1 /* 2 * linux/ipc/sem.c 3 * Copyright (C) 1992 Krishna Balasubramanian 4 * Copyright (C) 1995 Eric Schenk, Bruno Haible 5 * 6 * /proc/sysvipc/sem support (c) 1999 Dragos Acostachioaie <dragos@iname.com> 7 * 8 * SMP-threaded, sysctl's added 9 * (c) 1999 Manfred Spraul <manfred@colorfullife.com> 10 * Enforced range limit on SEM_UNDO 11 * (c) 2001 Red Hat Inc 12 * Lockless wakeup 13 * (c) 2003 Manfred Spraul <manfred@colorfullife.com> 14 * (c) 2016 Davidlohr Bueso <dave@stgolabs.net> 15 * Further wakeup optimizations, documentation 16 * (c) 2010 Manfred Spraul <manfred@colorfullife.com> 17 * 18 * support for audit of ipc object properties and permission changes 19 * Dustin Kirkland <dustin.kirkland@us.ibm.com> 20 * 21 * namespaces support 22 * OpenVZ, SWsoft Inc. 23 * Pavel Emelianov <xemul@openvz.org> 24 * 25 * Implementation notes: (May 2010) 26 * This file implements System V semaphores. 27 * 28 * User space visible behavior: 29 * - FIFO ordering for semop() operations (just FIFO, not starvation 30 * protection) 31 * - multiple semaphore operations that alter the same semaphore in 32 * one semop() are handled. 33 * - sem_ctime (time of last semctl()) is updated in the IPC_SET, SETVAL and 34 * SETALL calls. 35 * - two Linux specific semctl() commands: SEM_STAT, SEM_INFO. 36 * - undo adjustments at process exit are limited to 0..SEMVMX. 37 * - namespace are supported. 38 * - SEMMSL, SEMMNS, SEMOPM and SEMMNI can be configured at runtine by writing 39 * to /proc/sys/kernel/sem. 40 * - statistics about the usage are reported in /proc/sysvipc/sem. 41 * 42 * Internals: 43 * - scalability: 44 * - all global variables are read-mostly. 45 * - semop() calls and semctl(RMID) are synchronized by RCU. 46 * - most operations do write operations (actually: spin_lock calls) to 47 * the per-semaphore array structure. 48 * Thus: Perfect SMP scaling between independent semaphore arrays. 49 * If multiple semaphores in one array are used, then cache line 50 * trashing on the semaphore array spinlock will limit the scaling. 51 * - semncnt and semzcnt are calculated on demand in count_semcnt() 52 * - the task that performs a successful semop() scans the list of all 53 * sleeping tasks and completes any pending operations that can be fulfilled. 54 * Semaphores are actively given to waiting tasks (necessary for FIFO). 55 * (see update_queue()) 56 * - To improve the scalability, the actual wake-up calls are performed after 57 * dropping all locks. (see wake_up_sem_queue_prepare()) 58 * - All work is done by the waker, the woken up task does not have to do 59 * anything - not even acquiring a lock or dropping a refcount. 60 * - A woken up task may not even touch the semaphore array anymore, it may 61 * have been destroyed already by a semctl(RMID). 62 * - UNDO values are stored in an array (one per process and per 63 * semaphore array, lazily allocated). For backwards compatibility, multiple 64 * modes for the UNDO variables are supported (per process, per thread) 65 * (see copy_semundo, CLONE_SYSVSEM) 66 * - There are two lists of the pending operations: a per-array list 67 * and per-semaphore list (stored in the array). This allows to achieve FIFO 68 * ordering without always scanning all pending operations. 69 * The worst-case behavior is nevertheless O(N^2) for N wakeups. 70 */ 71 72 #include <linux/slab.h> 73 #include <linux/spinlock.h> 74 #include <linux/init.h> 75 #include <linux/proc_fs.h> 76 #include <linux/time.h> 77 #include <linux/security.h> 78 #include <linux/syscalls.h> 79 #include <linux/audit.h> 80 #include <linux/capability.h> 81 #include <linux/seq_file.h> 82 #include <linux/rwsem.h> 83 #include <linux/nsproxy.h> 84 #include <linux/ipc_namespace.h> 85 #include <linux/sched/wake_q.h> 86 87 #include <linux/uaccess.h> 88 #include "util.h" 89 90 91 /* One queue for each sleeping process in the system. */ 92 struct sem_queue { 93 struct list_head list; /* queue of pending operations */ 94 struct task_struct *sleeper; /* this process */ 95 struct sem_undo *undo; /* undo structure */ 96 int pid; /* process id of requesting process */ 97 int status; /* completion status of operation */ 98 struct sembuf *sops; /* array of pending operations */ 99 struct sembuf *blocking; /* the operation that blocked */ 100 int nsops; /* number of operations */ 101 bool alter; /* does *sops alter the array? */ 102 bool dupsop; /* sops on more than one sem_num */ 103 }; 104 105 /* Each task has a list of undo requests. They are executed automatically 106 * when the process exits. 107 */ 108 struct sem_undo { 109 struct list_head list_proc; /* per-process list: * 110 * all undos from one process 111 * rcu protected */ 112 struct rcu_head rcu; /* rcu struct for sem_undo */ 113 struct sem_undo_list *ulp; /* back ptr to sem_undo_list */ 114 struct list_head list_id; /* per semaphore array list: 115 * all undos for one array */ 116 int semid; /* semaphore set identifier */ 117 short *semadj; /* array of adjustments */ 118 /* one per semaphore */ 119 }; 120 121 /* sem_undo_list controls shared access to the list of sem_undo structures 122 * that may be shared among all a CLONE_SYSVSEM task group. 123 */ 124 struct sem_undo_list { 125 atomic_t refcnt; 126 spinlock_t lock; 127 struct list_head list_proc; 128 }; 129 130 131 #define sem_ids(ns) ((ns)->ids[IPC_SEM_IDS]) 132 133 #define sem_checkid(sma, semid) ipc_checkid(&sma->sem_perm, semid) 134 135 static int newary(struct ipc_namespace *, struct ipc_params *); 136 static void freeary(struct ipc_namespace *, struct kern_ipc_perm *); 137 #ifdef CONFIG_PROC_FS 138 static int sysvipc_sem_proc_show(struct seq_file *s, void *it); 139 #endif 140 141 #define SEMMSL_FAST 256 /* 512 bytes on stack */ 142 #define SEMOPM_FAST 64 /* ~ 372 bytes on stack */ 143 144 /* 145 * Switching from the mode suitable for simple ops 146 * to the mode for complex ops is costly. Therefore: 147 * use some hysteresis 148 */ 149 #define USE_GLOBAL_LOCK_HYSTERESIS 10 150 151 /* 152 * Locking: 153 * a) global sem_lock() for read/write 154 * sem_undo.id_next, 155 * sem_array.complex_count, 156 * sem_array.pending{_alter,_const}, 157 * sem_array.sem_undo 158 * 159 * b) global or semaphore sem_lock() for read/write: 160 * sem_array.sems[i].pending_{const,alter}: 161 * 162 * c) special: 163 * sem_undo_list.list_proc: 164 * * undo_list->lock for write 165 * * rcu for read 166 * use_global_lock: 167 * * global sem_lock() for write 168 * * either local or global sem_lock() for read. 169 * 170 * Memory ordering: 171 * Most ordering is enforced by using spin_lock() and spin_unlock(). 172 * The special case is use_global_lock: 173 * Setting it from non-zero to 0 is a RELEASE, this is ensured by 174 * using smp_store_release(). 175 * Testing if it is non-zero is an ACQUIRE, this is ensured by using 176 * smp_load_acquire(). 177 * Setting it from 0 to non-zero must be ordered with regards to 178 * this smp_load_acquire(), this is guaranteed because the smp_load_acquire() 179 * is inside a spin_lock() and after a write from 0 to non-zero a 180 * spin_lock()+spin_unlock() is done. 181 */ 182 183 #define sc_semmsl sem_ctls[0] 184 #define sc_semmns sem_ctls[1] 185 #define sc_semopm sem_ctls[2] 186 #define sc_semmni sem_ctls[3] 187 188 void sem_init_ns(struct ipc_namespace *ns) 189 { 190 ns->sc_semmsl = SEMMSL; 191 ns->sc_semmns = SEMMNS; 192 ns->sc_semopm = SEMOPM; 193 ns->sc_semmni = SEMMNI; 194 ns->used_sems = 0; 195 ipc_init_ids(&ns->ids[IPC_SEM_IDS]); 196 } 197 198 #ifdef CONFIG_IPC_NS 199 void sem_exit_ns(struct ipc_namespace *ns) 200 { 201 free_ipcs(ns, &sem_ids(ns), freeary); 202 idr_destroy(&ns->ids[IPC_SEM_IDS].ipcs_idr); 203 } 204 #endif 205 206 void __init sem_init(void) 207 { 208 sem_init_ns(&init_ipc_ns); 209 ipc_init_proc_interface("sysvipc/sem", 210 " key semid perms nsems uid gid cuid cgid otime ctime\n", 211 IPC_SEM_IDS, sysvipc_sem_proc_show); 212 } 213 214 /** 215 * unmerge_queues - unmerge queues, if possible. 