ipc/shm.c

   1 /*
   2  * linux/ipc/shm.c
   3  * Copyright (C) 1992, 1993 Krishna Balasubramanian
   4  *       Many improvements/fixes by Bruno Haible.
   5  * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
   6  * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
   7  *
   8  * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
   9  * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
  10  * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
  11  * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
  12  * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
  13  * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
  14  * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
  15  *
  16  * support for audit of ipc object properties and permission changes
  17  * Dustin Kirkland <dustin.kirkland@us.ibm.com>
  18  *
  19  * namespaces support
  20  * OpenVZ, SWsoft Inc.
  21  * Pavel Emelianov <xemul@openvz.org>
  22  *
  23  * Better ipc lock (kern_ipc_perm.lock) handling
  24  * Davidlohr Bueso <davidlohr.bueso@hp.com>, June 2013.
  25  */
  26
  27 #include <linux/slab.h>
  28 #include <linux/mm.h>
  29 #include <linux/hugetlb.h>
  30 #include <linux/shm.h>
  31 #include <linux/init.h>
  32 #include <linux/file.h>
  33 #include <linux/mman.h>
  34 #include <linux/shmem_fs.h>
  35 #include <linux/security.h>
  36 #include <linux/syscalls.h>
  37 #include <linux/audit.h>
  38 #include <linux/capability.h>
  39 #include <linux/ptrace.h>
  40 #include <linux/seq_file.h>
  41 #include <linux/rwsem.h>
  42 #include <linux/nsproxy.h>
  43 #include <linux/mount.h>
  44 #include <linux/ipc_namespace.h>
  45
  46 #include <linux/uaccess.h>
  47
  48 #include "util.h"
  49
  50 struct shm_file_data {
  51         int id;
  52         struct ipc_namespace *ns;
  53         struct file *file;
  54         const struct vm_operations_struct *vm_ops;
  55 };
  56
  57 #define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data))
  58
  59 static const struct file_operations shm_file_operations;
  60 static const struct vm_operations_struct shm_vm_ops;
  61
  62 #define shm_ids(ns)     ((ns)->ids[IPC_SHM_IDS])
  63
  64 #define shm_unlock(shp)                 \
  65         ipc_unlock(&(shp)->shm_perm)
  66
  67 static int newseg(struct ipc_namespace *, struct ipc_params *);
  68 static void shm_open(struct vm_area_struct *vma);
  69 static void shm_close(struct vm_area_struct *vma);
  70 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp);
  71 #ifdef CONFIG_PROC_FS
  72 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
  73 #endif
  74
  75 void shm_init_ns(struct ipc_namespace *ns)
  76 {
  77         ns->shm_ctlmax = SHMMAX;
  78         ns->shm_ctlall = SHMALL;
  79         ns->shm_ctlmni = SHMMNI;
  80         ns->shm_rmid_forced = 0;
  81         ns->shm_tot = 0;
  82         ipc_init_ids(&shm_ids(ns));
  83 }
  84
  85 /*
  86  * Called with shm_ids.rwsem (writer) and the shp structure locked.
  87  * Only shm_ids.rwsem remains locked on exit.
