]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - ipc/shm.c
UBUNTU: SAUCE: Documentation: import error c_funcptr_sig_re, c_sig_re (sphinx-doc...
[mirror_ubuntu-jammy-kernel.git] / ipc / shm.c
CommitLineData
b2441318 1// SPDX-License-Identifier: GPL-2.0
1da177e4
LT
2/*
3 * linux/ipc/shm.c
4 * Copyright (C) 1992, 1993 Krishna Balasubramanian
5 * Many improvements/fixes by Bruno Haible.
6 * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
7 * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
8 *
9 * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
10 * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
11 * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
12 * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
13 * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
14 * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
15 * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
16 *
073115d6
SG
17 * support for audit of ipc object properties and permission changes
18 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
4e982311
KK
19 *
20 * namespaces support
21 * OpenVZ, SWsoft Inc.
22 * Pavel Emelianov <xemul@openvz.org>
c2c737a0
DB
23 *
24 * Better ipc lock (kern_ipc_perm.lock) handling
25 * Davidlohr Bueso <davidlohr.bueso@hp.com>, June 2013.
1da177e4
LT
26 */
27
1da177e4
LT
28#include <linux/slab.h>
29#include <linux/mm.h>
30#include <linux/hugetlb.h>
31#include <linux/shm.h>
32#include <linux/init.h>
33#include <linux/file.h>
34#include <linux/mman.h>
1da177e4
LT
35#include <linux/shmem_fs.h>
36#include <linux/security.h>
37#include <linux/syscalls.h>
38#include <linux/audit.h>
c59ede7b 39#include <linux/capability.h>
7d87e14c 40#include <linux/ptrace.h>
19b4946c 41#include <linux/seq_file.h>
3e148c79 42#include <linux/rwsem.h>
4e982311 43#include <linux/nsproxy.h>
bc56bba8 44#include <linux/mount.h>
ae5e1b22 45#include <linux/ipc_namespace.h>
0eb71a9d 46#include <linux/rhashtable.h>
7d87e14c 47
7153e402 48#include <linux/uaccess.h>
1da177e4
LT
49
50#include "util.h"
51
a2e102cd
EB
52struct shmid_kernel /* private to the kernel */
53{
54 struct kern_ipc_perm shm_perm;
55 struct file *shm_file;
56 unsigned long shm_nattch;
57 unsigned long shm_segsz;
58 time64_t shm_atim;
59 time64_t shm_dtim;
60 time64_t shm_ctim;
98f929b1
EB
61 struct pid *shm_cprid;
62 struct pid *shm_lprid;
d7c9e99a 63 struct ucounts *mlock_ucounts;
a2e102cd
EB
64
65 /* The task created the shm object. NULL if the task is dead. */
66 struct task_struct *shm_creator;
67 struct list_head shm_clist; /* list by creator */
68} __randomize_layout;
69
70/* shm_mode upper byte flags */
71#define SHM_DEST 01000 /* segment will be destroyed on last detach */
72#define SHM_LOCKED 02000 /* segment will not be swapped */
73
bc56bba8
EB
74struct shm_file_data {
75 int id;
76 struct ipc_namespace *ns;
77 struct file *file;
78 const struct vm_operations_struct *vm_ops;
79};
80
81#define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data))
82
9a32144e 83static const struct file_operations shm_file_operations;
f0f37e2f 84static const struct vm_operations_struct shm_vm_ops;
1da177e4 85
ed2ddbf8 86#define shm_ids(ns) ((ns)->ids[IPC_SHM_IDS])
1da177e4 87
4e982311
KK
88#define shm_unlock(shp) \
89 ipc_unlock(&(shp)->shm_perm)
1da177e4 90
7748dbfa 91static int newseg(struct ipc_namespace *, struct ipc_params *);
bc56bba8
EB
92static void shm_open(struct vm_area_struct *vma);
93static void shm_close(struct vm_area_struct *vma);
239521f3 94static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp);
1da177e4 95#ifdef CONFIG_PROC_FS
19b4946c 96static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
1da177e4
LT
97#endif
98
eae04d25 99void shm_init_ns(struct ipc_namespace *ns)
4e982311 100{
4e982311
KK
101 ns->shm_ctlmax = SHMMAX;
102 ns->shm_ctlall = SHMALL;
103 ns->shm_ctlmni = SHMMNI;
b34a6b1d 104 ns->shm_rmid_forced = 0;
4e982311 105 ns->shm_tot = 0;
eae04d25 106 ipc_init_ids(&shm_ids(ns));
4e982311
KK
107}
108
f4566f04 109/*
d9a605e4
DB
110 * Called with shm_ids.rwsem (writer) and the shp structure locked.
111 * Only shm_ids.rwsem remains locked on exit.
f4566f04 112 */
01b8b07a 113static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
4e982311 114{
01b8b07a 115 struct shmid_kernel *shp;
63980c80 116
01b8b07a
PP
117 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
118
239521f3 119 if (shp->shm_nattch) {
4e982311
KK
120 shp->shm_perm.mode |= SHM_DEST;
121 /* Do not find it any more */
0cfb6aee 122 ipc_set_key_private(&shm_ids(ns), &shp->shm_perm);
4e982311
KK
123 shm_unlock(shp);
124 } else
125 shm_destroy(ns, shp);
126}
127
ae5e1b22 128#ifdef CONFIG_IPC_NS
4e982311
KK
129void shm_exit_ns(struct ipc_namespace *ns)
130{
01b8b07a 131 free_ipcs(ns, &shm_ids(ns), do_shm_rmid);
7d6feeb2 132 idr_destroy(&ns->ids[IPC_SHM_IDS].ipcs_idr);
0cfb6aee 133 rhashtable_destroy(&ns->ids[IPC_SHM_IDS].key_ht);
4e982311 134}
ae5e1b22 135#endif
1da177e4 136
140d0b21 137static int __init ipc_ns_init(void)
1da177e4 138{
eae04d25
DB
139 shm_init_ns(&init_ipc_ns);
140 return 0;
140d0b21
LT
141}
142
143pure_initcall(ipc_ns_init);
144
239521f3 145void __init shm_init(void)
140d0b21 146{
19b4946c 147 ipc_init_proc_interface("sysvipc/shm",
b7952180
HD
148#if BITS_PER_LONG <= 32
149 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n",
150#else
151 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n",
152#endif
4e982311 153 IPC_SHM_IDS, sysvipc_shm_proc_show);
1da177e4
LT
154}
155
8b8d52ac
DB
156static inline struct shmid_kernel *shm_obtain_object(struct ipc_namespace *ns, int id)
157{
55b7ae50 158 struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&shm_ids(ns), id);
8b8d52ac
DB
159
160 if (IS_ERR(ipcp))
161 return ERR_CAST(ipcp);
162
163 return container_of(ipcp, struct shmid_kernel, shm_perm);
164}
165
166static inline struct shmid_kernel *shm_obtain_object_check(struct ipc_namespace *ns, int id)
167{
168 struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&shm_ids(ns), id);
169
170 if (IS_ERR(ipcp))
171 return ERR_CAST(ipcp);
172
173 return container_of(ipcp, struct shmid_kernel, shm_perm);
174}
175
3e148c79 176/*
d9a605e4 177 * shm_lock_(check_) routines are called in the paths where the rwsem
00c2bf85 178 * is not necessarily held.
3e148c79 179 */
023a5355 180static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
1da177e4 181{
82061c57 182 struct kern_ipc_perm *ipcp;
03f02c76 183
82061c57
DB
184 rcu_read_lock();
185 ipcp = ipc_obtain_object_idr(&shm_ids(ns), id);
186 if (IS_ERR(ipcp))
187 goto err;
188
189 ipc_lock_object(ipcp);
190 /*
191 * ipc_rmid() may have already freed the ID while ipc_lock_object()
192 * was spinning: here verify that the structure is still valid.
193 * Upon races with RMID, return -EIDRM, thus indicating that
194 * the ID points to a removed identifier.
195 */
196 if (ipc_valid_object(ipcp)) {
197 /* return a locked ipc object upon success */
198 return container_of(ipcp, struct shmid_kernel, shm_perm);
199 }
200
201 ipc_unlock_object(ipcp);
9c21dae2 202 ipcp = ERR_PTR(-EIDRM);
82061c57
DB
203err:
204 rcu_read_unlock();
c5c8975b 205 /*
1ac0b6de 206 * Callers of shm_lock() must validate the status of the returned ipc
82061c57 207 * object pointer and error out as appropriate.
c5c8975b 208 */
59cf0a93 209 return ERR_CAST(ipcp);
023a5355
ND
210}
211
4c677e2e
VK
212static inline void shm_lock_by_ptr(struct shmid_kernel *ipcp)
213{
214 rcu_read_lock();
cf9d5d78 215 ipc_lock_object(&ipcp->shm_perm);
4c677e2e
VK
216}
217
53dad6d3
DB
218static void shm_rcu_free(struct rcu_head *head)
219{
dba4cdd3
MS
220 struct kern_ipc_perm *ptr = container_of(head, struct kern_ipc_perm,
221 rcu);
222 struct shmid_kernel *shp = container_of(ptr, struct shmid_kernel,
223 shm_perm);
7191adff 224 security_shm_free(&shp->shm_perm);
bc8136a5 225 kfree(shp);
53dad6d3
DB
226}
227
7ca7e564 228static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s)
1da177e4 229{
ab602f79 230 list_del(&s->shm_clist);
7ca7e564 231 ipc_rmid(&shm_ids(ns), &s->shm_perm);
1da177e4
LT
232}
233
1da177e4 234
1ac0b6de 235static int __shm_open(struct vm_area_struct *vma)
4e982311 236{
bc56bba8
EB
237 struct file *file = vma->vm_file;
238 struct shm_file_data *sfd = shm_file_data(file);
1da177e4
LT
239 struct shmid_kernel *shp;
240
bc56bba8 241 shp = shm_lock(sfd->ns, sfd->id);
1ac0b6de
KS
242
243 if (IS_ERR(shp))
244 return PTR_ERR(shp);
245
3f05317d
EB
246 if (shp->shm_file != sfd->file) {
247 /* ID was reused */
248 shm_unlock(shp);
249 return -EINVAL;
250 }
251
7ff2819e 252 shp->shm_atim = ktime_get_real_seconds();
98f929b1 253 ipc_update_pid(&shp->shm_lprid, task_tgid(current));
1da177e4
LT
254 shp->shm_nattch++;
255 shm_unlock(shp);
1ac0b6de
KS
256 return 0;
257}
258
259/* This is called by fork, once for every shm attach. */
260static void shm_open(struct vm_area_struct *vma)
261{
262 int err = __shm_open(vma);
263 /*
264 * We raced in the idr lookup or with shm_destroy().
