3 * Copyright (C) 1992, 1993 Krishna Balasubramanian
4 * Many improvements/fixes by Bruno Haible.
5 * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
6 * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
8 * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
9 * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
10 * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
11 * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
12 * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
13 * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
14 * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
16 * support for audit of ipc object properties and permission changes
17 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
21 * Pavel Emelianov <xemul@openvz.org>
23 * Better ipc lock (kern_ipc_perm.lock) handling
24 * Davidlohr Bueso <davidlohr.bueso@hp.com>, June 2013.
27 #include <linux/slab.h>
29 #include <linux/hugetlb.h>
30 #include <linux/shm.h>
31 #include <linux/init.h>
32 #include <linux/file.h>
33 #include <linux/mman.h>
34 #include <linux/shmem_fs.h>
35 #include <linux/security.h>
36 #include <linux/syscalls.h>
37 #include <linux/audit.h>
38 #include <linux/capability.h>
39 #include <linux/ptrace.h>
40 #include <linux/seq_file.h>
41 #include <linux/rwsem.h>
42 #include <linux/nsproxy.h>
43 #include <linux/mount.h>
44 #include <linux/ipc_namespace.h>
46 #include <linux/uaccess.h>
50 struct shm_file_data
{
52 struct ipc_namespace
*ns
;
54 const struct vm_operations_struct
*vm_ops
;
57 #define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data))
59 static const struct file_operations shm_file_operations
;
60 static const struct vm_operations_struct shm_vm_ops
;
62 #define shm_ids(ns) ((ns)->ids[IPC_SHM_IDS])
64 #define shm_unlock(shp) \
65 ipc_unlock(&(shp)->shm_perm)
67 static int newseg(struct ipc_namespace
*, struct ipc_params
*);
68 static void shm_open(struct vm_area_struct
*vma
);
69 static void shm_close(struct vm_area_struct
*vma
);
70 static void shm_destroy(struct ipc_namespace
*ns
, struct shmid_kernel
*shp
);
72 static int sysvipc_shm_proc_show(struct seq_file
*s
, void *it
);
75 void shm_init_ns(struct ipc_namespace
*ns
)
77 ns
->shm_ctlmax
= SHMMAX
;
78 ns
->shm_ctlall
= SHMALL
;
79 ns
->shm_ctlmni
= SHMMNI
;
80 ns
->shm_rmid_forced
= 0;
82 ipc_init_ids(&shm_ids(ns
));
86 * Called with shm_ids.rwsem (writer) and the shp structure locked.
87 * Only shm_ids.rwsem remains locked on exit.
89 static void do_shm_rmid(struct ipc_namespace
*ns
, struct kern_ipc_perm
*ipcp
)
91 struct shmid_kernel
*shp
;
92 shp
= container_of(ipcp
, struct shmid_kernel
, shm_perm
);
94 if (shp
->shm_nattch
) {
95 shp
->shm_perm
.mode
|= SHM_DEST
;
96 /* Do not find it any more */
97 shp
->shm_perm
.key
= IPC_PRIVATE
;
100 shm_destroy(ns
, shp
);
104 void shm_exit_ns(struct ipc_namespace
*ns
)
106 free_ipcs(ns
, &shm_ids(ns
), do_shm_rmid
);
107 idr_destroy(&ns
->ids
[IPC_SHM_IDS
].ipcs_idr
);
111 static int __init
ipc_ns_init(void)
113 shm_init_ns(&init_ipc_ns
);
117 pure_initcall(ipc_ns_init
);
119 void __init
shm_init(void)
121 ipc_init_proc_interface("sysvipc/shm",
122 #if BITS_PER_LONG <= 32
123 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n",
125 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n",
127 IPC_SHM_IDS
, sysvipc_shm_proc_show
);
130 static inline struct shmid_kernel
*shm_obtain_object(struct ipc_namespace
*ns
, int id
)
132 struct kern_ipc_perm
*ipcp
= ipc_obtain_object(&shm_ids(ns
), id
);
135 return ERR_CAST(ipcp
);
137 return container_of(ipcp
, struct shmid_kernel
, shm_perm
);
140 static inline struct shmid_kernel
*shm_obtain_object_check(struct ipc_namespace
*ns
, int id
)
142 struct kern_ipc_perm
*ipcp
= ipc_obtain_object_check(&shm_ids(ns
), id
);
145 return ERR_CAST(ipcp
);
147 return container_of(ipcp
, struct shmid_kernel
, shm_perm
);
151 * shm_lock_(check_) routines are called in the paths where the rwsem
152 * is not necessarily held.
