ipcp;
135
136 return container_of(ipcp, struct shmid_kernel, shm_perm);
137}
138
139static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s)
140{
141 ipc_rmid(&shm_ids(ns), &s->shm_perm);
142}
143
144
145
146static void shm_open(struct vm_area_struct *vma)
147{
148 struct file *file = vma->vm_file;
149 struct shm_file_data *sfd = shm_file_data(file);
150 struct shmid_kernel *shp;
151
152 shp = shm_lock(sfd->ns, sfd->id);
153 BUG_ON(IS_ERR(shp));
154 shp->shm_atim = get_seconds();
155 shp->shm_lprid = task_tgid_vnr(current);
156 shp->shm_nattch++;
157 shm_unlock(shp);
158}
159
160
161
162
163
164
165
166
167
168
169static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
170{
171 ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
172 shm_rmid(ns, shp);
173 shm_unlock(shp);
174 if (!is_file_hugepages(shp->shm_file))
175 shmem_lock(shp->shm_file, 0, shp->mlock_user);
176 else
177 user_shm_unlock(shp->shm_file->f_path.dentry->d_inode->i_size,
178 shp->mlock_user);
179 fput (shp->shm_file);
180 security_shm_free(shp);
181 ipc_rcu_putref(shp);
182}
183
184
185
186
187
188
189
190static void shm_close(struct vm_area_struct *vma)
191{
192 struct file * file = vma->vm_file;
193 struct shm_file_data *sfd = shm_file_data(file);
194 struct shmid_kernel *shp;
195 struct ipc_namespace *ns = sfd->ns;
196
197 down_write(&shm_ids(ns).rw_mutex);
198
199 shp = shm_lock(ns, sfd->id);
200 BUG_ON(IS_ERR(shp));
201 shp->shm_lprid = task_tgid_vnr(current);
202 shp->shm_dtim = get_seconds();
203 shp->shm_nattch--;
204 if(shp->shm_nattch == 0 &&
205 shp->shm_perm.mode & SHM_DEST)
206 shm_destroy(ns, shp);
207 else
208 shm_unlock(shp);
209 up_write(&shm_ids(ns).rw_mutex);
210}
211
212static int shm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
213{
214 struct file *file = vma->vm_file;
215 struct shm_file_data *sfd = shm_file_data(file);
216
217 return sfd->vm_ops->fault(vma, vmf);
218}
219
220#ifdef CONFIG_NUMA
221static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
222{
223 struct file *file = vma->vm_file;
224 struct shm_file_data *sfd = shm_file_data(file);
225 int err = 0;
226 if (sfd->vm_ops->set_policy)
227 err = sfd->vm_ops->set_policy(vma, new);
228 return err;
229}
230
231static struct mempolicy *shm_get_policy(struct vm_area_struct *vma,
232 unsigned long addr)
233{
234 struct file *file = vma->vm_file;
235 struct shm_file_data *sfd = shm_file_data(file);
236 struct mempolicy *pol = NULL;
237
238 if (sfd->vm_ops->get_policy)
239 pol = sfd->vm_ops->get_policy(vma, addr);
240 else if (vma->vm_policy)
241 pol = vma->vm_policy;
242
243 return pol;
244}
245#endif
246
247static int shm_mmap(struct file * file, struct vm_area_struct * vma)
248{
249 struct shm_file_data *sfd = shm_file_data(file);
250 int ret;
251
252 ret = sfd->file->f_op->mmap(sfd->file, vma);
253 if (ret != 0)
254 return ret;
255 sfd->vm_ops = vma->vm_ops;
256#ifdef CONFIG_MMU
257 BUG_ON(!sfd->vm_ops->fault);
258#endif
259 vma->vm_ops = &shm_vm_ops;
260 shm_open(vma);
261
262 return ret;
263}
264
265static int shm_release(struct inode *ino, struct file *file)
266{
267 struct shm_file_data *sfd = shm_file_data(file);
268
269 put_ipc_ns(sfd->ns);
270 shm_file_data(file) = NULL;
271 kfree(sfd);
272 return 0;
273}
274
275static int shm_fsync(struct file *file, struct dentry *dentry, int datasync)
276{
277 int (*fsync) (struct file *, struct dentry *, int datasync);
