xref: /openbmc/linux/ipc/shm.c (revision d5cb9783536a41df9f9cba5b0a1d78047ed787f7)
1 /*
2  * linux/ipc/shm.c
3  * Copyright (C) 1992, 1993 Krishna Balasubramanian
4  *	 Many improvements/fixes by Bruno Haible.
5  * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
6  * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
7  *
8  * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
9  * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
10  * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
11  * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
12  * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
13  * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
14  * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
15  *
16  */
17 
18 #include <linux/config.h>
19 #include <linux/slab.h>
20 #include <linux/mm.h>
21 #include <linux/hugetlb.h>
22 #include <linux/shm.h>
23 #include <linux/init.h>
24 #include <linux/file.h>
25 #include <linux/mman.h>
26 #include <linux/shmem_fs.h>
27 #include <linux/security.h>
28 #include <linux/syscalls.h>
29 #include <linux/audit.h>
30 #include <linux/ptrace.h>
31 #include <linux/seq_file.h>
32 
33 #include <asm/uaccess.h>
34 
35 #include "util.h"
36 
37 #define shm_flags	shm_perm.mode
38 
39 static struct file_operations shm_file_operations;
40 static struct vm_operations_struct shm_vm_ops;
41 
42 static struct ipc_ids shm_ids;
43 
44 #define shm_lock(id)	((struct shmid_kernel*)ipc_lock(&shm_ids,id))
45 #define shm_unlock(shp)	ipc_unlock(&(shp)->shm_perm)
46 #define shm_get(id)	((struct shmid_kernel*)ipc_get(&shm_ids,id))
47 #define shm_buildid(id, seq) \
48 	ipc_buildid(&shm_ids, id, seq)
49 
50 static int newseg (key_t key, int shmflg, size_t size);
51 static void shm_open (struct vm_area_struct *shmd);
52 static void shm_close (struct vm_area_struct *shmd);
53 #ifdef CONFIG_PROC_FS
54 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
55 #endif
56 
57 size_t	shm_ctlmax = SHMMAX;
58 size_t 	shm_ctlall = SHMALL;
59 int 	shm_ctlmni = SHMMNI;
60 
61 static int shm_tot; /* total number of shared memory pages */
62 
63 void __init shm_init (void)
64 {
65 	ipc_init_ids(&shm_ids, 1);
66 	ipc_init_proc_interface("sysvipc/shm",
67 				"       key      shmid perms       size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime\n",
68 				&shm_ids,
69 				sysvipc_shm_proc_show);
70 }
71 
72 static inline int shm_checkid(struct shmid_kernel *s, int id)
73 {
74 	if (ipc_checkid(&shm_ids,&s->shm_perm,id))
75 		return -EIDRM;
76 	return 0;
77 }
78 
79 static inline struct shmid_kernel *shm_rmid(int id)
80 {
81 	return (struct shmid_kernel *)ipc_rmid(&shm_ids,id);
82 }
83 
84 static inline int shm_addid(struct shmid_kernel *shp)
85 {
86 	return ipc_addid(&shm_ids, &shp->shm_perm, shm_ctlmni);
87 }
88 
89 
90 
91 static inline void shm_inc (int id) {
92 	struct shmid_kernel *shp;
93 
94 	if(!(shp = shm_lock(id)))
95 		BUG();
96 	shp->shm_atim = get_seconds();
97 	shp->shm_lprid = current->tgid;
98 	shp->shm_nattch++;
99 	shm_unlock(shp);
100 }
101 
102 /* This is called by fork, once for every shm attach. */
103 static void shm_open (struct vm_area_struct *shmd)
104 {
105 	shm_inc (shmd->vm_file->f_dentry->d_inode->i_ino);
106 }
107 
108 /*
109  * shm_destroy - free the struct shmid_kernel
110  *
111  * @shp: struct to free
112  *
113  * It has to be called with shp and shm_ids.sem locked,
114  * but returns with shp unlocked and freed.