  88  */
  89 static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
  90 {
  91         struct shmid_kernel *shp;
  92         shp = container_of(ipcp, struct shmid_kernel, shm_perm);
  93         WARN_ON(ns != shp->ns);
  94
  95         if (shp->shm_nattch) {
  96                 shp->shm_perm.mode |= SHM_DEST;
  97                 /* Do not find it any more */
  98                 shp->shm_perm.key = IPC_PRIVATE;
  99                 shm_unlock(shp);
 100         } else
 101                 shm_destroy(ns, shp);
 102 }
 103
 104 #ifdef CONFIG_IPC_NS
 105 void shm_exit_ns(struct ipc_namespace *ns)
 106 {
 107         free_ipcs(ns, &shm_ids(ns), do_shm_rmid);
 108         idr_destroy(&ns->ids[IPC_SHM_IDS].ipcs_idr);
 109 }
 110 #endif
 111
 112 static int __init ipc_ns_init(void)
 113 {
 114         shm_init_ns(&init_ipc_ns);
 115         return 0;
 116 }
 117
 118 pure_initcall(ipc_ns_init);
 119
 120 void __init shm_init(void)
 121 {
 122         ipc_init_proc_interface("sysvipc/shm",
 123 #if BITS_PER_LONG <= 32
 124                                 "       key      shmid perms       size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime        rss       swap\n",
 125 #else
 126                                 "       key      shmid perms                  size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime                   rss                  swap\n",
 127 #endif
 128                                 IPC_SHM_IDS, sysvipc_shm_proc_show);
 129 }
 130
 131 static inline struct shmid_kernel *shm_obtain_object(struct ipc_namespace *ns, int id)
 132 {
 133         struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&shm_ids(ns), id);
 134
 135         if (IS_ERR(ipcp))
 136                 return ERR_CAST(ipcp);
 137
 138         return container_of(ipcp, struct shmid_kernel, shm_perm);
 139 }
 140
 141 static inline struct shmid_kernel *shm_obtain_object_check(struct ipc_namespace *ns, int id)
 142 {
 143         struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&shm_ids(ns), id);
 144
 145         if (IS_ERR(ipcp))
 146                 return ERR_CAST(ipcp);
 147
 148         return container_of(ipcp, struct shmid_kernel, shm_perm);
 149 }
 150
 151 /*
 152  * shm_lock_(check_) routines are called in the paths where the rwsem
 153  * is not necessarily held.
 154  */
 155 static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
 156 {
 157         struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id);
 158
 159         /*
 160          * Callers of shm_lock() must validate the status of the returned ipc
 161          * object pointer (as returned by ipc_lock()), and error out as
 162          * appropriate.
 163          */
 164         if (IS_ERR(ipcp))
 165                 return (void *)ipcp;
 166         return container_of(ipcp, struct shmid_kernel, shm_perm);
 167 }
 168
 169 static inline void shm_lock_by_ptr(struct shmid_kernel *ipcp)
 170 {
 171         rcu_read_lock();
 172         ipc_lock_object(&ipcp->shm_perm);
 173 }
 174
 175 static void shm_rcu_free(struct rcu_head *head)
 176 {
 177         struct ipc_rcu *p = container_of(head, struct ipc_rcu, rcu);
 178         struct shmid_kernel *shp = ipc_rcu_to_struct(p);
 179
 180         security_shm_free(shp);
 181         ipc_rcu_free(head);
 182 }
 183
 184 /*
 185  * It has to be called with shp locked.
 186  * It must be called before ipc_rmid()
 187  */
 188 static inline void shm_clist_rm(struct shmid_kernel *shp)
 189 {
 190         struct task_struct *creator;
 191
 192         /* ensure that shm_creator does not disappear */
 193         rcu_read_lock();
 194
 195         /*
 196          * A concurrent exit_shm may do a list_del_init() as well.
 197          * Just do nothing if exit_shm already did the work
 198          */
 199         if (!list_empty(&shp->shm_clist)) {
 200                 /*
 201                  * shp->shm_creator is guaranteed to be valid *only*
 202                  * if shp->shm_clist is not empty.
 203                  */
 204                 creator = shp->shm_creator;
 205
 206                 task_lock(creator);
 207                 /*
 208                  * list_del_init() is a nop if the entry was already removed
 209                  * from the list.
 210                  */
 211                 list_del_init(&shp->shm_clist);
 212                 task_unlock(creator);
 213         }
 214         rcu_read_unlock();
 215 }
 216
 217 static inline void shm_rmid(struct shmid_kernel *s)
 218 {
 219         shm_clist_rm(s);
 220         ipc_rmid(&shm_ids(s->ns), &s->shm_perm);
 221 }
 222
 223
 224 static int __shm_open(struct vm_area_struct *vma)
 225 {
 226         struct file *file = vma->vm_file;
 227         struct shm_file_data *sfd = shm_file_data(file);
 228         struct shmid_kernel *shp;
 229
 230         shp = shm_lock(sfd->ns, sfd->id);
 231
 232         if (IS_ERR(shp))
 233                 return PTR_ERR(shp);
 234
 235         if (shp->shm_file != sfd->file) {
 236                 /* ID was reused */
 237                 shm_unlock(shp);
 238                 return -EINVAL;
 239         }
 240
 241         shp->shm_atim = get_seconds();
 242         shp->shm_lprid = task_tgid_vnr(current);
 243         shp->shm_nattch++;
 244         shm_unlock(shp);
 245         return 0;
 246 }
 247
 248 /* This is called by fork, once for every shm attach. */
 249 static void shm_open(struct vm_area_struct *vma)
 250 {
 251         int err = __shm_open(vma);
 252         /*
 253          * We raced in the idr lookup or with shm_destroy().
