xref: /openbmc/linux/ipc/shm.c (revision e868d61272caa648214046a096e5a6bfc068dc8c)
1 /*
2  * linux/ipc/shm.c
3  * Copyright (C) 1992, 1993 Krishna Balasubramanian
4  *	 Many improvements/fixes by Bruno Haible.
5  * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
6  * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
7  *
8  * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
9  * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
10  * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
11  * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
12  * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
13  * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
14  * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
15  *
16  * support for audit of ipc object properties and permission changes
17  * Dustin Kirkland <dustin.kirkland@us.ibm.com>
18  *
19  * namespaces support
20  * OpenVZ, SWsoft Inc.
21  * Pavel Emelianov <xemul@openvz.org>
22  */
23 
24 #include <linux/slab.h>
25 #include <linux/mm.h>
26 #include <linux/hugetlb.h>
27 #include <linux/shm.h>
28 #include <linux/init.h>
29 #include <linux/file.h>
30 #include <linux/mman.h>
31 #include <linux/shmem_fs.h>
32 #include <linux/security.h>
33 #include <linux/syscalls.h>
34 #include <linux/audit.h>
35 #include <linux/capability.h>
36 #include <linux/ptrace.h>
37 #include <linux/seq_file.h>
38 #include <linux/mutex.h>
39 #include <linux/nsproxy.h>
40 #include <linux/mount.h>
41 
42 #include <asm/uaccess.h>
43 
44 #include "util.h"
45 
46 struct shm_file_data {
47 	int id;
48 	struct ipc_namespace *ns;
49 	struct file *file;
50 	const struct vm_operations_struct *vm_ops;
51 };
52 
53 #define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data))
54 
55 static const struct file_operations shm_file_operations;
56 static struct vm_operations_struct shm_vm_ops;
57 
58 static struct ipc_ids init_shm_ids;
59 
60 #define shm_ids(ns)	(*((ns)->ids[IPC_SHM_IDS]))
61 
62 #define shm_lock(ns, id)		\
63 	((struct shmid_kernel*)ipc_lock(&shm_ids(ns),id))
64 #define shm_unlock(shp)			\
65 	ipc_unlock(&(shp)->shm_perm)
66 #define shm_get(ns, id)			\
67 	((struct shmid_kernel*)ipc_get(&shm_ids(ns),id))
68 #define shm_buildid(ns, id, seq)	\
69 	ipc_buildid(&shm_ids(ns), id, seq)
70 
71 static int newseg (struct ipc_namespace *ns, key_t key,
72 		int shmflg, size_t size);
73 static void shm_open(struct vm_area_struct *vma);
74 static void shm_close(struct vm_area_struct *vma);
75 static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
76 #ifdef CONFIG_PROC_FS
77 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
78 #endif
79 
80 static void __ipc_init __shm_init_ns(struct ipc_namespace *ns, struct ipc_ids *ids)
81 {
82 	ns->ids[IPC_SHM_IDS] = ids;
83 	ns->shm_ctlmax = SHMMAX;
84 	ns->shm_ctlall = SHMALL;
85 	ns->shm_ctlmni = SHMMNI;
86 	ns->shm_tot = 0;
87 	ipc_init_ids(ids, 1);
88 }
89 
90 static void do_shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *shp)
91 {
92 	if (shp->shm_nattch){
93 		shp->shm_perm.mode |= SHM_DEST;
94 		/* Do not find it any more */
95 		shp->shm_perm.key = IPC_PRIVATE;
96 		shm_unlock(shp);
97 	} else
98 		shm_destroy(ns, shp);
99 }
100 
101 #ifdef CONFIG_IPC_NS
102 int shm_init_ns(struct ipc_namespace *ns)
103 {
104 	struct ipc_ids *ids;
105 
106 	ids = kmalloc(sizeof(struct ipc_ids), GFP_KERNEL);
107 	if (ids == NULL)
108 		return -ENOMEM;
109 
110 	__shm_init_ns(ns, ids);
111 	return 0;
112 }
113 
114 void shm_exit_ns(struct ipc_namespace *ns)
115 {
116 	int i;
117 	struct shmid_kernel *shp;
118 
119 	mutex_lock(&shm_ids(ns).mutex);
120 	for (i = 0; i <= shm_ids(ns).max_id; i++) {