115  */
116 static void shm_destroy (struct shmid_kernel *shp)
117 {
118 	shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
119 	shm_rmid (shp->id);
120 	shm_unlock(shp);
121 	if (!is_file_hugepages(shp->shm_file))
122 		shmem_lock(shp->shm_file, 0, shp->mlock_user);
123 	else
124 		user_shm_unlock(shp->shm_file->f_dentry->d_inode->i_size,
125 						shp->mlock_user);
126 	fput (shp->shm_file);
127 	security_shm_free(shp);
128 	ipc_rcu_putref(shp);
129 }
130 
131 /*
132  * remove the attach descriptor shmd.
133  * free memory for segment if it is marked destroyed.
134  * The descriptor has already been removed from the current->mm->mmap list
135  * and will later be kfree()d.
136  */
137 static void shm_close (struct vm_area_struct *shmd)
138 {
139 	struct file * file = shmd->vm_file;
140 	int id = file->f_dentry->d_inode->i_ino;
141 	struct shmid_kernel *shp;
142 
143 	down (&shm_ids.sem);
144 	/* remove from the list of attaches of the shm segment */
145 	if(!(shp = shm_lock(id)))
146 		BUG();
147 	shp->shm_lprid = current->tgid;
148 	shp->shm_dtim = get_seconds();
149 	shp->shm_nattch--;
150 	if(shp->shm_nattch == 0 &&
151 	   shp->shm_flags & SHM_DEST)
152 		shm_destroy (shp);
153 	else
154 		shm_unlock(shp);
155 	up (&shm_ids.sem);
156 }
157 
158 static int shm_mmap(struct file * file, struct vm_area_struct * vma)
159 {
160 	file_accessed(file);
161 	vma->vm_ops = &shm_vm_ops;
162 	shm_inc(file->f_dentry->d_inode->i_ino);
163 	return 0;
164 }
165 
166 static struct file_operations shm_file_operations = {
167 	.mmap	= shm_mmap
168 };
169 
170 static struct vm_operations_struct shm_vm_ops = {
171 	.open	= shm_open,	/* callback for a new vm-area open */
172 	.close	= shm_close,	/* callback for when the vm-area is released */
173 	.nopage	= shmem_nopage,
174 #if defined(CONFIG_NUMA) && defined(CONFIG_SHMEM)
175 	.set_policy = shmem_set_policy,
176 	.get_policy = shmem_get_policy,
177 #endif
178 };
179 
180 static int newseg (key_t key, int shmflg, size_t size)
181 {
182 	int error;
183 	struct shmid_kernel *shp;
184 	int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
185 	struct file * file;
186 	char name[13];
187 	int id;
188 
189 	if (size < SHMMIN || size > shm_ctlmax)
190 		return -EINVAL;
191 
192 	if (shm_tot + numpages >= shm_ctlall)
193 		return -ENOSPC;
194 
195 	shp = ipc_rcu_alloc(sizeof(*shp));
196 	if (!shp)
197 		return -ENOMEM;
198 
199 	shp->shm_perm.key = key;
200 	shp->shm_flags = (shmflg & S_IRWXUGO);
201 	shp->mlock_user = NULL;
202 
203 	shp->shm_perm.security = NULL;
204 	error = security_shm_alloc(shp);
205 	if (error) {
206 		ipc_rcu_putref(shp);
207 		return error;
208 	}
209 
210 	if (shmflg & SHM_HUGETLB) {
211 		/* hugetlb_zero_setup takes care of mlock user accounting */
212 		file = hugetlb_zero_setup(size);
213 		shp->mlock_user = current->user;
214 	} else {
215 		sprintf (name, "SYSV%08x", key);
216 		file = shmem_file_setup(name, size, VM_ACCOUNT);
217 	}