265 * Either way, the ID is busted.
266 */
267 WARN_ON_ONCE(err);
1da177e4
LT
268}
269
1da177e4
LT
270/*
271 * shm_destroy - free the struct shmid_kernel
272 *
f4566f04 273 * @ns: namespace
1da177e4
LT
274 * @shp: struct to free
275 *
d9a605e4 276 * It has to be called with shp and shm_ids.rwsem (writer) locked,
1da177e4
LT
277 * but returns with shp unlocked and freed.
278 */
4e982311 279static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
1da177e4 280{
a399b29d
GT
281 struct file *shm_file;
282
283 shm_file = shp->shm_file;
284 shp->shm_file = NULL;
4e982311 285 ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
7ca7e564 286 shm_rmid(ns, shp);
1da177e4 287 shm_unlock(shp);
a399b29d 288 if (!is_file_hugepages(shm_file))
d7c9e99a
AG
289 shmem_lock(shm_file, 0, shp->mlock_ucounts);
290 else if (shp->mlock_ucounts)
07a46ed2 291 user_shm_unlock(i_size_read(file_inode(shm_file)),
d7c9e99a 292 shp->mlock_ucounts);
a399b29d 293 fput(shm_file);
98f929b1
EB
294 ipc_update_pid(&shp->shm_cprid, NULL);
295 ipc_update_pid(&shp->shm_lprid, NULL);
dba4cdd3 296 ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
1da177e4
LT
297}
298
b34a6b1d
VK
299/*
300 * shm_may_destroy - identifies whether shm segment should be destroyed now
301 *
302 * Returns true if and only if there are no active users of the segment and
303 * one of the following is true:
304 *
305 * 1) shmctl(id, IPC_RMID, NULL) was called for this shp
306 *
307 * 2) sysctl kernel.shm_rmid_forced is set to 1.
308 */
309static bool shm_may_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
310{
311 return (shp->shm_nattch == 0) &&
312 (ns->shm_rmid_forced ||
313 (shp->shm_perm.mode & SHM_DEST));
314}
315
1da177e4 316/*
bc56bba8 317 * remove the attach descriptor vma.
1da177e4
LT
318 * free memory for segment if it is marked destroyed.
319 * The descriptor has already been removed from the current->mm->mmap list
320 * and will later be kfree()d.
321 */
bc56bba8 322static void shm_close(struct vm_area_struct *vma)
1da177e4 323{
239521f3 324 struct file *file = vma->vm_file;
bc56bba8 325 struct shm_file_data *sfd = shm_file_data(file);
1da177e4 326 struct shmid_kernel *shp;
bc56bba8 327 struct ipc_namespace *ns = sfd->ns;
4e982311 328
d9a605e4 329 down_write(&shm_ids(ns).rwsem);
1da177e4 330 /* remove from the list of attaches of the shm segment */
00c2bf85 331 shp = shm_lock(ns, sfd->id);
1ac0b6de
KS
332
333 /*
334 * We raced in the idr lookup or with shm_destroy().
335 * Either way, the ID is busted.
336 */
337 if (WARN_ON_ONCE(IS_ERR(shp)))
338 goto done; /* no-op */
339
98f929b1 340 ipc_update_pid(&shp->shm_lprid, task_tgid(current));
7ff2819e 341 shp->shm_dtim = ktime_get_real_seconds();
1da177e4 342 shp->shm_nattch--;
b34a6b1d
VK
343 if (shm_may_destroy(ns, shp))
344 shm_destroy(ns, shp);
345 else
346 shm_unlock(shp);
1ac0b6de 347done:
d9a605e4 348 up_write(&shm_ids(ns).rwsem);
b34a6b1d
VK
349}
350
d9a605e4 351/* Called with ns->shm_ids(ns).rwsem locked */
b34a6b1d
VK
352static int shm_try_destroy_orphaned(int id, void *p, void *data)
353{
354 struct ipc_namespace *ns = data;
4c677e2e
VK
355 struct kern_ipc_perm *ipcp = p;
356 struct shmid_kernel *shp = container_of(ipcp, struct shmid_kernel, shm_perm);
b34a6b1d
VK
357
358 /*
359 * We want to destroy segments without users and with already
360 * exit'ed originating process.
4c677e2e 361 *
d9a605e4 362 * As shp->* are changed under rwsem, it's safe to skip shp locking.
b34a6b1d 363 */
4c677e2e 364 if (shp->shm_creator != NULL)
b34a6b1d 365 return 0;
b34a6b1d 366
4c677e2e
VK
367 if (shm_may_destroy(ns, shp)) {
368 shm_lock_by_ptr(shp);
4e982311 369 shm_destroy(ns, shp);
4c677e2e 370 }
b34a6b1d
VK
371 return 0;
372}
373
374void shm_destroy_orphaned(struct ipc_namespace *ns)
375{
d9a605e4 376 down_write(&shm_ids(ns).rwsem);
33a30ed4 377 if (shm_ids(ns).in_use)
4c677e2e 378 idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns);
d9a605e4 379 up_write(&shm_ids(ns).rwsem);
b34a6b1d
VK
380}
381
83293c0f 382/* Locking assumes this will only be called with task == current */
b34a6b1d
VK
383void exit_shm(struct task_struct *task)
384{
4c677e2e 385 struct ipc_namespace *ns = task->nsproxy->ipc_ns;
ab602f79 386 struct shmid_kernel *shp, *n;
b34a6b1d 387
83293c0f
JM
388 if (list_empty(&task->sysvshm.shm_clist))
389 return;
390
391 /*
392 * If kernel.shm_rmid_forced is not set then only keep track of
393 * which shmids are orphaned, so that a later set of the sysctl
394 * can clean them up.
395 */
396 if (!ns->shm_rmid_forced) {
397 down_read(&shm_ids(ns).rwsem);
398 list_for_each_entry(shp, &task->sysvshm.shm_clist, shm_clist)
399 shp->shm_creator = NULL;
400 /*
401 * Only under read lock but we are only called on current
402 * so no entry on the list will be shared.
403 */
404 list_del(&task->sysvshm.shm_clist);
405 up_read(&shm_ids(ns).rwsem);
298507d4 406 return;
83293c0f 407 }
298507d4 408
83293c0f
JM
409 /*
410 * Destroy all already created segments, that were not yet mapped,
411 * and mark any mapped as orphan to cover the sysctl toggling.
412 * Destroy is skipped if shm_may_destroy() returns false.
413 */
d9a605e4 414 down_write(&shm_ids(ns).rwsem);
83293c0f
JM
415 list_for_each_entry_safe(shp, n, &task->sysvshm.shm_clist, shm_clist) {
416 shp->shm_creator = NULL;
417
418 if (shm_may_destroy(ns, shp)) {
419 shm_lock_by_ptr(shp);
420 shm_destroy(ns, shp);
421 }
422 }
423
424 /* Remove the list head from any segments still attached. */
ab602f79 425 list_del(&task->sysvshm.shm_clist);
d9a605e4 426 up_write(&shm_ids(ns).rwsem);
1da177e4
LT
427}
428
14f28f57 429static vm_fault_t shm_fault(struct vm_fault *vmf)
bc56bba8 430{
11bac800 431 struct file *file = vmf->vma->vm_file;
bc56bba8
EB
432 struct shm_file_data *sfd = shm_file_data(file);
433
11bac800 434 return sfd->vm_ops->fault(vmf);
bc56bba8
EB
435}
436
dd3b614f 437static int shm_may_split(struct vm_area_struct *vma, unsigned long addr)
3d942ee0
MK
438{
439 struct file *file = vma->vm_file;
440 struct shm_file_data *sfd = shm_file_data(file);
441
dd3b614f
DS
442 if (sfd->vm_ops->may_split)
443 return sfd->vm_ops->may_split(vma, addr);
3d942ee0
MK
444
445 return 0;
446}
447
eec3636a
JC
448static unsigned long shm_pagesize(struct vm_area_struct *vma)
449{
450 struct file *file = vma->vm_file;
451 struct shm_file_data *sfd = shm_file_data(file);
452
453 if (sfd->vm_ops->pagesize)
454 return sfd->vm_ops->pagesize(vma);
455
456 return PAGE_SIZE;
457}
458
bc56bba8 459#ifdef CONFIG_NUMA
d823e3e7 460static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
bc56bba8
EB
461{
462 struct file *file = vma->vm_file;
463 struct shm_file_data *sfd = shm_file_data(file);
464 int err = 0;
63980c80 465
bc56bba8
EB
466 if (sfd->vm_ops->set_policy)
467 err = sfd->vm_ops->set_policy(vma, new);
468 return err;
469}
470
d823e3e7
AB
471static struct mempolicy *shm_get_policy(struct vm_area_struct *vma,
472 unsigned long addr)
bc56bba8
EB
473{
474 struct file *file = vma->vm_file;
475 struct shm_file_data *sfd = shm_file_data(file);
476 struct mempolicy *pol = NULL;
477
478 if (sfd->vm_ops->get_policy)
479 pol = sfd->vm_ops->get_policy(vma, addr);
52cd3b07 480 else if (vma->vm_policy)
bc56bba8 481 pol = vma->vm_policy;
52cd3b07 482
bc56bba8
EB
483 return pol;
484}
485#endif
486
239521f3 487static int shm_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 488{
bc56bba8 489 struct shm_file_data *sfd = shm_file_data(file);
b0e15190
DH
490 int ret;
491
1ac0b6de 492 /*
3f05317d
EB
493 * In case of remap_file_pages() emulation, the file can represent an
494 * IPC ID that was removed, and possibly even reused by another shm
495 * segment already. Propagate this case as an error to caller.