121 		shp = shm_lock(ns, i);
122 		if (shp == NULL)
123 			continue;
124 
125 		do_shm_rmid(ns, shp);
126 	}
127 	mutex_unlock(&shm_ids(ns).mutex);
128 
129 	ipc_fini_ids(ns->ids[IPC_SHM_IDS]);
130 	kfree(ns->ids[IPC_SHM_IDS]);
131 	ns->ids[IPC_SHM_IDS] = NULL;
132 }
133 #endif
134 
135 void __init shm_init (void)
136 {
137 	__shm_init_ns(&init_ipc_ns, &init_shm_ids);
138 	ipc_init_proc_interface("sysvipc/shm",
139 				"       key      shmid perms       size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime\n",
140 				IPC_SHM_IDS, sysvipc_shm_proc_show);
141 }
142 
143 static inline int shm_checkid(struct ipc_namespace *ns,
144 		struct shmid_kernel *s, int id)
145 {
146 	if (ipc_checkid(&shm_ids(ns), &s->shm_perm, id))
147 		return -EIDRM;
148 	return 0;
149 }
150 
151 static inline struct shmid_kernel *shm_rmid(struct ipc_namespace *ns, int id)
152 {
153 	return (struct shmid_kernel *)ipc_rmid(&shm_ids(ns), id);
154 }
155 
156 static inline int shm_addid(struct ipc_namespace *ns, struct shmid_kernel *shp)
157 {
158 	return ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
159 }
160 
161 
162 
163 /* This is called by fork, once for every shm attach. */
164 static void shm_open(struct vm_area_struct *vma)
165 {
166 	struct file *file = vma->vm_file;
167 	struct shm_file_data *sfd = shm_file_data(file);
168 	struct shmid_kernel *shp;
169 
170 	shp = shm_lock(sfd->ns, sfd->id);
171 	BUG_ON(!shp);
172 	shp->shm_atim = get_seconds();
173 	shp->shm_lprid = current->tgid;
174 	shp->shm_nattch++;
175 	shm_unlock(shp);
176 }
177 
178 /*
179  * shm_destroy - free the struct shmid_kernel
180  *
181  * @shp: struct to free
182  *
183  * It has to be called with shp and shm_ids.mutex locked,
184  * but returns with shp unlocked and freed.
185  */
186 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
187 {
188 	ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
189 	shm_rmid(ns, shp->id);
190 	shm_unlock(shp);
191 	if (!is_file_hugepages(shp->shm_file))
192 		shmem_lock(shp->shm_file, 0, shp->mlock_user);
193 	else
194 		user_shm_unlock(shp->shm_file->f_path.dentry->d_inode->i_size,
195 						shp->mlock_user);
196 	fput (shp->shm_file);
197 	security_shm_free(shp);
198 	ipc_rcu_putref(shp);
199 }
200 
201 /*
202  * remove the attach descriptor vma.
203  * free memory for segment if it is marked destroyed.
204  * The descriptor has already been removed from the current->mm->mmap list
205  * and will later be kfree()d.
206  */
207 static void shm_close(struct vm_area_struct *vma)
208 {
209 	struct file * file = vma->vm_file;
210 	struct shm_file_data *sfd = shm_file_data(file);
211 	struct shmid_kernel *shp;
212 	struct ipc_namespace *ns = sfd->ns;
213 
214 	mutex_lock(&shm_ids(ns).mutex);
215 	/* remove from the list of attaches of the shm segment */
216 	shp = shm_lock(ns, sfd->id);
217 	BUG_ON(!shp);
218 	shp->shm_lprid = current->tgid;
219 	shp->shm_dtim = get_seconds();
220 	shp->shm_nattch--;
221 	if(shp->shm_nattch == 0 &&
222 	   shp->shm_perm.mode & SHM_DEST)
223 		shm_destroy(ns, shp);
224 	else
225 		shm_unlock(shp);
226 	mutex_unlock(&shm_ids(ns).mutex);
227 }
228 
229 static struct page *shm_nopage(struct vm_area_struct *vma,
230 			       unsigned long address, int *type)
231 {
232 	struct file *file = vma->vm_file;
233 	struct shm_file_data *sfd = shm_file_data(file);
234 
235 	return sfd->vm_ops->nopage(vma, address, type);
236 }
237 
238 #ifdef CONFIG_NUMA
239 int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
240 {
241 	struct file *file = vma->vm_file;
242 	struct shm_file_data *sfd = shm_file_data(file);
243 	int err = 0;