218 	error = PTR_ERR(file);
219 	if (IS_ERR(file))
220 		goto no_file;
221 
222 	error = -ENOSPC;
223 	id = shm_addid(shp);
224 	if(id == -1)
225 		goto no_id;
226 
227 	shp->shm_cprid = current->tgid;
228 	shp->shm_lprid = 0;
229 	shp->shm_atim = shp->shm_dtim = 0;
230 	shp->shm_ctim = get_seconds();
231 	shp->shm_segsz = size;
232 	shp->shm_nattch = 0;
233 	shp->id = shm_buildid(id,shp->shm_perm.seq);
234 	shp->shm_file = file;
235 	file->f_dentry->d_inode->i_ino = shp->id;
236 
237 	/* Hugetlb ops would have already been assigned. */
238 	if (!(shmflg & SHM_HUGETLB))
239 		file->f_op = &shm_file_operations;
240 
241 	shm_tot += numpages;
242 	shm_unlock(shp);
243 	return shp->id;
244 
245 no_id:
246 	fput(file);
247 no_file:
248 	security_shm_free(shp);
249 	ipc_rcu_putref(shp);
250 	return error;
251 }
252 
253 asmlinkage long sys_shmget (key_t key, size_t size, int shmflg)
254 {
255 	struct shmid_kernel *shp;
256 	int err, id = 0;
257 
258 	down(&shm_ids.sem);
259 	if (key == IPC_PRIVATE) {
260 		err = newseg(key, shmflg, size);
261 	} else if ((id = ipc_findkey(&shm_ids, key)) == -1) {
262 		if (!(shmflg & IPC_CREAT))
263 			err = -ENOENT;
264 		else
265 			err = newseg(key, shmflg, size);
266 	} else if ((shmflg & IPC_CREAT) && (shmflg & IPC_EXCL)) {
267 		err = -EEXIST;
268 	} else {
269 		shp = shm_lock(id);
270 		if(shp==NULL)
271 			BUG();
272 		if (shp->shm_segsz < size)
273 			err = -EINVAL;
274 		else if (ipcperms(&shp->shm_perm, shmflg))
275 			err = -EACCES;
276 		else {
277 			int shmid = shm_buildid(id, shp->shm_perm.seq);
278 			err = security_shm_associate(shp, shmflg);
279 			if (!err)
280 				err = shmid;
281 		}
282 		shm_unlock(shp);
283 	}
284 	up(&shm_ids.sem);
285 
286 	return err;
287 }
288 
289 static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
290 {
291 	switch(version) {
292 	case IPC_64:
293 		return copy_to_user(buf, in, sizeof(*in));
294 	case IPC_OLD:
295 	    {
296 		struct shmid_ds out;
297 
298 		ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
299 		out.shm_segsz	= in->shm_segsz;
300 		out.shm_atime	= in->shm_atime;
301 		out.shm_dtime	= in->shm_dtime;
302 		out.shm_ctime	= in->shm_ctime;
303 		out.shm_cpid	= in->shm_cpid;
304 		out.shm_lpid	= in->shm_lpid;
305 		out.shm_nattch	= in->shm_nattch;
306 
307 		return copy_to_user(buf, &out, sizeof(out));
308 	    }
309 	default:
310 		return -EINVAL;
311 	}
312 }
313 
314 struct shm_setbuf {
315 	uid_t	uid;
316 	gid_t	gid;
317 	mode_t	mode;
318 };
319 
320 static inline unsigned long copy_shmid_from_user(struct shm_setbuf *out, void __user *buf, int version)
321 {
322 	switch(version) {
323 	case IPC_64:
324 	    {
325 		struct shmid64_ds tbuf;
326 
327 		if (copy_from_user(&tbuf, buf, sizeof(tbuf)))
328 			return -EFAULT;
329 
330 		out->uid	= tbuf.shm_perm.uid;
331 		out->gid	= tbuf.shm_perm.gid;
332 		out->mode	= tbuf.shm_flags;
333 
334 		return 0;
335 	    }
336 	case IPC_OLD:
337 	    {