216 * @sma: semaphore array 217 * 218 * The function unmerges the wait queues if complex_count is 0. 219 * It must be called prior to dropping the global semaphore array lock. 220 */ 221 static void unmerge_queues(struct sem_array *sma) 222 { 223 struct sem_queue *q, *tq; 224 225 /* complex operations still around? */ 226 if (sma->complex_count) 227 return; 228 /* 229 * We will switch back to simple mode. 230 * Move all pending operation back into the per-semaphore 231 * queues. 232 */ 233 list_for_each_entry_safe(q, tq, &sma->pending_alter, list) { 234 struct sem *curr; 235 curr = &sma->sems[q->sops[0].sem_num]; 236 237 list_add_tail(&q->list, &curr->pending_alter); 238 } 239 INIT_LIST_HEAD(&sma->pending_alter); 240 } 241 242 /** 243 * merge_queues - merge single semop queues into global queue 244 * @sma: semaphore array 245 * 246 * This function merges all per-semaphore queues into the global queue. 247 * It is necessary to achieve FIFO ordering for the pending single-sop 248 * operations when a multi-semop operation must sleep. 249 * Only the alter operations must be moved, the const operations can stay. 250 */ 251 static void merge_queues(struct sem_array *sma) 252 { 253 int i; 254 for (i = 0; i < sma->sem_nsems; i++) { 255 struct sem *sem = &sma->sems[i]; 256 257 list_splice_init(&sem->pending_alter, &sma->pending_alter); 258 } 259 } 260 261 static void sem_rcu_free(struct rcu_head *head) 262 { 263 struct kern_ipc_perm *p = container_of(head, struct kern_ipc_perm, rcu); 264 struct sem_array *sma = container_of(p, struct sem_array, sem_perm); 265 266 security_sem_free(sma); 267 kvfree(sma); 268 } 269 270 /* 271 * Enter the mode suitable for non-simple operations: 272 * Caller must own sem_perm.lock. 273 */ 274 static void complexmode_enter(struct sem_array *sma) 275 { 276 int i; 277 struct sem *sem; 278 279 if (sma->use_global_lock > 0) { 280 /* 281 * We are already in global lock mode. 282 * Nothing to do, just reset the 283 * counter until we return to simple mode. 284 */ 285 sma->use_global_lock = USE_GLOBAL_LOCK_HYSTERESIS; 286 return; 287 } 288 sma->use_global_lock = USE_GLOBAL_LOCK_HYSTERESIS; 289 290 for (i = 0; i < sma->sem_nsems; i++) { 291 sem = &sma->sems[i]; 292 spin_lock(&sem->lock); 293 spin_unlock(&sem->lock); 294 } 295 } 296 297 /* 298 * Try to leave the mode that disallows simple operations: 299 * Caller must own sem_perm.lock. 300 */ 301 static void complexmode_tryleave(struct sem_array *sma) 302 { 303 if (sma->complex_count) { 304 /* Complex ops are sleeping. 305 * We must stay in complex mode 306 */ 307 return; 308 } 309 if (sma->use_global_lock == 1) { 310 /* 311 * Immediately after setting use_global_lock to 0, 312 * a simple op can start. Thus: all memory writes 313 * performed by the current operation must be visible 314 * before we set use_global_lock to 0. 315 */ 316 smp_store_release(&sma->use_global_lock, 0); 317 } else { 318 sma->use_global_lock--; 319 } 320 } 321 322 #define SEM_GLOBAL_LOCK (-1) 323 /* 324 * If the request contains only one semaphore operation, and there are 325 * no complex transactions pending, lock only the semaphore involved. 326 * Otherwise, lock the entire semaphore array, since we either have 327 * multiple semaphores in our own semops, or we need to look at 328 * semaphores from other pending complex operations. 329 */ 330 static inline int sem_lock(struct sem_array *sma, struct sembuf *sops, 331 int nsops) 332 { 333 struct sem *sem; 334 335 if (nsops != 1) { 336 /* Complex operation - acquire a full lock */ 337 ipc_lock_object(&sma->sem_perm); 338 339 /* Prevent parallel simple ops */ 340 complexmode_enter(sma); 341 return SEM_GLOBAL_LOCK; 342 } 343 344 /* 345 * Only one semaphore affected - try to optimize locking. 346 * Optimized locking is possible if no complex operation 347 * is either enqueued or processed right now. 348 * 349 * Both facts are tracked by use_global_mode. 350 */ 351 sem = &sma->sems[sops->sem_num]; 352 353 /* 354 * Initial check for use_global_lock. Just an optimization, 355 * no locking, no memory barrier. 356 */ 357 if (!sma->use_global_lock) { 358 /* 359 * It appears that no complex operation is around. 360 * Acquire the per-semaphore lock. 361 */ 362 spin_lock(&sem->lock); 363 364 /* pairs with smp_store_release() */ 365 if (!smp_load_acquire(&sma->use_global_lock)) { 366 /* fast path successful! */ 367 return sops->sem_num; 368 } 369 spin_unlock(&sem->lock); 370 } 371 372 /* slow path: acquire the full lock */ 373 ipc_lock_object(&sma->sem_perm); 374 375 if (sma->use_global_lock == 0) { 376 /* 377 * The use_global_lock mode ended while we waited for 378 * sma->sem_perm.lock. Thus we must switch to locking 379 * with sem->lock. 380 * Unlike in the fast path, there is no need to recheck 381 * sma->use_global_lock after we have acquired sem->lock: 382 * We own sma->sem_perm.lock, thus use_global_lock cannot 383 * change. 384 */ 385 spin_lock(&sem->lock); 386 387 ipc_unlock_object(&sma->sem_perm); 388 return sops->sem_num; 389 } else { 390 /* 391 * Not a false alarm, thus continue to use the global lock 392 * mode. No need for complexmode_enter(), this was done by 393 * the caller that has set use_global_mode to non-zero. 394 */ 395 return SEM_GLOBAL_LOCK; 396 } 397 } 398 399 static inline void sem_unlock(struct sem_array *sma, int locknum) 400 { 401 if (locknum == SEM_GLOBAL_LOCK) { 402 unmerge_queues(sma); 403 complexmode_tryleave(sma); 404 ipc_unlock_object(&sma->sem_perm); 405 } else { 406 struct sem *sem = &sma->sems[locknum]; 407 spin_unlock(&sem->lock); 408 } 409 } 410 411 /* 412 * sem_lock_(check_) routines are called in the paths where the rwsem 413 * is not held. 414 * 415 * The caller holds the RCU read lock. 416 */ 417 static inline struct sem_array *sem_obtain_object(struct ipc_namespace *ns, int id) 418 { 419 struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&sem_ids(ns), id); 420 421 if (IS_ERR(ipcp)) 422 return ERR_CAST(ipcp); 423 424 return container_of(ipcp, struct sem_array, sem_perm); 425 } 426 427 static inline struct sem_array *sem_obtain_object_check(struct ipc_namespace *ns, 428 int id) 429 { 430 struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&sem_ids(ns), id); 431 432 if (IS_ERR(ipcp)) 433 return ERR_CAST(ipcp); 434 435 return container_of(ipcp, struct sem_array, sem_perm); 436 } 437 438 static inline void sem_lock_and_putref(struct sem_array *sma) 439 { 440 sem_lock(sma, NULL, -1); 441 ipc_rcu_putref(&sma->sem_perm, sem_rcu_free); 442 } 443 444 static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s) 445 { 446 ipc_rmid(&sem_ids(ns), &s->sem_perm); 447 } 448 449 static struct sem_array *sem_alloc(size_t nsems) 450 { 451 struct sem_array *sma; 452 size_t size; 453 454 if (nsems > (INT_MAX - sizeof(*sma)) / sizeof(sma->sems[0])) 455 return NULL; 456 457 size = sizeof(*sma) + nsems * sizeof(sma->sems[0]); 458 sma = kvmalloc(size, GFP_KERNEL); 459 if (unlikely(!sma)) 460 return NULL; 461 462 memset(sma, 0, size); 463 464 return sma; 465 } 466 467 /** 468 * newary - Create a new semaphore set 469 * @ns: namespace 470 * @params: ptr to the structure that contains key, semflg and nsems 471 * 472 * Called with sem_ids.rwsem held (as a writer) 473 */ 474 static int newary(struct ipc_namespace *ns, struct ipc_params *params) 475 { 476 int retval; 477 struct sem_array *sma; 478 key_t key = params->key; 479 int nsems = params->u.nsems; 480 int semflg = params->flg; 481 int i; 482 483 if (!nsems) 484 return -EINVAL; 485 if (ns->used_sems + nsems > ns->sc_semmns) 486 return -ENOSPC; 487 488 sma = sem_alloc(nsems); 489 if (!sma) 490 return -ENOMEM; 491 492 sma->sem_perm.mode = (semflg & S_IRWXUGO); 493 sma->sem_perm.key = key; 494 495 sma->sem_perm.security = NULL; 496 retval = security_sem_alloc(sma); 497 if (retval) { 498 kvfree(sma); 499 return retval; 500 } 501 502 for (i = 0; i < nsems; i++) { 503 INIT_LIST_HEAD(&sma->sems[i].pending_alter); 504 INIT_LIST_HEAD(&sma->sems[i].pending_const); 505 spin_lock_init(&sma->sems[i].lock); 506 } 507 508 sma->complex_count = 0; 509 sma->use_global_lock = USE_GLOBAL_LOCK_HYSTERESIS; 510 INIT_LIST_HEAD(&sma->pending_alter); 511 INIT_LIST_HEAD(&sma->pending_const); 512 INIT_LIST_HEAD(&sma->list_id); 513 sma->sem_nsems = nsems; 514 sma->sem_ctime = get_seconds(); 515 516 retval = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni); 517 if (retval < 0) { 518 call_rcu(&sma->sem_perm.rcu, sem_rcu_free); 519 return retval; 520 } 521 ns->used_sems += nsems; 522 523 sem_unlock(sma, -1); 524 rcu_read_unlock(); 525 526 return sma->sem_perm.id; 527 } 528 529 530 /* 531 * Called with sem_ids.rwsem and ipcp locked. 