278 struct shm_file_data *sfd = shm_file_data(file);
279 int ret = -EINVAL;
280
281 fsync = sfd->file->f_op->fsync;
282 if (fsync)
283 ret = fsync(sfd->file, sfd->file->f_path.dentry, datasync);
284 return ret;
285}
286
287static unsigned long shm_get_unmapped_area(struct file *file,
288 unsigned long addr, unsigned long len, unsigned long pgoff,
289 unsigned long flags)
290{
291 struct shm_file_data *sfd = shm_file_data(file);
292 return get_unmapped_area(sfd->file, addr, len, pgoff, flags);
293}
294
295int is_file_shm_hugepages(struct file *file)
296{
297 int ret = 0;
298
299 if (file->f_op == &shm_file_operations) {
300 struct shm_file_data *sfd;
301 sfd = shm_file_data(file);
302 ret = is_file_hugepages(sfd->file);
303 }
304 return ret;
305}
306
307static const struct file_operations shm_file_operations = {
308 .mmap = shm_mmap,
309 .fsync = shm_fsync,
310 .release = shm_release,
311 .get_unmapped_area = shm_get_unmapped_area,
312};
313
314static struct vm_operations_struct shm_vm_ops = {
315 .open = shm_open,
316 .close = shm_close,
317 .fault = shm_fault,
318#if defined(CONFIG_NUMA)
319 .set_policy = shm_set_policy,
320 .get_policy = shm_get_policy,
321#endif
322};
323
324
325
326
327
328
329
330
331
332static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
333{
334 key_t key = params->key;
335 int shmflg = params->flg;
336 size_t size = params->u.size;
337 int error;
338 struct shmid_kernel *shp;
339 int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
340 struct file * file;
341 char name[13];
342 int id;
343
344 if (size < SHMMIN || size > ns->shm_ctlmax)
345 return -EINVAL;
346
347 if (ns->shm_tot + numpages > ns->shm_ctlall)
348 return -ENOSPC;
349
350 shp = ipc_rcu_alloc(sizeof(*shp));
351 if (!shp)
352 return -ENOMEM;
353
354 shp->shm_perm.key = key;
355 shp->shm_perm.mode = (shmflg & S_IRWXUGO);
356 shp->mlock_user = NULL;
357
358 shp->shm_perm.security = NULL;
359 error = security_shm_alloc(shp);
360 if (error) {
361 ipc_rcu_putref(shp);
362 return error;
363 }
364
365 sprintf (name, "SYSV%08x", key);
366 if (shmflg & SHM_HUGETLB) {
367
368 file = hugetlb_file_setup(name, size);
369 shp->mlock_user = current->user;
370 } else {
371 int acctflag = VM_ACCOUNT;
372
373
374
375
376 if ((shmflg & SHM_NORESERVE) &&
377 sysctl_overcommit_memory != OVERCOMMIT_NEVER)
378 acctflag = 0;
379 file = shmem_file_setup(name, size, acctflag);
380 }
381 error = PTR_ERR(file);
382 if (IS_ERR(file))
383 goto no_file;
384
385 id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
386 if (id < 0) {
387 error = id;
388 goto no_id;
389 }
390
391 shp->shm_cprid = task_tgid_vnr(current);
392 shp->shm_lprid = 0;
393 shp->shm_atim = shp->shm_dtim = 0;
394 shp->shm_ctim = get_seconds();
395 shp->shm_segsz = size;
396 shp->shm_nattch = 0;
397 shp->shm_file = file;
398
399
400
401
402 file->f_dentry->d_inode->i_ino = shp->shm_perm.id;
403
404 ns->shm_tot += numpages;
405 error = shp->shm_perm.id;
406 shm_unlock(shp);
407 return error;
408
409no_id:
410 fput(file);
411no_file:
412 security_shm_free(shp);
413 ipc_rcu_putref(shp);
414 return error;
415}
416
417
418
419
420static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg)
421{
422 struct shmid_kernel *shp;
423
424 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
425 return security_shm_associate(shp, shmflg);
426}
427
428
429
430
431static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
432 struct ipc_params *params)