338 		struct shmid_ds tbuf_old;
339 
340 		if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
341 			return -EFAULT;
342 
343 		out->uid	= tbuf_old.shm_perm.uid;
344 		out->gid	= tbuf_old.shm_perm.gid;
345 		out->mode	= tbuf_old.shm_flags;
346 
347 		return 0;
348 	    }
349 	default:
350 		return -EINVAL;
351 	}
352 }
353 
354 static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
355 {
356 	switch(version) {
357 	case IPC_64:
358 		return copy_to_user(buf, in, sizeof(*in));
359 	case IPC_OLD:
360 	    {
361 		struct shminfo out;
362 
363 		if(in->shmmax > INT_MAX)
364 			out.shmmax = INT_MAX;
365 		else
366 			out.shmmax = (int)in->shmmax;
367 
368 		out.shmmin	= in->shmmin;
369 		out.shmmni	= in->shmmni;
370 		out.shmseg	= in->shmseg;
371 		out.shmall	= in->shmall;
372 
373 		return copy_to_user(buf, &out, sizeof(out));
374 	    }
375 	default:
376 		return -EINVAL;
377 	}
378 }
379 
380 static void shm_get_stat(unsigned long *rss, unsigned long *swp)
381 {
382 	int i;
383 
384 	*rss = 0;
385 	*swp = 0;
386 
387 	for (i = 0; i <= shm_ids.max_id; i++) {
388 		struct shmid_kernel *shp;
389 		struct inode *inode;
390 
391 		shp = shm_get(i);
392 		if(!shp)
393 			continue;
394 
395 		inode = shp->shm_file->f_dentry->d_inode;
396 
397 		if (is_file_hugepages(shp->shm_file)) {
398 			struct address_space *mapping = inode->i_mapping;
399 			*rss += (HPAGE_SIZE/PAGE_SIZE)*mapping->nrpages;
400 		} else {
401 			struct shmem_inode_info *info = SHMEM_I(inode);
402 			spin_lock(&info->lock);
403 			*rss += inode->i_mapping->nrpages;
404 			*swp += info->swapped;
405 			spin_unlock(&info->lock);
406 		}
407 	}
408 }
409 
410 asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf)
411 {
412 	struct shm_setbuf setbuf;
413 	struct shmid_kernel *shp;
414 	int err, version;
415 
416 	if (cmd < 0 || shmid < 0) {
417 		err = -EINVAL;
418 		goto out;
419 	}
420 
421 	version = ipc_parse_version(&cmd);
422 
423 	switch (cmd) { /* replace with proc interface ? */
424 	case IPC_INFO:
425 	{
426 		struct shminfo64 shminfo;
427 
428 		err = security_shm_shmctl(NULL, cmd);
429 		if (err)
430 			return err;
431 
432 		memset(&shminfo,0,sizeof(shminfo));
433 		shminfo.shmmni = shminfo.shmseg = shm_ctlmni;
434 		shminfo.shmmax = shm_ctlmax;
435 		shminfo.shmall = shm_ctlall;
436 
437 		shminfo.shmmin = SHMMIN;
438 		if(copy_shminfo_to_user (buf, &shminfo, version))
439 			return -EFAULT;
440 		/* reading a integer is always atomic */
441 		err= shm_ids.max_id;
442 		if(err<0)
443 			err = 0;
444 		goto out;
445 	}
446 	case SHM_INFO:
447 	{
448 		struct shm_info shm_info;
449 
450 		err = security_shm_shmctl(NULL, cmd);
451 		if (err)
452 			return err;
453 
454 		memset(&shm_info,0,sizeof(shm_info));
455 		down(&shm_ids.sem);
456 		shm_info.used_ids = shm_ids.in_use;
457 		shm_get_stat (&shm_info.shm_rss, &shm_info.shm_swp);
458 		shm_info.shm_tot = shm_tot;
459 		shm_info.swap_attempts = 0;
460 		shm_info.swap_successes = 0;
