1 /* 2 * linux/ipc/sem.c 3 * Copyright (C) 1992 Krishna Balasubramanian 4 * Copyright (C) 1995 Eric Schenk, Bruno Haible 5 * 6 * /proc/sysvipc/sem support (c) 1999 Dragos Acostachioaie <dragos@iname.com> 7 * 8 * SMP-threaded, sysctl's added 9 * (c) 1999 Manfred Spraul <manfred@colorfullife.com> 10 * Enforced range limit on SEM_UNDO 11 * (c) 2001 Red Hat Inc 12 * Lockless wakeup 13 * (c) 2003 Manfred Spraul <manfred@colorfullife.com> 14 * Further wakeup optimizations, documentation 15 * (c) 2010 Manfred Spraul <manfred@colorfullife.com> 16 * 17 * support for audit of ipc object properties and permission changes 18 * Dustin Kirkland <dustin.kirkland@us.ibm.com> 19 * 20 * namespaces support 21 * OpenVZ, SWsoft Inc. 22 * Pavel Emelianov <xemul@openvz.org> 23 * 24 * Implementation notes: (May 2010) 25 * This file implements System V semaphores. 26 * 27 * User space visible behavior: 28 * - FIFO ordering for semop() operations (just FIFO, not starvation 29 * protection) 30 * - multiple semaphore operations that alter the same semaphore in 31 * one semop() are handled. 32 * - sem_ctime (time of last semctl()) is updated in the IPC_SET, SETVAL and 33 * SETALL calls. 34 * - two Linux specific semctl() commands: SEM_STAT, SEM_INFO. 35 * - undo adjustments at process exit are limited to 0..SEMVMX. 36 * - namespace are supported. 37 * - SEMMSL, SEMMNS, SEMOPM and SEMMNI can be configured at runtine by writing 38 * to /proc/sys/kernel/sem. 39 * - statistics about the usage are reported in /proc/sysvipc/sem. 40 * 41 * Internals: 42 * - scalability: 43 * - all global variables are read-mostly. 44 * - semop() calls and semctl(RMID) are synchronized by RCU. 45 * - most operations do write operations (actually: spin_lock calls) to 46 * the per-semaphore array structure. 47 * Thus: Perfect SMP scaling between independent semaphore arrays. 48 * If multiple semaphores in one array are used, then cache line 49 * trashing on the semaphore array spinlock will limit the scaling. 50 * - semncnt and semzcnt are calculated on demand in count_semncnt() and 51 * count_semzcnt() 52 * - the task that performs a successful semop() scans the list of all 53 * sleeping tasks and completes any pending operations that can be fulfilled. 54 * Semaphores are actively given to waiting tasks (necessary for FIFO). 55 * (see update_queue()) 56 * - To improve the scalability, the actual wake-up calls are performed after 57 * dropping all locks. (see wake_up_sem_queue_prepare(), 58 * wake_up_sem_queue_do()) 59 * - All work is done by the waker, the woken up task does not have to do 60 * anything - not even acquiring a lock or dropping a refcount. 61 * - A woken up task may not even touch the semaphore array anymore, it may 62 * have been destroyed already by a semctl(RMID). 63 * - The synchronizations between wake-ups due to a timeout/signal and a 64 * wake-up due to a completed semaphore operation is achieved by using an 65 * intermediate state (IN_WAKEUP). 66 * - UNDO values are stored in an array (one per process and per 67 * semaphore array, lazily allocated). For backwards compatibility, multiple 68 * modes for the UNDO variables are supported (per process, per thread) 69 * (see copy_semundo, CLONE_SYSVSEM) 70 * - There are two lists of the pending operations: a per-array list 71 * and per-semaphore list (stored in the array). This allows to achieve FIFO 72 * ordering without always scanning all pending operations. 73 * The worst-case behavior is nevertheless O(N^2) for N wakeups. 74 */ 75 76 #include <linux/slab.h> 77 #include <linux/spinlock.h> 78 #include <linux/init.h> 79 #include <linux/proc_fs.h> 80 #include <linux/time.h> 81 #include <linux/security.h> 82 #include <linux/syscalls.h> 83 #include <linux/audit.h> 84 #include <linux/capability.h> 85 #include <linux/seq_file.h> 86 #include <linux/rwsem.h> 87 #include <linux/nsproxy.h> 88 #include <linux/ipc_namespace.h> 89 90 #include <asm/uaccess.h> 91 #include "util.h" 92 93 #define sem_ids(ns) ((ns)->ids[IPC_SEM_IDS]) 94 95 #define sem_unlock(sma) ipc_unlock(&(sma)->sem_perm) 96 #define sem_checkid(sma, semid) ipc_checkid(&sma->sem_perm, semid) 97 98 static int newary(struct ipc_namespace *, struct ipc_params *); 99 static void freeary(struct ipc_namespace *, struct kern_ipc_perm *); 100 #ifdef CONFIG_PROC_FS 101 static int sysvipc_sem_proc_show(struct seq_file *s, void *it); 102 #endif 103 104 #define SEMMSL_FAST 256 /* 512 bytes on stack */ 105 #define SEMOPM_FAST 64 /* ~ 372 bytes on stack */ 106 107 /* 108 * linked list protection: 109 * sem_undo.id_next, 110 * sem_array.sem_pending{,last}, 111 * sem_array.sem_undo: sem_lock() for read/write 112 * sem_undo.proc_next: only "current" is allowed to read/write that field. 113 * 114 */ 115 116 #define sc_semmsl sem_ctls[0] 117 #define sc_semmns sem_ctls[1] 118 #define sc_semopm sem_ctls[2] 119 #define sc_semmni sem_ctls[3] 120 121 void sem_init_ns(struct ipc_namespace *ns) 122 { 123 ns->sc_semmsl = SEMMSL; 124 ns->sc_semmns = SEMMNS; 125 ns->sc_semopm = SEMOPM; 126 ns->sc_semmni = SEMMNI; 127 ns->used_sems = 0; 128 ipc_init_ids(&ns->ids[IPC_SEM_IDS]); 129 } 130 131 #ifdef CONFIG_IPC_NS 132 void sem_exit_ns(struct ipc_namespace *ns) 133 { 134 free_ipcs(ns, &sem_ids(ns), freeary); 135 idr_destroy(&ns->ids[IPC_SEM_IDS].ipcs_idr); 136 } 137 #endif 138 139 void __init sem_init (void) 140 { 141 sem_init_ns(&init_ipc_ns); 142 ipc_init_proc_interface("sysvipc/sem", 143 " key semid perms nsems uid gid cuid cgid otime ctime\n", 144 IPC_SEM_IDS, sysvipc_sem_proc_show); 145 } 146 147 /* 148 * sem_lock_(check_) routines are called in the