244 	if (sfd->vm_ops->set_policy)
245 		err = sfd->vm_ops->set_policy(vma, new);
246 	return err;
247 }
248 
249 struct mempolicy *shm_get_policy(struct vm_area_struct *vma, unsigned long addr)
250 {
251 	struct file *file = vma->vm_file;
252 	struct shm_file_data *sfd = shm_file_data(file);
253 	struct mempolicy *pol = NULL;
254 
255 	if (sfd->vm_ops->get_policy)
256 		pol = sfd->vm_ops->get_policy(vma, addr);
257 	else
258 		pol = vma->vm_policy;
259 	return pol;
260 }
261 #endif
262 
263 static int shm_mmap(struct file * file, struct vm_area_struct * vma)
264 {
265 	struct shm_file_data *sfd = shm_file_data(file);
266 	int ret;
267 
268 	ret = sfd->file->f_op->mmap(sfd->file, vma);
269 	if (ret != 0)
270 		return ret;
271 	sfd->vm_ops = vma->vm_ops;
272 	vma->vm_ops = &shm_vm_ops;
273 	shm_open(vma);
274 
275 	return ret;
276 }
277 
278 static int shm_release(struct inode *ino, struct file *file)
279 {
280 	struct shm_file_data *sfd = shm_file_data(file);
281 
282 	put_ipc_ns(sfd->ns);
283 	shm_file_data(file) = NULL;
284 	kfree(sfd);
285 	return 0;
286 }
287 
288 static int shm_fsync(struct file *file, struct dentry *dentry, int datasync)
289 {
290 	int (*fsync) (struct file *, struct dentry *, int datasync);
291 	struct shm_file_data *sfd = shm_file_data(file);
292 	int ret = -EINVAL;
293 
294 	fsync = sfd->file->f_op->fsync;
295 	if (fsync)
296 		ret = fsync(sfd->file, sfd->file->f_path.dentry, datasync);
297 	return ret;
298 }
299 
300 static unsigned long shm_get_unmapped_area(struct file *file,
301 	unsigned long addr, unsigned long len, unsigned long pgoff,
302 	unsigned long flags)
303 {
304 	struct shm_file_data *sfd = shm_file_data(file);
305 	return get_unmapped_area(sfd->file, addr, len, pgoff, flags);
306 }
307 
308 int is_file_shm_hugepages(struct file *file)
309 {
310 	int ret = 0;
311 
312 	if (file->f_op == &shm_file_operations) {
313 		struct shm_file_data *sfd;
314 		sfd = shm_file_data(file);
315 		ret = is_file_hugepages(sfd->file);
316 	}
317 	return ret;
318 }
319 
320 static const struct file_operations shm_file_operations = {
321 	.mmap		= shm_mmap,
322 	.fsync		= shm_fsync,
323 	.release	= shm_release,
324 	.get_unmapped_area	= shm_get_unmapped_area,
325 };
326 
327 static struct vm_operations_struct shm_vm_ops = {
328 	.open	= shm_open,	/* callback for a new vm-area open */
329 	.close	= shm_close,	/* callback for when the vm-area is released */
330 	.nopage	= shm_nopage,
331 #if defined(CONFIG_NUMA)
332 	.set_policy = shm_set_policy,
333 	.get_policy = shm_get_policy,
334 #endif
335 };
336 
337 static int newseg (struct ipc_namespace *ns, key_t key, int shmflg, size_t size)
338 {
339 	int error;
340 	struct shmid_kernel *shp;
341 	int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
342 	struct file * file;
343 	char name[13];
344 	int id;
345 
346 	if (size < SHMMIN || size > ns->shm_ctlmax)
347 		return -EINVAL;
348 
349 	if (ns->shm_tot + numpages > ns->shm_ctlall)
350 		return -ENOSPC;
351 
352 	shp = ipc_rcu_alloc(sizeof(*shp));
353 	if (!shp)
354 		return -ENOMEM;
355 
356 	shp->shm_perm.key = key;
357 	shp->shm_perm.mode = (shmflg & S_IRWXUGO);
358 	shp->mlock_user = NULL;
359 
360 	shp->shm_perm.security = NULL;
361 	error = security_shm_alloc(shp);
362 	if (error) {
363 		ipc_rcu_putref(shp);
364 		return error;
365 	}
366 
367 	if (shmflg & SHM_HUGETLB) {
368 		/* hugetlb_zero_setup takes care of mlock user accounting */
369 		file = hugetlb_zero_setup(size);
370 		shp->mlock_user = current->user;
371 	} else {
372 		int acctflag = VM_ACCOUNT;
373 		/*
374 		 * Do not allow no accounting for OVERCOMMIT_NEVER, even
375 	 	 * if it's asked for.