1ac0b6de 496 */
63980c80 497 ret = __shm_open(vma);
1ac0b6de
KS
498 if (ret)
499 return ret;
500
f74ac015 501 ret = call_mmap(sfd->file, vma);
1ac0b6de
KS
502 if (ret) {
503 shm_close(vma);
bc56bba8 504 return ret;
1ac0b6de 505 }
bc56bba8 506 sfd->vm_ops = vma->vm_ops;
2e92a3ba 507#ifdef CONFIG_MMU
d0edd852 508 WARN_ON(!sfd->vm_ops->fault);
2e92a3ba 509#endif
bc56bba8 510 vma->vm_ops = &shm_vm_ops;
1ac0b6de 511 return 0;
1da177e4
LT
512}
513
4e982311
KK
514static int shm_release(struct inode *ino, struct file *file)
515{
bc56bba8 516 struct shm_file_data *sfd = shm_file_data(file);
4e982311 517
bc56bba8 518 put_ipc_ns(sfd->ns);
3f05317d 519 fput(sfd->file);
bc56bba8
EB
520 shm_file_data(file) = NULL;
521 kfree(sfd);
4e982311
KK
522 return 0;
523}
524
02c24a82 525static int shm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
516dffdc 526{
516dffdc 527 struct shm_file_data *sfd = shm_file_data(file);
516dffdc 528
7ea80859
CH
529 if (!sfd->file->f_op->fsync)
530 return -EINVAL;
0f41074a 531 return sfd->file->f_op->fsync(sfd->file, start, end, datasync);
516dffdc
AL
532}
533
7d8a4569
WD
534static long shm_fallocate(struct file *file, int mode, loff_t offset,
535 loff_t len)
536{
537 struct shm_file_data *sfd = shm_file_data(file);
538
539 if (!sfd->file->f_op->fallocate)
540 return -EOPNOTSUPP;
541 return sfd->file->f_op->fallocate(file, mode, offset, len);
542}
543
bc56bba8
EB
544static unsigned long shm_get_unmapped_area(struct file *file,
545 unsigned long addr, unsigned long len, unsigned long pgoff,
546 unsigned long flags)
547{
548 struct shm_file_data *sfd = shm_file_data(file);
63980c80 549
c4caa778
AV
550 return sfd->file->f_op->get_unmapped_area(sfd->file, addr, len,
551 pgoff, flags);
bc56bba8 552}
bc56bba8 553
9a32144e 554static const struct file_operations shm_file_operations = {
4e982311 555 .mmap = shm_mmap,
516dffdc 556 .fsync = shm_fsync,
4e982311 557 .release = shm_release,
ed5e5894 558 .get_unmapped_area = shm_get_unmapped_area,
6038f373 559 .llseek = noop_llseek,
7d8a4569 560 .fallocate = shm_fallocate,
c4caa778
AV
561};
562
c01d5b30
HD
563/*
564 * shm_file_operations_huge is now identical to shm_file_operations,
565 * but we keep it distinct for the sake of is_file_shm_hugepages().
566 */
c4caa778
AV
567static const struct file_operations shm_file_operations_huge = {
568 .mmap = shm_mmap,
569 .fsync = shm_fsync,
570 .release = shm_release,
bc56bba8 571 .get_unmapped_area = shm_get_unmapped_area,
6038f373 572 .llseek = noop_llseek,
7d8a4569 573 .fallocate = shm_fallocate,
1da177e4
LT
574};
575
2954e440 576bool is_file_shm_hugepages(struct file *file)
c4caa778
AV
577{
578 return file->f_op == &shm_file_operations_huge;
579}
580
f0f37e2f 581static const struct vm_operations_struct shm_vm_ops = {
1da177e4
LT
582 .open = shm_open, /* callback for a new vm-area open */
583 .close = shm_close, /* callback for when the vm-area is released */
54cb8821 584 .fault = shm_fault,
dd3b614f 585 .may_split = shm_may_split,
eec3636a 586 .pagesize = shm_pagesize,
bc56bba8
EB
587#if defined(CONFIG_NUMA)
588 .set_policy = shm_set_policy,
589 .get_policy = shm_get_policy,
1da177e4
LT
590#endif
591};
592
f4566f04
ND
593/**
594 * newseg - Create a new shared memory segment
595 * @ns: namespace
596 * @params: ptr to the structure that contains key, size and shmflg
597 *
d9a605e4 598 * Called with shm_ids.rwsem held as a writer.
f4566f04 599 */
7748dbfa 600static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
1da177e4 601{
7748dbfa
ND
602 key_t key = params->key;
603 int shmflg = params->flg;
604 size_t size = params->u.size;
1da177e4
LT
605 int error;
606 struct shmid_kernel *shp;
d69f3bad 607 size_t numpages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
239521f3 608 struct file *file;
1da177e4 609 char name[13];
ca16d140 610 vm_flags_t acctflag = 0;
1da177e4 611
4e982311 612 if (size < SHMMIN || size > ns->shm_ctlmax)
1da177e4
LT
613 return -EINVAL;
614
1376327c
MS
615 if (numpages << PAGE_SHIFT < size)
616 return -ENOSPC;
617
09c6eb1f
MS
618 if (ns->shm_tot + numpages < ns->shm_tot ||
619 ns->shm_tot + numpages > ns->shm_ctlall)
1da177e4
LT
620 return -ENOSPC;
621
18319498 622 shp = kmalloc(sizeof(*shp), GFP_KERNEL_ACCOUNT);
42e618f7 623 if (unlikely(!shp))
1da177e4
LT
624 return -ENOMEM;
625
626 shp->shm_perm.key = key;
b33291c0 627 shp->shm_perm.mode = (shmflg & S_IRWXUGO);
d7c9e99a 628 shp->mlock_ucounts = NULL;
1da177e4
LT
629
630 shp->shm_perm.security = NULL;
7191adff 631 error = security_shm_alloc(&shp->shm_perm);
1da177e4 632 if (error) {
bc8136a5 633 kfree(shp);
1da177e4
LT
634 return error;
635 }
636
239521f3 637 sprintf(name, "SYSV%08x", key);
1da177e4 638 if (shmflg & SHM_HUGETLB) {
c103a4dc 639 struct hstate *hs;
091d0d55
LZ
640 size_t hugesize;
641
c103a4dc 642 hs = hstate_sizelog((shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK);
091d0d55
LZ
643 if (!hs) {
644 error = -EINVAL;
645 goto no_file;
646 }
647 hugesize = ALIGN(size, huge_page_size(hs));
af73e4d9 648
5a6fe125
MG
649 /* hugetlb_file_setup applies strict accounting */
650 if (shmflg & SHM_NORESERVE)
651 acctflag = VM_NORESERVE;
af73e4d9 652 file = hugetlb_file_setup(name, hugesize, acctflag,
d7c9e99a 653 &shp->mlock_ucounts, HUGETLB_SHMFS_INODE,
42d7395f 654 (shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK);
1da177e4 655 } else {
bf8f972d
BP
656 /*
657 * Do not allow no accounting for OVERCOMMIT_NEVER, even
239521f3 658 * if it's asked for.
bf8f972d
BP
659 */
660 if ((shmflg & SHM_NORESERVE) &&
661 sysctl_overcommit_memory != OVERCOMMIT_NEVER)
fc8744ad 662 acctflag = VM_NORESERVE;
e1832f29 663 file = shmem_kernel_file_setup(name, size, acctflag);
1da177e4
LT
664 }
665 error = PTR_ERR(file);
666 if (IS_ERR(file))
667 goto no_file;
668
98f929b1
EB
669 shp->shm_cprid = get_pid(task_tgid(current));
670 shp->shm_lprid = NULL;
1da177e4 671 shp->shm_atim = shp->shm_dtim = 0;
7ff2819e 672 shp->shm_ctim = ktime_get_real_seconds();
1da177e4
LT
673 shp->shm_segsz = size;
674 shp->shm_nattch = 0;
1da177e4 675 shp->shm_file = file;
5774ed01 676 shp->shm_creator = current;
b9a53227 677
39c96a1b 678 /* ipc_addid() locks shp upon success. */
a2642f87
MS
679 error = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
680 if (error < 0)
b9a53227 681 goto no_id;
b9a53227 682
ab602f79 683 list_add(&shp->shm_clist, &current->sysvshm.shm_clist);
dbfcd91f 684
30475cc1
BP
685 /*
686 * shmid gets reported as "inode#" in /proc/pid/maps.