 254          * Either way, the ID is busted.
 255          */
 256         WARN_ON_ONCE(err);
 257 }
 258
 259 /*
 260  * shm_destroy - free the struct shmid_kernel
 261  *
 262  * @ns: namespace
 263  * @shp: struct to free
 264  *
 265  * It has to be called with shp and shm_ids.rwsem (writer) locked,
 266  * but returns with shp unlocked and freed.
 267  */
 268 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
 269 {
 270         struct file *shm_file;
 271
 272         shm_file = shp->shm_file;
 273         shp->shm_file = NULL;
 274         ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
 275         shm_rmid(shp);
 276         shm_unlock(shp);
 277         if (!is_file_hugepages(shm_file))
 278                 shmem_lock(shm_file, 0, shp->mlock_user);
 279         else if (shp->mlock_user)
 280                 user_shm_unlock(i_size_read(file_inode(shm_file)),
 281                                 shp->mlock_user);
 282         fput(shm_file);
 283         ipc_rcu_putref(shp, shm_rcu_free);
 284 }
 285
 286 /*
 287  * shm_may_destroy - identifies whether shm segment should be destroyed now
 288  *
 289  * Returns true if and only if there are no active users of the segment and
 290  * one of the following is true:
 291  *
 292  * 1) shmctl(id, IPC_RMID, NULL) was called for this shp
 293  *
 294  * 2) sysctl kernel.shm_rmid_forced is set to 1.
 295  */
 296 static bool shm_may_destroy(struct shmid_kernel *shp)
 297 {
 298         return (shp->shm_nattch == 0) &&
 299                (shp->ns->shm_rmid_forced ||
 300                 (shp->shm_perm.mode & SHM_DEST));
 301 }
 302
 303 /*
 304  * remove the attach descriptor vma.
 305  * free memory for segment if it is marked destroyed.
 306  * The descriptor has already been removed from the current->mm->mmap list
 307  * and will later be kfree()d.
 308  */
 309 static void shm_close(struct vm_area_struct *vma)
 310 {
 311         struct file *file = vma->vm_file;
 312         struct shm_file_data *sfd = shm_file_data(file);
 313         struct shmid_kernel *shp;
 314         struct ipc_namespace *ns = sfd->ns;
 315
 316         down_write(&shm_ids(ns).rwsem);
 317         /* remove from the list of attaches of the shm segment */
 318         shp = shm_lock(ns, sfd->id);
 319
 320         /*
 321          * We raced in the idr lookup or with shm_destroy().
 322          * Either way, the ID is busted.
 323          */
 324         if (WARN_ON_ONCE(IS_ERR(shp)))
 325                 goto done; /* no-op */
 326
 327         shp->shm_lprid = task_tgid_vnr(current);
 328         shp->shm_dtim = get_seconds();
 329         shp->shm_nattch--;
 330         if (shm_may_destroy(shp))
 331                 shm_destroy(ns, shp);
 332         else
 333                 shm_unlock(shp);
 334 done:
 335         up_write(&shm_ids(ns).rwsem);
 336 }
 337
 338 /* Called with ns->shm_ids(ns).rwsem locked */
 339 static int shm_try_destroy_orphaned(int id, void *p, void *data)
 340 {
 341         struct ipc_namespace *ns = data;
 342         struct kern_ipc_perm *ipcp = p;
 343         struct shmid_kernel *shp = container_of(ipcp, struct shmid_kernel, shm_perm);
 344
 345         /*
 346          * We want to destroy segments without users and with already
 347          * exit'ed originating process.
 348          *
 349          * As shp->* are changed under rwsem, it's safe to skip shp locking.