376 		 */
377 		if  ((shmflg & SHM_NORESERVE) &&
378 				sysctl_overcommit_memory != OVERCOMMIT_NEVER)
379 			acctflag = 0;
380 		sprintf (name, "SYSV%08x", key);
381 		file = shmem_file_setup(name, size, acctflag);
382 	}
383 	error = PTR_ERR(file);
384 	if (IS_ERR(file))
385 		goto no_file;
386 
387 	error = -ENOSPC;
388 	id = shm_addid(ns, shp);
389 	if(id == -1)
390 		goto no_id;
391 
392 	shp->shm_cprid = current->tgid;
393 	shp->shm_lprid = 0;
394 	shp->shm_atim = shp->shm_dtim = 0;
395 	shp->shm_ctim = get_seconds();
396 	shp->shm_segsz = size;
397 	shp->shm_nattch = 0;
398 	shp->id = shm_buildid(ns, id, shp->shm_perm.seq);
399 	shp->shm_file = file;
400 
401 	ns->shm_tot += numpages;
402 	shm_unlock(shp);
403 	return shp->id;
404 
405 no_id:
406 	fput(file);
407 no_file:
408 	security_shm_free(shp);
409 	ipc_rcu_putref(shp);
410 	return error;
411 }
412 
413 asmlinkage long sys_shmget (key_t key, size_t size, int shmflg)
414 {
415 	struct shmid_kernel *shp;
416 	int err, id = 0;
417 	struct ipc_namespace *ns;
418 
419 	ns = current->nsproxy->ipc_ns;
420 
421 	mutex_lock(&shm_ids(ns).mutex);
422 	if (key == IPC_PRIVATE) {
423 		err = newseg(ns, key, shmflg, size);
424 	} else if ((id = ipc_findkey(&shm_ids(ns), key)) == -1) {
425 		if (!(shmflg & IPC_CREAT))
426 			err = -ENOENT;
427 		else
428 			err = newseg(ns, key, shmflg, size);
429 	} else if ((shmflg & IPC_CREAT) && (shmflg & IPC_EXCL)) {
430 		err = -EEXIST;
431 	} else {
432 		shp = shm_lock(ns, id);
433 		BUG_ON(shp==NULL);
434 		if (shp->shm_segsz < size)
435 			err = -EINVAL;
436 		else if (ipcperms(&shp->shm_perm, shmflg))
437 			err = -EACCES;
438 		else {
439 			int shmid = shm_buildid(ns, id, shp->shm_perm.seq);
440 			err = security_shm_associate(shp, shmflg);
441 			if (!err)
442 				err = shmid;
443 		}
444 		shm_unlock(shp);
445 	}
446 	mutex_unlock(&shm_ids(ns).mutex);
447 
448 	return err;
449 }
450 
451 static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
452 {
453 	switch(version) {
454 	case IPC_64:
455 		return copy_to_user(buf, in, sizeof(*in));
456 	case IPC_OLD:
457 	    {
458 		struct shmid_ds out;
459 
460 		ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
461 		out.shm_segsz	= in->shm_segsz;
462 		out.shm_atime	= in->shm_atime;
463 		out.shm_dtime	= in->shm_dtime;
464 		out.shm_ctime	= in->shm_ctime;
465 		out.shm_cpid	= in->shm_cpid;
466 		out.shm_lpid	= in->shm_lpid;
467 		out.shm_nattch	= in->shm_nattch;
468 
469 		return copy_to_user(buf, &out, sizeof(out));
470 	    }
471 	default:
472 		return -EINVAL;
473 	}
474 }
475 
476 struct shm_setbuf {
477 	uid_t	uid;
478 	gid_t	gid;
479 	mode_t	mode;
480 };
481 
482 static inline unsigned long copy_shmid_from_user(struct shm_setbuf *out, void __user *buf, int version)
483 {
484 	switch(version) {
485 	case IPC_64:
486 	    {
487 		struct shmid64_ds tbuf;
488 
489 		if (copy_from_user(&tbuf, buf, sizeof(tbuf)))
490 			return -EFAULT;
491 
492 		out->uid	= tbuf.shm_perm.uid;
493 		out->gid	= tbuf.shm_perm.gid;
494 		out->mode	= tbuf.shm_perm.mode;
495 
496 		return 0;
497 	    }
498 	case IPC_OLD:
499 	    {
500 		struct shmid_ds tbuf_old;
501 
502 		if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
503 			return -EFAULT;
504 
505 		out->uid	= tbuf_old.shm_perm.uid;
506 		out->gid	= tbuf_old.shm_perm.gid;
507 		out->mode	= tbuf_old.shm_perm.mode;
508 
509 		return 0;
510 	    }
511 	default:
512 		return -EINVAL;
513 	}
514 }
515 
516 static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
517 {
518 	switch(version) {
519 	case IPC_64:
520 		return copy_to_user(buf, in, sizeof(*in));
521 	case IPC_OLD:
522 	    {
523 		struct shminfo out;
524 
525 		if(in->shmmax > INT_MAX)
526 			out.shmmax = INT_MAX;
527 		else
528 			out.shmmax = (int)in->shmmax;
529 
530 		out.shmmin	= in->shmmin;
531 		out.shmmni	= in->shmmni;