paths where the rw_mutex 149 * is not held. 150 */ 151 static inline struct sem_array *sem_lock(struct ipc_namespace *ns, int id) 152 { 153 struct kern_ipc_perm *ipcp = ipc_lock(&sem_ids(ns), id); 154 155 if (IS_ERR(ipcp)) 156 return (struct sem_array *)ipcp; 157 158 return container_of(ipcp, struct sem_array, sem_perm); 159 } 160 161 static inline struct sem_array *sem_lock_check(struct ipc_namespace *ns, 162 int id) 163 { 164 struct kern_ipc_perm *ipcp = ipc_lock_check(&sem_ids(ns), id); 165 166 if (IS_ERR(ipcp)) 167 return (struct sem_array *)ipcp; 168 169 return container_of(ipcp, struct sem_array, sem_perm); 170 } 171 172 static inline void sem_lock_and_putref(struct sem_array *sma) 173 { 174 ipc_lock_by_ptr(&sma->sem_perm); 175 ipc_rcu_putref(sma); 176 } 177 178 static inline void sem_getref_and_unlock(struct sem_array *sma) 179 { 180 ipc_rcu_getref(sma); 181 ipc_unlock(&(sma)->sem_perm); 182 } 183 184 static inline void sem_putref(struct sem_array *sma) 185 { 186 ipc_lock_by_ptr(&sma->sem_perm); 187 ipc_rcu_putref(sma); 188 ipc_unlock(&(sma)->sem_perm); 189 } 190 191 static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s) 192 { 193 ipc_rmid(&sem_ids(ns), &s->sem_perm); 194 } 195 196 /* 197 * Lockless wakeup algorithm: 198 * Without the check/retry algorithm a lockless wakeup is possible: 199 * - queue.status is initialized to -EINTR before blocking. 200 * - wakeup is performed by 201 * * unlinking the queue entry from sma->sem_pending 202 * * setting queue.status to IN_WAKEUP 203 * This is the notification for the blocked thread that a 204 * result value is imminent. 205 * * call wake_up_process 206 * * set queue.status to the final value. 207 * - the previously blocked thread checks queue.status: 208 * * if it's IN_WAKEUP, then it must wait until the value changes 209 * * if it's not -EINTR, then the operation was completed by 210 * update_queue. semtimedop can return queue.status without 211 * performing any operation on the sem array. 212 * * otherwise it must acquire the spinlock and check what's up. 213 * 214 * The two-stage algorithm is necessary to protect against the following 215 * races: 216 * - if queue.status is set after wake_up_process, then the woken up idle 217 * thread could race forward and try (and fail) to acquire sma->lock 218 * before update_queue had a chance to set queue.status 219 * - if queue.status is written before wake_up_process and if the 220 * blocked process is woken up by a signal between writing 221 * queue.status and the wake_up_process, then the woken up 222 * process could return from semtimedop and die by calling 223 * sys_exit before wake_up_process is called. Then wake_up_process 224 * will oops, because the task structure is already invalid. 225 * (yes, this happened on s390 with sysv msg). 226 * 227 */ 228 #define IN_WAKEUP 1 229 230 /** 231 * newary - Create a new semaphore set 232 * @ns: namespace 233 * @params: ptr to the structure that contains key, semflg and nsems 234 * 235 * Called with sem_ids.rw_mutex held (as a writer) 236 */ 237 238 static int newary(struct ipc_namespace *ns, struct ipc_params *params) 239 { 240 int id; 241 int retval; 242 struct sem_array *sma; 243 int size; 244 key_t key = params->key; 245 int nsems = params->u.nsems; 246 int semflg = params->flg; 247 int i; 248 249 if (!nsems) 250 return -EINVAL; 251 if (ns->used_sems + nsems > ns->sc_semmns) 252 return -ENOSPC; 253 254 size = sizeof (*sma) + nsems * sizeof (struct sem); 255 sma = ipc_rcu_alloc(size); 256 if (!sma) { 257 return -ENOMEM; 258 } 259 memset (sma, 0, size); 260 261 sma->sem_perm.mode = (semflg & S_IRWXUGO); 262 sma->sem_perm.key = key; 263 264 sma->sem_perm.security = NULL; 265 retval = security_sem_alloc(sma); 266 if (retval) { 267 ipc_rcu_putref(sma); 268 return retval; 269 } 270 271 id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni); 272 if (id < 0) { 273 security_sem_free(sma); 274 ipc_rcu_putref(sma); 275 return id; 276 } 277 ns->used_sems += nsems; 278 279 sma->sem_base = (struct sem *) &sma[1]; 280 281 for (i = 0; i < nsems; i++) 282 INIT_LIST_HEAD(&sma->sem_base[i].sem_pending); 283 284 sma->complex_count = 0; 285 INIT_LIST_HEAD(&sma->sem_pending); 286 INIT_LIST_HEAD(&sma->list_id); 287 sma->sem_nsems = nsems; 288 sma->sem_ctime = get_seconds(); 289 sem_unlock(sma); 290 291 return sma->sem_perm.id; 292 } 293 294 295 /* 296 * Called with sem_ids.rw_mutex and ipcp locked. 297 */ 298 static inline int sem_security(struct kern_ipc_perm *ipcp, int semflg) 299 { 300 struct sem_array *sma; 301 302 sma = container_of(ipcp, struct sem_array, sem_perm); 303 return security_sem_associate(sma, semflg); 304 } 305 306 /* 307 * Called with sem_ids.rw_mutex and ipcp locked. 308 */ 309 static inline int sem_more_checks(struct kern_ipc_perm *ipcp, 310 struct ipc_params *params) 311 { 312 struct sem_array *sma; 313 314 sma = container_of(ipcp, struct sem_array, sem_perm); 315 if (params->u.nsems > sma->sem_nsems) 316 return -EINVAL; 317 318 return 0; 319 } 320 321 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg) 322 { 323 struct ipc_namespace *ns; 324 struct ipc_ops sem_ops; 325 struct ipc_params sem_params; 326 327 ns = current->nsproxy->ipc_ns; 328 329 if (nsems < 0 || nsems > ns->sc_semmsl) 330 return -EINVAL; 331 332 sem_ops.getnew = newary; 333 sem_ops.associate = sem_security; 334 sem_ops.more_checks = sem_more_checks; 335 336 sem_params.key = key; 337 sem_params.flg = semflg; 338 sem_params.u.nsems = nsems; 339 340 return ipcget(ns, &sem_ids(ns), &sem_ops, &sem_params); 341 } 342 343 /* 344 * Determine whether a sequence of semaphore operations would succeed 345 * all at once. Return 0 if yes, 1 if need to sleep, else return error code. 346 */ 347 348 static int try_atomic_semop (struct sem_array * sma, struct sembuf * sops, 349 int nsops, struct sem_undo *un, int pid) 350 { 351 int result, sem_op; 352 struct sembuf *sop; 353 struct sem * curr; 354 355 for (sop = sops; sop < sops + nsops; sop++) { 356 curr = sma->sem_base + sop->sem_num; 357 sem_op = sop->sem_op; 358 result = curr->semval; 359 360 if (!sem_op && result) 361 goto would_block; 362 363 result += sem_op; 364 if (result < 0) 365 goto would_block; 366 if (result > SEMVMX) 367 goto out_of_range; 368 if (sop->sem_flg & SEM_UNDO) { 369 int undo = un->semadj[sop->sem_num] - sem_op; 370 /* 371 * Exceeding the undo range is an error. 