433{
434 struct shmid_kernel *shp;
435
436 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
437 if (shp->shm_segsz < params->u.size)
438 return -EINVAL;
439
440 return 0;
441}
442
443asmlinkage long sys_shmget (key_t key, size_t size, int shmflg)
444{
445 struct ipc_namespace *ns;
446 struct ipc_ops shm_ops;
447 struct ipc_params shm_params;
448
449 ns = current->nsproxy->ipc_ns;
450
451 shm_ops.getnew = newseg;
452 shm_ops.associate = shm_security;
453 shm_ops.more_checks = shm_more_checks;
454
455 shm_params.key = key;
456 shm_params.flg = shmflg;
457 shm_params.u.size = size;
458
459 return ipcget(ns, &shm_ids(ns), &shm_ops, &shm_params);
460}
461
462static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
463{
464 switch(version) {
465 case IPC_64:
466 return copy_to_user(buf, in, sizeof(*in));
467 case IPC_OLD:
468 {
469 struct shmid_ds out;
470
471 ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
472 out.shm_segsz = in->shm_segsz;
473 out.shm_atime = in->shm_atime;
474 out.shm_dtime = in->shm_dtime;
475 out.shm_ctime = in->shm_ctime;
476 out.shm_cpid = in->shm_cpid;
477 out.shm_lpid = in->shm_lpid;
478 out.shm_nattch = in->shm_nattch;
479
480 return copy_to_user(buf, &out, sizeof(out));
481 }
482 default:
483 return -EINVAL;
484 }
485}
486
487static inline unsigned long
488copy_shmid_from_user(struct shmid64_ds *out, void __user *buf, int version)
489{
490 switch(version) {
491 case IPC_64:
492 if (copy_from_user(out, buf, sizeof(*out)))
493 return -EFAULT;
494 return 0;
495 case IPC_OLD:
496 {
497 struct shmid_ds tbuf_old;
498
499 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
500 return -EFAULT;
501
502 out->shm_perm.uid = tbuf_old.shm_perm.uid;
503 out->shm_perm.gid = tbuf_old.shm_perm.gid;
504 out->shm_perm.mode = tbuf_old.shm_perm.mode;
505
506 return 0;
507 }
508 default:
509 return -EINVAL;
510 }
511}
512
513static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
514{
515 switch(version) {
516 case IPC_64:
517 return copy_to_user(buf, in, sizeof(*in));
518 case IPC_OLD:
519 {
520 struct shminfo out;
521
522 if(in->shmmax > INT_MAX)
523 out.shmmax = INT_MAX;
524 else
525 out.shmmax = (int)in->shmmax;
526
527 out.shmmin = in->shmmin;
528 out.shmmni = in->shmmni;
529 out.shmseg = in->shmseg;
530 out.shmall = in->shmall;
531
532 return copy_to_user(buf, &out, sizeof(out));
533 }
534 default:
535 return -EINVAL;
536 }
537}
538
539
540
541
542static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
543 unsigned long *swp)
544{
545 int next_id;
546 int total, in_use;
547
548 *rss = 0;
549 *swp = 0;
550
551 in_use = shm_ids(ns).in_use;
552
553 for (total = 0, next_id = 0; total < in_use; next_id++) {
554 struct shmid_kernel *shp;
555 struct inode *inode;
556
557 shp = idr_find(&shm_ids(ns).ipcs_idr, next_id);
558 if (shp == NULL)
559 continue;
560
561 inode = shp->shm_file->f_path.dentry->d_inode;
562
563 if (is_file_hugepages(shp->shm_file)) {
564 struct address_space *mapping = inode->i_mapping;
565 struct hstate *h = hstate_file(shp->shm_file);
566 *rss += pages_per_huge_page(h) * mapping->nrpages;
567 } else {
568 struct shmem_inode_info *info = SHMEM_I(inode);
569 spin_lock(&info->lock);
570 *rss += inode->i_mapping->nrpages;
571 *swp += info->swapped;
572 spin_unlock(&info->lock);
573 }
574
575 total++;
576 }
577}
578
579
580
581
582
583
584static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