 350          */
 351         if (!list_empty(&shp->shm_clist))
 352                 return 0;
 353
 354         if (shm_may_destroy(shp)) {
 355                 shm_lock_by_ptr(shp);
 356                 shm_destroy(ns, shp);
 357         }
 358         return 0;
 359 }
 360
 361 void shm_destroy_orphaned(struct ipc_namespace *ns)
 362 {
 363         down_write(&shm_ids(ns).rwsem);
 364         if (shm_ids(ns).in_use)
 365                 idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns);
 366         up_write(&shm_ids(ns).rwsem);
 367 }
 368
 369 /* Locking assumes this will only be called with task == current */
 370 void exit_shm(struct task_struct *task)
 371 {
 372         for (;;) {
 373                 struct shmid_kernel *shp;
 374                 struct ipc_namespace *ns;
 375
 376                 task_lock(task);
 377
 378                 if (list_empty(&task->sysvshm.shm_clist)) {
 379                         task_unlock(task);
 380                         break;
 381                 }
 382
 383                 shp = list_first_entry(&task->sysvshm.shm_clist, struct shmid_kernel,
 384                                 shm_clist);
 385
 386                 /*
 387                  * 1) Get pointer to the ipc namespace. It is worth to say
 388                  * that this pointer is guaranteed to be valid because
 389                  * shp lifetime is always shorter than namespace lifetime
 390                  * in which shp lives.
 391                  * We taken task_lock it means that shp won't be freed.
 392                  */
 393                 ns = shp->ns;
 394
 395                 /*
 396                  * 2) If kernel.shm_rmid_forced is not set then only keep track of
 397                  * which shmids are orphaned, so that a later set of the sysctl
 398                  * can clean them up.
 399                  */
 400                 if (!ns->shm_rmid_forced)
 401                         goto unlink_continue;
 402
 403                 /*
 404                  * 3) get a reference to the namespace.
 405                  *    The refcount could be already 0. If it is 0, then
 406                  *    the shm objects will be free by free_ipc_work().
 407                  */
 408                 ns = get_ipc_ns_not_zero(ns);
 409                 if (!ns) {
 410 unlink_continue:
 411                         list_del_init(&shp->shm_clist);
 412                         task_unlock(task);
 413                         continue;
 414                 }
 415
 416                 /*
 417                  * 4) get a reference to shp.
 418                  *   This cannot fail: shm_clist_rm() is called before
 419                  *   ipc_rmid(), thus the refcount cannot be 0.
 420                  */
 421                 WARN_ON(!ipc_rcu_getref(&shp->shm_perm));
 422
 423                 /*
 424                  * 5) unlink the shm segment from the list of segments
 425                  *    created by current.
 426                  *    This must be done last. After unlinking,
 427                  *    only the refcounts obtained above prevent IPC_RMID
 428                  *    from destroying the segment or the namespace.
 429                  */
 430                 list_del_init(&shp->shm_clist);
 431
 432                 task_unlock(task);
 433
 434                 /*
 435                  * 6) we have all references
 436                  *    Thus lock & if needed destroy shp.
 437                  */
 438                 down_write(&shm_ids(ns).rwsem);
 439                 shm_lock_by_ptr(shp);
 440                 /*
 441                  * rcu_read_lock was implicitly taken in shm_lock_by_ptr, it's
 442                  * safe to call ipc_rcu_putref here
 443                  */
 444                 ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
 445
 446                 if (ipc_valid_object(&shp->shm_perm)) {
 447                         if (shm_may_destroy(shp))
 448                                 shm_destroy(ns, shp);
 449                         else
 450                                 shm_unlock(shp);
 451                 } else {
 452                         /*
 453                          * Someone else deleted the shp from namespace
 454                          * idr/kht while we have waited.
 455                          * Just unlock and continue.