372 */ 373 if (undo < (-SEMAEM - 1) || undo > SEMAEM) 374 goto out_of_range; 375 } 376 curr->semval = result; 377 } 378 379 sop--; 380 while (sop >= sops) { 381 sma->sem_base[sop->sem_num].sempid = pid; 382 if (sop->sem_flg & SEM_UNDO) 383 un->semadj[sop->sem_num] -= sop->sem_op; 384 sop--; 385 } 386 387 return 0; 388 389 out_of_range: 390 result = -ERANGE; 391 goto undo; 392 393 would_block: 394 if (sop->sem_flg & IPC_NOWAIT) 395 result = -EAGAIN; 396 else 397 result = 1; 398 399 undo: 400 sop--; 401 while (sop >= sops) { 402 sma->sem_base[sop->sem_num].semval -= sop->sem_op; 403 sop--; 404 } 405 406 return result; 407 } 408 409 /** wake_up_sem_queue_prepare(q, error): Prepare wake-up 410 * @q: queue entry that must be signaled 411 * @error: Error value for the signal 412 * 413 * Prepare the wake-up of the queue entry q. 414 */ 415 static void wake_up_sem_queue_prepare(struct list_head *pt, 416 struct sem_queue *q, int error) 417 { 418 if (list_empty(pt)) { 419 /* 420 * Hold preempt off so that we don't get preempted and have the 421 * wakee busy-wait until we're scheduled back on. 422 */ 423 preempt_disable(); 424 } 425 q->status = IN_WAKEUP; 426 q->pid = error; 427 428 list_add_tail(&q->simple_list, pt); 429 } 430 431 /** 432 * wake_up_sem_queue_do(pt) - do the actual wake-up 433 * @pt: list of tasks to be woken up 434 * 435 * Do the actual wake-up. 436 * The function is called without any locks held, thus the semaphore array 437 * could be destroyed already and the tasks can disappear as soon as the 438 * status is set to the actual return code. 439 */ 440 static void wake_up_sem_queue_do(struct list_head *pt) 441 { 442 struct sem_queue *q, *t; 443 int did_something; 444 445 did_something = !list_empty(pt); 446 list_for_each_entry_safe(q, t, pt, simple_list) { 447 wake_up_process(q->sleeper); 448 /* q can disappear immediately after writing q->status. */ 449 smp_wmb(); 450 q->status = q->pid; 451 } 452 if (did_something) 453 preempt_enable(); 454 } 455 456 static void unlink_queue(struct sem_array *sma, struct sem_queue *q) 457 { 458 list_del(&q->list); 459 if (q->nsops == 1) 460 list_del(&q->simple_list); 461 else 462 sma->complex_count--; 463 } 464 465 /** check_restart(sma, q) 466 * @sma: semaphore array 467 * @q: the operation that just completed 468 * 469 * update_queue is O(N^2) when it restarts scanning the whole queue of 470 * waiting operations. Therefore this function checks if the restart is 471 * really necessary. It is called after a previously waiting operation 472 * was completed. 473 */ 474 static int check_restart(struct sem_array *sma, struct sem_queue *q) 475 { 476 struct sem *curr; 477 struct sem_queue *h; 478 479 /* if the operation didn't modify the array, then no restart */ 480 if (q->alter == 0) 481 return 0; 482 483 /* pending complex operations are too difficult to analyse */ 484 if (sma->complex_count) 485 return 1; 486 487 /* we were a sleeping complex operation. Too difficult */ 488 if (q->nsops > 1) 489 return 1; 490 491 curr = sma->sem_base + q->sops[0].sem_num; 492 493 /* No-one waits on this queue */ 494 if (list_empty(&curr->sem_pending)) 495 return 0; 496 497 /* the new semaphore value */ 498 if (curr->semval) { 499 /* It is impossible that someone waits for the new value: 500 * - q is a previously sleeping simple operation that 501 * altered the array. It must be a decrement, because 502 * simple increments never sleep. 503 * - The value is not 0, thus wait-for-zero won't proceed. 504 * - If there are older (higher priority) decrements 505 * in the queue, then they have observed the original 506 * semval value and couldn't proceed. The operation 507 * decremented to value - thus they won't proceed either. 508 */ 509 BUG_ON(q->sops[0].sem_op >= 0); 510 return 0; 511 } 512 /* 513 * semval is 0. Check if there are wait-for-zero semops. 514 * They must be the first entries in the per-semaphore simple queue 515 */ 516 h = list_first_entry(&curr->sem_pending, struct sem_queue, simple_list); 517 BUG_ON(h->nsops != 1); 518 BUG_ON(h->sops[0].sem_num != q->sops[0].sem_num); 519 520 /* Yes, there is a wait-for-zero semop. Restart */ 521 if (h->sops[0].sem_op == 0) 522 return 1; 523 524 /* Again - no-one is waiting for the new value. */ 525 return 0; 526 } 527 528 529 /** 530 * update_queue(sma, semnum): Look for tasks that can be completed. 531 * @sma: semaphore array. 532 * @semnum: semaphore that was modified. 533 * @pt: list head for the tasks that must be woken up. 534 * 535 * update_queue must be called after a semaphore in a semaphore array 536 * was modified. If multiple semaphore were modified, then @semnum 537 * must be set to -1. 538 * The tasks that must be woken up are added to @pt. The return code 539 * is stored in q->pid. 540 * The function return 1 if at least one semop was completed successfully. 