532 */ 533 static inline int sem_security(struct kern_ipc_perm *ipcp, int semflg) 534 { 535 struct sem_array *sma; 536 537 sma = container_of(ipcp, struct sem_array, sem_perm); 538 return security_sem_associate(sma, semflg); 539 } 540 541 /* 542 * Called with sem_ids.rwsem and ipcp locked. 543 */ 544 static inline int sem_more_checks(struct kern_ipc_perm *ipcp, 545 struct ipc_params *params) 546 { 547 struct sem_array *sma; 548 549 sma = container_of(ipcp, struct sem_array, sem_perm); 550 if (params->u.nsems > sma->sem_nsems) 551 return -EINVAL; 552 553 return 0; 554 } 555 556 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg) 557 { 558 struct ipc_namespace *ns; 559 static const struct ipc_ops sem_ops = { 560 .getnew = newary, 561 .associate = sem_security, 562 .more_checks = sem_more_checks, 563 }; 564 struct ipc_params sem_params; 565 566 ns = current->nsproxy->ipc_ns; 567 568 if (nsems < 0 || nsems > ns->sc_semmsl) 569 return -EINVAL; 570 571 sem_params.key = key; 572 sem_params.flg = semflg; 573 sem_params.u.nsems = nsems; 574 575 return ipcget(ns, &sem_ids(ns), &sem_ops, &sem_params); 576 } 577 578 /** 579 * perform_atomic_semop[_slow] - Attempt to perform semaphore 580 * operations on a given array. 581 * @sma: semaphore array 582 * @q: struct sem_queue that describes the operation 583 * 584 * Caller blocking are as follows, based the value 585 * indicated by the semaphore operation (sem_op): 586 * 587 * (1) >0 never blocks. 588 * (2) 0 (wait-for-zero operation): semval is non-zero. 589 * (3) <0 attempting to decrement semval to a value smaller than zero. 590 * 591 * Returns 0 if the operation was possible. 592 * Returns 1 if the operation is impossible, the caller must sleep. 593 * Returns <0 for error codes. 594 */ 595 static int perform_atomic_semop_slow(struct sem_array *sma, struct sem_queue *q) 596 { 597 int result, sem_op, nsops, pid; 598 struct sembuf *sop; 599 struct sem *curr; 600 struct sembuf *sops; 601 struct sem_undo *un; 602 603 sops = q->sops; 604 nsops = q->nsops; 605 un = q->undo; 606 607 for (sop = sops; sop < sops + nsops; sop++) { 608 curr = &sma->sems[sop->sem_num]; 609 sem_op = sop->sem_op; 610 result = curr->semval; 611 612 if (!sem_op && result) 613 goto would_block; 614 615 result += sem_op; 616 if (result < 0) 617 goto would_block; 618 if (result > SEMVMX) 619 goto out_of_range; 620 621 if (sop->sem_flg & SEM_UNDO) { 622 int undo = un->semadj[sop->sem_num] - sem_op; 623 /* Exceeding the undo range is an error. */ 624 if (undo < (-SEMAEM - 1) || undo > SEMAEM) 625 goto out_of_range; 626 un->semadj[sop->sem_num] = undo; 627 } 628 629 curr->semval = result; 630 } 631 632 sop--; 633 pid = q->pid; 634 while (sop >= sops) { 635 sma->sems[sop->sem_num].sempid = pid; 636 sop--; 637 } 638 639 return 0; 640 641 out_of_range: 642 result = -ERANGE; 643 goto undo; 644 645 would_block: 646 q->blocking = sop; 647 648 if (sop->sem_flg & IPC_NOWAIT) 649 result = -EAGAIN; 650 else 651 result = 1; 652 653 undo: 654 sop--; 655 while (sop >= sops) { 656 sem_op = sop->sem_op; 657 sma->sems[sop->sem_num].semval -= sem_op; 658 if (sop->sem_flg & SEM_UNDO) 659 un->semadj[sop->sem_num] += sem_op; 660 sop--; 661 } 662 663 return result; 664 } 665 666 static int perform_atomic_semop(struct sem_array *sma, struct sem_queue *q) 667 { 668 int result, sem_op, nsops; 669 struct sembuf *sop; 670 struct sem *curr; 671 struct sembuf *sops; 672 struct sem_undo *un; 673 674 sops = q->sops; 675 nsops = q->nsops; 676 un = q->undo; 677 678 if (unlikely(q->dupsop)) 679 return perform_atomic_semop_slow(sma, q); 680 681 /* 682 * We scan the semaphore set twice, first to ensure that the entire 683 * operation can succeed, therefore avoiding any pointless writes 684 * to shared memory and having to undo such changes in order to block 685 * until the operations can go through. 686 */ 687 for (sop = sops; sop < sops + nsops; sop++) { 688 curr = &sma->sems[sop->sem_num]; 689 sem_op = sop->sem_op; 690 result = curr->semval; 691 692 if (!sem_op && result) 693 goto would_block; /* wait-for-zero */ 694 695 result += sem_op; 696 if (result < 0) 697 goto would_block; 698 699 if (result > SEMVMX) 700 return -ERANGE; 701 702 if (sop->sem_flg & SEM_UNDO) { 703 int undo = un->semadj[sop->sem_num] - sem_op; 704 705 /* Exceeding the undo range is an error. */ 706 if (undo < (-SEMAEM - 1) || undo > SEMAEM) 707 return -ERANGE; 708 } 709 } 710 711 for (sop = sops; sop < sops + nsops; sop++) { 712 curr = &sma->sems[sop->sem_num]; 713 sem_op = sop->sem_op; 714 result = curr->semval; 715 716 if (sop->sem_flg & SEM_UNDO) { 717 int undo = un->semadj[sop->sem_num] - sem_op; 718 719 un->semadj[sop->sem_num] = undo; 720 } 721 curr->semval += sem_op; 722 curr->sempid = q->pid; 723 } 724 725 return 0; 726 727 would_block: 728 q->blocking = sop; 729 return sop->sem_flg & IPC_NOWAIT ? -EAGAIN : 1; 730 } 731 732 static inline void wake_up_sem_queue_prepare(struct sem_queue *q, int error, 733 struct wake_q_head *wake_q) 734 { 735 wake_q_add(wake_q, q->sleeper); 736 /* 737 * Rely on the above implicit barrier, such that we can 738 * ensure that we hold reference to the task before setting 739 * q->status. Otherwise we could race with do_exit if the 740 * task is awoken by an external event before calling 741 * wake_up_process(). 742 */ 743 WRITE_ONCE(q->status, error); 744 } 745 746 static void unlink_queue(struct sem_array *sma, struct sem_queue *q) 747 { 748 list_del(&q->list); 749 if (q->nsops > 1) 750 sma->complex_count--; 751 } 752 753 /** check_restart(sma, q) 754 * @sma: semaphore array 755 * @q: the operation that just completed 756 * 757 * update_queue is O(N^2) when it restarts scanning the whole queue of 758 * waiting operations. Therefore this function checks if the restart is 759 * really necessary. It is called after a previously waiting operation 760 * modified the array. 761 * Note that wait-for-zero operations are handled without restart. 762 */ 763 static inline int check_restart(struct sem_array *sma, struct sem_queue *q) 764 { 765 /* pending complex alter operations are too difficult to analyse */ 766 if (!list_empty(&sma->pending_alter)) 767 return 1; 768 769 /* we were a sleeping complex operation. Too difficult */ 770 if (q->nsops > 1) 771 return 1; 772 773 /* It is impossible that someone waits for the new value: 774 * - complex operations always restart. 775 * - wait-for-zero are handled seperately. 776 * - q is a previously sleeping simple operation that 777 * altered the array. It must be a decrement, because 778 * simple increments never sleep. 779 * - If there are older (higher priority) decrements 780 * in the queue, then they have observed the original 781 * semval value and couldn't proceed. The operation 782 * decremented to value - thus they won't proceed either. 783 */ 784 return 0; 785 } 786 787 /** 788 * wake_const_ops - wake up non-alter tasks 789 * @sma: semaphore array. 790 * @semnum: semaphore that was modified. 