461 		err = shm_ids.max_id;
462 		up(&shm_ids.sem);
463 		if(copy_to_user (buf, &shm_info, sizeof(shm_info))) {
464 			err = -EFAULT;
465 			goto out;
466 		}
467 
468 		err = err < 0 ? 0 : err;
469 		goto out;
470 	}
471 	case SHM_STAT:
472 	case IPC_STAT:
473 	{
474 		struct shmid64_ds tbuf;
475 		int result;
476 		memset(&tbuf, 0, sizeof(tbuf));
477 		shp = shm_lock(shmid);
478 		if(shp==NULL) {
479 			err = -EINVAL;
480 			goto out;
481 		} else if(cmd==SHM_STAT) {
482 			err = -EINVAL;
483 			if (shmid > shm_ids.max_id)
484 				goto out_unlock;
485 			result = shm_buildid(shmid, shp->shm_perm.seq);
486 		} else {
487 			err = shm_checkid(shp,shmid);
488 			if(err)
489 				goto out_unlock;
490 			result = 0;
491 		}
492 		err=-EACCES;
493 		if (ipcperms (&shp->shm_perm, S_IRUGO))
494 			goto out_unlock;
495 		err = security_shm_shmctl(shp, cmd);
496 		if (err)
497 			goto out_unlock;
498 		kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm);
499 		tbuf.shm_segsz	= shp->shm_segsz;
500 		tbuf.shm_atime	= shp->shm_atim;
501 		tbuf.shm_dtime	= shp->shm_dtim;
502 		tbuf.shm_ctime	= shp->shm_ctim;
503 		tbuf.shm_cpid	= shp->shm_cprid;
504 		tbuf.shm_lpid	= shp->shm_lprid;
505 		if (!is_file_hugepages(shp->shm_file))
506 			tbuf.shm_nattch	= shp->shm_nattch;
507 		else
508 			tbuf.shm_nattch = file_count(shp->shm_file) - 1;
509 		shm_unlock(shp);
510 		if(copy_shmid_to_user (buf, &tbuf, version))
511 			err = -EFAULT;
512 		else
513 			err = result;
514 		goto out;
515 	}
516 	case SHM_LOCK:
517 	case SHM_UNLOCK:
518 	{
519 		shp = shm_lock(shmid);
520 		if(shp==NULL) {
521 			err = -EINVAL;
522 			goto out;
523 		}
524 		err = shm_checkid(shp,shmid);
525 		if(err)
526 			goto out_unlock;
527 
528 		if (!capable(CAP_IPC_LOCK)) {
529 			err = -EPERM;
530 			if (current->euid != shp->shm_perm.uid &&
531 			    current->euid != shp->shm_perm.cuid)
532 				goto out_unlock;
533 			if (cmd == SHM_LOCK &&
534 			    !current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur)
535 				goto out_unlock;
536 		}
537 
538 		err = security_shm_shmctl(shp, cmd);
539 		if (err)
540 			goto out_unlock;
541 
542 		if(cmd==SHM_LOCK) {
543 			struct user_struct * user = current->user;
544 			if (!is_file_hugepages(shp->shm_file)) {
545 				err = shmem_lock(shp->shm_file, 1, user);
546 				if (!err) {
547 					shp->shm_flags |= SHM_LOCKED;
548 					shp->mlock_user = user;
549 				}
550 			}
551 		} else if (!is_file_hugepages(shp->shm_file)) {
552 			shmem_lock(shp->shm_file, 0, shp->mlock_user);
553 			shp->shm_flags &= ~SHM_LOCKED;
554 			shp->mlock_user = NULL;
555 		}
556 		shm_unlock(shp);
557 		goto out;
558 	}
559 	case IPC_RMID:
560 	{
561 		/*
562 		 *	We cannot simply remove the file. The SVID states
563 		 *	that the block remains until the last person
564 		 *	detaches from it, then is deleted. A shmat() on
565 		 *	an RMID segment is legal in older Linux and if
566 		 *	we change it apps break...