532 		out.shmseg	= in->shmseg;
533 		out.shmall	= in->shmall;
534 
535 		return copy_to_user(buf, &out, sizeof(out));
536 	    }
537 	default:
538 		return -EINVAL;
539 	}
540 }
541 
542 static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
543 		unsigned long *swp)
544 {
545 	int i;
546 
547 	*rss = 0;
548 	*swp = 0;
549 
550 	for (i = 0; i <= shm_ids(ns).max_id; i++) {
551 		struct shmid_kernel *shp;
552 		struct inode *inode;
553 
554 		shp = shm_get(ns, i);
555 		if(!shp)
556 			continue;
557 
558 		inode = shp->shm_file->f_path.dentry->d_inode;
559 
560 		if (is_file_hugepages(shp->shm_file)) {
561 			struct address_space *mapping = inode->i_mapping;
562 			*rss += (HPAGE_SIZE/PAGE_SIZE)*mapping->nrpages;
563 		} else {
564 			struct shmem_inode_info *info = SHMEM_I(inode);
565 			spin_lock(&info->lock);
566 			*rss += inode->i_mapping->nrpages;
567 			*swp += info->swapped;
568 			spin_unlock(&info->lock);
569 		}
570 	}
571 }
572 
573 asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf)
574 {
575 	struct shm_setbuf setbuf;
576 	struct shmid_kernel *shp;
577 	int err, version;
578 	struct ipc_namespace *ns;
579 
580 	if (cmd < 0 || shmid < 0) {
581 		err = -EINVAL;
582 		goto out;
583 	}
584 
585 	version = ipc_parse_version(&cmd);
586 	ns = current->nsproxy->ipc_ns;
587 
588 	switch (cmd) { /* replace with proc interface ? */
589 	case IPC_INFO:
590 	{
591 		struct shminfo64 shminfo;
592 
593 		err = security_shm_shmctl(NULL, cmd);
594 		if (err)
595 			return err;
596 
597 		memset(&shminfo,0,sizeof(shminfo));
598 		shminfo.shmmni = shminfo.shmseg = ns->shm_ctlmni;
599 		shminfo.shmmax = ns->shm_ctlmax;
600 		shminfo.shmall = ns->shm_ctlall;
601 
602 		shminfo.shmmin = SHMMIN;
603 		if(copy_shminfo_to_user (buf, &shminfo, version))
604 			return -EFAULT;
605 		/* reading a integer is always atomic */
606 		err= shm_ids(ns).max_id;
607 		if(err<0)
608 			err = 0;
609 		goto out;
610 	}
611 	case SHM_INFO:
612 	{
613 		struct shm_info shm_info;
614 
615 		err = security_shm_shmctl(NULL, cmd);
616 		if (err)
617 			return err;
618 
619 		memset(&shm_info,0,sizeof(shm_info));
620 		mutex_lock(&shm_ids(ns).mutex);
621 		shm_info.used_ids = shm_ids(ns).in_use;
622 		shm_get_stat (ns, &shm_info.shm_rss, &shm_info.shm_swp);
623 		shm_info.shm_tot = ns->shm_tot;
624 		shm_info.swap_attempts = 0;
625 		shm_info.swap_successes = 0;
626 		err = shm_ids(ns).max_id;
627 		mutex_unlock(&shm_ids(ns).mutex);
628 		if(copy_to_user (buf, &shm_info, sizeof(shm_info))) {
629 			err = -EFAULT;
630 			goto out;
631 		}
632 
633 		err = err < 0 ? 0 : err;
634 		goto out;
635 	}
636 	case SHM_STAT:
637 	case IPC_STAT:
638 	{
639 		struct shmid64_ds tbuf;
640 		int result;
641 		memset(&tbuf, 0, sizeof(tbuf));
642 		shp = shm_lock(ns, shmid);
643 		if(shp==NULL) {
644 			err = -EINVAL;
645 			goto out;
646 		} else if(cmd==SHM_STAT) {
647 			err = -EINVAL;
648 			if (shmid > shm_ids(ns).max_id)
649 				goto out_unlock;
650 			result = shm_buildid(ns, shmid, shp->shm_perm.seq);
651 		} else {
652 			err = shm_checkid(ns, shp,shmid);
653 			if(err)
654 				goto out_unlock;
655 			result = 0;
656 		}
657 		err=-EACCES;
658 		if (ipcperms (&shp->shm_perm, S_IRUGO))
659 			goto out_unlock;
660 		err = security_shm_shmctl(shp, cmd);
661 		if (err)
662 			goto out_unlock;
663 		kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm);
664 		tbuf.shm_segsz	= shp->shm_segsz;
665 		tbuf.shm_atime	= shp->shm_atim;
666 		tbuf.shm_dtime	= shp->shm_dtim;
667 		tbuf.shm_ctime	= shp->shm_ctim;
668 		tbuf.shm_cpid	= shp->shm_cprid;
669 		tbuf.shm_lpid	= shp->shm_lprid;
670 		tbuf.shm_nattch	= shp->shm_nattch;
671 		shm_unlock(shp);
672 		if(copy_shmid_to_user (buf, &tbuf, version))
673 			err = -EFAULT;
674 		else
675 			err = result;
676 		goto out;
677 	}
678 	case SHM_LOCK:
679 	case SHM_UNLOCK:
680 	{