791 * @wake_q: lockless wake-queue head. 792 * 793 * wake_const_ops must be called after a semaphore in a semaphore array 794 * was set to 0. If complex const operations are pending, wake_const_ops must 795 * be called with semnum = -1, as well as with the number of each modified 796 * semaphore. 797 * The tasks that must be woken up are added to @wake_q. The return code 798 * is stored in q->pid. 799 * The function returns 1 if at least one operation was completed successfully. 800 */ 801 static int wake_const_ops(struct sem_array *sma, int semnum, 802 struct wake_q_head *wake_q) 803 { 804 struct sem_queue *q, *tmp; 805 struct list_head *pending_list; 806 int semop_completed = 0; 807 808 if (semnum == -1) 809 pending_list = &sma->pending_const; 810 else 811 pending_list = &sma->sems[semnum].pending_const; 812 813 list_for_each_entry_safe(q, tmp, pending_list, list) { 814 int error = perform_atomic_semop(sma, q); 815 816 if (error > 0) 817 continue; 818 /* operation completed, remove from queue & wakeup */ 819 unlink_queue(sma, q); 820 821 wake_up_sem_queue_prepare(q, error, wake_q); 822 if (error == 0) 823 semop_completed = 1; 824 } 825 826 return semop_completed; 827 } 828 829 /** 830 * do_smart_wakeup_zero - wakeup all wait for zero tasks 831 * @sma: semaphore array 832 * @sops: operations that were performed 833 * @nsops: number of operations 834 * @wake_q: lockless wake-queue head 835 * 836 * Checks all required queue for wait-for-zero operations, based 837 * on the actual changes that were performed on the semaphore array. 838 * The function returns 1 if at least one operation was completed successfully. 839 */ 840 static int do_smart_wakeup_zero(struct sem_array *sma, struct sembuf *sops, 841 int nsops, struct wake_q_head *wake_q) 842 { 843 int i; 844 int semop_completed = 0; 845 int got_zero = 0; 846 847 /* first: the per-semaphore queues, if known */ 848 if (sops) { 849 for (i = 0; i < nsops; i++) { 850 int num = sops[i].sem_num; 851 852 if (sma->sems[num].semval == 0) { 853 got_zero = 1; 854 semop_completed |= wake_const_ops(sma, num, wake_q); 855 } 856 } 857 } else { 858 /* 859 * No sops means modified semaphores not known. 860 * Assume all were changed. 861 */ 862 for (i = 0; i < sma->sem_nsems; i++) { 863 if (sma->sems[i].semval == 0) { 864 got_zero = 1; 865 semop_completed |= wake_const_ops(sma, i, wake_q); 866 } 867 } 868 } 869 /* 870 * If one of the modified semaphores got 0, 871 * then check the global queue, too. 872 */ 873 if (got_zero) 874 semop_completed |= wake_const_ops(sma, -1, wake_q); 875 876 return semop_completed; 877 } 878 879 880 /** 881 * update_queue - look for tasks that can be completed. 882 * @sma: semaphore array. 883 * @semnum: semaphore that was modified. 884 * @wake_q: lockless wake-queue head. 885 * 886 * update_queue must be called after a semaphore in a semaphore array 887 * was modified. If multiple semaphores were modified, update_queue must 888 * be called with semnum = -1, as well as with the number of each modified 889 * semaphore. 890 * The tasks that must be woken up are added to @wake_q. The return code 891 * is stored in q->pid. 892 * The function internally checks if const operations can now succeed. 893 * 894 * The function return 1 if at least one semop was completed successfully. 895 */ 896 static int update_queue(struct sem_array *sma, int semnum, struct wake_q_head *wake_q) 897 { 898 struct sem_queue *q, *tmp; 899 struct list_head *pending_list; 900 int semop_completed = 0; 901 902 if (semnum == -1) 903 pending_list = &sma->pending_alter; 904 else 905 pending_list = &sma->sems[semnum].pending_alter; 906 907 again: 908 list_for_each_entry_safe(q, tmp, pending_list, list) { 909 int error, restart; 910 911 /* If we are scanning the single sop, per-semaphore list of 912 * one semaphore and that semaphore is 0, then it is not 913 * necessary to scan further: simple increments 914 * that affect only one entry succeed immediately and cannot 915 * be in the per semaphore pending queue, and decrements 916 * cannot be successful if the value is already 0. 917 */ 918 if (semnum != -1 && sma->sems[semnum].semval == 0) 919 break; 920 921 error = perform_atomic_semop(sma, q); 922 923 /* Does q->sleeper still need to sleep? */ 924 if (error > 0) 925 continue; 926 927 unlink_queue(sma, q); 928 929 if (error) { 930 restart = 0; 931 } else { 932 semop_completed = 1; 933 do_smart_wakeup_zero(sma, q->sops, q->nsops, wake_q); 934 restart = check_restart(sma, q); 935 } 936 937 wake_up_sem_queue_prepare(q, error, wake_q); 938 if (restart) 939 goto again; 940 } 941 return semop_completed; 942 } 943 944 /** 945 * set_semotime - set sem_otime 946 * @sma: semaphore array 947 * @sops: operations that modified the array, may be NULL 948 * 949 * sem_otime is replicated to avoid cache line trashing. 950 * This function sets one instance to the current time. 951 */ 952 static void set_semotime(struct sem_array *sma, struct sembuf *sops) 953 { 954 if (sops == NULL) { 955 sma->sems[0].sem_otime = get_seconds(); 956 } else { 957 sma->sems[sops[0].sem_num].sem_otime = 958 get_seconds(); 959 } 960 } 961 962 /** 963 * do_smart_update - optimized update_queue 964 * @sma: semaphore array 965 * @sops: operations that were performed 966 * @nsops: number of operations 967 * @otime: force setting otime 968 * @wake_q: lockless wake-queue head 969 * 970 * do_smart_update() does the required calls to update_queue and wakeup_zero, 971 * based on the actual changes that were performed on the semaphore array. 972 * Note that the function does not do the actual wake-up: the caller is 973 * responsible for calling wake_up_q(). 974 * It is safe to perform this call after dropping all locks. 975 */ 976 static void do_smart_update(struct sem_array *sma, struct sembuf *sops, int nsops, 977 int otime, struct wake_q_head *wake_q) 978 { 979 int i; 980 981 otime |= do_smart_wakeup_zero(sma, sops, nsops, wake_q); 982 983 if (!list_empty(&sma->pending_alter)) { 984 /* semaphore array uses the global queue - just process it. */ 985 otime |= update_queue(sma, -1, wake_q); 986 } else { 987 if (!sops) { 988 /* 989 * No sops, thus the modified semaphores are not 990 * known. Check all. 991 */ 992 for (i = 0; i < sma->sem_nsems; i++) 993 otime |= update_queue(sma, i, wake_q); 994 } else { 995 /* 996 * Check the semaphores that were increased: 997 * - No complex ops, thus all sleeping ops are 998 * decrease. 999 * - if we decreased the value, then any sleeping 1000 * semaphore ops wont be able to run: If the 1001 * previous value was too small, then the new 1002 * value will be too small, too. 1003 */ 1004 for (i = 0; i < nsops; i++) { 1005 if (sops[i].sem_op > 0) { 1006 otime |= update_queue(sma, 1007 sops[i].sem_num, wake_q); 1008 } 1009 } 1010 } 1011 } 1012 if (otime) 1013 set_semotime(sma, sops); 1014 } 1015 1016 /* 1017 * check_qop: Test if a queued operation sleeps on the semaphore semnum 1018 */ 1019 static int check_qop(struct sem_array *sma, int semnum, struct sem_queue *q, 1020 bool count_zero) 1021 { 1022 struct sembuf *sop = q->blocking; 1023 1024 /* 1025 * Linux always (since 0.99.10) reported a task as sleeping on all 1026 * semaphores. This violates SUS, therefore it was changed to the 1027 * standard compliant behavior. 1028 * Give the administrators a chance to notice that an application 1029 * might misbehave because it relies on the Linux behavior. 1030 */ 1031 pr_info_once("semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant.\n" 1032 "The task %s (%d) triggered the difference, watch for misbehavior.