 456                          */
 457                         shm_unlock(shp);
 458                 }
 459
 460                 up_write(&shm_ids(ns).rwsem);
 461                 put_ipc_ns(ns); /* paired with get_ipc_ns_not_zero */
 462         }
 463 }
 464
 465 static int shm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 466 {
 467         struct file *file = vma->vm_file;
 468         struct shm_file_data *sfd = shm_file_data(file);
 469
 470         return sfd->vm_ops->fault(vma, vmf);
 471 }
 472
 473 #ifdef CONFIG_NUMA
 474 static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
 475 {
 476         struct file *file = vma->vm_file;
 477         struct shm_file_data *sfd = shm_file_data(file);
 478         int err = 0;
 479         if (sfd->vm_ops->set_policy)
 480                 err = sfd->vm_ops->set_policy(vma, new);
 481         return err;
 482 }
 483
 484 static struct mempolicy *shm_get_policy(struct vm_area_struct *vma,
 485                                         unsigned long addr)
 486 {
 487         struct file *file = vma->vm_file;
 488         struct shm_file_data *sfd = shm_file_data(file);
 489         struct mempolicy *pol = NULL;
 490
 491         if (sfd->vm_ops->get_policy)
 492                 pol = sfd->vm_ops->get_policy(vma, addr);
 493         else if (vma->vm_policy)
 494                 pol = vma->vm_policy;
 495
 496         return pol;
 497 }
 498 #endif
 499
 500 static int shm_mmap(struct file *file, struct vm_area_struct *vma)
 501 {
 502         struct shm_file_data *sfd = shm_file_data(file);
 503         int ret;
 504
 505         /*
 506          * In case of remap_file_pages() emulation, the file can represent an
 507          * IPC ID that was removed, and possibly even reused by another shm
 508          * segment already.  Propagate this case as an error to caller.
 509          */
 510         ret =__shm_open(vma);
 511         if (ret)
 512                 return ret;
 513
 514         ret = sfd->file->f_op->mmap(sfd->file, vma);
 515         if (ret) {
 516                 shm_close(vma);
 517                 return ret;
 518         }
 519         sfd->vm_ops = vma->vm_ops;
 520 #ifdef CONFIG_MMU
 521         WARN_ON(!sfd->vm_ops->fault);
 522 #endif
 523         vma->vm_ops = &shm_vm_ops;
 524         return 0;
 525 }
 526
 527 static int shm_release(struct inode *ino, struct file *file)
 528 {
 529         struct shm_file_data *sfd = shm_file_data(file);
 530
 531         put_ipc_ns(sfd->ns);
 532         fput(sfd->file);
 533         shm_file_data(file) = NULL;
 534         kfree(sfd);
 535         return 0;
 536 }
 537
 538 static int shm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
 539 {
 540         struct shm_file_data *sfd = shm_file_data(file);
 541
 542         if (!sfd->file->f_op->fsync)
 543                 return -EINVAL;
 544         return sfd->file->f_op->fsync(sfd->file, start, end, datasync);
 545 }
 546
 547 static long shm_fallocate(struct file *file, int mode, loff_t offset,
 548                           loff_t len)
 549 {
 550         struct shm_file_data *sfd = shm_file_data(file);
 551
 552         if (!sfd->file->f_op->fallocate)
 553                 return -EOPNOTSUPP;
 554         return sfd->file->f_op->fallocate(file, mode, offset, len);
 555 }
 556
 557 static unsigned long shm_get_unmapped_area(struct file *file,
 558         unsigned long addr, unsigned long len, unsigned long pgoff,
 559         unsigned long flags)
 560 {
 561         struct shm_file_data *sfd = shm_file_data(file);
 562         return sfd->file->f_op->get_unmapped_area(sfd->file, addr, len,
 563                                                 pgoff, flags);
 564 }
 565
 566 static const struct file_operations shm_file_operations = {
 567         .mmap           = shm_mmap,
 568         .fsync          = shm_fsync,
 569         .release        = shm_release,
 570 #ifndef CONFIG_MMU
 571         .get_unmapped_area      = shm_get_unmapped_area,
 572 #endif
 573         .llseek         = noop_llseek,
 574         .fallocate      = shm_fallocate,
 575 };
 576
 577 static const struct file_operations shm_file_operations_huge = {
 578         .mmap           = shm_mmap,
 579         .fsync          = shm_fsync,
 580         .release        = shm_release,
 581         .get_unmapped_area      = shm_get_unmapped_area,
 582         .llseek         = noop_llseek,
 583         .fallocate      = shm_fallocate,
 584 };
 585
 586 int is_file_shm_hugepages(struct file *file)
 587 {
 588         return file->f_op == &shm_file_operations_huge;
 589 }
 590
 591 static const struct vm_operations_struct shm_vm_ops = {
 592         .open   = shm_open,     /* callback for a new vm-area open */
 593         .close  = shm_close,    /* callback for when the vm-area is released */
 594         .fault  = shm_fault,
 595 #if defined(CONFIG_NUMA)
 596         .set_policy = shm_set_policy,
 597         .get_policy = shm_get_policy,
 598 #endif
 599 };
 600
 601 /**
 602  * newseg - Create a new shared memory segment
 603  * @ns: namespace
 604  * @params: ptr to the structure that contains key, size and shmflg
 605  *
 606  * Called with shm_ids.rwsem held as a writer.