567 		 *
568 		 *	Instead we set a destroyed flag, and then blow
569 		 *	the name away when the usage hits zero.
570 		 */
571 		down(&shm_ids.sem);
572 		shp = shm_lock(shmid);
573 		err = -EINVAL;
574 		if (shp == NULL)
575 			goto out_up;
576 		err = shm_checkid(shp, shmid);
577 		if(err)
578 			goto out_unlock_up;
579 
580 		if (current->euid != shp->shm_perm.uid &&
581 		    current->euid != shp->shm_perm.cuid &&
582 		    !capable(CAP_SYS_ADMIN)) {
583 			err=-EPERM;
584 			goto out_unlock_up;
585 		}
586 
587 		err = security_shm_shmctl(shp, cmd);
588 		if (err)
589 			goto out_unlock_up;
590 
591 		if (shp->shm_nattch){
592 			shp->shm_flags |= SHM_DEST;
593 			/* Do not find it any more */
594 			shp->shm_perm.key = IPC_PRIVATE;
595 			shm_unlock(shp);
596 		} else
597 			shm_destroy (shp);
598 		up(&shm_ids.sem);
599 		goto out;
600 	}
601 
602 	case IPC_SET:
603 	{
604 		if (copy_shmid_from_user (&setbuf, buf, version)) {
605 			err = -EFAULT;
606 			goto out;
607 		}
608 		if ((err = audit_ipc_perms(0, setbuf.uid, setbuf.gid, setbuf.mode)))
609 			return err;
610 		down(&shm_ids.sem);
611 		shp = shm_lock(shmid);
612 		err=-EINVAL;
613 		if(shp==NULL)
614 			goto out_up;
615 		err = shm_checkid(shp,shmid);
616 		if(err)
617 			goto out_unlock_up;
618 		err=-EPERM;
619 		if (current->euid != shp->shm_perm.uid &&
620 		    current->euid != shp->shm_perm.cuid &&
621 		    !capable(CAP_SYS_ADMIN)) {
622 			goto out_unlock_up;
623 		}
624 
625 		err = security_shm_shmctl(shp, cmd);
626 		if (err)
627 			goto out_unlock_up;
628 
629 		shp->shm_perm.uid = setbuf.uid;
630 		shp->shm_perm.gid = setbuf.gid;
631 		shp->shm_flags = (shp->shm_flags & ~S_IRWXUGO)
632 			| (setbuf.mode & S_IRWXUGO);
633 		shp->shm_ctim = get_seconds();
634 		break;
635 	}
636 
637 	default:
638 		err = -EINVAL;
639 		goto out;
640 	}
641 
642 	err = 0;
643 out_unlock_up:
644 	shm_unlock(shp);
645 out_up:
646 	up(&shm_ids.sem);
647 	goto out;
648 out_unlock:
649 	shm_unlock(shp);
650 out:
651 	return err;
652 }
653 
654 /*
655  * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
656  *
657  * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
658  * "raddr" thing points to kernel space, and there has to be a wrapper around
659  * this.