\n", 1033 current->comm, task_pid_nr(current)); 1034 1035 if (sop->sem_num != semnum) 1036 return 0; 1037 1038 if (count_zero && sop->sem_op == 0) 1039 return 1; 1040 if (!count_zero && sop->sem_op < 0) 1041 return 1; 1042 1043 return 0; 1044 } 1045 1046 /* The following counts are associated to each semaphore: 1047 * semncnt number of tasks waiting on semval being nonzero 1048 * semzcnt number of tasks waiting on semval being zero 1049 * 1050 * Per definition, a task waits only on the semaphore of the first semop 1051 * that cannot proceed, even if additional operation would block, too. 1052 */ 1053 static int count_semcnt(struct sem_array *sma, ushort semnum, 1054 bool count_zero) 1055 { 1056 struct list_head *l; 1057 struct sem_queue *q; 1058 int semcnt; 1059 1060 semcnt = 0; 1061 /* First: check the simple operations. They are easy to evaluate */ 1062 if (count_zero) 1063 l = &sma->sems[semnum].pending_const; 1064 else 1065 l = &sma->sems[semnum].pending_alter; 1066 1067 list_for_each_entry(q, l, list) { 1068 /* all task on a per-semaphore list sleep on exactly 1069 * that semaphore 1070 */ 1071 semcnt++; 1072 } 1073 1074 /* Then: check the complex operations. */ 1075 list_for_each_entry(q, &sma->pending_alter, list) { 1076 semcnt += check_qop(sma, semnum, q, count_zero); 1077 } 1078 if (count_zero) { 1079 list_for_each_entry(q, &sma->pending_const, list) { 1080 semcnt += check_qop(sma, semnum, q, count_zero); 1081 } 1082 } 1083 return semcnt; 1084 } 1085 1086 /* Free a semaphore set. freeary() is called with sem_ids.rwsem locked 1087 * as a writer and the spinlock for this semaphore set hold. sem_ids.rwsem 1088 * remains locked on exit. 1089 */ 1090 static void freeary(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp) 1091 { 1092 struct sem_undo *un, *tu; 1093 struct sem_queue *q, *tq; 1094 struct sem_array *sma = container_of(ipcp, struct sem_array, sem_perm); 1095 int i; 1096 DEFINE_WAKE_Q(wake_q); 1097 1098 /* Free the existing undo structures for this semaphore set. */ 1099 ipc_assert_locked_object(&sma->sem_perm); 1100 list_for_each_entry_safe(un, tu, &sma->list_id, list_id) { 1101 list_del(&un->list_id); 1102 spin_lock(&un->ulp->lock); 1103 un->semid = -1; 1104 list_del_rcu(&un->list_proc); 1105 spin_unlock(&un->ulp->lock); 1106 kfree_rcu(un, rcu); 1107 } 1108 1109 /* Wake up all pending processes and let them fail with EIDRM. */ 1110 list_for_each_entry_safe(q, tq, &sma->pending_const, list) { 1111 unlink_queue(sma, q); 1112 wake_up_sem_queue_prepare(q, -EIDRM, &wake_q); 1113 } 1114 1115 list_for_each_entry_safe(q, tq, &sma->pending_alter, list) { 1116 unlink_queue(sma, q); 1117 wake_up_sem_queue_prepare(q, -EIDRM, &wake_q); 1118 } 1119 for (i = 0; i < sma->sem_nsems; i++) { 1120 struct sem *sem = &sma->sems[i]; 1121 list_for_each_entry_safe(q, tq, &sem->pending_const, list) { 1122 unlink_queue(sma, q); 1123 wake_up_sem_queue_prepare(q, -EIDRM, &wake_q); 1124 } 1125 list_for_each_entry_safe(q, tq, &sem->pending_alter, list) { 1126 unlink_queue(sma, q); 1127 wake_up_sem_queue_prepare(q, -EIDRM, &wake_q); 1128 } 1129 } 1130 1131 /* Remove the semaphore set from the IDR */ 1132 sem_rmid(ns, sma); 1133 sem_unlock(sma, -1); 1134 rcu_read_unlock(); 1135 1136 wake_up_q(&wake_q); 1137 ns->used_sems -= sma->sem_nsems; 1138 ipc_rcu_putref(&sma->sem_perm, sem_rcu_free); 1139 } 1140 1141 static unsigned long copy_semid_to_user(void __user *buf, struct semid64_ds *in, int version) 1142 { 1143 switch (version) { 1144 case IPC_64: 1145 return copy_to_user(buf, in, sizeof(*in)); 1146 case IPC_OLD: 1147 { 1148 struct semid_ds out; 1149 1150 memset(&out, 0, sizeof(out)); 1151 1152 ipc64_perm_to_ipc_perm(&in->sem_perm, &out.sem_perm); 1153 1154 out.sem_otime = in->sem_otime; 1155 out.sem_ctime = in->sem_ctime; 1156 out.sem_nsems = in->sem_nsems; 1157 1158 return copy_to_user(buf, &out, sizeof(out)); 1159 } 1160 default: 1161 return -EINVAL; 1162 } 1163 } 1164 1165 static time_t get_semotime(struct sem_array *sma) 1166 { 1167 int i; 1168 time_t res; 1169 1170 res = sma->sems[0].sem_otime; 1171 for (i = 1; i < sma->sem_nsems; i++) { 1172 time_t to = sma->sems[i].sem_otime; 1173 1174 if (to > res) 1175 res = to; 1176 } 1177 return res; 1178 } 1179 1180 static int semctl_nolock(struct ipc_namespace *ns, int semid, 1181 int cmd, int version, void __user *p) 1182 { 1183 int err; 1184 struct sem_array *sma; 1185 1186 switch (cmd) { 1187 case IPC_INFO: 1188 case SEM_INFO: 1189 { 1190 struct seminfo seminfo; 1191 int max_id; 1192 1193 err = security_sem_semctl(NULL, cmd); 1194 if (err) 1195 return err; 1196 1197 memset(&seminfo, 0, sizeof(seminfo)); 1198 seminfo.semmni = ns->sc_semmni; 1199 seminfo.semmns = ns->sc_semmns; 1200 seminfo.semmsl = ns->sc_semmsl; 1201 seminfo.semopm = ns->sc_semopm; 1202 seminfo.semvmx = SEMVMX; 1203 seminfo.semmnu = SEMMNU; 1204 seminfo.semmap = SEMMAP; 1205 seminfo.semume = SEMUME; 1206 down_read(&sem_ids(ns).rwsem); 1207 if (cmd == SEM_INFO) { 1208 seminfo.semusz = sem_ids(ns).in_use; 1209 seminfo.semaem = ns->used_sems; 1210 } else { 1211 seminfo.semusz = SEMUSZ; 1212 seminfo.semaem = SEMAEM; 1213 } 1214 max_id = ipc_get_maxid(&sem_ids(ns)); 1215 up_read(&sem_ids(ns).rwsem); 1216 if (copy_to_user(p, &seminfo, sizeof(struct seminfo))) 1217 return -EFAULT; 1218 return (max_id < 0) ? 0 : max_id; 1219 } 1220 case IPC_STAT: 1221 case SEM_STAT: 1222 { 1223 struct semid64_ds tbuf; 1224 int id = 0; 1225 1226 memset(&tbuf, 0, sizeof(tbuf)); 1227 1228 rcu_read_lock(); 1229 if (cmd == SEM_STAT) { 1230 sma = sem_obtain_object(ns, semid); 1231 if (IS_ERR(sma)) { 1232 err = PTR_ERR(sma); 1233 goto out_unlock; 1234 } 1235 id = sma->sem_perm.id; 1236 } else { 1237 sma = sem_obtain_object_check(ns, semid); 1238 if (IS_ERR(sma)) { 1239 err = PTR_ERR(sma); 1240 goto out_unlock; 1241 } 1242 } 1243 1244 err = -EACCES; 1245 if (ipcperms(ns, &sma->sem_perm, S_IRUGO)) 1246 goto out_unlock; 1247 1248 err = security_sem_semctl(sma, cmd); 1249 if (err) 1250 goto out_unlock; 1251 1252 kernel_to_ipc64_perm(&sma->sem_perm, &tbuf.sem_perm); 1253 tbuf.sem_otime = get_semotime(sma); 1254 tbuf.sem_ctime = sma->sem_ctime; 1255 tbuf.sem_nsems = sma->sem_nsems; 1256 rcu_read_unlock(); 1257 if (copy_semid_to_user(p, &tbuf, version)) 1258 return -EFAULT; 1259 return id; 1260 } 1261 default: 1262 return -EINVAL; 1263 } 1264 out_unlock: 1265 rcu_read_unlock(); 1266 return err; 1267 } 1268 1269 static int semctl_setval(struct ipc_namespace *ns, int semid, int semnum, 1270 unsigned long arg) 1271 { 1272 struct sem_undo *un; 1273 struct sem_array *sma; 1274 struct sem *curr; 1275 int err, val; 1276 DEFINE_WAKE_Q(wake_q); 1277 1278 #if defined(CONFIG_64BIT) && defined(__BIG_ENDIAN) 1279 /* big-endian 64bit */ 1280 val = arg >> 32; 1281 #else 1282 /* 32bit or little-endian 64bit */ 1283 val = arg; 1284 #endif 1285 1286 if (val > SEMVMX || val < 0) 1287 return -ERANGE; 1288 1289 rcu_read_lock(); 1290 sma = sem_obtain_object_check(ns, semid); 1291 if (IS_ERR(sma)) { 1292 rcu_read_unlock(); 1293 return PTR_ERR(sma); 1294 } 1295 1296 if (semnum < 0 || semnum >= sma->sem_nsems) { 1297 rcu_read_unlock(); 1298 return -EINVAL; 1299 } 1300 1301 1302 if (ipcperms(ns, &sma->sem_perm, S_IWUGO)) { 1303 rcu_read_unlock(); 1304 return -EACCES; 1305 } 1306 1307 err = security_sem_semctl(sma, SETVAL); 1308 if (err) { 1309 rcu_read_unlock(); 1310 return -EACCES; 1311 } 1312 1313 sem_lock(sma, NULL, -1); 1314 1315 if (!ipc_valid_object(&sma->sem_perm)) { 1316 sem_unlock(sma, -1); 1317 rcu_read_unlock(); 1318 return -EIDRM; 1319 } 1320 1321 curr = &sma->sems[semnum]; 1322 1323 ipc_assert_locked_object(&sma->sem_perm); 1324 list_for_each_entry(un, &sma->list_id, list_id) 1325 un->semadj[semnum] = 0; 1326 1327 curr->semval = val; 1328 curr->sempid = task_tgid_vnr(current); 1329 sma->sem_ctime = get_seconds(); 1330 /* maybe some queued-up processes were waiting for this */ 1331 do_smart_update(sma, NULL, 0, 0, &wake_q); 1332 sem_unlock(sma, -1); 1333 rcu_read_unlock(); 1334 wake_up_q(&wake_q); 1335 return 0; 1336 } 1337 1338 static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, 1339 int cmd, void __user *p) 1340 { 1341 struct sem_array *sma; 1342 struct sem *curr; 