154 static inline struct shmid_kernel
*shm_lock(struct ipc_namespace
*ns
, int id
)
156 struct kern_ipc_perm
*ipcp
= ipc_lock(&shm_ids(ns
), id
);
159 return (struct shmid_kernel
*)ipcp
;
161 return container_of(ipcp
, struct shmid_kernel
, shm_perm
);
164 static inline void shm_lock_by_ptr(struct shmid_kernel
*ipcp
)
167 ipc_lock_object(&ipcp
->shm_perm
);
170 static void shm_rcu_free(struct rcu_head
*head
)
172 struct ipc_rcu
*p
= container_of(head
, struct ipc_rcu
, rcu
);
173 struct shmid_kernel
*shp
= ipc_rcu_to_struct(p
);
175 security_shm_free(shp
);
179 static inline void shm_rmid(struct ipc_namespace
*ns
, struct shmid_kernel
*s
)
181 list_del(&s
->shm_clist
);
182 ipc_rmid(&shm_ids(ns
), &s
->shm_perm
);
186 /* This is called by fork, once for every shm attach. */
187 static void shm_open(struct vm_area_struct
*vma
)
189 struct file
*file
= vma
->vm_file
;
190 struct shm_file_data
*sfd
= shm_file_data(file
);
191 struct shmid_kernel
*shp
;
193 shp
= shm_lock(sfd
->ns
, sfd
->id
);
195 shp
->shm_atim
= get_seconds();
196 shp
->shm_lprid
= task_tgid_vnr(current
);
202 * shm_destroy - free the struct shmid_kernel
205 * @shp: struct to free
207 * It has to be called with shp and shm_ids.rwsem (writer) locked,
208 * but returns with shp unlocked and freed.
210 static void shm_destroy(struct ipc_namespace
*ns
, struct shmid_kernel
*shp
)
212 struct file
*shm_file
;
214 shm_file
= shp
->shm_file
;
215 shp
->shm_file
= NULL
;
216 ns
->shm_tot
-= (shp
->shm_segsz
+ PAGE_SIZE
- 1) >> PAGE_SHIFT
;
219 if (!is_file_hugepages(shm_file
))
220 shmem_lock(shm_file
, 0, shp
->mlock_user
);
221 else if (shp
->mlock_user
)
222 user_shm_unlock(file_inode(shm_file
)->i_size
, shp
->mlock_user
);
224 ipc_rcu_putref(shp
, shm_rcu_free
);
228 * shm_may_destroy - identifies whether shm segment should be destroyed now
230 * Returns true if and only if there are no active users of the segment and
231 * one of the following is true:
233 * 1) shmctl(id, IPC_RMID, NULL) was called for this shp
235 * 2) sysctl kernel.shm_rmid_forced is set to 1.
237 static bool shm_may_destroy(struct ipc_namespace
*ns
, struct shmid_kernel
*shp
)
239 return (shp
->shm_nattch
== 0) &&
240 (ns
->shm_rmid_forced
||
241 (shp
->shm_perm
.mode
& SHM_DEST
));
245 * remove the attach descriptor vma.
246 * free memory for segment if it is marked destroyed.
247 * The descriptor has already been removed from the current->mm->mmap list
248 * and will later be kfree()d.
250 static void shm_close(struct vm_area_struct
*vma
)
252 struct file
*file
= vma
->vm_file
;
253 struct shm_file_data
*sfd
= shm_file_data(file
);
254 struct shmid_kernel
*shp
;
255 struct ipc_namespace
*ns
= sfd
->ns
;
257 down_write(&shm_ids(ns
).rwsem
);
258 /* remove from the list of attaches of the shm segment */
259 shp
= shm_lock(ns
, sfd
->id
);
261 shp
->shm_lprid
= task_tgid_vnr(current
);
262 shp
->shm_dtim
= get_seconds();
264 if (shm_may_destroy(ns
, shp
))
265 shm_destroy(ns
, shp
);
268 up_write(&shm_ids(ns
).rwsem
);
271 /* Called with ns->shm_ids(ns).rwsem locked */
272 static void shm_mark_orphan(struct shmid_kernel
*shp
, struct ipc_namespace
*ns
)
274 if (WARN_ON(shp
->shm_creator
!= current
)) /* Remove me when it works */
278 * Mark it as orphaned to destroy the segment when
279 * kernel.shm_rmid_forced is changed.
280 * It is noop if the following shm_may_destroy() returns true.
282 shp
->shm_creator
= NULL
;
285 * Don't even try to destroy it. If shm_rmid_forced=0 and IPC_RMID
286 * is not set, it shouldn't be deleted here.
288 if (!ns
->shm_rmid_forced
)
291 if (shm_may_destroy(ns
, shp
)) {
292 shm_lock_by_ptr(shp
);
293 shm_destroy(ns
, shp
);
297 /* Called with ns->shm_ids(ns).rwsem locked */
298 static int shm_try_destroy_orphaned(int id
, void *p
, void *data
)
300 struct ipc_namespace
*ns
= data
;
301 struct kern_ipc_perm
*ipcp
= p
;
302 struct shmid_kernel
*shp
= container_of(ipcp
, struct shmid_kernel
, shm_perm
);
305 * We want to destroy segments without users and with already
306 * exit'ed originating process.