541 */ 542 static int update_queue(struct sem_array *sma, int semnum, struct list_head *pt) 543 { 544 struct sem_queue *q; 545 struct list_head *walk; 546 struct list_head *pending_list; 547 int offset; 548 int semop_completed = 0; 549 550 /* if there are complex operations around, then knowing the semaphore 551 * that was modified doesn't help us. Assume that multiple semaphores 552 * were modified. 553 */ 554 if (sma->complex_count) 555 semnum = -1; 556 557 if (semnum == -1) { 558 pending_list = &sma->sem_pending; 559 offset = offsetof(struct sem_queue, list); 560 } else { 561 pending_list = &sma->sem_base[semnum].sem_pending; 562 offset = offsetof(struct sem_queue, simple_list); 563 } 564 565 again: 566 walk = pending_list->next; 567 while (walk != pending_list) { 568 int error, restart; 569 570 q = (struct sem_queue *)((char *)walk - offset); 571 walk = walk->next; 572 573 /* If we are scanning the single sop, per-semaphore list of 574 * one semaphore and that semaphore is 0, then it is not 575 * necessary to scan the "alter" entries: simple increments 576 * that affect only one entry succeed immediately and cannot 577 * be in the per semaphore pending queue, and decrements 578 * cannot be successful if the value is already 0. 579 */ 580 if (semnum != -1 && sma->sem_base[semnum].semval == 0 && 581 q->alter) 582 break; 583 584 error = try_atomic_semop(sma, q->sops, q->nsops, 585 q->undo, q->pid); 586 587 /* Does q->sleeper still need to sleep? */ 588 if (error > 0) 589 continue; 590 591 unlink_queue(sma, q); 592 593 if (error) { 594 restart = 0; 595 } else { 596 semop_completed = 1; 597 restart = check_restart(sma, q); 598 } 599 600 wake_up_sem_queue_prepare(pt, q, error); 601 if (restart) 602 goto again; 603 } 604 return semop_completed; 605 } 606 607 /** 608 * do_smart_update(sma, sops, nsops, otime, pt) - optimized update_queue 609 * @sma: semaphore array 610 * @sops: operations that were performed 611 * @nsops: number of operations 612 * @otime: force setting otime 613 * @pt: list head of the tasks that must be woken up. 614 * 615 * do_smart_update() does the required called to update_queue, based on the 616 * actual changes that were performed on the semaphore array. 617 * Note that the function does not do the actual wake-up: the caller is 618 * responsible for calling wake_up_sem_queue_do(@pt). 619 * It is safe to perform this call after dropping all locks. 620 */ 621 static void do_smart_update(struct sem_array *sma, struct sembuf *sops, int nsops, 622 int otime, struct list_head *pt) 623 { 624 int i; 625 626 if (sma->complex_count || sops == NULL) { 627 if (update_queue(sma, -1, pt)) 628 otime = 1; 629 goto done; 630 } 631 632 for (i = 0; i < nsops; i++) { 633 if (sops[i].sem_op > 0 || 634 (sops[i].sem_op < 0 && 635 sma->sem_base[sops[i].sem_num].semval == 0)) 636 if (update_queue(sma, sops[i].sem_num, pt)) 637 otime = 1; 638 } 639 done: 640 if (otime) 641 sma->sem_otime = get_seconds(); 642 } 643 644 645 /* The following counts are associated to each semaphore: 646 * semncnt number of tasks waiting on semval being nonzero 647 * semzcnt number of tasks waiting on semval being zero 648 * This model assumes that a task waits on exactly one semaphore. 649 * Since semaphore operations are to be performed atomically, tasks actually 650 * wait on a whole sequence of semaphores simultaneously. 651 * The counts we return here are a rough approximation, but still 652 * warrant that semncnt+semzcnt>0 if the task is on the pending queue. 653 */ 654 static int count_semncnt (struct sem_array * sma, ushort semnum) 655 { 656 int semncnt; 657 struct sem_queue * q; 658 659 semncnt = 0; 660 list_for_each_entry(q, &sma->sem_pending, list) { 661 struct sembuf * sops = q->sops; 662 int nsops = q->nsops; 663 int i; 664 for (i = 0; i < nsops; i++) 665 if (sops[i].sem_num == semnum 666 && (sops[i].sem_op < 0) 667 && !(sops[i].sem_flg & IPC_NOWAIT)) 668 semncnt++; 669 } 670 return semncnt; 671 } 672 673 static int count_semzcnt (struct sem_array * sma, ushort semnum) 674 { 675 int semzcnt; 676 struct sem_queue * q; 677 678 semzcnt = 0; 679 list_for_each_entry(q, &sma->sem_pending, list) { 680 struct sembuf * sops = q->sops; 681 int nsops = q->nsops; 682 int i; 683 for (i = 0; i < nsops; i++) 684 if (sops[i].sem_num == semnum 685 && (sops[i].sem_op == 0) 686 && !(sops[i].sem_flg & IPC_NOWAIT)) 687 semzcnt++; 688 } 689 return semzcnt; 690 } 691 692 static void free_un(struct rcu_head *head) 693 { 694 struct sem_undo *un = container_of(head, struct sem_undo, rcu); 695 kfree(un); 696 } 697 698 /* Free a semaphore set. freeary() is called with sem_ids.rw_mutex locked 699 * as a writer and the spinlock for this semaphore set hold. sem_ids.rw_mutex 700 * remains locked on exit. 701 */ 702 static void freeary(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp) 703 { 704 struct sem_undo *un, *tu; 705 struct sem_queue *q, *tq; 706 struct sem_array *sma = container_of(ipcp, struct sem_array, sem_perm); 707 struct list_head tasks; 708 709 /* Free the existing undo structures for this semaphore set. */ 710 assert_spin_locked(&sma->sem_perm.lock); 711 list_for_each_entry_safe(un, tu, &sma->list_id, list_id) { 712 list_del(&un->list_id); 713 spin_lock(&un->ulp->lock); 714 un->semid = -1; 715 list_del_rcu(&un->list_proc); 716 spin_unlock(&un->ulp->lock); 717 call_rcu(&un->rcu, free_un); 718 } 719 720 /* Wake up all pending processes and let them fail with EIDRM. */ 721 INIT_LIST_HEAD(&tasks); 722 list_for_each_entry_safe(q, tq, &sma->sem_pending, list) { 723 unlink_queue(sma, q); 724 