681 		shp = shm_lock(ns, shmid);
682 		if(shp==NULL) {
683 			err = -EINVAL;
684 			goto out;
685 		}
686 		err = shm_checkid(ns, shp,shmid);
687 		if(err)
688 			goto out_unlock;
689 
690 		err = audit_ipc_obj(&(shp->shm_perm));
691 		if (err)
692 			goto out_unlock;
693 
694 		if (!capable(CAP_IPC_LOCK)) {
695 			err = -EPERM;
696 			if (current->euid != shp->shm_perm.uid &&
697 			    current->euid != shp->shm_perm.cuid)
698 				goto out_unlock;
699 			if (cmd == SHM_LOCK &&
700 			    !current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur)
701 				goto out_unlock;
702 		}
703 
704 		err = security_shm_shmctl(shp, cmd);
705 		if (err)
706 			goto out_unlock;
707 
708 		if(cmd==SHM_LOCK) {
709 			struct user_struct * user = current->user;
710 			if (!is_file_hugepages(shp->shm_file)) {
711 				err = shmem_lock(shp->shm_file, 1, user);
712 				if (!err) {
713 					shp->shm_perm.mode |= SHM_LOCKED;
714 					shp->mlock_user = user;
715 				}
716 			}
717 		} else if (!is_file_hugepages(shp->shm_file)) {
718 			shmem_lock(shp->shm_file, 0, shp->mlock_user);
719 			shp->shm_perm.mode &= ~SHM_LOCKED;
720 			shp->mlock_user = NULL;
721 		}
722 		shm_unlock(shp);
723 		goto out;
724 	}
725 	case IPC_RMID:
726 	{
727 		/*
728 		 *	We cannot simply remove the file. The SVID states
729 		 *	that the block remains until the last person
730 		 *	detaches from it, then is deleted. A shmat() on
731 		 *	an RMID segment is legal in older Linux and if
732 		 *	we change it apps break...
733 		 *
734 		 *	Instead we set a destroyed flag, and then blow
735 		 *	the name away when the usage hits zero.
736 		 */
737 		mutex_lock(&shm_ids(ns).mutex);
738 		shp = shm_lock(ns, shmid);
739 		err = -EINVAL;
740 		if (shp == NULL)
741 			goto out_up;
742 		err = shm_checkid(ns, shp, shmid);
743 		if(err)
744 			goto out_unlock_up;
745 
746 		err = audit_ipc_obj(&(shp->shm_perm));
747 		if (err)
748 			goto out_unlock_up;
749 
750 		if (current->euid != shp->shm_perm.uid &&
751 		    current->euid != shp->shm_perm.cuid &&
752 		    !capable(CAP_SYS_ADMIN)) {
753 			err=-EPERM;
754 			goto out_unlock_up;
755 		}
756 
757 		err = security_shm_shmctl(shp, cmd);
758 		if (err)
759 			goto out_unlock_up;
760 
761 		do_shm_rmid(ns, shp);
762 		mutex_unlock(&shm_ids(ns).mutex);
763 		goto out;
764 	}
765 
766 	case IPC_SET:
767 	{
768 		if (copy_shmid_from_user (&setbuf, buf, version)) {
769 			err = -EFAULT;
770 			goto out;
771 		}
772 		mutex_lock(&shm_ids(ns).mutex);
773 		shp = shm_lock(ns, shmid);
774 		err=-EINVAL;
775 		if(shp==NULL)
776 			goto out_up;
777 		err = shm_checkid(ns, shp,shmid);
778 		if(err)
779 			goto out_unlock_up;
780 		err = audit_ipc_obj(&(shp->shm_perm));
781 		if (err)
782 			goto out_unlock_up;
783 		err = audit_ipc_set_perm(0, setbuf.uid, setbuf.gid, setbuf.mode);
784 		if (err)
785 			goto out_unlock_up;
786 		err=-EPERM;
787 		if (current->euid != shp->shm_perm.uid &&
788 		    current->euid != shp->shm_perm.cuid &&
789 		    !capable(CAP_SYS_ADMIN)) {
790 			goto out_unlock_up;
791 		}
792 
793 		err = security_shm_shmctl(shp, cmd);
794 		if (err)
795 			goto out_unlock_up;
796 
797 		shp->shm_perm.uid = setbuf.uid;
798 		shp->shm_perm.gid = setbuf.gid;
799 		shp->shm_perm.mode = (shp->shm_perm.mode & ~S_IRWXUGO)
800 			| (setbuf.mode & S_IRWXUGO);
801 		shp->shm_ctim = get_seconds();
802 		break;
803 	}
804 
805 	default:
806 		err = -EINVAL;
807 		goto out;
808 	}
809 
810 	err = 0;
811 out_unlock_up:
812 	shm_unlock(shp);
813 out_up:
814 	mutex_unlock(&shm_ids(ns).mutex);
815 	goto out;
816 out_unlock:
817 	shm_unlock(shp);
818 out:
819 	return err;
820 }
821 
822 /*
823  * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
824  *
825  * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
826  * "raddr" thing points to kernel space, and there has to be a wrapper around
827  * this.