585 struct shmid_ds __user *buf, int version)
586{
587 struct kern_ipc_perm *ipcp;
588 struct shmid64_ds shmid64;
589 struct shmid_kernel *shp;
590 int err;
591
592 if (cmd == IPC_SET) {
593 if (copy_shmid_from_user(&shmid64, buf, version))
594 return -EFAULT;
595 }
596
597 ipcp = ipcctl_pre_down(&shm_ids(ns), shmid, cmd, &shmid64.shm_perm, 0);
598 if (IS_ERR(ipcp))
599 return PTR_ERR(ipcp);
600
601 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
602
603 err = security_shm_shmctl(shp, cmd);
604 if (err)
605 goto out_unlock;
606 switch (cmd) {
607 case IPC_RMID:
608 do_shm_rmid(ns, ipcp);
609 goto out_up;
610 case IPC_SET:
611 ipc_update_perm(&shmid64.shm_perm, ipcp);
612 shp->shm_ctim = get_seconds();
613 break;
614 default:
615 err = -EINVAL;
616 }
617out_unlock:
618 shm_unlock(shp);
619out_up:
620 up_write(&shm_ids(ns).rw_mutex);
621 return err;
622}
623
624asmlinkage long sys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf)
625{
626 struct shmid_kernel *shp;
627 int err, version;
628 struct ipc_namespace *ns;
629
630 if (cmd < 0 || shmid < 0) {
631 err = -EINVAL;
632 goto out;
633 }
634
635 version = ipc_parse_version(&cmd);
636 ns = current->nsproxy->ipc_ns;
637
638 switch (cmd) {
639 case IPC_INFO:
640 {
641 struct shminfo64 shminfo;
642
643 err = security_shm_shmctl(NULL, cmd);
644 if (err)
645 return err;
646
647 memset(&shminfo,0,sizeof(shminfo));
648 shminfo.shmmni = shminfo.shmseg = ns->shm_ctlmni;
649 shminfo.shmmax = ns->shm_ctlmax;
650 shminfo.shmall = ns->shm_ctlall;
651
652 shminfo.shmmin = SHMMIN;
653 if(copy_shminfo_to_user (buf, &shminfo, version))
654 return -EFAULT;
655
656 down_read(&shm_ids(ns).rw_mutex);
657 err = ipc_get_maxid(&shm_ids(ns));
658 up_read(&shm_ids(ns).rw_mutex);
659
660 if(err<0)
661 err = 0;
662 goto out;
663 }
664 case SHM_INFO:
665 {
666 struct shm_info shm_info;
667
668 err = security_shm_shmctl(NULL, cmd);
669 if (err)
670 return err;
671
672 memset(&shm_info,0,sizeof(shm_info));
673 down_read(&shm_ids(ns).rw_mutex);
674 shm_info.used_ids = shm_ids(ns).in_use;
675 shm_get_stat (ns, &shm_info.shm_rss, &shm_info.shm_swp);
676 shm_info.shm_tot = ns->shm_tot;
677 shm_info.swap_attempts = 0;
678 shm_info.swap_successes = 0;
679 err = ipc_get_maxid(&shm_ids(ns));
680 up_read(&shm_ids(ns).rw_mutex);
681 if(copy_to_user (buf, &shm_info, sizeof(shm_info))) {
682 err = -EFAULT;
683 goto out;
684 }
685
686 err = err < 0 ? 0 : err;
687 goto out;
688 }
689 case SHM_STAT:
690 case IPC_STAT:
691 {
692 struct shmid64_ds tbuf;
693 int result;
694
695 if (!buf) {
696 err = -EFAULT;
697 goto out;
698 }
699
700 if (cmd == SHM_STAT) {
701 shp = shm_lock(ns, shmid);
702 if (IS_ERR(shp)) {
703 err = PTR_ERR(shp);
704 goto out;
705 }
706 result = shp->shm_perm.id;
707 } else {
708 shp = shm_lock_check(ns, shmid);
709 if (IS_ERR(shp)) {
710 err = PTR_ERR(shp);
711 goto out;
712 }
713 result = 0;
714 }
715 err=-EACCES;
716 if (ipcperms (&shp->shm_perm, S_IRUGO))
717 goto out_unlock;
718 err = security_shm_shmctl(shp, cmd);
719 if (err)
720 goto out_unlock;
721 memset(&tbuf, 0, sizeof(tbuf));
722 kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm);
723 tbuf.shm_segsz = shp->shm_segsz;
724 tbuf.shm_atime = shp->shm_atim;
725 tbuf.shm_dtime = shp->shm_dtim;
726 tbuf.shm_ctime = shp->shm_ctim;
727 tbuf.shm_cpid = shp->shm_cprid;
728 tbuf.shm_lpid = shp->shm_lprid;
729 tbuf.shm_nattch = shp->shm_nattch;
730 shm_unlock(shp);