687 * proc-ps tools use this. Changing this will break them.
688 */
496ad9aa 689 file_inode(file)->i_ino = shp->shm_perm.id;
551110a9 690
4e982311 691 ns->shm_tot += numpages;
7ca7e564 692 error = shp->shm_perm.id;
dbfcd91f 693
cf9d5d78 694 ipc_unlock_object(&shp->shm_perm);
dbfcd91f 695 rcu_read_unlock();
7ca7e564 696 return error;
1da177e4
LT
697
698no_id:
2236d4d3
EB
699 ipc_update_pid(&shp->shm_cprid, NULL);
700 ipc_update_pid(&shp->shm_lprid, NULL);
d7c9e99a
AG
701 if (is_file_hugepages(file) && shp->mlock_ucounts)
702 user_shm_unlock(size, shp->mlock_ucounts);
1da177e4 703 fput(file);
39cfffd7
MS
704 ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
705 return error;
1da177e4 706no_file:
a2642f87 707 call_rcu(&shp->shm_perm.rcu, shm_rcu_free);
1da177e4
LT
708 return error;
709}
710
f4566f04 711/*
d9a605e4 712 * Called with shm_ids.rwsem and ipcp locked.
f4566f04 713 */
00898e85 714static int shm_more_checks(struct kern_ipc_perm *ipcp, struct ipc_params *params)
7748dbfa 715{
03f02c76
ND
716 struct shmid_kernel *shp;
717
718 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
719 if (shp->shm_segsz < params->u.size)
7748dbfa
ND
720 return -EINVAL;
721
722 return 0;
723}
724
65749e0b 725long ksys_shmget(key_t key, size_t size, int shmflg)
1da177e4 726{
4e982311 727 struct ipc_namespace *ns;
eb66ec44
MK
728 static const struct ipc_ops shm_ops = {
729 .getnew = newseg,
50ab44b1 730 .associate = security_shm_associate,
eb66ec44
MK
731 .more_checks = shm_more_checks,
732 };
7748dbfa 733 struct ipc_params shm_params;
4e982311
KK
734
735 ns = current->nsproxy->ipc_ns;
1da177e4 736
7748dbfa
ND
737 shm_params.key = key;
738 shm_params.flg = shmflg;
739 shm_params.u.size = size;
1da177e4 740
7748dbfa 741 return ipcget(ns, &shm_ids(ns), &shm_ops, &shm_params);
1da177e4
LT
742}
743
65749e0b
DB
744SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
745{
746 return ksys_shmget(key, size, shmflg);
747}
748
1da177e4
LT
749static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
750{
239521f3 751 switch (version) {
1da177e4
LT
752 case IPC_64:
753 return copy_to_user(buf, in, sizeof(*in));
754 case IPC_OLD:
755 {
756 struct shmid_ds out;
757
3af54c9b 758 memset(&out, 0, sizeof(out));
1da177e4
LT
759 ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
760 out.shm_segsz = in->shm_segsz;
761 out.shm_atime = in->shm_atime;
762 out.shm_dtime = in->shm_dtime;
763 out.shm_ctime = in->shm_ctime;
764 out.shm_cpid = in->shm_cpid;
765 out.shm_lpid = in->shm_lpid;
766 out.shm_nattch = in->shm_nattch;
767
768 return copy_to_user(buf, &out, sizeof(out));
769 }
770 default:
771 return -EINVAL;
772 }
773}
774
016d7132
PP
775static inline unsigned long
776copy_shmid_from_user(struct shmid64_ds *out, void __user *buf, int version)
1da177e4 777{
239521f3 778 switch (version) {
1da177e4 779 case IPC_64:
016d7132 780 if (copy_from_user(out, buf, sizeof(*out)))
1da177e4 781 return -EFAULT;
1da177e4 782 return 0;
1da177e4
LT
783 case IPC_OLD:
784 {
785 struct shmid_ds tbuf_old;
786
787 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
788 return -EFAULT;
789
016d7132
PP
790 out->shm_perm.uid = tbuf_old.shm_perm.uid;
791 out->shm_perm.gid = tbuf_old.shm_perm.gid;
792 out->shm_perm.mode = tbuf_old.shm_perm.mode;
1da177e4
LT
793
794 return 0;
795 }
796 default:
797 return -EINVAL;
798 }
799}
800
801static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
802{
239521f3 803 switch (version) {
1da177e4
LT
804 case IPC_64:
805 return copy_to_user(buf, in, sizeof(*in));
806 case IPC_OLD:
807 {
808 struct shminfo out;
809
239521f3 810 if (in->shmmax > INT_MAX)
1da177e4
LT
811 out.shmmax = INT_MAX;
812 else
813 out.shmmax = (int)in->shmmax;
814
815 out.shmmin = in->shmmin;
816 out.shmmni = in->shmmni;
817 out.shmseg = in->shmseg;
46c0a8ca 818 out.shmall = in->shmall;
1da177e4
LT
819
820 return copy_to_user(buf, &out, sizeof(out));
821 }
822 default:
823 return -EINVAL;
824 }
825}
826
b7952180
HD
827/*
828 * Calculate and add used RSS and swap pages of a shm.
d9a605e4 829 * Called with shm_ids.rwsem held as a reader
b7952180
HD
830 */
831static void shm_add_rss_swap(struct shmid_kernel *shp,
832 unsigned long *rss_add, unsigned long *swp_add)
833{
834 struct inode *inode;
835
496ad9aa 836 inode = file_inode(shp->shm_file);
b7952180
HD
837
838 if (is_file_hugepages(shp->shm_file)) {
839 struct address_space *mapping = inode->i_mapping;
840 struct hstate *h = hstate_file(shp->shm_file);
841 *rss_add += pages_per_huge_page(h) * mapping->nrpages;
842 } else {
843#ifdef CONFIG_SHMEM
844 struct shmem_inode_info *info = SHMEM_I(inode);
63980c80 845
4595ef88 846 spin_lock_irq(&info->lock);
b7952180
HD
847 *rss_add += inode->i_mapping->nrpages;
848 *swp_add += info->swapped;
4595ef88 849 spin_unlock_irq(&info->lock);
b7952180
HD
850#else
851 *rss_add += inode->i_mapping->nrpages;
852#endif
853 }
854}
855
f4566f04 856/*
d9a605e4 857 * Called with shm_ids.rwsem held as a reader
f4566f04 858 */
4e982311
KK
859static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
860 unsigned long *swp)
1da177e4 861{
7ca7e564
ND
862 int next_id;
863 int total, in_use;
1da177e4
LT
864
865 *rss = 0;
866 *swp = 0;
867
7ca7e564
ND
868 in_use = shm_ids(ns).in_use;
869
870 for (total = 0, next_id = 0; total < in_use; next_id++) {
e562aebc 871 struct kern_ipc_perm *ipc;
1da177e4 872 struct shmid_kernel *shp;
1da177e4 873
e562aebc
TB
874 ipc = idr_find(&shm_ids(ns).ipcs_idr, next_id);
875 if (ipc == NULL)
1da177e4 876 continue;
e562aebc 877 shp = container_of(ipc, struct shmid_kernel, shm_perm);
1da177e4 878
b7952180 879 shm_add_rss_swap(shp, rss, swp);
7ca7e564
ND
880
881 total++;
1da177e4
LT
882 }
883}
884
8d4cc8b5 885/*
d9a605e4 886 * This function handles some shmctl commands which require the rwsem
8d4cc8b5 887 * to be held in write mode.
d9a605e4 888 * NOTE: no locks must be held, the rwsem is taken inside this function.