828  */
829 long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
830 {
831 	struct shmid_kernel *shp;
832 	unsigned long addr;
833 	unsigned long size;
834 	struct file * file;
835 	int    err;
836 	unsigned long flags;
837 	unsigned long prot;
838 	int acc_mode;
839 	unsigned long user_addr;
840 	struct ipc_namespace *ns;
841 	struct shm_file_data *sfd;
842 	struct path path;
843 	mode_t f_mode;
844 
845 	err = -EINVAL;
846 	if (shmid < 0)
847 		goto out;
848 	else if ((addr = (ulong)shmaddr)) {
849 		if (addr & (SHMLBA-1)) {
850 			if (shmflg & SHM_RND)
851 				addr &= ~(SHMLBA-1);	   /* round down */
852 			else
853 #ifndef __ARCH_FORCE_SHMLBA
854 				if (addr & ~PAGE_MASK)
855 #endif
856 					goto out;
857 		}
858 		flags = MAP_SHARED | MAP_FIXED;
859 	} else {
860 		if ((shmflg & SHM_REMAP))
861 			goto out;
862 
863 		flags = MAP_SHARED;
864 	}
865 
866 	if (shmflg & SHM_RDONLY) {
867 		prot = PROT_READ;
868 		acc_mode = S_IRUGO;
869 		f_mode = FMODE_READ;
870 	} else {
871 		prot = PROT_READ | PROT_WRITE;
872 		acc_mode = S_IRUGO | S_IWUGO;
873 		f_mode = FMODE_READ | FMODE_WRITE;
874 	}
875 	if (shmflg & SHM_EXEC) {
876 		prot |= PROT_EXEC;
877 		acc_mode |= S_IXUGO;
878 	}
879 
880 	/*
881 	 * We cannot rely on the fs check since SYSV IPC does have an
882 	 * additional creator id...
883 	 */
884 	ns = current->nsproxy->ipc_ns;
885 	shp = shm_lock(ns, shmid);
886 	if(shp == NULL)
887 		goto out;
888 
889 	err = shm_checkid(ns, shp,shmid);
890 	if (err)
891 		goto out_unlock;
892 
893 	err = -EACCES;
894 	if (ipcperms(&shp->shm_perm, acc_mode))
895 		goto out_unlock;
896 
897 	err = security_shm_shmat(shp, shmaddr, shmflg);
898 	if (err)
899 		goto out_unlock;
900 
901 	path.dentry = dget(shp->shm_file->f_path.dentry);
902 	path.mnt    = mntget(shp->shm_file->f_path.mnt);
903 	shp->shm_nattch++;
904 	size = i_size_read(path.dentry->d_inode);
905 	shm_unlock(shp);
906 
907 	err = -ENOMEM;
908 	sfd = kzalloc(sizeof(*sfd), GFP_KERNEL);
909 	if (!sfd)
910 		goto out_put_path;
911 
912 	err = -ENOMEM;
913 	file = get_empty_filp();
914 	if (!file)
915 		goto out_free;
916 
917 	file->f_op = &shm_file_operations;
918 	file->private_data = sfd;
919 	file->f_path = path;
920 	file->f_mapping = shp->shm_file->f_mapping;
921 	file->f_mode = f_mode;
922 	sfd->id = shp->id;
923 	sfd->ns = get_ipc_ns(ns);
924 	sfd->file = shp->shm_file;
925 	sfd->vm_ops = NULL;
926 
927 	down_write(&current->mm->mmap_sem);
928 	if (addr && !(shmflg & SHM_REMAP)) {
929 		err = -EINVAL;
930 		if (find_vma_intersection(current->mm, addr, addr + size))
931 			goto invalid;
932 		/*
933 		 * If shm segment goes below stack, make sure there is some
934 		 * space left for the stack to grow (at least 4 pages).
935 		 */
936 		if (addr < current->mm->start_stack &&
937 		    addr > current->mm->start_stack - size - PAGE_SIZE * 5)
938 			goto invalid;
939 	}
940 
941 	user_addr = do_mmap (file, addr, size, prot, flags, 0);
942 	*raddr = user_addr;
943 	err = 0;
944 	if (IS_ERR_VALUE(user_addr))
945 		err = (long)user_addr;
946 invalid:
947 	up_write(&current->mm->mmap_sem);
948 
949 	fput(file);
950 
951 out_nattch:
952 	mutex_lock(&shm_ids(ns).mutex);
953 	shp = shm_lock(ns, shmid);
954 	BUG_ON(!shp);
955 	shp->shm_nattch--;
956 	if(shp->shm_nattch == 0 &&
957 	   shp->shm_perm.mode & SHM_DEST)
958 		shm_destroy(ns, shp);
959 	else
960 		shm_unlock(shp);
961 	mutex_unlock(&shm_ids(ns).mutex);
962 
963 out:
964 	return err;
965 
966 out_unlock:
967 	shm_unlock(shp);
968 	goto out;
969 
970 out_free:
971 	kfree(sfd);
972 out_put_path:
973 	dput(path.dentry);
974 	mntput(path.mnt);
975 	goto out_nattch;
976 }
977 
978 asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg)
979 {
980 	unsigned long ret;
981 	long err;
982 
983 	err = do_shmat(shmid, shmaddr, shmflg, &ret);
984 	if (err)
985 		return err;
986 	force_successful_syscall_return();
987 	return (long)ret;
988 }
989 
990 /*
991  * detach and kill segment if marked destroyed.