1343 int err, nsems; 1344 ushort fast_sem_io[SEMMSL_FAST]; 1345 ushort *sem_io = fast_sem_io; 1346 DEFINE_WAKE_Q(wake_q); 1347 1348 rcu_read_lock(); 1349 sma = sem_obtain_object_check(ns, semid); 1350 if (IS_ERR(sma)) { 1351 rcu_read_unlock(); 1352 return PTR_ERR(sma); 1353 } 1354 1355 nsems = sma->sem_nsems; 1356 1357 err = -EACCES; 1358 if (ipcperms(ns, &sma->sem_perm, cmd == SETALL ? S_IWUGO : S_IRUGO)) 1359 goto out_rcu_wakeup; 1360 1361 err = security_sem_semctl(sma, cmd); 1362 if (err) 1363 goto out_rcu_wakeup; 1364 1365 err = -EACCES; 1366 switch (cmd) { 1367 case GETALL: 1368 { 1369 ushort __user *array = p; 1370 int i; 1371 1372 sem_lock(sma, NULL, -1); 1373 if (!ipc_valid_object(&sma->sem_perm)) { 1374 err = -EIDRM; 1375 goto out_unlock; 1376 } 1377 if (nsems > SEMMSL_FAST) { 1378 if (!ipc_rcu_getref(&sma->sem_perm)) { 1379 err = -EIDRM; 1380 goto out_unlock; 1381 } 1382 sem_unlock(sma, -1); 1383 rcu_read_unlock(); 1384 sem_io = kvmalloc_array(nsems, sizeof(ushort), 1385 GFP_KERNEL); 1386 if (sem_io == NULL) { 1387 ipc_rcu_putref(&sma->sem_perm, sem_rcu_free); 1388 return -ENOMEM; 1389 } 1390 1391 rcu_read_lock(); 1392 sem_lock_and_putref(sma); 1393 if (!ipc_valid_object(&sma->sem_perm)) { 1394 err = -EIDRM; 1395 goto out_unlock; 1396 } 1397 } 1398 for (i = 0; i < sma->sem_nsems; i++) 1399 sem_io[i] = sma->sems[i].semval; 1400 sem_unlock(sma, -1); 1401 rcu_read_unlock(); 1402 err = 0; 1403 if (copy_to_user(array, sem_io, nsems*sizeof(ushort))) 1404 err = -EFAULT; 1405 goto out_free; 1406 } 1407 case SETALL: 1408 { 1409 int i; 1410 struct sem_undo *un; 1411 1412 if (!ipc_rcu_getref(&sma->sem_perm)) { 1413 err = -EIDRM; 1414 goto out_rcu_wakeup; 1415 } 1416 rcu_read_unlock(); 1417 1418 if (nsems > SEMMSL_FAST) { 1419 sem_io = kvmalloc_array(nsems, sizeof(ushort), 1420 GFP_KERNEL); 1421 if (sem_io == NULL) { 1422 ipc_rcu_putref(&sma->sem_perm, sem_rcu_free); 1423 return -ENOMEM; 1424 } 1425 } 1426 1427 if (copy_from_user(sem_io, p, nsems*sizeof(ushort))) { 1428 ipc_rcu_putref(&sma->sem_perm, sem_rcu_free); 1429 err = -EFAULT; 1430 goto out_free; 1431 } 1432 1433 for (i = 0; i < nsems; i++) { 1434 if (sem_io[i] > SEMVMX) { 1435 ipc_rcu_putref(&sma->sem_perm, sem_rcu_free); 1436 err = -ERANGE; 1437 goto out_free; 1438 } 1439 } 1440 rcu_read_lock(); 1441 sem_lock_and_putref(sma); 1442 if (!ipc_valid_object(&sma->sem_perm)) { 1443 err = -EIDRM; 1444 goto out_unlock; 1445 } 1446 1447 for (i = 0; i < nsems; i++) { 1448 sma->sems[i].semval = sem_io[i]; 1449 sma->sems[i].sempid = task_tgid_vnr(current); 1450 } 1451 1452 ipc_assert_locked_object(&sma->sem_perm); 1453 list_for_each_entry(un, &sma->list_id, list_id) { 1454 for (i = 0; i < nsems; i++) 1455 un->semadj[i] = 0; 1456 } 1457 sma->sem_ctime = get_seconds(); 1458 /* maybe some queued-up processes were waiting for this */ 1459 do_smart_update(sma, NULL, 0, 0, &wake_q); 1460 err = 0; 1461 goto out_unlock; 1462 } 1463 /* GETVAL, GETPID, GETNCTN, GETZCNT: fall-through */ 1464 } 1465 err = -EINVAL; 1466 if (semnum < 0 || semnum >= nsems) 1467 goto out_rcu_wakeup; 1468 1469 sem_lock(sma, NULL, -1); 1470 if (!ipc_valid_object(&sma->sem_perm)) { 1471 err = -EIDRM; 1472 goto out_unlock; 1473 } 1474 curr = &sma->sems[semnum]; 1475 1476 switch (cmd) { 1477 case GETVAL: 1478 err = curr->semval; 1479 goto out_unlock; 1480 case GETPID: 1481 err = curr->sempid; 1482 goto out_unlock; 1483 case GETNCNT: 1484 err = count_semcnt(sma, semnum, 0); 1485 goto out_unlock; 1486 case GETZCNT: 1487 err = count_semcnt(sma, semnum, 1); 1488 goto out_unlock; 1489 } 1490 1491 out_unlock: 1492 sem_unlock(sma, -1); 1493 out_rcu_wakeup: 1494 rcu_read_unlock(); 1495 wake_up_q(&wake_q); 1496 out_free: 1497 if (sem_io != fast_sem_io) 1498 kvfree(sem_io); 1499 return err; 1500 } 1501 1502 static inline unsigned long 1503 copy_semid_from_user(struct semid64_ds *out, void __user *buf, int version) 1504 { 1505 switch (version) { 1506 case IPC_64: 1507 if (copy_from_user(out, buf, sizeof(*out))) 1508 return -EFAULT; 1509 return 0; 1510 case IPC_OLD: 1511 { 1512 struct semid_ds tbuf_old; 1513 1514 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old))) 1515 return -EFAULT; 1516 1517 out->sem_perm.uid = tbuf_old.sem_perm.uid; 1518 out->sem_perm.gid = tbuf_old.sem_perm.gid; 1519 out->sem_perm.mode = tbuf_old.sem_perm.mode; 1520 1521 return 0; 1522 } 1523 default: 1524 return -EINVAL; 1525 } 1526 } 1527 1528 /* 1529 * This function handles some semctl commands which require the rwsem 1530 * to be held in write mode. 1531 * NOTE: no locks must be held, the rwsem is taken inside this function. 1532 */ 1533 static int semctl_down(struct ipc_namespace *ns, int semid, 1534 int cmd, int version, void __user *p) 1535 { 1536 struct sem_array *sma; 1537 int err; 1538 struct semid64_ds semid64; 1539 struct kern_ipc_perm *ipcp; 1540 1541 if (cmd == IPC_SET) { 1542 if (copy_semid_from_user(&semid64, p, version)) 1543 return -EFAULT; 1544 } 1545 1546 down_write(&sem_ids(ns).rwsem); 1547 rcu_read_lock(); 1548 1549 ipcp = ipcctl_pre_down_nolock(ns, &sem_ids(ns), semid, cmd, 1550 &semid64.sem_perm, 0); 1551 if (IS_ERR(ipcp)) { 1552 err = PTR_ERR(ipcp); 1553 goto out_unlock1; 1554 } 1555 1556 sma = container_of(ipcp, struct sem_array, sem_perm); 1557 1558 err = security_sem_semctl(sma, cmd); 1559 if (err) 1560 goto out_unlock1; 1561 1562 switch (cmd) { 1563 case IPC_RMID: 1564 sem_lock(sma, NULL, -1); 1565 /* freeary unlocks the ipc object and rcu */ 1566 freeary(ns, ipcp); 1567 goto out_up; 1568 case IPC_SET: 1569 sem_lock(sma, NULL, -1); 1570 err = ipc_update_perm(&semid64.sem_perm, ipcp); 1571 if (err) 1572 goto out_unlock0; 1573 sma->sem_ctime = get_seconds(); 1574 break; 1575 default: 1576 err = -EINVAL; 1577 goto out_unlock1; 1578 } 1579 1580 out_unlock0: 1581 sem_unlock(sma, -1); 1582 out_unlock1: 1583 rcu_read_unlock(); 1584 out_up: 1585 up_write(&sem_ids(ns).rwsem); 1586 return err; 1587 } 1588 1589 SYSCALL_DEFINE4(semctl, int, semid, int, semnum, int, cmd, unsigned long, arg) 1590 { 1591 int version; 1592 struct ipc_namespace *ns; 1593 void __user *p = (void __user *)arg; 1594 1595 if (semid < 0) 1596 return -EINVAL; 1597 1598 version = ipc_parse_version(&cmd); 1599 ns = current->nsproxy->ipc_ns; 1600 1601 switch (cmd) { 1602 case IPC_INFO: 1603 case SEM_INFO: 1604 case IPC_STAT: 1605 case SEM_STAT: 1606 return semctl_nolock(ns, semid, cmd, version, p); 1607 case GETALL: 1608 case GETVAL: 1609 case GETPID: 1610 case GETNCNT: 1611 case GETZCNT: 1612 case SETALL: 1613 return semctl_main(ns, semid, semnum, cmd, p); 1614 case SETVAL: 1615 return semctl_setval(ns, semid, semnum, arg); 1616 case IPC_RMID: 1617 case IPC_SET: 1618 return semctl_down(ns, semid, cmd, version, p); 1619 default: 1620 return -EINVAL; 1621 } 1622 } 1623 1624 /* If the task doesn't already have a undo_list, then allocate one 1625 * here. We guarantee there is only one thread using this undo list, 1626 * and current is THE ONE 1627 * 1628 * If this allocation and assignment succeeds, but later 1629 * portions of this code fail, there is no need to free the sem_undo_list. 1630 * Just let it stay associated with the task, and it'll be freed later 1631 * at exit time. 1632 * 1633 * This can block, so callers must hold no locks. 