308 * As shp->* are changed under rwsem, it's safe to skip shp locking.
310 if (shp
->shm_creator
!= NULL
)
313 if (shm_may_destroy(ns
, shp
)) {
314 shm_lock_by_ptr(shp
);
315 shm_destroy(ns
, shp
);
320 void shm_destroy_orphaned(struct ipc_namespace
*ns
)
322 down_write(&shm_ids(ns
).rwsem
);
323 if (shm_ids(ns
).in_use
)
324 idr_for_each(&shm_ids(ns
).ipcs_idr
, &shm_try_destroy_orphaned
, ns
);
325 up_write(&shm_ids(ns
).rwsem
);
329 void exit_shm(struct task_struct
*task
)
331 struct ipc_namespace
*ns
= task
->nsproxy
->ipc_ns
;
332 struct shmid_kernel
*shp
, *n
;
334 if (shm_ids(ns
).in_use
== 0)
337 /* Destroy all already created segments, but not mapped yet */
338 down_write(&shm_ids(ns
).rwsem
);
339 list_for_each_entry_safe(shp
, n
, &task
->sysvshm
.shm_clist
, shm_clist
)
340 shm_mark_orphan(shp
, ns
);
341 /* remove the list head from any segments still attached */
342 list_del(&task
->sysvshm
.shm_clist
);
343 up_write(&shm_ids(ns
).rwsem
);
346 static int shm_fault(struct vm_area_struct
*vma
, struct vm_fault
*vmf
)
348 struct file
*file
= vma
->vm_file
;
349 struct shm_file_data
*sfd
= shm_file_data(file
);
351 return sfd
->vm_ops
->fault(vma
, vmf
);
355 static int shm_set_policy(struct vm_area_struct
*vma
, struct mempolicy
*new)
357 struct file
*file
= vma
->vm_file
;
358 struct shm_file_data
*sfd
= shm_file_data(file
);
360 if (sfd
->vm_ops
->set_policy
)
361 err
= sfd
->vm_ops
->set_policy(vma
, new);
365 static struct mempolicy
*shm_get_policy(struct vm_area_struct
*vma
,
368 struct file
*file
= vma
->vm_file
;
369 struct shm_file_data
*sfd
= shm_file_data(file
);
370 struct mempolicy
*pol
= NULL
;
372 if (sfd
->vm_ops
->get_policy
)
373 pol
= sfd
->vm_ops
->get_policy(vma
, addr
);
374 else if (vma
->vm_policy
)
375 pol
= vma
->vm_policy
;
381 static int shm_mmap(struct file
*file
, struct vm_area_struct
*vma
)
383 struct shm_file_data
*sfd
= shm_file_data(file
);
386 ret
= sfd
->file
->f_op
->mmap(sfd
->file
, vma
);
389 sfd
->vm_ops
= vma
->vm_ops
;
391 BUG_ON(!sfd
->vm_ops
->fault
);
393 vma
->vm_ops
= &shm_vm_ops
;
399 static int shm_release(struct inode
*ino
, struct file
*file
)
401 struct shm_file_data
*sfd
= shm_file_data(file
);
404 shm_file_data(file
) = NULL
;
409 static int shm_fsync(struct file
*file
, loff_t start
, loff_t end
, int datasync
)
411 struct shm_file_data
*sfd
= shm_file_data(file
);
413 if (!sfd
->file
->f_op
->fsync
)
415 return sfd
->file
->f_op
->fsync(sfd
->file
, start
, end
, datasync
);
418 static long shm_fallocate(struct file
*file
, int mode
, loff_t offset
,
421 struct shm_file_data
*sfd
= shm_file_data(file
);
423 if (!sfd
->file
->f_op
->fallocate
)
425 return sfd
->file
->f_op
->fallocate(file
, mode
, offset
, len
);
428 static unsigned long shm_get_unmapped_area(struct file
*file
,
429 unsigned long addr
, unsigned long len
, unsigned long pgoff
,
432 struct shm_file_data
*sfd
= shm_file_data(file
);
433 return sfd
->file
->f_op
->get_unmapped_area(sfd
->file
, addr
, len
,
437 static const struct file_operations shm_file_operations
= {
440 .release
= shm_release
,
442 .get_unmapped_area
= shm_get_unmapped_area
,
444 .llseek
= noop_llseek
,
445 .fallocate
= shm_fallocate
,
448 static const struct file_operations shm_file_operations_huge
= {
451 .release
= shm_release
,
452 .get_unmapped_area
= shm_get_unmapped_area
,
453 .llseek
= noop_llseek
,
454 .fallocate
= shm_fallocate
,
457 int is_file_shm_hugepages(struct file
*file
)
459 return file
->f_op
== &shm_file_operations_huge
;
462 static const struct vm_operations_struct shm_vm_ops
= {
463 .open
= shm_open
, /* callback for a new vm-area open */
464 .close
= shm_close
, /* callback for when the vm-area is released */
466 #if defined(CONFIG_NUMA)
467 .set_policy
= shm_set_policy
,
468 .get_policy
= shm_get_policy
,
473 * newseg - Create a new shared memory segment
475 * @params: ptr to the structure that contains key, size and shmflg
477 * Called with shm_ids.rwsem held as a writer.