8d4cc8b5
PP
889 */
890static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
9ba720c1 891 struct shmid64_ds *shmid64)
1da177e4 892{
8d4cc8b5 893 struct kern_ipc_perm *ipcp;
8d4cc8b5
PP
894 struct shmid_kernel *shp;
895 int err;
896
d9a605e4 897 down_write(&shm_ids(ns).rwsem);
7b4cc5d8
DB
898 rcu_read_lock();
899
4241c1a3 900 ipcp = ipcctl_obtain_check(ns, &shm_ids(ns), shmid, cmd,
9ba720c1 901 &shmid64->shm_perm, 0);
7b4cc5d8
DB
902 if (IS_ERR(ipcp)) {
903 err = PTR_ERR(ipcp);
7b4cc5d8
DB
904 goto out_unlock1;
905 }
8d4cc8b5 906
a5f75e7f 907 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
8d4cc8b5 908
7191adff 909 err = security_shm_shmctl(&shp->shm_perm, cmd);
8d4cc8b5 910 if (err)
79ccf0f8 911 goto out_unlock1;
7b4cc5d8 912
8d4cc8b5
PP
913 switch (cmd) {
914 case IPC_RMID:
79ccf0f8 915 ipc_lock_object(&shp->shm_perm);
7b4cc5d8 916 /* do_shm_rmid unlocks the ipc object and rcu */
8d4cc8b5
PP
917 do_shm_rmid(ns, ipcp);
918 goto out_up;
919 case IPC_SET:
79ccf0f8 920 ipc_lock_object(&shp->shm_perm);
9ba720c1 921 err = ipc_update_perm(&shmid64->shm_perm, ipcp);
1efdb69b 922 if (err)
7b4cc5d8 923 goto out_unlock0;
7ff2819e 924 shp->shm_ctim = ktime_get_real_seconds();
8d4cc8b5
PP
925 break;
926 default:
927 err = -EINVAL;
79ccf0f8 928 goto out_unlock1;
8d4cc8b5 929 }
7b4cc5d8
DB
930
931out_unlock0:
932 ipc_unlock_object(&shp->shm_perm);
933out_unlock1:
934 rcu_read_unlock();
8d4cc8b5 935out_up:
d9a605e4 936 up_write(&shm_ids(ns).rwsem);
8d4cc8b5
PP
937 return err;
938}
939
9ba720c1
AV
940static int shmctl_ipc_info(struct ipc_namespace *ns,
941 struct shminfo64 *shminfo)
8d4cc8b5 942{
9ba720c1
AV
943 int err = security_shm_shmctl(NULL, IPC_INFO);
944 if (!err) {
945 memset(shminfo, 0, sizeof(*shminfo));
946 shminfo->shmmni = shminfo->shmseg = ns->shm_ctlmni;
947 shminfo->shmmax = ns->shm_ctlmax;
948 shminfo->shmall = ns->shm_ctlall;
949 shminfo->shmmin = SHMMIN;
d9a605e4 950 down_read(&shm_ids(ns).rwsem);
27c331a1 951 err = ipc_get_maxidx(&shm_ids(ns));
d9a605e4 952 up_read(&shm_ids(ns).rwsem);
239521f3 953 if (err < 0)
1da177e4 954 err = 0;
1da177e4 955 }
9ba720c1
AV
956 return err;
957}
1da177e4 958
9ba720c1
AV
959static int shmctl_shm_info(struct ipc_namespace *ns,
960 struct shm_info *shm_info)
961{
962 int err = security_shm_shmctl(NULL, SHM_INFO);
963 if (!err) {
964 memset(shm_info, 0, sizeof(*shm_info));
d9a605e4 965 down_read(&shm_ids(ns).rwsem);
9ba720c1
AV
966 shm_info->used_ids = shm_ids(ns).in_use;
967 shm_get_stat(ns, &shm_info->shm_rss, &shm_info->shm_swp);
968 shm_info->shm_tot = ns->shm_tot;
969 shm_info->swap_attempts = 0;
970 shm_info->swap_successes = 0;
27c331a1 971 err = ipc_get_maxidx(&shm_ids(ns));
d9a605e4 972 up_read(&shm_ids(ns).rwsem);
9ba720c1
AV
973 if (err < 0)
974 err = 0;
1da177e4 975 }
9ba720c1
AV
976 return err;
977}
c97cb9cc 978
9ba720c1
AV
979static int shmctl_stat(struct ipc_namespace *ns, int shmid,
980 int cmd, struct shmid64_ds *tbuf)
981{
982 struct shmid_kernel *shp;
9ba720c1 983 int err;
c97cb9cc 984
87ad4b0d
PM
985 memset(tbuf, 0, sizeof(*tbuf));
986
9ba720c1 987 rcu_read_lock();
c21a6970 988 if (cmd == SHM_STAT || cmd == SHM_STAT_ANY) {
9ba720c1
AV
989 shp = shm_obtain_object(ns, shmid);
990 if (IS_ERR(shp)) {
991 err = PTR_ERR(shp);
992 goto out_unlock;
993 }
c21a6970 994 } else { /* IPC_STAT */
9ba720c1
AV
995 shp = shm_obtain_object_check(ns, shmid);
996 if (IS_ERR(shp)) {
997 err = PTR_ERR(shp);
1da177e4 998 goto out_unlock;
1da177e4 999 }
9ba720c1 1000 }
1da177e4 1001
c21a6970
DB
1002 /*
1003 * Semantically SHM_STAT_ANY ought to be identical to
1004 * that functionality provided by the /proc/sysvipc/
1005 * interface. As such, only audit these calls and
1006 * do not do traditional S_IRUGO permission checks on
1007 * the ipc object.
1008 */
1009 if (cmd == SHM_STAT_ANY)
1010 audit_ipc_obj(&shp->shm_perm);
1011 else {
1012 err = -EACCES;
1013 if (ipcperms(ns, &shp->shm_perm, S_IRUGO))
1014 goto out_unlock;
1015 }
c97cb9cc 1016
7191adff 1017 err = security_shm_shmctl(&shp->shm_perm, cmd);
9ba720c1
AV
1018 if (err)
1019 goto out_unlock;
1020
87ad4b0d
PM
1021 ipc_lock_object(&shp->shm_perm);
1022
1023 if (!ipc_valid_object(&shp->shm_perm)) {
1024 ipc_unlock_object(&shp->shm_perm);
1025 err = -EIDRM;
1026 goto out_unlock;
1027 }
1028
9ba720c1
AV
1029 kernel_to_ipc64_perm(&shp->shm_perm, &tbuf->shm_perm);
1030 tbuf->shm_segsz = shp->shm_segsz;
1031 tbuf->shm_atime = shp->shm_atim;
1032 tbuf->shm_dtime = shp->shm_dtim;
1033 tbuf->shm_ctime = shp->shm_ctim;
c2ab975c
AB
1034#ifndef CONFIG_64BIT
1035 tbuf->shm_atime_high = shp->shm_atim >> 32;
1036 tbuf->shm_dtime_high = shp->shm_dtim >> 32;
1037 tbuf->shm_ctime_high = shp->shm_ctim >> 32;
1038#endif
98f929b1
EB
1039 tbuf->shm_cpid = pid_vnr(shp->shm_cprid);
1040 tbuf->shm_lpid = pid_vnr(shp->shm_lprid);
9ba720c1 1041 tbuf->shm_nattch = shp->shm_nattch;
87ad4b0d 1042
615c999c
MS
1043 if (cmd == IPC_STAT) {
1044 /*
1045 * As defined in SUS:
1046 * Return 0 on success
1047 */
1048 err = 0;
1049 } else {
1050 /*
1051 * SHM_STAT and SHM_STAT_ANY (both Linux specific)
1052 * Return the full id, including the sequence number
1053 */
1054 err = shp->shm_perm.id;
1055 }
68eccc1d 1056
615c999c 1057 ipc_unlock_object(&shp->shm_perm);
68eccc1d 1058out_unlock:
c97cb9cc 1059 rcu_read_unlock();
68eccc1d
DB
1060 return err;
1061}
1062
9ba720c1 1063static int shmctl_do_lock(struct ipc_namespace *ns, int shmid, int cmd)
68eccc1d
DB
1064{
1065 struct shmid_kernel *shp;
9ba720c1
AV
1066 struct file *shm_file;
1067 int err;
68eccc1d 1068
9ba720c1
AV
1069 rcu_read_lock();
1070 shp = shm_obtain_object_check(ns, shmid);
1071 if (IS_ERR(shp)) {
1072 err = PTR_ERR(shp);
1073 goto out_unlock1;
1da177e4 1074 }
c97cb9cc 1075
9ba720c1 1076 audit_ipc_obj(&(shp->shm_perm));
7191adff 1077 err = security_shm_shmctl(&shp->shm_perm, cmd);
9ba720c1
AV
1078 if (err)
1079 goto out_unlock1;
c97cb9cc 1080
9ba720c1 1081 ipc_lock_object(&shp->shm_perm);
c97cb9cc 1082
9ba720c1
AV
1083 /* check if shm_destroy() is tearing down shp */
1084 if (!ipc_valid_object(&shp->shm_perm)) {
1085 err = -EIDRM;
1086 goto out_unlock0;
1da177e4 1087 }
073115d6 1088
9ba720c1
AV
1089 if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
1090 kuid_t euid = current_euid();
0f3d2b01 1091
9ba720c1
AV
1092 if (!uid_eq(euid, shp->shm_perm.uid) &&
1093 !uid_eq(euid, shp->shm_perm.cuid)) {
1094 err = -EPERM;
0f3d2b01
RA
1095 goto out_unlock0;
1096 }
9ba720c1
AV
1097 if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
1098 err = -EPERM;
1099 goto out_unlock0;
1da177e4 1100 }
68eccc1d
DB
1101 }
1102
9ba720c1
AV
1103 shm_file = shp->shm_file;
1104 if (is_file_hugepages(shm_file))