1634 */ 1635 static inline int get_undo_list(struct sem_undo_list **undo_listp) 1636 { 1637 struct sem_undo_list *undo_list; 1638 1639 undo_list = current->sysvsem.undo_list; 1640 if (!undo_list) { 1641 undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL); 1642 if (undo_list == NULL) 1643 return -ENOMEM; 1644 spin_lock_init(&undo_list->lock); 1645 atomic_set(&undo_list->refcnt, 1); 1646 INIT_LIST_HEAD(&undo_list->list_proc); 1647 1648 current->sysvsem.undo_list = undo_list; 1649 } 1650 *undo_listp = undo_list; 1651 return 0; 1652 } 1653 1654 static struct sem_undo *__lookup_undo(struct sem_undo_list *ulp, int semid) 1655 { 1656 struct sem_undo *un; 1657 1658 list_for_each_entry_rcu(un, &ulp->list_proc, list_proc) { 1659 if (un->semid == semid) 1660 return un; 1661 } 1662 return NULL; 1663 } 1664 1665 static struct sem_undo *lookup_undo(struct sem_undo_list *ulp, int semid) 1666 { 1667 struct sem_undo *un; 1668 1669 assert_spin_locked(&ulp->lock); 1670 1671 un = __lookup_undo(ulp, semid); 1672 if (un) { 1673 list_del_rcu(&un->list_proc); 1674 list_add_rcu(&un->list_proc, &ulp->list_proc); 1675 } 1676 return un; 1677 } 1678 1679 /** 1680 * find_alloc_undo - lookup (and if not present create) undo array 1681 * @ns: namespace 1682 * @semid: semaphore array id 1683 * 1684 * The function looks up (and if not present creates) the undo structure. 1685 * The size of the undo structure depends on the size of the semaphore 1686 * array, thus the alloc path is not that straightforward. 1687 * Lifetime-rules: sem_undo is rcu-protected, on success, the function 1688 * performs a rcu_read_lock(). 1689 */ 1690 static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid) 1691 { 1692 struct sem_array *sma; 1693 struct sem_undo_list *ulp; 1694 struct sem_undo *un, *new; 1695 int nsems, error; 1696 1697 error = get_undo_list(&ulp); 1698 if (error) 1699 return ERR_PTR(error); 1700 1701 rcu_read_lock(); 1702 spin_lock(&ulp->lock); 1703 un = lookup_undo(ulp, semid); 1704 spin_unlock(&ulp->lock); 1705 if (likely(un != NULL)) 1706 goto out; 1707 1708 /* no undo structure around - allocate one. */ 1709 /* step 1: figure out the size of the semaphore array */ 1710 sma = sem_obtain_object_check(ns, semid); 1711 if (IS_ERR(sma)) { 1712 rcu_read_unlock(); 1713 return ERR_CAST(sma); 1714 } 1715 1716 nsems = sma->sem_nsems; 1717 if (!ipc_rcu_getref(&sma->sem_perm)) { 1718 rcu_read_unlock(); 1719 un = ERR_PTR(-EIDRM); 1720 goto out; 1721 } 1722 rcu_read_unlock(); 1723 1724 /* step 2: allocate new undo structure */ 1725 new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL); 1726 if (!new) { 1727 ipc_rcu_putref(&sma->sem_perm, sem_rcu_free); 1728 return ERR_PTR(-ENOMEM); 1729 } 1730 1731 /* step 3: Acquire the lock on semaphore array */ 1732 rcu_read_lock(); 1733 sem_lock_and_putref(sma); 1734 if (!ipc_valid_object(&sma->sem_perm)) { 1735 sem_unlock(sma, -1); 1736 rcu_read_unlock(); 1737 kfree(new); 1738 un = ERR_PTR(-EIDRM); 1739 goto out; 1740 } 1741 spin_lock(&ulp->lock); 1742 1743 /* 1744 * step 4: check for races: did someone else allocate the undo struct? 1745 */ 1746 un = lookup_undo(ulp, semid); 1747 if (un) { 1748 kfree(new); 1749 goto success; 1750 } 1751 /* step 5: initialize & link new undo structure */ 1752 new->semadj = (short *) &new[1]; 1753 new->ulp = ulp; 1754 new->semid = semid; 1755 assert_spin_locked(&ulp->lock); 1756 list_add_rcu(&new->list_proc, &ulp->list_proc); 1757 ipc_assert_locked_object(&sma->sem_perm); 1758 list_add(&new->list_id, &sma->list_id); 1759 un = new; 1760 1761 success: 1762 spin_unlock(&ulp->lock); 1763 sem_unlock(sma, -1); 1764 out: 1765 return un; 1766 } 1767 1768 SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops, 1769 unsigned, nsops, const struct timespec __user *, timeout) 1770 { 1771 int error = -EINVAL; 1772 struct sem_array *sma; 1773 struct sembuf fast_sops[SEMOPM_FAST]; 1774 struct sembuf *sops = fast_sops, *sop; 1775 struct sem_undo *un; 1776 int max, locknum; 1777 bool undos = false, alter = false, dupsop = false; 1778 struct sem_queue queue; 1779 unsigned long dup = 0, jiffies_left = 0; 1780 struct ipc_namespace *ns; 1781 1782 ns = current->nsproxy->ipc_ns; 1783 1784 if (nsops < 1 || semid < 0) 1785 return -EINVAL; 1786 if (nsops > ns->sc_semopm) 1787 return -E2BIG; 1788 if (nsops > SEMOPM_FAST) { 1789 sops = kmalloc(sizeof(*sops)*nsops, GFP_KERNEL); 1790 if (sops == NULL) 1791 return -ENOMEM; 1792 } 1793 1794 if (copy_from_user(sops, tsops, nsops * sizeof(*tsops))) { 1795 error = -EFAULT; 1796 goto out_free; 1797 } 1798 1799 if (timeout) { 1800 struct timespec _timeout; 1801 if (copy_from_user(&_timeout, timeout, sizeof(*timeout))) { 1802 error = -EFAULT; 1803 goto out_free; 1804 } 1805 if (_timeout.tv_sec < 0 || _timeout.tv_nsec < 0 || 1806 _timeout.tv_nsec >= 1000000000L) { 1807 error = -EINVAL; 1808 goto out_free; 1809 } 1810 jiffies_left = timespec_to_jiffies(&_timeout); 1811 } 1812 1813 max = 0; 1814 for (sop = sops; sop < sops + nsops; sop++) { 1815 unsigned long mask = 1ULL << ((sop->sem_num) % BITS_PER_LONG); 1816 1817 if (sop->sem_num >= max) 1818 max = sop->sem_num; 1819 if (sop->sem_flg & SEM_UNDO) 1820 undos = true; 1821 if (dup & mask) { 1822 /* 1823 * There was a previous alter access that appears 1824 * to have accessed the same semaphore, thus use 1825 * the dupsop logic. "appears", because the detection 1826 * can only check % BITS_PER_LONG. 1827 */ 1828 dupsop = true; 1829 } 1830 if (sop->sem_op != 0) { 1831 alter = true; 1832 dup |= mask; 1833 } 1834 } 1835 1836 if (undos) { 1837 /* On success, find_alloc_undo takes the rcu_read_lock */ 1838 un = find_alloc_undo(ns, semid); 1839 if (IS_ERR(un)) { 1840 error = PTR_ERR(un); 1841 goto out_free; 1842 } 1843 } else { 1844 un = NULL; 1845 rcu_read_lock(); 1846 } 1847 1848 sma = sem_obtain_object_check(ns, semid); 1849 if (IS_ERR(sma)) { 1850 rcu_read_unlock(); 1851 error = PTR_ERR(sma); 1852 goto out_free; 1853 } 1854 1855 error = -EFBIG; 1856 if (max >= sma->sem_nsems) { 1857 rcu_read_unlock(); 1858 goto out_free; 1859 } 1860 1861 error = -EACCES; 1862 if (ipcperms(ns, &sma->sem_perm, alter ? S_IWUGO : S_IRUGO)) { 1863 rcu_read_unlock(); 1864 goto out_free; 1865 } 1866 1867 error = security_sem_semop(sma, sops, nsops, alter); 1868 if (error) { 1869 rcu_read_unlock(); 1870 goto out_free; 1871 } 1872 1873 error = -EIDRM; 1874 locknum = sem_lock(sma, sops, nsops); 1875 /* 1876 * We eventually might perform the following check in a lockless 1877 * fashion, considering ipc_valid_object() locking constraints. 1878 * If nsops == 1 and there is no contention for sem_perm.lock, then 1879 * only a per-semaphore lock is held and it's OK to proceed with the 1880 * check below. More details on the fine grained locking scheme 1881 * entangled here and why it's RMID race safe on comments at sem_lock() 1882 */ 1883 if (!ipc_valid_object(&sma->sem_perm)) 1884 goto out_unlock_free; 1885 /* 1886 * semid identifiers are not unique - find_alloc_undo may have 1887 * allocated an undo structure, it was invalidated by an RMID 1888 * and now a new array with received the same id. Check and fail. 1889 * This case can be detected checking un->semid. The existence of 1890 * "un" itself is guaranteed by rcu. 1891 */ 1892 if (un && un->semid == -1) 1893 goto out_unlock_free; 1894 1895 queue.sops = sops; 1896 queue.nsops = nsops; 1897 queue.undo = un; 1898 queue.pid = task_tgid_vnr(current); 1899 queue.alter = alter; 1900 queue.dupsop = dupsop; 1901 1902 error = perform_atomic_semop(sma, &queue); 1903 if (error == 0) { /* non-blocking succesfull path */ 1904 DEFINE_WAKE_Q(wake_q); 1905 1906 /* 1907 * If the operation was successful, then do 1908 * the required updates. 1909 */ 1910 if (alter) 1911 do_smart_update(sma, sops, nsops, 1, &wake_q); 1912 else 1913 set_semotime(sma, sops); 1914 1915 sem_unlock(sma, locknum); 1916 rcu_read_unlock(); 1917 wake_up_q(&wake_q); 1918 1919 goto out_free; 1920 } 1921 if (error < 0) /* non-blocking error path */ 1922 goto out_unlock_free; 1923 1924 /* 1925 * We need to sleep on this operation, so we put the current 1926 * task into the pending queue and go to sleep. 