wake_up_sem_queue_prepare(&tasks, q, -EIDRM); 725 } 726 727 /* Remove the semaphore set from the IDR */ 728 sem_rmid(ns, sma); 729 sem_unlock(sma); 730 731 wake_up_sem_queue_do(&tasks); 732 ns->used_sems -= sma->sem_nsems; 733 security_sem_free(sma); 734 ipc_rcu_putref(sma); 735 } 736 737 static unsigned long copy_semid_to_user(void __user *buf, struct semid64_ds *in, int version) 738 { 739 switch(version) { 740 case IPC_64: 741 return copy_to_user(buf, in, sizeof(*in)); 742 case IPC_OLD: 743 { 744 struct semid_ds out; 745 746 ipc64_perm_to_ipc_perm(&in->sem_perm, &out.sem_perm); 747 748 out.sem_otime = in->sem_otime; 749 out.sem_ctime = in->sem_ctime; 750 out.sem_nsems = in->sem_nsems; 751 752 return copy_to_user(buf, &out, sizeof(out)); 753 } 754 default: 755 return -EINVAL; 756 } 757 } 758 759 static int semctl_nolock(struct ipc_namespace *ns, int semid, 760 int cmd, int version, union semun arg) 761 { 762 int err; 763 struct sem_array *sma; 764 765 switch(cmd) { 766 case IPC_INFO: 767 case SEM_INFO: 768 { 769 struct seminfo seminfo; 770 int max_id; 771 772 err = security_sem_semctl(NULL, cmd); 773 if (err) 774 return err; 775 776 memset(&seminfo,0,sizeof(seminfo)); 777 seminfo.semmni = ns->sc_semmni; 778 seminfo.semmns = ns->sc_semmns; 779 seminfo.semmsl = ns->sc_semmsl; 780 seminfo.semopm = ns->sc_semopm; 781 seminfo.semvmx = SEMVMX; 782 seminfo.semmnu = SEMMNU; 783 seminfo.semmap = SEMMAP; 784 seminfo.semume = SEMUME; 785 down_read(&sem_ids(ns).rw_mutex); 786 if (cmd == SEM_INFO) { 787 seminfo.semusz = sem_ids(ns).in_use; 788 seminfo.semaem = ns->used_sems; 789 } else { 790 seminfo.semusz = SEMUSZ; 791 seminfo.semaem = SEMAEM; 792 } 793 max_id = ipc_get_maxid(&sem_ids(ns)); 794 up_read(&sem_ids(ns).rw_mutex); 795 if (copy_to_user (arg.__buf, &seminfo, sizeof(struct seminfo))) 796 return -EFAULT; 797 return (max_id < 0) ? 0: max_id; 798 } 799 case IPC_STAT: 800 case SEM_STAT: 801 { 802 struct semid64_ds tbuf; 803 int id; 804 805 if (cmd == SEM_STAT) { 806 sma = sem_lock(ns, semid); 807 if (IS_ERR(sma)) 808 return PTR_ERR(sma); 809 id = sma->sem_perm.id; 810 } else { 811 sma = sem_lock_check(ns, semid); 812 if (IS_ERR(sma)) 813 return PTR_ERR(sma); 814 id = 0; 815 } 816 817 err = -EACCES; 818 if (ipcperms (&sma->sem_perm, S_IRUGO)) 819 goto out_unlock; 820 821 err = security_sem_semctl(sma, cmd); 822 if (err) 823 goto out_unlock; 824 825 memset(&tbuf, 0, sizeof(tbuf)); 826 827 kernel_to_ipc64_perm(&sma->sem_perm, &tbuf.sem_perm); 828 tbuf.sem_otime = sma->sem_otime; 829 tbuf.sem_ctime = sma->sem_ctime; 830 tbuf.sem_nsems = sma->sem_nsems; 831 sem_unlock(sma); 832 if (copy_semid_to_user (arg.buf, &tbuf, version)) 833 return -EFAULT; 834 return id; 835 } 836 default: 837 return -EINVAL; 838 } 839 out_unlock: 840 sem_unlock(sma); 841 return err; 842 } 843 844 static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, 845 int cmd, int version, union semun arg) 846 { 847 struct sem_array *sma; 848 struct sem* curr; 849 int err; 850 ushort fast_sem_io[SEMMSL_FAST]; 851 ushort* sem_io = fast_sem_io; 852 int nsems; 853 struct list_head tasks; 854 855 sma = sem_lock_check(ns, semid); 856 if (IS_ERR(sma)) 857 return PTR_ERR(sma); 858 859 INIT_LIST_HEAD(&tasks); 860 nsems = sma->sem_nsems; 861 862 err = -EACCES; 863 if (ipcperms (&sma->sem_perm, (cmd==SETVAL||cmd==SETALL)?S_IWUGO:S_IRUGO)) 864 goto out_unlock; 865 866 err = security_sem_semctl(sma, cmd); 867 if (err) 868 goto out_unlock; 869 870 err = -EACCES; 871 switch (cmd) { 872 case GETALL: 873 { 874 ushort __user *array = arg.array; 875 int i; 876 877 if(nsems > SEMMSL_FAST) { 878 sem_getref_and_unlock(sma); 879 880 sem_io = ipc_alloc(sizeof(ushort)*nsems); 881 if(sem_io == NULL) { 882 sem_putref(sma); 883 return -ENOMEM; 884 } 885 886 sem_lock_and_putref(sma); 887 if (sma->sem_perm.deleted) { 888 sem_unlock(sma); 889 err = -EIDRM; 890 goto out_free; 891 } 892 } 893 894 for (i = 0; i < sma->sem_nsems; i++) 895 sem_io[i] = sma->sem_base[i].semval; 896 sem_unlock(sma); 897 err = 0; 898 if(copy_to_user(array, sem_io, nsems*sizeof(ushort))) 899 err = -EFAULT; 900 goto out_free; 901 } 902 case SETALL: 903 { 904 int i; 905 struct sem_undo *un; 906 907 sem_getref_and_unlock(sma); 908 909 if(nsems > SEMMSL_FAST) { 910 sem_io = ipc_alloc(sizeof(ushort)*nsems); 911 if(sem_io == NULL) { 912 sem_putref(sma); 913 return -ENOMEM; 914 } 915 } 916 917 if (copy_from_user (sem_io, arg.array, nsems*sizeof(ushort))) { 918 sem_putref(sma); 919 err = -EFAULT; 920 goto out_free; 921 } 922 923 for (i = 0; i < nsems; i++) { 924 if (sem_io[i] > SEMVMX) { 925 sem_putref(sma); 926 err = -ERANGE; 927 goto out_free; 928 } 929 } 930 sem_lock_and_putref(sma); 931 if (sma->sem_perm.deleted) { 932 sem_unlock(sma); 933 err = -EIDRM; 934 goto out_free; 935 } 936 937 for (i = 0; i < nsems; i++) 938 sma->sem_base[i].semval = sem_io[i]; 939 940 assert_spin_locked(&sma->sem_perm.lock); 941 list_for_each_entry(un, &sma->list_id, list_id) { 942 for (i = 0; i < nsems; i++) 943 un->semadj[i] = 0; 944 } 945 sma->sem_ctime = get_seconds(); 946 /* maybe some queued-up processes were waiting for this */ 947 do_smart_update(sma, NULL, 0, 0, &tasks); 948 err = 0; 949 goto out_unlock; 950 } 951 /* GETVAL, GETPID, GETNCTN, GETZCNT, SETVAL: fall-through */ 952 } 953 err = -EINVAL; 954 if(semnum < 0 || semnum >= nsems) 955 goto out_unlock; 956 957 curr = &sma->sem_base[semnum]; 958 959 switch (cmd) { 960 case GETVAL: 961 err = curr->semval; 962 goto out_unlock; 963 case GETPID: 964 err = curr->sempid; 965 goto out_unlock; 966 case GETNCNT: 967 err = count_semncnt(sma,semnum); 968 goto out_unlock; 969 