479 static int newseg(struct ipc_namespace
*ns
, struct ipc_params
*params
)
481 key_t key
= params
->key
;
482 int shmflg
= params
->flg
;
483 size_t size
= params
->u
.size
;
485 struct shmid_kernel
*shp
;
486 size_t numpages
= (size
+ PAGE_SIZE
- 1) >> PAGE_SHIFT
;
490 vm_flags_t acctflag
= 0;
492 if (size
< SHMMIN
|| size
> ns
->shm_ctlmax
)
495 if (numpages
<< PAGE_SHIFT
< size
)
498 if (ns
->shm_tot
+ numpages
< ns
->shm_tot
||
499 ns
->shm_tot
+ numpages
> ns
->shm_ctlall
)
502 shp
= ipc_rcu_alloc(sizeof(*shp
));
506 shp
->shm_perm
.key
= key
;
507 shp
->shm_perm
.mode
= (shmflg
& S_IRWXUGO
);
508 shp
->mlock_user
= NULL
;
510 shp
->shm_perm
.security
= NULL
;
511 error
= security_shm_alloc(shp
);
513 ipc_rcu_putref(shp
, ipc_rcu_free
);
517 sprintf(name
, "SYSV%08x", key
);
518 if (shmflg
& SHM_HUGETLB
) {
522 hs
= hstate_sizelog((shmflg
>> SHM_HUGE_SHIFT
) & SHM_HUGE_MASK
);
527 hugesize
= ALIGN(size
, huge_page_size(hs
));
529 /* hugetlb_file_setup applies strict accounting */
530 if (shmflg
& SHM_NORESERVE
)
531 acctflag
= VM_NORESERVE
;
532 file
= hugetlb_file_setup(name
, hugesize
, acctflag
,
533 &shp
->mlock_user
, HUGETLB_SHMFS_INODE
,
534 (shmflg
>> SHM_HUGE_SHIFT
) & SHM_HUGE_MASK
);
537 * Do not allow no accounting for OVERCOMMIT_NEVER, even
540 if ((shmflg
& SHM_NORESERVE
) &&
541 sysctl_overcommit_memory
!= OVERCOMMIT_NEVER
)
542 acctflag
= VM_NORESERVE
;
543 file
= shmem_file_setup(name
, size
, acctflag
);
545 error
= PTR_ERR(file
);
549 id
= ipc_addid(&shm_ids(ns
), &shp
->shm_perm
, ns
->shm_ctlmni
);
555 shp
->shm_cprid
= task_tgid_vnr(current
);
557 shp
->shm_atim
= shp
->shm_dtim
= 0;
558 shp
->shm_ctim
= get_seconds();
559 shp
->shm_segsz
= size
;
561 shp
->shm_file
= file
;
562 shp
->shm_creator
= current
;
563 list_add(&shp
->shm_clist
, ¤t
->sysvshm
.shm_clist
);
566 * shmid gets reported as "inode#" in /proc/pid/maps.
567 * proc-ps tools use this. Changing this will break them.
569 file_inode(file
)->i_ino
= shp
->shm_perm
.id
;
571 ns
->shm_tot
+= numpages
;
572 error
= shp
->shm_perm
.id
;
574 ipc_unlock_object(&shp
->shm_perm
);
579 if (is_file_hugepages(file
) && shp
->mlock_user
)
580 user_shm_unlock(size
, shp
->mlock_user
);
583 ipc_rcu_putref(shp
, shm_rcu_free
);
588 * Called with shm_ids.rwsem and ipcp locked.
590 static inline int shm_security(struct kern_ipc_perm
*ipcp
, int shmflg
)
592 struct shmid_kernel
*shp
;
594 shp
= container_of(ipcp
, struct shmid_kernel
, shm_perm
);
595 return security_shm_associate(shp
, shmflg
);
599 * Called with shm_ids.rwsem and ipcp locked.