1927 */ 1928 if (nsops == 1) { 1929 struct sem *curr; 1930 curr = &sma->sems[sops->sem_num]; 1931 1932 if (alter) { 1933 if (sma->complex_count) { 1934 list_add_tail(&queue.list, 1935 &sma->pending_alter); 1936 } else { 1937 1938 list_add_tail(&queue.list, 1939 &curr->pending_alter); 1940 } 1941 } else { 1942 list_add_tail(&queue.list, &curr->pending_const); 1943 } 1944 } else { 1945 if (!sma->complex_count) 1946 merge_queues(sma); 1947 1948 if (alter) 1949 list_add_tail(&queue.list, &sma->pending_alter); 1950 else 1951 list_add_tail(&queue.list, &sma->pending_const); 1952 1953 sma->complex_count++; 1954 } 1955 1956 do { 1957 queue.status = -EINTR; 1958 queue.sleeper = current; 1959 1960 __set_current_state(TASK_INTERRUPTIBLE); 1961 sem_unlock(sma, locknum); 1962 rcu_read_unlock(); 1963 1964 if (timeout) 1965 jiffies_left = schedule_timeout(jiffies_left); 1966 else 1967 schedule(); 1968 1969 /* 1970 * fastpath: the semop has completed, either successfully or 1971 * not, from the syscall pov, is quite irrelevant to us at this 1972 * point; we're done. 1973 * 1974 * We _do_ care, nonetheless, about being awoken by a signal or 1975 * spuriously. The queue.status is checked again in the 1976 * slowpath (aka after taking sem_lock), such that we can detect 1977 * scenarios where we were awakened externally, during the 1978 * window between wake_q_add() and wake_up_q(). 1979 */ 1980 error = READ_ONCE(queue.status); 1981 if (error != -EINTR) { 1982 /* 1983 * User space could assume that semop() is a memory 1984 * barrier: Without the mb(), the cpu could 1985 * speculatively read in userspace stale data that was 1986 * overwritten by the previous owner of the semaphore. 1987 */ 1988 smp_mb(); 1989 goto out_free; 1990 } 1991 1992 rcu_read_lock(); 1993 locknum = sem_lock(sma, sops, nsops); 1994 1995 if (!ipc_valid_object(&sma->sem_perm)) 1996 goto out_unlock_free; 1997 1998 error = READ_ONCE(queue.status); 1999 2000 /* 2001 * If queue.status != -EINTR we are woken up by another process. 2002 * Leave without unlink_queue(), but with sem_unlock(). 2003 */ 2004 if (error != -EINTR) 2005 goto out_unlock_free; 2006 2007 /* 2008 * If an interrupt occurred we have to clean up the queue. 2009 */ 2010 if (timeout && jiffies_left == 0) 2011 error = -EAGAIN; 2012 } while (error == -EINTR && !signal_pending(current)); /* spurious */ 2013 2014 unlink_queue(sma, &queue); 2015 2016 out_unlock_free: 2017 sem_unlock(sma, locknum); 2018 rcu_read_unlock(); 2019 out_free: 2020 if (sops != fast_sops) 2021 kfree(sops); 2022 return error; 2023 } 2024 2025 SYSCALL_DEFINE3(semop, int, semid, struct sembuf __user *, tsops, 2026 unsigned, nsops) 2027 { 2028 return sys_semtimedop(semid, tsops, nsops, NULL); 2029 } 2030 2031 /* If CLONE_SYSVSEM is set, establish sharing of SEM_UNDO state between 2032 * parent and child tasks. 2033 */ 2034 2035 int copy_semundo(unsigned long clone_flags, struct task_struct *tsk) 2036 { 2037 struct sem_undo_list *undo_list; 2038 int error; 2039 2040 if (clone_flags & CLONE_SYSVSEM) { 2041 error = get_undo_list(&undo_list); 2042 if (error) 2043 return error; 2044 atomic_inc(&undo_list->refcnt); 2045 tsk->sysvsem.undo_list = undo_list; 2046 } else 2047 tsk->sysvsem.undo_list = NULL; 2048 2049 return 0; 2050 } 2051 2052 /* 2053 * add semadj values to semaphores, free undo structures. 2054 * undo structures are not freed when semaphore arrays are destroyed 2055 * so some of them may be out of date. 2056 * IMPLEMENTATION NOTE: There is some confusion over whether the 2057 * set of adjustments that needs to be done should be done in an atomic 2058 * manner or not. That is, if we are attempting to decrement the semval 2059 * should we queue up and wait until we can do so legally? 2060 * The original implementation attempted to do this (queue and wait). 2061 * The current implementation does not do so. The POSIX standard 2062 * and SVID should be consulted to determine what behavior is mandated. 2063 */ 2064 void exit_sem(struct task_struct *tsk) 2065 { 2066 struct sem_undo_list *ulp; 2067 2068 ulp = tsk->sysvsem.undo_list; 2069 if (!ulp) 2070 return; 2071 tsk->sysvsem.undo_list = NULL; 2072 2073 if (!atomic_dec_and_test(&ulp->refcnt)) 2074 return; 2075 2076 for (;;) { 2077 struct sem_array *sma; 2078 struct sem_undo *un; 2079 int semid, i; 2080 DEFINE_WAKE_Q(wake_q); 2081 2082 cond_resched(); 2083 2084 rcu_read_lock(); 2085 un = list_entry_rcu(ulp->list_proc.next, 2086 struct sem_undo, list_proc); 2087 if (&un->list_proc == &ulp->list_proc) { 2088 /* 2089 * We must wait for freeary() before freeing this ulp, 2090 * in case we raced with last sem_undo. There is a small 2091 * possibility where we exit while freeary() didn't 2092 * finish unlocking sem_undo_list. 2093 */ 2094 spin_unlock_wait(&ulp->lock); 2095 rcu_read_unlock(); 2096 break; 2097 } 2098 spin_lock(&ulp->lock); 2099 semid = un->semid; 2100 spin_unlock(&ulp->lock); 2101 2102 /* exit_sem raced with IPC_RMID, nothing to do */ 2103 if (semid == -1) { 2104 rcu_read_unlock(); 2105 continue; 2106 } 2107 2108 sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, semid); 2109 /* exit_sem raced with IPC_RMID, nothing to do */ 2110 if (IS_ERR(sma)) { 2111 rcu_read_unlock(); 2112 continue; 2113 } 2114 2115 sem_lock(sma, NULL, -1); 2116 /* exit_sem raced with IPC_RMID, nothing to do */ 2117 if (!ipc_valid_object(&sma->sem_perm)) { 2118 sem_unlock(sma, -1); 2119 rcu_read_unlock(); 2120 continue; 2121 } 2122 un = __lookup_undo(ulp, semid); 2123 if (un == NULL) { 2124 /* exit_sem raced with IPC_RMID+semget() that created 2125 * exactly the same semid. Nothing to do. 2126 */ 2127 sem_unlock(sma, -1); 2128 rcu_read_unlock(); 2129 continue; 2130 } 2131 2132 /* remove un from the linked lists */ 2133 ipc_assert_locked_object(&sma->sem_perm); 2134 list_del(&un->list_id); 2135 2136 /* we are the last process using this ulp, acquiring ulp->lock 2137 * isn't required. Besides that, we are also protected against 2138 * IPC_RMID as we hold sma->sem_perm lock now 2139 */ 2140 list_del_rcu(&un->list_proc); 2141 2142 /* perform adjustments registered in un */ 2143 for (i = 0; i < sma->sem_nsems; i++) { 2144 struct sem *semaphore = &sma->sems[i]; 2145 if (un->semadj[i]) { 2146 semaphore->semval += un->semadj[i]; 2147 /* 2148 * Range checks of the new semaphore value, 2149 * not defined by sus: 2150 * - Some unices ignore the undo entirely 2151 * (e.g. HP UX 11i 11.22, Tru64 V5.1) 2152 * - some cap the value (e.g. FreeBSD caps 2153 * at 0, but doesn't enforce SEMVMX) 2154 * 2155 * Linux caps the semaphore value, both at 0 2156 * and at SEMVMX. 2157 * 2158 * Manfred <manfred@colorfullife.com> 2159 */ 2160 if (semaphore->semval < 0) 2161 semaphore->semval = 0; 2162 if (semaphore->semval > SEMVMX) 2163 semaphore->semval = SEMVMX; 2164 semaphore->sempid = task_tgid_vnr(current); 2165 } 2166 } 2167 /* maybe some queued-up processes were waiting for this */ 2168 do_smart_update(sma, NULL, 0, 1, &wake_q); 2169 sem_unlock(sma, -1); 2170 rcu_read_unlock(); 2171 wake_up_q(&wake_q); 2172 2173 kfree_rcu(un, rcu); 2174 } 2175 kfree(ulp); 2176 } 2177 2178 #ifdef CONFIG_PROC_FS 2179 static int sysvipc_sem_proc_show(struct seq_file *s, void *it) 2180 { 2181 struct user_namespace *user_ns = seq_user_ns(s); 2182 struct kern_ipc_perm *ipcp = it; 2183 struct sem_array *sma = container_of(ipcp, struct sem_array, sem_perm); 2184 time_t sem_otime; 2185 2186 /* 2187 * The proc interface isn't aware of sem_lock(), it calls 2188 * ipc_lock_object() directly (in sysvipc_find_ipc). 2189 * In order to stay compatible with sem_lock(), we must 2190 * enter / leave complex_mode. 2191 */ 2192 complexmode_enter(sma); 2193 2194 sem_otime = get_semotime(sma); 2195 2196 seq_printf(s, 2197 "%10d %10d %4o %10u %5u %5u %5u %5u %10lu %10lu\n", 2198 sma->sem_perm.key, 2199 sma->sem_perm.id, 2200 sma->sem_perm.mode, 2201 sma->sem_nsems, 2202 from_kuid_munged(user_ns, sma->sem_perm.uid), 2203 from_kgid_munged(user_ns, sma->sem_perm.gid), 2204 from_kuid_munged(user_ns, sma->sem_perm.cuid), 2205 from_kgid_munged(user_ns, sma->sem_perm.cgid), 2206 sem_otime, 2207 sma->sem_ctime); 2208 2209 complexmode_tryleave(sma); 2210 2211 return 0; 2212 } 2213 #endif 2214