case GETZCNT: 970 err = count_semzcnt(sma,semnum); 971 goto out_unlock; 972 case SETVAL: 973 { 974 int val = arg.val; 975 struct sem_undo *un; 976 977 err = -ERANGE; 978 if (val > SEMVMX || val < 0) 979 goto out_unlock; 980 981 assert_spin_locked(&sma->sem_perm.lock); 982 list_for_each_entry(un, &sma->list_id, list_id) 983 un->semadj[semnum] = 0; 984 985 curr->semval = val; 986 curr->sempid = task_tgid_vnr(current); 987 sma->sem_ctime = get_seconds(); 988 /* maybe some queued-up processes were waiting for this */ 989 do_smart_update(sma, NULL, 0, 0, &tasks); 990 err = 0; 991 goto out_unlock; 992 } 993 } 994 out_unlock: 995 sem_unlock(sma); 996 wake_up_sem_queue_do(&tasks); 997 998 out_free: 999 if(sem_io != fast_sem_io) 1000 ipc_free(sem_io, sizeof(ushort)*nsems); 1001 return err; 1002 } 1003 1004 static inline unsigned long 1005 copy_semid_from_user(struct semid64_ds *out, void __user *buf, int version) 1006 { 1007 switch(version) { 1008 case IPC_64: 1009 if (copy_from_user(out, buf, sizeof(*out))) 1010 return -EFAULT; 1011 return 0; 1012 case IPC_OLD: 1013 { 1014 struct semid_ds tbuf_old; 1015 1016 if(copy_from_user(&tbuf_old, buf, sizeof(tbuf_old))) 1017 return -EFAULT; 1018 1019 out->sem_perm.uid = tbuf_old.sem_perm.uid; 1020 out->sem_perm.gid = tbuf_old.sem_perm.gid; 1021 out->sem_perm.mode = tbuf_old.sem_perm.mode; 1022 1023 return 0; 1024 } 1025 default: 1026 return -EINVAL; 1027 } 1028 } 1029 1030 /* 1031 * This function handles some semctl commands which require the rw_mutex 1032 * to be held in write mode. 1033 * NOTE: no locks must be held, the rw_mutex is taken inside this function. 1034 */ 1035 static int semctl_down(struct ipc_namespace *ns, int semid, 1036 int cmd, int version, union semun arg) 1037 { 1038 struct sem_array *sma; 1039 int err; 1040 struct semid64_ds semid64; 1041 struct kern_ipc_perm *ipcp; 1042 1043 if(cmd == IPC_SET) { 1044 if (copy_semid_from_user(&semid64, arg.buf, version)) 1045 return -EFAULT; 1046 } 1047 1048 ipcp = ipcctl_pre_down(&sem_ids(ns), semid, cmd, &semid64.sem_perm, 0); 1049 if (IS_ERR(ipcp)) 1050 return PTR_ERR(ipcp); 1051 1052 sma = container_of(ipcp, struct sem_array, sem_perm); 1053 1054 err = security_sem_semctl(sma, cmd); 1055 if (err) 1056 goto out_unlock; 1057 1058 switch(cmd){ 1059 case IPC_RMID: 1060 freeary(ns, ipcp); 1061 goto out_up; 1062 case IPC_SET: 1063 ipc_update_perm(&semid64.sem_perm, ipcp); 1064 sma->sem_ctime = get_seconds(); 1065 break; 1066 default: 1067 err = -EINVAL; 1068 } 1069 1070 out_unlock: 1071 sem_unlock(sma); 1072 out_up: 1073 up_write(&sem_ids(ns).rw_mutex); 1074 return err; 1075 } 1076 1077 SYSCALL_DEFINE(semctl)(int semid, int semnum, int cmd, union semun arg) 1078 { 1079 int err = -EINVAL; 1080 int version; 1081 struct ipc_namespace *ns; 1082 1083 if (semid < 0) 1084 return -EINVAL; 1085 1086 version = ipc_parse_version(&cmd); 1087 ns = current->nsproxy->ipc_ns; 1088 1089 switch(cmd) { 1090 case IPC_INFO: 1091 case SEM_INFO: 1092 case IPC_STAT: 1093 case SEM_STAT: 1094 err = semctl_nolock(ns, semid, cmd, version, arg); 1095 return err; 1096 case GETALL: 1097 case GETVAL: 1098 case GETPID: 1099 case GETNCNT: 1100 case GETZCNT: 1101 case SETVAL: 1102 case SETALL: 1103 err = semctl_main(ns,semid,semnum,cmd,version,arg); 1104 return err; 1105 case IPC_RMID: 1106 case IPC_SET: 1107 err = semctl_down(ns, semid, cmd, version, arg); 1108 return err; 1109 default: 1110 return -EINVAL; 1111 } 1112 } 1113 #ifdef CONFIG_HAVE_SYSCALL_WRAPPERS 1114 asmlinkage long SyS_semctl(int semid, int semnum, int cmd, union semun arg) 1115 { 1116 return SYSC_semctl((int) semid, (int) semnum, (int) cmd, arg); 1117 } 1118 SYSCALL_ALIAS(sys_semctl, SyS_semctl); 1119 #endif 1120 1121 /* If the task doesn't already have a undo_list, then allocate one 1122 * here. We guarantee there is only one thread using this undo list, 1123 * and current is THE ONE 1124 * 1125 * If this allocation and assignment succeeds, but later 1126 * portions of this code fail, there is no need to free the sem_undo_list. 1127 * Just let it stay associated with the task, and it'll be freed later 1128 * at exit time. 1129 * 1130 * This can block, so callers must hold no locks. 1131 */ 1132 static inline int get_undo_list(struct sem_undo_list **undo_listp) 1133 { 1134 struct sem_undo_list *undo_list; 1135 1136 undo_list = current->sysvsem.undo_list; 1137 if (!undo_list) { 1138 undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL); 1139 if (undo_list == NULL) 1140 return -ENOMEM; 1141 spin_lock_init(&undo_list->lock); 1142 atomic_set(&undo_list->refcnt, 1); 1143 INIT_LIST_HEAD(&undo_list->list_proc); 1144 1145 current->sysvsem.undo_list = undo_list; 1146 } 1147 *undo_listp = undo_list; 1148 return 0; 1149 } 1150 1151 static struct sem_undo *__lookup_undo(struct sem_undo_list *ulp, int semid) 1152 { 1153 struct sem_undo *un; 1154 1155 list_for_each_entry_rcu(un, &ulp->list_proc, list_proc) { 1156 if (un->semid == semid) 1157 return un; 1158 } 1159 return NULL; 1160 } 1161 1162 static struct sem_undo *lookup_undo(struct sem_undo_list *ulp, int semid) 1163 { 1164 struct sem_undo *un; 1165 1166 assert_spin_locked(&ulp->lock); 1167 1168 un = __lookup_undo(ulp, semid); 1169 if (un) { 1170 list_del_rcu(&un->list_proc); 1171 list_add_rcu(&un->list_proc, &ulp->list_proc); 1172 } 1173 return un; 1174 } 1175 1176 /** 1177 * find_alloc_undo - Lookup (and if not present create) undo array 1178 * @ns: namespace 1179 * @semid: semaphore array id 1180 * 1181 * The function looks up (and if not present creates) the undo structure. 