601 static inline int shm_more_checks(struct kern_ipc_perm
*ipcp
,
602 struct ipc_params
*params
)
604 struct shmid_kernel
*shp
;
606 shp
= container_of(ipcp
, struct shmid_kernel
, shm_perm
);
607 if (shp
->shm_segsz
< params
->u
.size
)
613 SYSCALL_DEFINE3(shmget
, key_t
, key
, size_t, size
, int, shmflg
)
615 struct ipc_namespace
*ns
;
616 static const struct ipc_ops shm_ops
= {
618 .associate
= shm_security
,
619 .more_checks
= shm_more_checks
,
621 struct ipc_params shm_params
;
623 ns
= current
->nsproxy
->ipc_ns
;
625 shm_params
.key
= key
;
626 shm_params
.flg
= shmflg
;
627 shm_params
.u
.size
= size
;
629 return ipcget(ns
, &shm_ids(ns
), &shm_ops
, &shm_params
);
632 static inline unsigned long copy_shmid_to_user(void __user
*buf
, struct shmid64_ds
*in
, int version
)
636 return copy_to_user(buf
, in
, sizeof(*in
));
641 memset(&out
, 0, sizeof(out
));
642 ipc64_perm_to_ipc_perm(&in
->shm_perm
, &out
.shm_perm
);
643 out
.shm_segsz
= in
->shm_segsz
;
644 out
.shm_atime
= in
->shm_atime
;
645 out
.shm_dtime
= in
->shm_dtime
;
646 out
.shm_ctime
= in
->shm_ctime
;
647 out
.shm_cpid
= in
->shm_cpid
;
648 out
.shm_lpid
= in
->shm_lpid
;
649 out
.shm_nattch
= in
->shm_nattch
;
651 return copy_to_user(buf
, &out
, sizeof(out
));
658 static inline unsigned long
659 copy_shmid_from_user(struct shmid64_ds
*out
, void __user
*buf
, int version
)
663 if (copy_from_user(out
, buf
, sizeof(*out
)))
668 struct shmid_ds tbuf_old
;
670 if (copy_from_user(&tbuf_old
, buf
, sizeof(tbuf_old
)))
673 out
->shm_perm
.uid
= tbuf_old
.shm_perm
.uid
;
674 out
->shm_perm
.gid
= tbuf_old
.shm_perm
.gid
;
675 out
->shm_perm
.mode
= tbuf_old
.shm_perm
.mode
;
684 static inline unsigned long copy_shminfo_to_user(void __user
*buf
, struct shminfo64
*in
, int version
)
688 return copy_to_user(buf
, in
, sizeof(*in
));
693 if (in
->shmmax
> INT_MAX
)
694 out
.shmmax
= INT_MAX
;
696 out
.shmmax
= (int)in
->shmmax
;
698 out
.shmmin
= in
->shmmin
;
699 out
.shmmni
= in
->shmmni
;
700 out
.shmseg
= in
->shmseg
;
701 out
.shmall
= in
->shmall
;
703 return copy_to_user(buf
, &out
, sizeof(out
));
711 * Calculate and add used RSS and swap pages of a shm.
712 * Called with shm_ids.rwsem held as a reader
714 static void shm_add_rss_swap(struct shmid_kernel
*shp
,
715 unsigned long *rss_add
, unsigned long *swp_add
)
719 inode
= file_inode(shp
->shm_file
);
721 if (is_file_hugepages(shp
->shm_file
)) {
722 struct address_space
*mapping
= inode
->i_mapping
;
723 struct hstate
*h
= hstate_file(shp
->shm_file
);
724 *rss_add
+= pages_per_huge_page(h
) * mapping
->nrpages
;
727 struct shmem_inode_info
*info
= SHMEM_I(inode
);
728 spin_lock(&info
->lock
);
729 *rss_add
+= inode
->i_mapping
->nrpages
;
730 *swp_add
+= info
->swapped
;
731 spin_unlock(&info
->lock
);
733 *rss_add
+= inode
->i_mapping
->nrpages
;
739 * Called with shm_ids.rwsem held as a reader
741 static void shm_get_stat(struct ipc_namespace
*ns
, unsigned long *rss
,
750 in_use
= shm_ids(ns
).in_use
;
752 for (total
= 0, next_id
= 0; total
< in_use
; next_id
++) {
753 struct kern_ipc_perm
*ipc
;
754 struct shmid_kernel
*shp
;
756 ipc
= idr_find(&shm_ids(ns
).ipcs_idr
, next_id
);
759 shp
= container_of(ipc
, struct shmid_kernel
, shm_perm
);
761 shm_add_rss_swap(shp
, rss
, swp
);
768 * This function handles some shmctl commands which require the rwsem
769 * to be held in write mode.
770 * NOTE: no locks must be held, the rwsem is taken inside this function.