1105 goto out_unlock0;
85046579 1106
9ba720c1 1107 if (cmd == SHM_LOCK) {
d7c9e99a 1108 struct ucounts *ucounts = current_ucounts();
63980c80 1109
d7c9e99a 1110 err = shmem_lock(shm_file, 1, ucounts);
9ba720c1
AV
1111 if (!err && !(shp->shm_perm.mode & SHM_LOCKED)) {
1112 shp->shm_perm.mode |= SHM_LOCKED;
d7c9e99a 1113 shp->mlock_ucounts = ucounts;
1da177e4 1114 }
9ba720c1 1115 goto out_unlock0;
1da177e4
LT
1116 }
1117
9ba720c1
AV
1118 /* SHM_UNLOCK */
1119 if (!(shp->shm_perm.mode & SHM_LOCKED))
1120 goto out_unlock0;
d7c9e99a 1121 shmem_lock(shm_file, 0, shp->mlock_ucounts);
9ba720c1 1122 shp->shm_perm.mode &= ~SHM_LOCKED;
d7c9e99a 1123 shp->mlock_ucounts = NULL;
9ba720c1
AV
1124 get_file(shm_file);
1125 ipc_unlock_object(&shp->shm_perm);
1126 rcu_read_unlock();
1127 shmem_unlock_mapping(shm_file->f_mapping);
1128
1129 fput(shm_file);
1130 return err;
1131
2caacaa8
DB
1132out_unlock0:
1133 ipc_unlock_object(&shp->shm_perm);
1134out_unlock1:
c97cb9cc 1135 rcu_read_unlock();
68eccc1d
DB
1136 return err;
1137}
1138
275f2214 1139static long ksys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf, int version)
68eccc1d 1140{
275f2214 1141 int err;
68eccc1d 1142 struct ipc_namespace *ns;
553f770e 1143 struct shmid64_ds sem64;
68eccc1d 1144
2caacaa8
DB
1145 if (cmd < 0 || shmid < 0)
1146 return -EINVAL;
68eccc1d 1147
68eccc1d
DB
1148 ns = current->nsproxy->ipc_ns;
1149
1150 switch (cmd) {
9ba720c1
AV
1151 case IPC_INFO: {
1152 struct shminfo64 shminfo;
1153 err = shmctl_ipc_info(ns, &shminfo);
1154 if (err < 0)
1155 return err;
1156 if (copy_shminfo_to_user(buf, &shminfo, version))
1157 err = -EFAULT;
1158 return err;
1159 }
1160 case SHM_INFO: {
1161 struct shm_info shm_info;
1162 err = shmctl_shm_info(ns, &shm_info);
1163 if (err < 0)
1164 return err;
1165 if (copy_to_user(buf, &shm_info, sizeof(shm_info)))
1166 err = -EFAULT;
1167 return err;
1168 }
68eccc1d 1169 case SHM_STAT:
c21a6970 1170 case SHM_STAT_ANY:
9ba720c1 1171 case IPC_STAT: {
553f770e 1172 err = shmctl_stat(ns, shmid, cmd, &sem64);
9ba720c1
AV
1173 if (err < 0)
1174 return err;
553f770e 1175 if (copy_shmid_to_user(buf, &sem64, version))
9ba720c1
AV
1176 err = -EFAULT;
1177 return err;
1178 }
2caacaa8 1179 case IPC_SET:
553f770e 1180 if (copy_shmid_from_user(&sem64, buf, version))
9ba720c1 1181 return -EFAULT;
df561f66 1182 fallthrough;
9ba720c1 1183 case IPC_RMID:
553f770e 1184 return shmctl_down(ns, shmid, cmd, &sem64);
1da177e4
LT
1185 case SHM_LOCK:
1186 case SHM_UNLOCK:
9ba720c1
AV
1187 return shmctl_do_lock(ns, shmid, cmd);
1188 default:
1189 return -EINVAL;
1190 }
1191}
89e004ea 1192
c84d0791
DB
1193SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
1194{
275f2214
AB
1195 return ksys_shmctl(shmid, cmd, buf, IPC_64);
1196}
1197
1198#ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
1199long ksys_old_shmctl(int shmid, int cmd, struct shmid_ds __user *buf)
1200{
1201 int version = ipc_parse_version(&cmd);
1202
1203 return ksys_shmctl(shmid, cmd, buf, version);
1204}
1205
1206SYSCALL_DEFINE3(old_shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
1207{
1208 return ksys_old_shmctl(shmid, cmd, buf);
c84d0791 1209}
275f2214 1210#endif
c84d0791 1211
553f770e
AV
1212#ifdef CONFIG_COMPAT
1213
1214struct compat_shmid_ds {
1215 struct compat_ipc_perm shm_perm;
1216 int shm_segsz;
9afc5eee
AB
1217 old_time32_t shm_atime;
1218 old_time32_t shm_dtime;
1219 old_time32_t shm_ctime;
553f770e
AV
1220 compat_ipc_pid_t shm_cpid;
1221 compat_ipc_pid_t shm_lpid;
1222 unsigned short shm_nattch;
1223 unsigned short shm_unused;
1224 compat_uptr_t shm_unused2;
1225 compat_uptr_t shm_unused3;
1226};
1da177e4 1227
553f770e
AV
1228struct compat_shminfo64 {
1229 compat_ulong_t shmmax;
1230 compat_ulong_t shmmin;
1231 compat_ulong_t shmmni;
1232 compat_ulong_t shmseg;
1233 compat_ulong_t shmall;
1234 compat_ulong_t __unused1;
1235 compat_ulong_t __unused2;
1236 compat_ulong_t __unused3;
1237 compat_ulong_t __unused4;
1238};
073115d6 1239
553f770e
AV
1240struct compat_shm_info {
1241 compat_int_t used_ids;
1242 compat_ulong_t shm_tot, shm_rss, shm_swp;
1243 compat_ulong_t swap_attempts, swap_successes;
1244};
0f3d2b01 1245
553f770e
AV
1246static int copy_compat_shminfo_to_user(void __user *buf, struct shminfo64 *in,
1247 int version)
1248{
1249 if (in->shmmax > INT_MAX)
1250 in->shmmax = INT_MAX;
1251 if (version == IPC_64) {
1252 struct compat_shminfo64 info;
1253 memset(&info, 0, sizeof(info));
1254 info.shmmax = in->shmmax;
1255 info.shmmin = in->shmmin;
1256 info.shmmni = in->shmmni;
1257 info.shmseg = in->shmseg;
1258 info.shmall = in->shmall;
1259 return copy_to_user(buf, &info, sizeof(info));
1260 } else {
1261 struct shminfo info;
1262 memset(&info, 0, sizeof(info));
1263 info.shmmax = in->shmmax;
1264 info.shmmin = in->shmmin;
1265 info.shmmni = in->shmmni;
1266 info.shmseg = in->shmseg;
1267 info.shmall = in->shmall;
1268 return copy_to_user(buf, &info, sizeof(info));
1269 }
1270}
0f3d2b01 1271
553f770e
AV
1272static int put_compat_shm_info(struct shm_info *ip,
1273 struct compat_shm_info __user *uip)
1274{
1275 struct compat_shm_info info;
1276
1277 memset(&info, 0, sizeof(info));
1278 info.used_ids = ip->used_ids;
1279 info.shm_tot = ip->shm_tot;
1280 info.shm_rss = ip->shm_rss;
1281 info.shm_swp = ip->shm_swp;
1282 info.swap_attempts = ip->swap_attempts;
1283 info.swap_successes = ip->swap_successes;
b776e4b1 1284 return copy_to_user(uip, &info, sizeof(info));
553f770e 1285}
1da177e4 1286
553f770e
AV
1287static int copy_compat_shmid_to_user(void __user *buf, struct shmid64_ds *in,
1288 int version)
1289{
1290 if (version == IPC_64) {
1291 struct compat_shmid64_ds v;
1292 memset(&v, 0, sizeof(v));
28327fae 1293 to_compat_ipc64_perm(&v.shm_perm, &in->shm_perm);
c2ab975c
AB
1294 v.shm_atime = lower_32_bits(in->shm_atime);
1295 v.shm_atime_high = upper_32_bits(in->shm_atime);
1296 v.shm_dtime = lower_32_bits(in->shm_dtime);
1297 v.shm_dtime_high = upper_32_bits(in->shm_dtime);
1298 v.shm_ctime = lower_32_bits(in->shm_ctime);
1299 v.shm_ctime_high = upper_32_bits(in->shm_ctime);
553f770e
AV
1300 v.shm_segsz = in->shm_segsz;
1301 v.shm_nattch = in->shm_nattch;
1302 v.shm_cpid = in->shm_cpid;
1303 v.shm_lpid = in->shm_lpid;
1304 return copy_to_user(buf, &v, sizeof(v));
1305 } else {
1306 struct compat_shmid_ds v;
1307 memset(&v, 0, sizeof(v));
28327fae 1308 to_compat_ipc_perm(&v.shm_perm, &in->shm_perm);
553f770e 1309 v.shm_perm.key = in->shm_perm.key;
553f770e
AV
1310 v.shm_atime = in->shm_atime;
1311 v.shm_dtime = in->shm_dtime;
1312 v.shm_ctime = in->shm_ctime;
1313 v.shm_segsz = in->shm_segsz;
1314 v.shm_nattch = in->shm_nattch;
1315 v.shm_cpid = in->shm_cpid;