660  */
661 long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
662 {
663 	struct shmid_kernel *shp;
664 	unsigned long addr;
665 	unsigned long size;
666 	struct file * file;
667 	int    err;
668 	unsigned long flags;
669 	unsigned long prot;
670 	unsigned long o_flags;
671 	int acc_mode;
672 	void *user_addr;
673 
674 	if (shmid < 0) {
675 		err = -EINVAL;
676 		goto out;
677 	} else if ((addr = (ulong)shmaddr)) {
678 		if (addr & (SHMLBA-1)) {
679 			if (shmflg & SHM_RND)
680 				addr &= ~(SHMLBA-1);	   /* round down */
681 			else
682 #ifndef __ARCH_FORCE_SHMLBA
683 				if (addr & ~PAGE_MASK)
684 #endif
685 					return -EINVAL;
686 		}
687 		flags = MAP_SHARED | MAP_FIXED;
688 	} else {
689 		if ((shmflg & SHM_REMAP))
690 			return -EINVAL;
691 
692 		flags = MAP_SHARED;
693 	}
694 
695 	if (shmflg & SHM_RDONLY) {
696 		prot = PROT_READ;
697 		o_flags = O_RDONLY;
698 		acc_mode = S_IRUGO;
699 	} else {
700 		prot = PROT_READ | PROT_WRITE;
701 		o_flags = O_RDWR;
702 		acc_mode = S_IRUGO | S_IWUGO;
703 	}
704 	if (shmflg & SHM_EXEC) {
705 		prot |= PROT_EXEC;
706 		acc_mode |= S_IXUGO;
707 	}
708 
709 	/*
710 	 * We cannot rely on the fs check since SYSV IPC does have an
711 	 * additional creator id...
712 	 */
713 	shp = shm_lock(shmid);
714 	if(shp == NULL) {
715 		err = -EINVAL;
716 		goto out;
717 	}
718 	err = shm_checkid(shp,shmid);
719 	if (err) {
720 		shm_unlock(shp);
721 		goto out;
722 	}
723 	if (ipcperms(&shp->shm_perm, acc_mode)) {
724 		shm_unlock(shp);
725 		err = -EACCES;
726 		goto out;
727 	}
728 
729 	err = security_shm_shmat(shp, shmaddr, shmflg);
730 	if (err) {
731 		shm_unlock(shp);
732 		return err;
733 	}
734 
735 	file = shp->shm_file;
736 	size = i_size_read(file->f_dentry->d_inode);
737 	shp->shm_nattch++;
738 	shm_unlock(shp);
739 
740 	down_write(&current->mm->mmap_sem);
741 	if (addr && !(shmflg & SHM_REMAP)) {
742 		user_addr = ERR_PTR(-EINVAL);
743 		if (find_vma_intersection(current->mm, addr, addr + size))
744 			goto invalid;
745 		/*
746 		 * If shm segment goes below stack, make sure there is some
747 		 * space left for the stack to grow (at least 4 pages).
748 		 */
749 		if (addr < current->mm->start_stack &&
750 		    addr > current->mm->start_stack - size - PAGE_SIZE * 5)
751 			goto invalid;
752 	}
753 
754 	user_addr = (void*) do_mmap (file, addr, size, prot, flags, 0);
755 
756 invalid:
757 	up_write(&current->mm->mmap_sem);
758 
759 	down (&shm_ids.sem);
760 	if(!(shp = shm_lock(shmid)))
761 		BUG();
762 	shp->shm_nattch--;
763 	if(shp->shm_nattch == 0 &&
764 	   shp->shm_flags & SHM_DEST)
765 		shm_destroy (shp);
766 	else
767 		shm_unlock(shp);
768 	up (&shm_ids.sem);
769 
770 	*raddr = (unsigned long) user_addr;
771 	err = 0;
772 	if (IS_ERR(user_addr))
773 		err = PTR_ERR(user_addr);
774 out:
775 	return err;
776 }
777 
778 asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg)
779 {
780 	unsigned long ret;
781 	long err;
782 
783 	err = do_shmat(shmid, shmaddr, shmflg, &ret);
784 	if (err)
785 		return err;
786 	force_successful_syscall_return();
787 	return (long)ret;
788 }
789 
790 /*
791  * detach and kill segment if marked destroyed.
792  * The work is done in shm_close.