772 static int shmctl_down(struct ipc_namespace
*ns
, int shmid
, int cmd
,
773 struct shmid_ds __user
*buf
, int version
)
775 struct kern_ipc_perm
*ipcp
;
776 struct shmid64_ds shmid64
;
777 struct shmid_kernel
*shp
;
780 if (cmd
== IPC_SET
) {
781 if (copy_shmid_from_user(&shmid64
, buf
, version
))
785 down_write(&shm_ids(ns
).rwsem
);
788 ipcp
= ipcctl_pre_down_nolock(ns
, &shm_ids(ns
), shmid
, cmd
,
789 &shmid64
.shm_perm
, 0);
795 shp
= container_of(ipcp
, struct shmid_kernel
, shm_perm
);
797 err
= security_shm_shmctl(shp
, cmd
);
803 ipc_lock_object(&shp
->shm_perm
);
804 /* do_shm_rmid unlocks the ipc object and rcu */
805 do_shm_rmid(ns
, ipcp
);
808 ipc_lock_object(&shp
->shm_perm
);
809 err
= ipc_update_perm(&shmid64
.shm_perm
, ipcp
);
812 shp
->shm_ctim
= get_seconds();
820 ipc_unlock_object(&shp
->shm_perm
);
824 up_write(&shm_ids(ns
).rwsem
);
828 static int shmctl_nolock(struct ipc_namespace
*ns
, int shmid
,
829 int cmd
, int version
, void __user
*buf
)
832 struct shmid_kernel
*shp
;
834 /* preliminary security checks for *_INFO */
835 if (cmd
== IPC_INFO
|| cmd
== SHM_INFO
) {
836 err
= security_shm_shmctl(NULL
, cmd
);
844 struct shminfo64 shminfo
;
846 memset(&shminfo
, 0, sizeof(shminfo
));
847 shminfo
.shmmni
= shminfo
.shmseg
= ns
->shm_ctlmni
;
848 shminfo
.shmmax
= ns
->shm_ctlmax
;
849 shminfo
.shmall
= ns
->shm_ctlall
;
851 shminfo
.shmmin
= SHMMIN
;
852 if (copy_shminfo_to_user(buf
, &shminfo
, version
))
855 down_read(&shm_ids(ns
).rwsem
);
856 err
= ipc_get_maxid(&shm_ids(ns
));
857 up_read(&shm_ids(ns
).rwsem
);
865 struct shm_info shm_info
;
867 memset(&shm_info
, 0, sizeof(shm_info
));
868 down_read(&shm_ids(ns
).rwsem
);
869 shm_info
.used_ids
= shm_ids(ns
).in_use
;
870 shm_get_stat(ns
, &shm_info
.shm_rss
, &shm_info
.shm_swp
);
871 shm_info
.shm_tot
= ns
->shm_tot
;
872 shm_info
.swap_attempts
= 0;
873 shm_info
.swap_successes
= 0;
874 err
= ipc_get_maxid(&shm_ids(ns
));
875 up_read(&shm_ids(ns
).rwsem
);
876 if (copy_to_user(buf
, &shm_info
, sizeof(shm_info
))) {
881 err
= err
< 0 ? 0 : err
;
887 struct shmid64_ds tbuf
;
891 if (cmd
== SHM_STAT
) {
892 shp
= shm_obtain_object(ns
, shmid
);
897 result
= shp
->shm_perm
.id
;
899 shp
= shm_obtain_object_check(ns
, shmid
);
908 if (ipcperms(ns
, &shp
->shm_perm
, S_IRUGO
))
911 err
= security_shm_shmctl(shp
, cmd
);
915 memset(&tbuf
, 0, sizeof(tbuf
));
916 kernel_to_ipc64_perm(&shp
->shm_perm
, &tbuf
.shm_perm
);
917 tbuf
.shm_segsz
= shp
->shm_segsz
;
918 tbuf
.shm_atime
= shp
->shm_atim
;
919 tbuf
.shm_dtime
= shp
->shm_dtim
;
920 tbuf
.shm_ctime
= shp
->shm_ctim
;
921 tbuf
.shm_cpid
= shp
->shm_cprid
;
922 tbuf
.shm_lpid
= shp
->shm_lprid
;
923 tbuf
.shm_nattch
= shp
->shm_nattch
;
926 if (copy_shmid_to_user(buf
, &tbuf
, version
))
942 SYSCALL_DEFINE3(shmctl
, int, shmid
, int, cmd
, struct shmid_ds __user
*, buf
)
944 struct shmid_kernel
*shp
;
946 struct ipc_namespace
*ns
;
948 if (cmd
< 0 || shmid
< 0)
951 version
= ipc_parse_version(&cmd
);
952 ns
= current
->nsproxy
->ipc_ns
;
959 return shmctl_nolock(ns
, shmid
, cmd
, version
, buf
);
962 return shmctl_down(ns
, shmid
, cmd
, buf
, version
);
966 struct file
*shm_file
;
969 shp
= shm_obtain_object_check(ns
, shmid
);
975 audit_ipc_obj(&(shp
->shm_perm
));
976 err
= security_shm_shmctl(shp
, cmd
);
980 ipc_lock_object(&shp
->shm_perm
);
982 /* check if shm_destroy() is tearing down shp */
983 if (!ipc_valid_object(&shp
->shm_perm
)) {
988 if (!ns_capable(ns
->user_ns
, CAP_IPC_LOCK
)) {
989 kuid_t euid
= current_euid();
990 if (!uid_eq(euid
, shp
->shm_perm
.uid
) &&
991 !uid_eq(euid
, shp
->shm_perm
.cuid
)) {
995 if (cmd
== SHM_LOCK
&& !rlimit(RLIMIT_MEMLOCK
)) {
1001 shm_file