1316 v.shm_lpid = in->shm_lpid;
1317 return copy_to_user(buf, &v, sizeof(v));
1318 }
1319}
85046579 1320
553f770e
AV
1321static int copy_compat_shmid_from_user(struct shmid64_ds *out, void __user *buf,
1322 int version)
1323{
1324 memset(out, 0, sizeof(*out));
1325 if (version == IPC_64) {
6aa211e8 1326 struct compat_shmid64_ds __user *p = buf;
28327fae 1327 return get_compat_ipc64_perm(&out->shm_perm, &p->shm_perm);
553f770e 1328 } else {
6aa211e8 1329 struct compat_shmid_ds __user *p = buf;
28327fae 1330 return get_compat_ipc_perm(&out->shm_perm, &p->shm_perm);
553f770e 1331 }
553f770e 1332}
63980c80 1333
1cd377ba 1334static long compat_ksys_shmctl(int shmid, int cmd, void __user *uptr, int version)
553f770e
AV
1335{
1336 struct ipc_namespace *ns;
1337 struct shmid64_ds sem64;
553f770e 1338 int err;
85046579 1339
553f770e
AV
1340 ns = current->nsproxy->ipc_ns;
1341
1342 if (cmd < 0 || shmid < 0)
1343 return -EINVAL;
2caacaa8 1344
553f770e
AV
1345 switch (cmd) {
1346 case IPC_INFO: {
1347 struct shminfo64 shminfo;
1348 err = shmctl_ipc_info(ns, &shminfo);
1349 if (err < 0)
1350 return err;
1351 if (copy_compat_shminfo_to_user(uptr, &shminfo, version))
1352 err = -EFAULT;
1353 return err;
1354 }
1355 case SHM_INFO: {
1356 struct shm_info shm_info;
1357 err = shmctl_shm_info(ns, &shm_info);
1358 if (err < 0)
1359 return err;
1360 if (put_compat_shm_info(&shm_info, uptr))
1361 err = -EFAULT;
8d4cc8b5 1362 return err;
2caacaa8 1363 }
553f770e 1364 case IPC_STAT:
c21a6970 1365 case SHM_STAT_ANY:
553f770e
AV
1366 case SHM_STAT:
1367 err = shmctl_stat(ns, shmid, cmd, &sem64);
1368 if (err < 0)
1369 return err;
58aff0af 1370 if (copy_compat_shmid_to_user(uptr, &sem64, version))
553f770e
AV
1371 err = -EFAULT;
1372 return err;
1373
1374 case IPC_SET:
1375 if (copy_compat_shmid_from_user(&sem64, uptr, version))
1376 return -EFAULT;
df561f66 1377 fallthrough;
553f770e
AV
1378 case IPC_RMID:
1379 return shmctl_down(ns, shmid, cmd, &sem64);
1380 case SHM_LOCK:
1381 case SHM_UNLOCK:
1382 return shmctl_do_lock(ns, shmid, cmd);
1da177e4 1383 default:
8d4cc8b5 1384 return -EINVAL;
1da177e4 1385 }
1da177e4
LT
1386 return err;
1387}
c84d0791
DB
1388
1389COMPAT_SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, void __user *, uptr)
1390{
275f2214 1391 return compat_ksys_shmctl(shmid, cmd, uptr, IPC_64);
c84d0791 1392}
275f2214
AB
1393
1394#ifdef CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION
1395long compat_ksys_old_shmctl(int shmid, int cmd, void __user *uptr)
1396{
1397 int version = compat_ipc_parse_version(&cmd);
1398
1399 return compat_ksys_shmctl(shmid, cmd, uptr, version);
1400}
1401
1402COMPAT_SYSCALL_DEFINE3(old_shmctl, int, shmid, int, cmd, void __user *, uptr)
1403{
1404 return compat_ksys_old_shmctl(shmid, cmd, uptr);
1405}
1406#endif
553f770e 1407#endif
1da177e4
LT
1408
1409/*
1410 * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
1411 *
1412 * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
1413 * "raddr" thing points to kernel space, and there has to be a wrapper around
1414 * this.
1415 */
95e91b83
DB
1416long do_shmat(int shmid, char __user *shmaddr, int shmflg,
1417 ulong *raddr, unsigned long shmlba)
1da177e4
LT
1418{
1419 struct shmid_kernel *shp;
f0cb8802 1420 unsigned long addr = (unsigned long)shmaddr;
1da177e4 1421 unsigned long size;
4f089acc 1422 struct file *file, *base;
1da177e4 1423 int err;
f0cb8802 1424 unsigned long flags = MAP_SHARED;
1da177e4 1425 unsigned long prot;
1da177e4 1426 int acc_mode;
4e982311 1427 struct ipc_namespace *ns;
bc56bba8 1428 struct shm_file_data *sfd;
c9c554f2 1429 int f_flags;
41badc15 1430 unsigned long populate = 0;
1da177e4 1431
bc56bba8
EB
1432 err = -EINVAL;
1433 if (shmid < 0)
1da177e4 1434 goto out;
f0cb8802
DB
1435
1436 if (addr) {
079a96ae 1437 if (addr & (shmlba - 1)) {
8f89c007 1438 if (shmflg & SHM_RND) {
a73ab244 1439 addr &= ~(shmlba - 1); /* round down */
8f89c007
DB
1440
1441 /*
1442 * Ensure that the round-down is non-nil
1443 * when remapping. This can happen for
1444 * cases when addr < shmlba.
1445 */
1446 if (!addr && (shmflg & SHM_REMAP))
1447 goto out;
1448 } else
1da177e4
LT
1449#ifndef __ARCH_FORCE_SHMLBA
1450 if (addr & ~PAGE_MASK)
1451#endif
bc56bba8 1452 goto out;
1da177e4 1453 }
1da177e4 1454
f0cb8802
DB
1455 flags |= MAP_FIXED;
1456 } else if ((shmflg & SHM_REMAP))
1457 goto out;
1da177e4
LT
1458
1459 if (shmflg & SHM_RDONLY) {
1460 prot = PROT_READ;
1da177e4 1461 acc_mode = S_IRUGO;
c9c554f2 1462 f_flags = O_RDONLY;
1da177e4
LT
1463 } else {
1464 prot = PROT_READ | PROT_WRITE;
1da177e4 1465 acc_mode = S_IRUGO | S_IWUGO;
c9c554f2 1466 f_flags = O_RDWR;
1da177e4
LT
1467 }
1468 if (shmflg & SHM_EXEC) {
1469 prot |= PROT_EXEC;
1470 acc_mode |= S_IXUGO;
1471 }
1472
1473 /*
1474 * We cannot rely on the fs check since SYSV IPC does have an
1475 * additional creator id...
1476 */
4e982311 1477 ns = current->nsproxy->ipc_ns;
c2c737a0
DB
1478 rcu_read_lock();
1479 shp = shm_obtain_object_check(ns, shmid);
023a5355
ND
1480 if (IS_ERR(shp)) {
1481 err = PTR_ERR(shp);
c2c737a0 1482 goto out_unlock;
023a5355 1483 }
bc56bba8
EB
1484
1485 err = -EACCES;
b0e77598 1486 if (ipcperms(ns, &shp->shm_perm, acc_mode))
bc56bba8 1487 goto out_unlock;
1da177e4 1488
7191adff 1489 err = security_shm_shmat(&shp->shm_perm, shmaddr, shmflg);
bc56bba8
EB
1490 if (err)
1491 goto out_unlock;
1492
c2c737a0 1493 ipc_lock_object(&shp->shm_perm);
a399b29d
GT
1494
1495 /* check if shm_destroy() is tearing down shp */
0f3d2b01 1496 if (!ipc_valid_object(&shp->shm_perm)) {
a399b29d
GT
1497 ipc_unlock_object(&shp->shm_perm);
1498 err = -EIDRM;
1499 goto out_unlock;
1500 }
1501
4f089acc
AV
1502 /*
1503 * We need to take a reference to the real shm file to prevent the
1504 * pointer from becoming stale in cases where the lifetime of the outer
1505 * file extends beyond that of the shm segment. It's not usually
1506 * possible, but it can happen during remap_file_pages() emulation as
1507 * that unmaps the memory, then does ->mmap() via file reference only.
1508 * We'll deny the ->mmap() if the shm segment was since removed, but to
1509 * detect shm ID reuse we need to compare the file pointers.
1510 */
1511 base = get_file(shp->shm_file);
1da177e4 1512 shp->shm_nattch++;
4f089acc 1513 size = i_size_read(file_inode(base));
c2c737a0
DB
1514 ipc_unlock_object(&shp->shm_perm);
1515 rcu_read_unlock();
1da177e4 1516
bc56bba8
EB
1517 err = -ENOMEM;
1518 sfd = kzalloc(sizeof(*sfd), GFP_KERNEL);
f42569b1 1519 if (!sfd) {
4f089acc 1520 fput(base);
f42569b1
DB
1521 goto out_nattch;
1522 }
bc56bba8 1523
4f089acc
AV
1524 file = alloc_file_clone(base, f_flags,
1525 is_file_hugepages(base) ?