1182 * The size of the undo structure depends on the size of the semaphore 1183 * array, thus the alloc path is not that straightforward. 1184 * Lifetime-rules: sem_undo is rcu-protected, on success, the function 1185 * performs a rcu_read_lock(). 1186 */ 1187 static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid) 1188 { 1189 struct sem_array *sma; 1190 struct sem_undo_list *ulp; 1191 struct sem_undo *un, *new; 1192 int nsems; 1193 int error; 1194 1195 error = get_undo_list(&ulp); 1196 if (error) 1197 return ERR_PTR(error); 1198 1199 rcu_read_lock(); 1200 spin_lock(&ulp->lock); 1201 un = lookup_undo(ulp, semid); 1202 spin_unlock(&ulp->lock); 1203 if (likely(un!=NULL)) 1204 goto out; 1205 rcu_read_unlock(); 1206 1207 /* no undo structure around - allocate one. */ 1208 /* step 1: figure out the size of the semaphore array */ 1209 sma = sem_lock_check(ns, semid); 1210 if (IS_ERR(sma)) 1211 return ERR_CAST(sma); 1212 1213 nsems = sma->sem_nsems; 1214 sem_getref_and_unlock(sma); 1215 1216 /* step 2: allocate new undo structure */ 1217 new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL); 1218 if (!new) { 1219 sem_putref(sma); 1220 return ERR_PTR(-ENOMEM); 1221 } 1222 1223 /* step 3: Acquire the lock on semaphore array */ 1224 sem_lock_and_putref(sma); 1225 if (sma->sem_perm.deleted) { 1226 sem_unlock(sma); 1227 kfree(new); 1228 un = ERR_PTR(-EIDRM); 1229 goto out; 1230 } 1231 spin_lock(&ulp->lock); 1232 1233 /* 1234 * step 4: check for races: did someone else allocate the undo struct? 1235 */ 1236 un = lookup_undo(ulp, semid); 1237 if (un) { 1238 kfree(new); 1239 goto success; 1240 } 1241 /* step 5: initialize & link new undo structure */ 1242 new->semadj = (short *) &new[1]; 1243 new->ulp = ulp; 1244 new->semid = semid; 1245 assert_spin_locked(&ulp->lock); 1246 list_add_rcu(&new->list_proc, &ulp->list_proc); 1247 assert_spin_locked(&sma->sem_perm.lock); 1248 list_add(&new->list_id, &sma->list_id); 1249 un = new; 1250 1251 success: 1252 spin_unlock(&ulp->lock); 1253 rcu_read_lock(); 1254 sem_unlock(sma); 1255 out: 1256 return un; 1257 } 1258 1259 SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops, 1260 unsigned, nsops, const struct timespec __user *, timeout) 1261 { 1262 int error = -EINVAL; 1263 struct sem_array *sma; 1264 struct sembuf fast_sops[SEMOPM_FAST]; 1265 struct sembuf* sops = fast_sops, *sop; 1266 struct sem_undo *un; 1267 int undos = 0, alter = 0, max; 1268 struct sem_queue queue; 1269 unsigned long jiffies_left = 0; 1270 struct ipc_namespace *ns; 1271 struct list_head tasks; 1272 1273 ns = current->nsproxy->ipc_ns; 1274 1275 if (nsops < 1 || semid < 0) 1276 return -EINVAL; 1277 if (nsops > ns->sc_semopm) 1278 return -E2BIG; 1279 if(nsops > SEMOPM_FAST) { 1280 sops = kmalloc(sizeof(*sops)*nsops,GFP_KERNEL); 1281 if(sops==NULL) 1282 return -ENOMEM; 1283 } 1284 if (copy_from_user (sops, tsops, nsops * sizeof(*tsops))) { 1285 error=-EFAULT; 1286 goto out_free; 1287 } 1288 if (timeout) { 1289 struct timespec _timeout; 1290 if (copy_from_user(&_timeout, timeout, sizeof(*timeout))) { 1291 error = -EFAULT; 1292 goto out_free; 1293 } 1294 if (_timeout.tv_sec < 0 || _timeout.tv_nsec < 0 || 1295 _timeout.tv_nsec >= 1000000000L) { 1296 error = -EINVAL; 1297 goto out_free; 1298 } 1299 jiffies_left = timespec_to_jiffies(&_timeout); 1300 } 1301 max = 0; 1302 for (sop = sops; sop < sops + nsops; sop++) { 1303 if (sop->sem_num >= max) 1304 max = sop->sem_num; 1305 if (sop->sem_flg & SEM_UNDO) 1306 undos = 1; 1307 if (sop->sem_op != 0) 1308 alter = 1; 1309 } 1310 1311 if (undos) { 1312 un = find_alloc_undo(ns, semid); 1313 if (IS_ERR(un)) { 1314 error = PTR_ERR(un); 1315 goto out_free; 1316 } 1317 } else 1318 un = NULL; 1319 1320 INIT_LIST_HEAD(&tasks); 1321 1322 sma = sem_lock_check(ns, semid); 1323 if (IS_ERR(sma)) { 1324 if (un) 1325 rcu_read_unlock(); 1326 error = PTR_ERR(sma); 1327 goto out_free; 1328 } 1329 1330 /* 1331 * semid identifiers are not unique - find_alloc_undo may have 1332 * allocated an undo structure, it was invalidated by an RMID 1333 * and now a new array with received the same id. Check and fail. 1334 * This case can be detected checking un->semid. The existance of 1335 * "un" itself is guaranteed by rcu. 1336 */ 1337 error = -EIDRM; 1338 if (un) { 1339 if (un->semid == -1) { 1340 rcu_read_unlock(); 1341 goto out_unlock_free; 1342 } else { 1343 /* 1344 * rcu lock can be released, "un" cannot disappear: 1345 * - sem_lock is acquired, thus IPC_RMID is 1346 * impossible. 1347 * - exit_sem is impossible, it always operates on 1348 * current (or a dead task). 1349 */ 1350 1351 rcu_read_unlock(); 1352 } 1353 } 1354 1355 error = -EFBIG; 1356 if (max >= sma->sem_nsems) 1357 goto out_unlock_free; 1358 1359 error = -EACCES; 1360 if (ipcperms(&sma->sem_perm, alter ? S_IWUGO : S_IRUGO)) 1361 goto out_unlock_free; 1362 1363 error = security_sem_semop(sma, sops, nsops, alter); 1364 if (error) 1365 goto out_unlock_free; 1366 1367 error = try_atomic_semop (sma, sops, nsops, un, task_tgid_vnr(current)); 1368 if (error <= 0) { 1369 if (alter && error == 0) 1370 do_smart_update(sma, sops, nsops, 1, &tasks); 1371 1372 goto out_unlock_free; 1373 } 1374 1375 /* We need to sleep on this operation, so we put the current 1376 * task into the pending queue and go to sleep. 