731 if(copy_shmid_to_user (buf, &tbuf, version))
732 err = -EFAULT;
733 else
734 err = result;
735 goto out;
736 }
737 case SHM_LOCK:
738 case SHM_UNLOCK:
739 {
740 struct file *uninitialized_var(shm_file);
741
742 lru_add_drain_all();
743
744 shp = shm_lock_check(ns, shmid);
745 if (IS_ERR(shp)) {
746 err = PTR_ERR(shp);
747 goto out;
748 }
749
750 err = audit_ipc_obj(&(shp->shm_perm));
751 if (err)
752 goto out_unlock;
753
754 if (!capable(CAP_IPC_LOCK)) {
755 err = -EPERM;
756 if (current->euid != shp->shm_perm.uid &&
757 current->euid != shp->shm_perm.cuid)
758 goto out_unlock;
759 if (cmd == SHM_LOCK &&
760 !current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur)
761 goto out_unlock;
762 }
763
764 err = security_shm_shmctl(shp, cmd);
765 if (err)
766 goto out_unlock;
767
768 if(cmd==SHM_LOCK) {
769 struct user_struct * user = current->user;
770 if (!is_file_hugepages(shp->shm_file)) {
771 err = shmem_lock(shp->shm_file, 1, user);
772 if (!err && !(shp->shm_perm.mode & SHM_LOCKED)){
773 shp->shm_perm.mode |= SHM_LOCKED;
774 shp->mlock_user = user;
775 }
776 }
777 } else if (!is_file_hugepages(shp->shm_file)) {
778 shmem_lock(shp->shm_file, 0, shp->mlock_user);
779 shp->shm_perm.mode &= ~SHM_LOCKED;
780 shp->mlock_user = NULL;
781 }
782 shm_unlock(shp);
783 goto out;
784 }
785 case IPC_RMID:
786 case IPC_SET:
787 err = shmctl_down(ns, shmid, cmd, buf, version);
788 return err;
789 default:
790 return -EINVAL;
791 }
792
793out_unlock:
794 shm_unlock(shp);
795out:
796 return err;
797}
798
799
800
801
802
803
804
805
806long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
807{
808 struct shmid_kernel *shp;
809 unsigned long addr;
810 unsigned long size;
811 struct file * file;
812 int err;
813 unsigned long flags;
814 unsigned long prot;
815 int acc_mode;
816 unsigned long user_addr;
817 struct ipc_namespace *ns;
818 struct shm_file_data *sfd;
819 struct path path;
820 fmode_t f_mode;
821
822 err = -EINVAL;
823 if (shmid < 0)
824 goto out;
825 else if ((addr = (ulong)shmaddr)) {
826 if (addr & (SHMLBA-1)) {
827 if (shmflg & SHM_RND)
828 addr &= ~(SHMLBA-1);
829 else
830#ifndef __ARCH_FORCE_SHMLBA
831 if (addr & ~PAGE_MASK)
832#endif
833 goto out;
834 }
835 flags = MAP_SHARED | MAP_FIXED;
836 } else {
837 if ((shmflg & SHM_REMAP))
838 goto out;
839
840 flags = MAP_SHARED;
841 }
842
843 if (shmflg & SHM_RDONLY) {
844 prot = PROT_READ;
845 acc_mode = S_IRUGO;
846 f_mode = FMODE_READ;
847 } else {
848 prot = PROT_READ | PROT_WRITE;
849 acc_mode = S_IRUGO | S_IWUGO;
850 f_mode = FMODE_READ | FMODE_WRITE;
851 }
852 if (shmflg & SHM_EXEC) {
853 prot |= PROT_EXEC;
854 acc_mode |= S_IXUGO;
855 }
856
857
858
859
860
861 ns = current->nsproxy->ipc_ns;
862 shp = shm_lock_check(ns, shmid);
863 if (IS_ERR(shp)) {
864 err = PTR_ERR(shp);
865 goto out;
866 }
867
868 err = -EACCES;
869 if (ipcperms(&shp->shm_perm, acc_mode))
870 goto out_unlock;
871
872 err = security_shm_shmat(shp, shmaddr, shmflg);
873 if (err)
874 goto out_unlock;
875
876 path.dentry = dget(shp->shm_file->f_path.dentry);
877 path.mnt = shp->shm_file->f_path.mnt;
878 shp->shm_nattch++;
879 size = i_size_read(path.dentry->d_inode);
880 shm_unlock(shp);
881
882 err = -ENOMEM;
883 sfd = kzalloc(sizeof(*sfd), GFP_KERNEL);
884 if (!sfd)
885 goto out_put_dentry;
886
887 file = alloc_file(path.mnt, path.dentry, f_mode, &shm_file_operations);
888 if (!file)
889 goto out_free;
890