992  * The work is done in shm_close.
993  */
994 asmlinkage long sys_shmdt(char __user *shmaddr)
995 {
996 	struct mm_struct *mm = current->mm;
997 	struct vm_area_struct *vma, *next;
998 	unsigned long addr = (unsigned long)shmaddr;
999 	loff_t size = 0;
1000 	int retval = -EINVAL;
1001 
1002 	if (addr & ~PAGE_MASK)
1003 		return retval;
1004 
1005 	down_write(&mm->mmap_sem);
1006 
1007 	/*
1008 	 * This function tries to be smart and unmap shm segments that
1009 	 * were modified by partial mlock or munmap calls:
1010 	 * - It first determines the size of the shm segment that should be
1011 	 *   unmapped: It searches for a vma that is backed by shm and that
1012 	 *   started at address shmaddr. It records it's size and then unmaps
1013 	 *   it.
1014 	 * - Then it unmaps all shm vmas that started at shmaddr and that
1015 	 *   are within the initially determined size.
1016 	 * Errors from do_munmap are ignored: the function only fails if
1017 	 * it's called with invalid parameters or if it's called to unmap
1018 	 * a part of a vma. Both calls in this function are for full vmas,
1019 	 * the parameters are directly copied from the vma itself and always
1020 	 * valid - therefore do_munmap cannot fail. (famous last words?)
1021 	 */
1022 	/*
1023 	 * If it had been mremap()'d, the starting address would not
1024 	 * match the usual checks anyway. So assume all vma's are
1025 	 * above the starting address given.
1026 	 */
1027 	vma = find_vma(mm, addr);
1028 
1029 	while (vma) {
1030 		next = vma->vm_next;
1031 
1032 		/*
1033 		 * Check if the starting address would match, i.e. it's
1034 		 * a fragment created by mprotect() and/or munmap(), or it
1035 		 * otherwise it starts at this address with no hassles.
1036 		 */
1037 		if ((vma->vm_ops == &shm_vm_ops) &&
1038 			(vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) {
1039 
1040 
1041 			size = vma->vm_file->f_path.dentry->d_inode->i_size;
1042 			do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1043 			/*
1044 			 * We discovered the size of the shm segment, so
1045 			 * break out of here and fall through to the next
1046 			 * loop that uses the size information to stop
1047 			 * searching for matching vma's.
1048 			 */
1049 			retval = 0;
1050 			vma = next;
1051 			break;
1052 		}
1053 		vma = next;
1054 	}
1055 
1056 	/*
1057 	 * We need look no further than the maximum address a fragment
1058 	 * could possibly have landed at. Also cast things to loff_t to
1059 	 * prevent overflows and make comparisions vs. equal-width types.
1060 	 */
1061 	size = PAGE_ALIGN(size);
1062 	while (vma && (loff_t)(vma->vm_end - addr) <= size) {
1063 		next = vma->vm_next;
1064 
1065 		/* finding a matching vma now does not alter retval */
1066 		if ((vma->vm_ops == &shm_vm_ops) &&
1067 			(vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff)
1068 
1069 			do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1070 		vma = next;
1071 	}
1072 
1073 	up_write(&mm->mmap_sem);
1074 	return retval;
1075 }
1076 
1077 #ifdef CONFIG_PROC_FS
1078 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
1079 {
1080 	struct shmid_kernel *shp = it;
1081 	char *format;
1082 
1083 #define SMALL_STRING "%10d %10d  %4o %10u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
1084 #define BIG_STRING   "%10d %10d  %4o %21u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
1085 
1086 	if (sizeof(size_t) <= sizeof(int))
1087 		format = SMALL_STRING;
1088 	else
1089 		format = BIG_STRING;
1090 	return seq_printf(s, format,
1091 			  shp->shm_perm.key,
1092 			  shp->id,
1093 			  shp->shm_perm.mode,
1094 			  shp->shm_segsz,
1095 			  shp->shm_cprid,
1096 			  shp->shm_lprid,
1097 			  shp->shm_nattch,
1098 			  shp->shm_perm.uid,
1099 			  shp->shm_perm.gid,
1100 			  shp->shm_perm.cuid,
1101 			  shp->shm_perm.cgid,
1102 			  shp->shm_atim,
1103 			  shp->shm_dtim,
1104 			  shp->shm_ctim);
1105 }
1106 #endif
1107