= shp
->shm_file
;
1002 if (is_file_hugepages(shm_file
))
1005 if (cmd
== SHM_LOCK
) {
1006 struct user_struct
*user
= current_user();
1007 err
= shmem_lock(shm_file
, 1, user
);
1008 if (!err
&& !(shp
->shm_perm
.mode
& SHM_LOCKED
)) {
1009 shp
->shm_perm
.mode
|= SHM_LOCKED
;
1010 shp
->mlock_user
= user
;
1016 if (!(shp
->shm_perm
.mode
& SHM_LOCKED
))
1018 shmem_lock(shm_file
, 0, shp
->mlock_user
);
1019 shp
->shm_perm
.mode
&= ~SHM_LOCKED
;
1020 shp
->mlock_user
= NULL
;
1022 ipc_unlock_object(&shp
->shm_perm
);
1024 shmem_unlock_mapping(shm_file
->f_mapping
);
1034 ipc_unlock_object(&shp
->shm_perm
);
1041 * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
1043 * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
1044 * "raddr" thing points to kernel space, and there has to be a wrapper around
1047 long do_shmat(int shmid
, char __user
*shmaddr
, int shmflg
, ulong
*raddr
,
1048 unsigned long shmlba
)
1050 struct shmid_kernel
*shp
;
1055 unsigned long flags
;
1058 struct ipc_namespace
*ns
;
1059 struct shm_file_data
*sfd
;
1062 unsigned long populate
= 0;
1067 else if ((addr
= (ulong
)shmaddr
)) {
1068 if (addr
& (shmlba
- 1)) {
1069 if (shmflg
& SHM_RND
)
1070 addr
&= ~(shmlba
- 1); /* round down */
1072 #ifndef __ARCH_FORCE_SHMLBA
1073 if (addr
& ~PAGE_MASK
)
1077 flags
= MAP_SHARED
| MAP_FIXED
;
1079 if ((shmflg
& SHM_REMAP
))
1085 if (shmflg
& SHM_RDONLY
) {
1088 f_mode
= FMODE_READ
;
1090 prot
= PROT_READ
| PROT_WRITE
;
1091 acc_mode
= S_IRUGO
| S_IWUGO
;
1092 f_mode
= FMODE_READ
| FMODE_WRITE
;
1094 if (shmflg
& SHM_EXEC
) {
1096 acc_mode
|= S_IXUGO
;
1100 * We cannot rely on the fs check since SYSV IPC does have an
1101 * additional creator id...
1103 ns
= current
->nsproxy
->ipc_ns
;
1105 shp
= shm_obtain_object_check(ns
, shmid
);
1112 if (ipcperms(ns
, &shp
->shm_perm
, acc_mode
))
1115 err
= security_shm_shmat(shp
, shmaddr
, shmflg
);
1119 ipc_lock_object(&shp
->shm_perm
);
1121 /* check if shm_destroy() is tearing down shp */
1122 if (!ipc_valid_object(&shp
->shm_perm
)) {
1123 ipc_unlock_object(&shp
->shm_perm
);
1128 path
= shp
->shm_file
->f_path
;
1131 size
= i_size_read(path
.dentry
->d_inode
);
1132 ipc_unlock_object(&shp
->shm_perm
);
1136 sfd
= kzalloc(sizeof(*sfd
), GFP_KERNEL
);
1142 file
= alloc_file(&path
, f_mode
,
1143 is_file_hugepages(shp
->shm_file
) ?
1144 &shm_file_operations_huge
:
1145 &shm_file_operations
);
1146 err
= PTR_ERR(file
);
1153 file
->private_data
= sfd
;
1154 file
->f_mapping
= shp
->shm_file
->f_mapping
;
1155 sfd
->id
= shp
->shm_perm
.id
;
1156 sfd
->ns
= get_ipc_ns(ns
);
1157 sfd
->file
= shp
->shm_file
;
1160 err
= security_mmap_file(file
, prot
, flags
);
1164 down_write(¤t
->mm
->mmap_sem
);
1165 if (addr
&& !(shmflg
& SHM_REMAP
)) {
1167 if (addr
+ size
< addr
)
1170 if (find_vma_intersection(current
->mm
, addr
, addr
+ size
))
1173 * If shm segment goes below stack, make sure there is some
1174 * space left for the stack to grow (at least 4 pages).
1176 if (addr
< current
->mm
->start_stack
&&
1177 addr
> current
->mm
->start_stack
- size
- PAGE_SIZE
* 5)
1181 addr
= do_mmap_pgoff(file
, addr
, size
, prot
, flags
, 0, &populate
);
1184 if (IS_ERR_VALUE(addr
))
1187 up_write(¤t
->mm
->mmap_sem
);
1189 mm_populate(addr
, populate
);
1195 down_write(&shm_ids(ns
).rwsem
);
1196 shp
= shm_lock(ns
, shmid
);
1197 BUG_ON(IS_ERR(shp
));
1199 if (shm_may_destroy(ns
, shp
))
1200 shm_destroy(ns
, shp
);
1203 up_write(&shm_ids(ns
).rwsem
);
1212 SYSCALL_DEFINE3(shmat
, int, shmid
, char __user
*, shmaddr
, int, shmflg
)
1217 err
= do_shmat(shmid
, shmaddr
, shmflg
, &ret
, SHMLBA
);
1220 force_successful_syscall_return();
1225 * detach and kill segment if marked destroyed.