1377 */ 1378 1379 queue.sops = sops; 1380 queue.nsops = nsops; 1381 queue.undo = un; 1382 queue.pid = task_tgid_vnr(current); 1383 queue.alter = alter; 1384 if (alter) 1385 list_add_tail(&queue.list, &sma->sem_pending); 1386 else 1387 list_add(&queue.list, &sma->sem_pending); 1388 1389 if (nsops == 1) { 1390 struct sem *curr; 1391 curr = &sma->sem_base[sops->sem_num]; 1392 1393 if (alter) 1394 list_add_tail(&queue.simple_list, &curr->sem_pending); 1395 else 1396 list_add(&queue.simple_list, &curr->sem_pending); 1397 } else { 1398 INIT_LIST_HEAD(&queue.simple_list); 1399 sma->complex_count++; 1400 } 1401 1402 queue.status = -EINTR; 1403 queue.sleeper = current; 1404 current->state = TASK_INTERRUPTIBLE; 1405 sem_unlock(sma); 1406 1407 if (timeout) 1408 jiffies_left = schedule_timeout(jiffies_left); 1409 else 1410 schedule(); 1411 1412 error = queue.status; 1413 while(unlikely(error == IN_WAKEUP)) { 1414 cpu_relax(); 1415 error = queue.status; 1416 } 1417 1418 if (error != -EINTR) { 1419 /* fast path: update_queue already obtained all requested 1420 * resources */ 1421 goto out_free; 1422 } 1423 1424 sma = sem_lock(ns, semid); 1425 if (IS_ERR(sma)) { 1426 error = -EIDRM; 1427 goto out_free; 1428 } 1429 1430 /* 1431 * If queue.status != -EINTR we are woken up by another process 1432 */ 1433 error = queue.status; 1434 if (error != -EINTR) { 1435 goto out_unlock_free; 1436 } 1437 1438 /* 1439 * If an interrupt occurred we have to clean up the queue 1440 */ 1441 if (timeout && jiffies_left == 0) 1442 error = -EAGAIN; 1443 unlink_queue(sma, &queue); 1444 1445 out_unlock_free: 1446 sem_unlock(sma); 1447 1448 wake_up_sem_queue_do(&tasks); 1449 out_free: 1450 if(sops != fast_sops) 1451 kfree(sops); 1452 return error; 1453 } 1454 1455 SYSCALL_DEFINE3(semop, int, semid, struct sembuf __user *, tsops, 1456 unsigned, nsops) 1457 { 1458 return sys_semtimedop(semid, tsops, nsops, NULL); 1459 } 1460 1461 /* If CLONE_SYSVSEM is set, establish sharing of SEM_UNDO state between 1462 * parent and child tasks. 1463 */ 1464 1465 int copy_semundo(unsigned long clone_flags, struct task_struct *tsk) 1466 { 1467 struct sem_undo_list *undo_list; 1468 int error; 1469 1470 if (clone_flags & CLONE_SYSVSEM) { 1471 error = get_undo_list(&undo_list); 1472 if (error) 1473 return error; 1474 atomic_inc(&undo_list->refcnt); 1475 tsk->sysvsem.undo_list = undo_list; 1476 } else 1477 tsk->sysvsem.undo_list = NULL; 1478 1479 return 0; 1480 } 1481 1482 /* 1483 * add semadj values to semaphores, free undo structures. 1484 * undo structures are not freed when semaphore arrays are destroyed 1485 * so some of them may be out of date. 1486 * IMPLEMENTATION NOTE: There is some confusion over whether the 1487 * set of adjustments that needs to be done should be done in an atomic 1488 * manner or not. That is, if we are attempting to decrement the semval 1489 * should we queue up and wait until we can do so legally? 1490 * The original implementation attempted to do this (queue and wait). 1491 * The current implementation does not do so. The POSIX standard 1492 * and SVID should be consulted to determine what behavior is mandated. 1493 */ 1494 void exit_sem(struct task_struct *tsk) 1495 { 1496 struct sem_undo_list *ulp; 1497 1498 ulp = tsk->sysvsem.undo_list; 1499 if (!ulp) 1500 return; 1501 tsk->sysvsem.undo_list = NULL; 1502 1503 if (!atomic_dec_and_test(&ulp->refcnt)) 1504 return; 1505 1506 for (;;) { 1507 struct sem_array *sma; 1508 struct sem_undo *un; 1509 struct list_head tasks; 1510 int semid; 1511 int i; 1512 1513 rcu_read_lock(); 1514 un = list_entry_rcu(ulp->list_proc.next, 1515 struct sem_undo, list_proc); 1516 if (&un->list_proc == &ulp->list_proc) 1517 semid = -1; 1518 else 1519 semid = un->semid; 1520 rcu_read_unlock(); 1521 1522 if (semid == -1) 1523 break; 1524 1525 sma = sem_lock_check(tsk->nsproxy->ipc_ns, un->semid); 1526 1527 /* exit_sem raced with IPC_RMID, nothing to do */ 1528 if (IS_ERR(sma)) 1529 continue; 1530 1531 un = __lookup_undo(ulp, semid); 1532 if (un == NULL) { 1533 /* exit_sem raced with IPC_RMID+semget() that created 1534 * exactly the same semid. Nothing to do. 1535 */ 1536 sem_unlock(sma); 1537 continue; 1538 } 1539 1540 /* remove un from the linked lists */ 1541 assert_spin_locked(&sma->sem_perm.lock); 1542 list_del(&un->list_id); 1543 1544 spin_lock(&ulp->lock); 1545 list_del_rcu(&un->list_proc); 1546 spin_unlock(&ulp->lock); 1547 1548 /* perform adjustments registered in un */ 1549 for (i = 0; i < sma->sem_nsems; i++) { 1550 struct sem * semaphore = &sma->sem_base[i]; 1551 if (un->semadj[i]) { 1552 semaphore->semval += un->semadj[i]; 1553 /* 1554 * Range checks of the new semaphore value, 1555 * not defined by sus: 1556 * - Some unices ignore the undo entirely 1557 * (e.g. HP UX 11i 11.22, Tru64 V5.1) 1558 * - some cap the value (e.g. FreeBSD caps 1559 * at 0, but doesn't enforce SEMVMX) 1560 * 1561 * Linux caps the semaphore value, both at 0 1562 * and at SEMVMX. 1563 * 1564 * Manfred <manfred@colorfullife.com> 1565 */ 1566 if (semaphore->semval < 0) 1567 semaphore->semval = 0; 1568 if (semaphore->semval > SEMVMX) 1569 semaphore->semval = SEMVMX; 1570 semaphore->sempid = task_tgid_vnr(current); 1571 } 1572 } 1573 /* maybe some queued-up processes were waiting for this */ 1574 INIT_LIST_HEAD(&tasks); 1575 do_smart_update(sma, NULL, 0, 1, &tasks); 1576 sem_unlock(sma); 1577 wake_up_sem_queue_do(&tasks); 1578 1579 call_rcu(&un->rcu, free_un); 1580 } 1581 kfree(ulp); 1582 } 1583 1584 #ifdef CONFIG_PROC_FS 1585 static int sysvipc_sem_proc_show(struct seq_file *s, void *it) 1586 { 1587 struct sem_array *sma = it; 1588 1589 return seq_printf(s, 1590 "%10d %10d %4o %10u %5u %5u %5u %5u %10lu %10lu\n", 1591 sma->sem_perm.key, 1592 sma->sem_perm.id, 1593 sma->sem_perm.mode, 1594 sma->sem_nsems, 1595 sma->sem_perm.uid, 1596 sma->sem_perm.gid, 1597 sma->sem_perm.cuid, 1598 sma->sem_perm.cgid, 1599 sma->sem_otime, 1600 sma->sem_ctime); 1601 } 1602 #endif 1603