c4caa778
AV
1526 &shm_file_operations_huge :
1527 &shm_file_operations);
39b65252 1528 err = PTR_ERR(file);
f42569b1
DB
1529 if (IS_ERR(file)) {
1530 kfree(sfd);
4f089acc 1531 fput(base);
f42569b1
DB
1532 goto out_nattch;
1533 }
bc56bba8 1534
7ca7e564 1535 sfd->id = shp->shm_perm.id;
bc56bba8 1536 sfd->ns = get_ipc_ns(ns);
4f089acc 1537 sfd->file = base;
bc56bba8 1538 sfd->vm_ops = NULL;
4f089acc 1539 file->private_data = sfd;
bc56bba8 1540
8b3ec681
AV
1541 err = security_mmap_file(file, prot, flags);
1542 if (err)
1543 goto out_fput;
1544
d8ed45c5 1545 if (mmap_write_lock_killable(current->mm)) {
91f4f94e
MH
1546 err = -EINTR;
1547 goto out_fput;
1548 }
1549
1da177e4 1550 if (addr && !(shmflg & SHM_REMAP)) {
bc56bba8 1551 err = -EINVAL;
247a8ce8
MS
1552 if (addr + size < addr)
1553 goto invalid;
1554
1da177e4
LT
1555 if (find_vma_intersection(current->mm, addr, addr + size))
1556 goto invalid;
1da177e4 1557 }
f42569b1 1558
45e55300 1559 addr = do_mmap(file, addr, size, prot, flags, 0, &populate, NULL);
bebeb3d6 1560 *raddr = addr;
bc56bba8 1561 err = 0;
bebeb3d6
ML
1562 if (IS_ERR_VALUE(addr))
1563 err = (long)addr;
1da177e4 1564invalid:
d8ed45c5 1565 mmap_write_unlock(current->mm);
bebeb3d6 1566 if (populate)
41badc15 1567 mm_populate(addr, populate);
1da177e4 1568
8b3ec681 1569out_fput:
bc56bba8
EB
1570 fput(file);
1571
1572out_nattch:
d9a605e4 1573 down_write(&shm_ids(ns).rwsem);
00c2bf85 1574 shp = shm_lock(ns, shmid);
1da177e4 1575 shp->shm_nattch--;
b34a6b1d 1576 if (shm_may_destroy(ns, shp))
4e982311 1577 shm_destroy(ns, shp);
1da177e4
LT
1578 else
1579 shm_unlock(shp);
d9a605e4 1580 up_write(&shm_ids(ns).rwsem);
1da177e4 1581 return err;
bc56bba8
EB
1582
1583out_unlock:
c2c737a0 1584 rcu_read_unlock();
f42569b1
DB
1585out:
1586 return err;
1da177e4
LT
1587}
1588
d5460c99 1589SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
7d87e14c
SR
1590{
1591 unsigned long ret;
1592 long err;
1593
079a96ae 1594 err = do_shmat(shmid, shmaddr, shmflg, &ret, SHMLBA);
7d87e14c
SR
1595 if (err)
1596 return err;
1597 force_successful_syscall_return();
1598 return (long)ret;
1599}
1600
a78ee9ed
AV
1601#ifdef CONFIG_COMPAT
1602
1603#ifndef COMPAT_SHMLBA
1604#define COMPAT_SHMLBA SHMLBA
1605#endif
1606
1607COMPAT_SYSCALL_DEFINE3(shmat, int, shmid, compat_uptr_t, shmaddr, int, shmflg)
1608{
1609 unsigned long ret;
1610 long err;
1611
1612 err = do_shmat(shmid, compat_ptr(shmaddr), shmflg, &ret, COMPAT_SHMLBA);
1613 if (err)
1614 return err;
1615 force_successful_syscall_return();
1616 return (long)ret;
1617}
1618#endif
1619
1da177e4
LT
1620/*
1621 * detach and kill segment if marked destroyed.
1622 * The work is done in shm_close.
1623 */
da1e2744 1624long ksys_shmdt(char __user *shmaddr)
1da177e4
LT
1625{
1626 struct mm_struct *mm = current->mm;
586c7e6a 1627 struct vm_area_struct *vma;
1da177e4 1628 unsigned long addr = (unsigned long)shmaddr;
1da177e4 1629 int retval = -EINVAL;
586c7e6a
MF
1630#ifdef CONFIG_MMU
1631 loff_t size = 0;
d3c97900 1632 struct file *file;
586c7e6a
MF
1633 struct vm_area_struct *next;
1634#endif
1da177e4 1635
df1e2fb5
HD
1636 if (addr & ~PAGE_MASK)
1637 return retval;
1638
d8ed45c5 1639 if (mmap_write_lock_killable(mm))
91f4f94e 1640 return -EINTR;
1da177e4
LT
1641
1642 /*
1643 * This function tries to be smart and unmap shm segments that
1644 * were modified by partial mlock or munmap calls:
1645 * - It first determines the size of the shm segment that should be
1646 * unmapped: It searches for a vma that is backed by shm and that
1647 * started at address shmaddr. It records it's size and then unmaps
1648 * it.
1649 * - Then it unmaps all shm vmas that started at shmaddr and that
d3c97900
DH
1650 * are within the initially determined size and that are from the
1651 * same shm segment from which we determined the size.
1da177e4
LT
1652 * Errors from do_munmap are ignored: the function only fails if
1653 * it's called with invalid parameters or if it's called to unmap
1654 * a part of a vma. Both calls in this function are for full vmas,
1655 * the parameters are directly copied from the vma itself and always
1656 * valid - therefore do_munmap cannot fail. (famous last words?)
1657 */
1658 /*
1659 * If it had been mremap()'d, the starting address would not
1660 * match the usual checks anyway. So assume all vma's are
1661 * above the starting address given.
1662 */
1663 vma = find_vma(mm, addr);
1664
8feae131 1665#ifdef CONFIG_MMU
1da177e4
LT
1666 while (vma) {
1667 next = vma->vm_next;
1668
1669 /*
1670 * Check if the starting address would match, i.e. it's
1671 * a fragment created by mprotect() and/or munmap(), or it
1672 * otherwise it starts at this address with no hassles.
1673 */
bc56bba8 1674 if ((vma->vm_ops == &shm_vm_ops) &&
1da177e4
LT
1675 (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) {
1676
d3c97900
DH
1677 /*
1678 * Record the file of the shm segment being
1679 * unmapped. With mremap(), someone could place
1680 * page from another segment but with equal offsets
1681 * in the range we are unmapping.
1682 */
1683 file = vma->vm_file;
07a46ed2 1684 size = i_size_read(file_inode(vma->vm_file));
897ab3e0 1685 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start, NULL);
1da177e4
LT
1686 /*
1687 * We discovered the size of the shm segment, so
1688 * break out of here and fall through to the next
1689 * loop that uses the size information to stop
1690 * searching for matching vma's.
1691 */
1692 retval = 0;
1693 vma = next;
1694 break;
1695 }
1696 vma = next;
1697 }
1698
1699 /*
1700 * We need look no further than the maximum address a fragment
1701 * could possibly have landed at. Also cast things to loff_t to
25985edc 1702 * prevent overflows and make comparisons vs. equal-width types.
1da177e4 1703 */
8e36709d 1704 size = PAGE_ALIGN(size);
1da177e4
LT
1705 while (vma && (loff_t)(vma->vm_end - addr) <= size) {
1706 next = vma->vm_next;
1707
1708 /* finding a matching vma now does not alter retval */
bc56bba8 1709 if ((vma->vm_ops == &shm_vm_ops) &&
d3c97900
DH
1710 ((vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) &&
1711 (vma->vm_file == file))
897ab3e0 1712 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start, NULL);
1da177e4
LT
1713 vma = next;
1714 }
1715
63980c80 1716#else /* CONFIG_MMU */
8feae131 1717 /* under NOMMU conditions, the exact address to be destroyed must be
63980c80
SP
1718 * given
1719 */
530fcd16 1720 if (vma && vma->vm_start == addr && vma->vm_ops == &shm_vm_ops) {
897ab3e0 1721 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start, NULL);
8feae131
DH
1722 retval = 0;
1723 }
1724
1725#endif
1726
d8ed45c5 1727 mmap_write_unlock(mm);
1da177e4
LT
1728 return retval;
1729}
1730
da1e2744
DB
1731SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
1732{
1733 return ksys_shmdt(shmaddr);
1734}
1735
1da177e4 1736#ifdef CONFIG_PROC_FS
19b4946c 1737static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
1da177e4 1738{
98f929b1 1739 struct pid_namespace *pid_ns = ipc_seq_pid_ns(s);
1efdb69b 1740 struct user_namespace *user_ns = seq_user_ns(s);
ade9f91b
KC
1741 struct kern_ipc_perm *ipcp = it;
1742 struct shmid_kernel *shp;
b7952180
HD
1743 unsigned long rss = 0, swp = 0;
1744
ade9f91b 1745 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
b7952180 1746 shm_add_rss_swap(shp, &rss, &swp);
1da177e4 1747
6c826818
PM
1748#if BITS_PER_LONG <= 32
1749#define SIZE_SPEC "%10lu"
1750#else
1751#define SIZE_SPEC "%21lu"
1752#endif
1da177e4 1753
7f032d6e
JP
1754 seq_printf(s,
1755 "%10d %10d %4o " SIZE_SPEC " %5u %5u "
7ff2819e 1756 "%5lu %5u %5u %5u %5u %10llu %10llu %10llu "
7f032d6e
JP
1757 SIZE_SPEC " " SIZE_SPEC "\n",
1758 shp->shm_perm.key,
1759 shp->shm_perm.id,
1760 shp->shm_perm.mode,
1761 shp->shm_segsz,
98f929b1
EB
1762 pid_nr_ns(shp->shm_cprid, pid_ns),
1763 pid_nr_ns(shp->shm_lprid, pid_ns),
7f032d6e
JP
1764 shp->shm_nattch,
1765 from_kuid_munged(user_ns, shp->shm_perm.uid),
1766 from_kgid_munged(user_ns, shp->shm_perm.gid),
1767 from_kuid_munged(user_ns, shp->shm_perm.cuid),
1768 from_kgid_munged(user_ns, shp->shm_perm.cgid),
1769 shp->shm_atim,
1770 shp->shm_dtim,
1771 shp->shm_ctim,
1772 rss * PAGE_SIZE,
1773 swp * PAGE_SIZE);
1774
1775 return 0;
1da177e4
LT
1776}
1777#endif