1226 * The work is done in shm_close.
1228 SYSCALL_DEFINE1(shmdt
, char __user
*, shmaddr
)
1230 struct mm_struct
*mm
= current
->mm
;
1231 struct vm_area_struct
*vma
;
1232 unsigned long addr
= (unsigned long)shmaddr
;
1233 int retval
= -EINVAL
;
1236 struct vm_area_struct
*next
;
1239 if (addr
& ~PAGE_MASK
)
1242 down_write(&mm
->mmap_sem
);
1245 * This function tries to be smart and unmap shm segments that
1246 * were modified by partial mlock or munmap calls:
1247 * - It first determines the size of the shm segment that should be
1248 * unmapped: It searches for a vma that is backed by shm and that
1249 * started at address shmaddr. It records it's size and then unmaps
1251 * - Then it unmaps all shm vmas that started at shmaddr and that
1252 * are within the initially determined size.
1253 * Errors from do_munmap are ignored: the function only fails if
1254 * it's called with invalid parameters or if it's called to unmap
1255 * a part of a vma. Both calls in this function are for full vmas,
1256 * the parameters are directly copied from the vma itself and always
1257 * valid - therefore do_munmap cannot fail. (famous last words?)
1260 * If it had been mremap()'d, the starting address would not
1261 * match the usual checks anyway. So assume all vma's are
1262 * above the starting address given.
1264 vma
= find_vma(mm
, addr
);
1268 next
= vma
->vm_next
;
1271 * Check if the starting address would match, i.e. it's
1272 * a fragment created by mprotect() and/or munmap(), or it
1273 * otherwise it starts at this address with no hassles.
1275 if ((vma
->vm_ops
== &shm_vm_ops
) &&
1276 (vma
->vm_start
- addr
)/PAGE_SIZE
== vma
->vm_pgoff
) {
1279 size
= file_inode(vma
->vm_file
)->i_size
;
1280 do_munmap(mm
, vma
->vm_start
, vma
->vm_end
- vma
->vm_start
);
1282 * We discovered the size of the shm segment, so
1283 * break out of here and fall through to the next
1284 * loop that uses the size information to stop
1285 * searching for matching vma's.
1295 * We need look no further than the maximum address a fragment
1296 * could possibly have landed at. Also cast things to loff_t to
1297 * prevent overflows and make comparisons vs. equal-width types.
1299 size
= PAGE_ALIGN(size
);
1300 while (vma
&& (loff_t
)(vma
->vm_end
- addr
) <= size
) {
1301 next
= vma
->vm_next
;
1303 /* finding a matching vma now does not alter retval */
1304 if ((vma
->vm_ops
== &shm_vm_ops
) &&
1305 (vma
->vm_start
- addr
)/PAGE_SIZE
== vma
->vm_pgoff
)
1307 do_munmap(mm
, vma
->vm_start
, vma
->vm_end
- vma
->vm_start
);
1311 #else /* CONFIG_MMU */
1312 /* under NOMMU conditions, the exact address to be destroyed must be
1314 if (vma
&& vma
->vm_start
== addr
&& vma
->vm_ops
== &shm_vm_ops
) {
1315 do_munmap(mm
, vma
->vm_start
, vma
->vm_end
- vma
->vm_start
);
1321 up_write(&mm
->mmap_sem
);
1325 #ifdef CONFIG_PROC_FS
1326 static int sysvipc_shm_proc_show(struct seq_file
*s
, void *it
)
1328 struct user_namespace
*user_ns
= seq_user_ns(s
);
1329 struct shmid_kernel
*shp
= it
;
1330 unsigned long rss
= 0, swp
= 0;
1332 shm_add_rss_swap(shp
, &rss
, &swp
);
1334 #if BITS_PER_LONG <= 32
1335 #define SIZE_SPEC "%10lu"
1337 #define SIZE_SPEC "%21lu"
1340 return seq_printf(s
,
1341 "%10d %10d %4o " SIZE_SPEC
" %5u %5u "
1342 "%5lu %5u %5u %5u %5u %10lu %10lu %10lu "
1343 SIZE_SPEC
" " SIZE_SPEC
"\n",
1351 from_kuid_munged(user_ns
, shp
->shm_perm
.uid
),
1352 from_kgid_munged(user_ns
, shp
->shm_perm
.gid
),
1353 from_kuid_munged(user_ns
, shp
->shm_perm
.cuid
),
1354 from_kgid_munged(user_ns
, shp
->shm_perm
.cgid
),