891 file->private_data = sfd;
892 file->f_mapping = shp->shm_file->f_mapping;
893 sfd->id = shp->shm_perm.id;
894 sfd->ns = get_ipc_ns(ns);
895 sfd->file = shp->shm_file;
896 sfd->vm_ops = NULL;
897
898 down_write(¤t->mm->mmap_sem);
899 if (addr && !(shmflg & SHM_REMAP)) {
900 err = -EINVAL;
901 if (find_vma_intersection(current->mm, addr, addr + size))
902 goto invalid;
903
904
905
906
907 if (addr < current->mm->start_stack &&
908 addr > current->mm->start_stack - size - PAGE_SIZE * 5)
909 goto invalid;
910 }
911
912 user_addr = do_mmap (file, addr, size, prot, flags, 0);
913 *raddr = user_addr;
914 err = 0;
915 if (IS_ERR_VALUE(user_addr))
916 err = (long)user_addr;
917invalid:
918 up_write(¤t->mm->mmap_sem);
919
920 fput(file);
921
922out_nattch:
923 down_write(&shm_ids(ns).rw_mutex);
924 shp = shm_lock(ns, shmid);
925 BUG_ON(IS_ERR(shp));
926 shp->shm_nattch--;
927 if(shp->shm_nattch == 0 &&
928 shp->shm_perm.mode & SHM_DEST)
929 shm_destroy(ns, shp);
930 else
931 shm_unlock(shp);
932 up_write(&shm_ids(ns).rw_mutex);
933
934out:
935 return err;
936
937out_unlock:
938 shm_unlock(shp);
939 goto out;
940
941out_free:
942 kfree(sfd);
943out_put_dentry:
944 dput(path.dentry);
945 goto out_nattch;
946}
947
948asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg)
949{
950 unsigned long ret;
951 long err;
952
953 err = do_shmat(shmid, shmaddr, shmflg, &ret);
954 if (err)
955 return err;
956 force_successful_syscall_return();
957 return (long)ret;
958}
959
960
961
962
963
964asmlinkage long sys_shmdt(char __user *shmaddr)
965{
966 struct mm_struct *mm = current->mm;
967 struct vm_area_struct *vma, *next;
968 unsigned long addr = (unsigned long)shmaddr;
969 loff_t size = 0;
970 int retval = -EINVAL;
971
972 if (addr & ~PAGE_MASK)
973 return retval;
974
975 down_write(&mm->mmap_sem);
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997 vma = find_vma(mm, addr);
998
999 while (vma) {
1000 next = vma->vm_next;
1001
1002
1003
1004
1005
1006
1007 if ((vma->vm_ops == &shm_vm_ops) &&
1008 (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) {
1009
1010
1011 size = vma->vm_file->f_path.dentry->d_inode->i_size;
1012 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1013
1014
1015
1016
1017
1018
1019 retval = 0;
1020 vma = next;
1021 break;
1022 }
1023 vma = next;
1024 }
1025
1026
1027
1028
1029
1030
1031 size = PAGE_ALIGN(size);
1032 while (vma && (loff_t)(vma->vm_end - addr) <= size) {
1033 next = vma->vm_next;
1034
1035
1036 if ((vma->vm_ops == &shm_vm_ops) &&
1037 (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff)
1038
1039 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1040 vma = next;
1041 }
1042
1043 up_write(&mm->mmap_sem);
1044 return retval;
1045}
1046
1047#ifdef CONFIG_PROC_FS
1048static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
1049{
1050 struct shmid_kernel *shp = it;
1051
1052#if BITS_PER_LONG <= 32
1053#define SIZE_SPEC "%10lu"
1054#else
1055#define SIZE_SPEC "%21lu"
1056#endif
1057
1058 return seq_printf(s,
1059 "%10d %10d %4o " SIZE_SPEC " %5u %5u "
1060 "%5lu %5u %5u %5u %5u %10lu %10lu %10lu\n",
1061 shp->shm_perm.key,
1062 shp->shm_perm.id,
1063 shp->shm_perm.mode,
1064 shp->shm_segsz,
1065 shp->shm_cprid,
1066 shp->shm_lprid,
1067 shp->shm_nattch,
1068 shp->shm_perm.uid,
1069 shp->shm_perm.gid,
1070 shp->shm_perm.cuid,
1071 shp->shm_perm.cgid,
1072 shp->shm_atim,
1073 shp->shm_dtim,
1074 shp->shm_ctim);
1075}
1076#endif