793  */
794 asmlinkage long sys_shmdt(char __user *shmaddr)
795 {
796 	struct mm_struct *mm = current->mm;
797 	struct vm_area_struct *vma, *next;
798 	unsigned long addr = (unsigned long)shmaddr;
799 	loff_t size = 0;
800 	int retval = -EINVAL;
801 
802 	down_write(&mm->mmap_sem);
803 
804 	/*
805 	 * This function tries to be smart and unmap shm segments that
806 	 * were modified by partial mlock or munmap calls:
807 	 * - It first determines the size of the shm segment that should be
808 	 *   unmapped: It searches for a vma that is backed by shm and that
809 	 *   started at address shmaddr. It records it's size and then unmaps
810 	 *   it.
811 	 * - Then it unmaps all shm vmas that started at shmaddr and that
812 	 *   are within the initially determined size.
813 	 * Errors from do_munmap are ignored: the function only fails if
814 	 * it's called with invalid parameters or if it's called to unmap
815 	 * a part of a vma. Both calls in this function are for full vmas,
816 	 * the parameters are directly copied from the vma itself and always
817 	 * valid - therefore do_munmap cannot fail. (famous last words?)
818 	 */
819 	/*
820 	 * If it had been mremap()'d, the starting address would not
821 	 * match the usual checks anyway. So assume all vma's are
822 	 * above the starting address given.
823 	 */
824 	vma = find_vma(mm, addr);
825 
826 	while (vma) {
827 		next = vma->vm_next;
828 
829 		/*
830 		 * Check if the starting address would match, i.e. it's
831 		 * a fragment created by mprotect() and/or munmap(), or it
832 		 * otherwise it starts at this address with no hassles.
833 		 */
834 		if ((vma->vm_ops == &shm_vm_ops || is_vm_hugetlb_page(vma)) &&
835 			(vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) {
836 
837 
838 			size = vma->vm_file->f_dentry->d_inode->i_size;
839 			do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
840 			/*
841 			 * We discovered the size of the shm segment, so
842 			 * break out of here and fall through to the next
843 			 * loop that uses the size information to stop
844 			 * searching for matching vma's.
845 			 */
846 			retval = 0;
847 			vma = next;
848 			break;
849 		}
850 		vma = next;
851 	}
852 
853 	/*
854 	 * We need look no further than the maximum address a fragment
855 	 * could possibly have landed at. Also cast things to loff_t to
856 	 * prevent overflows and make comparisions vs. equal-width types.
857 	 */
858 	while (vma && (loff_t)(vma->vm_end - addr) <= size) {
859 		next = vma->vm_next;
860 
861 		/* finding a matching vma now does not alter retval */
862 		if ((vma->vm_ops == &shm_vm_ops || is_vm_hugetlb_page(vma)) &&
863 			(vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff)
864 
865 			do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
866 		vma = next;
867 	}
868 
869 	up_write(&mm->mmap_sem);
870 	return retval;
871 }
872 
873 #ifdef CONFIG_PROC_FS
874 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
875 {
876 	struct shmid_kernel *shp = it;
877 	char *format;
878 
879 #define SMALL_STRING "%10d %10d  %4o %10u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
880 #define BIG_STRING   "%10d %10d  %4o %21u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
881 
882 	if (sizeof(size_t) <= sizeof(int))
883 		format = SMALL_STRING;
884 	else
885 		format = BIG_STRING;
886 	return seq_printf(s, format,
887 			  shp->shm_perm.key,
888 			  shp->id,
889 			  shp->shm_flags,
890 			  shp->shm_segsz,
891 			  shp->shm_cprid,
892 			  shp->shm_lprid,
893 			  is_file_hugepages(shp->shm_file) ? (file_count(shp->shm_file) - 1) : shp->shm_nattch,
894 			  shp->shm_perm.uid,
895 			  shp->shm_perm.gid,
896 			  shp->shm_perm.cuid,
897 			  shp->shm_perm.cgid,
898 			  shp->shm_atim,
899 			  shp->shm_dtim,
900 			  shp->shm_ctim);
901 }
902 #endif
903