 607  */
 608 static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
 609 {
 610         key_t key = params->key;
 611         int shmflg = params->flg;
 612         size_t size = params->u.size;
 613         int error;
 614         struct shmid_kernel *shp;
 615         size_t numpages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
 616         struct file *file;
 617         char name[13];
 618         int id;
 619         vm_flags_t acctflag = 0;
 620
 621         if (size < SHMMIN || size > ns->shm_ctlmax)
 622                 return -EINVAL;
 623
 624         if (numpages << PAGE_SHIFT < size)
 625                 return -ENOSPC;
 626
 627         if (ns->shm_tot + numpages < ns->shm_tot ||
 628                         ns->shm_tot + numpages > ns->shm_ctlall)
 629                 return -ENOSPC;
 630
 631         shp = ipc_rcu_alloc(sizeof(*shp));
 632         if (!shp)
 633                 return -ENOMEM;
 634
 635         shp->shm_perm.key = key;
 636         shp->shm_perm.mode = (shmflg & S_IRWXUGO);
 637         shp->mlock_user = NULL;
 638
 639         shp->shm_perm.security = NULL;
 640         error = security_shm_alloc(shp);
 641         if (error) {
 642                 ipc_rcu_putref(shp, ipc_rcu_free);
 643                 return error;
 644         }
 645
 646         sprintf(name, "SYSV%08x", key);
 647         if (shmflg & SHM_HUGETLB) {
 648                 struct hstate *hs;
 649                 size_t hugesize;
 650
 651                 hs = hstate_sizelog((shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK);
 652                 if (!hs) {
 653                         error = -EINVAL;
 654                         goto no_file;
 655                 }
 656                 hugesize = ALIGN(size, huge_page_size(hs));
 657
 658                 /* hugetlb_file_setup applies strict accounting */
 659                 if (shmflg & SHM_NORESERVE)
 660                         acctflag = VM_NORESERVE;
 661                 file = hugetlb_file_setup(name, hugesize, acctflag,
 662                                   &shp->mlock_user, HUGETLB_SHMFS_INODE,
 663                                 (shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK);
 664         } else {
 665                 /*
 666                  * Do not allow no accounting for OVERCOMMIT_NEVER, even
 667                  * if it's asked for.
 668                  */
 669                 if  ((shmflg & SHM_NORESERVE) &&
 670                                 sysctl_overcommit_memory != OVERCOMMIT_NEVER)
 671                         acctflag = VM_NORESERVE;
 672                 file = shmem_kernel_file_setup(name, size, acctflag);
 673         }
 674         error = PTR_ERR(file);
 675         if (IS_ERR(file))
 676                 goto no_file;
 677
 678         shp->shm_cprid = task_tgid_vnr(current);
 679         shp->shm_lprid = 0;
 680         shp->shm_atim = shp->shm_dtim = 0;
 681         shp->shm_ctim = get_seconds();
 682         shp->shm_segsz = size;
 683         shp->shm_nattch = 0;
 684         shp->shm_file = file;
 685         shp->shm_creator = current;
 686
 687         id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
 688         if (id < 0) {
 689                 error = id;
 690                 goto no_id;
 691         }
 692
 693         shp->ns = ns;
 694
 695         task_lock(current);
 696         list_add(&shp->shm_clist, &current->sysvshm.shm_clist);
 697         task_unlock(current);
 698
 699         /*
 700          * shmid gets reported as "inode#" in /proc/pid/maps.
 701          * proc-ps tools use this. Changing this will break them.
 702          */
 703         file_inode(file)->i_ino = shp->shm_perm.id;
 704
 705         ns->shm_tot += numpages;
 706         error = shp->shm_perm.id;
 707
 708         ipc_unlock_object(&shp->shm_perm);
 709         rcu_read_unlock();
 710         return error;
 711
 712 no_id:
 713         if (is_file_hugepages(file) && shp->mlock_user)
 714                 user_shm_unlock(size, shp->mlock_user);
 715         fput(file);
 716 no_file:
 717         ipc_rcu_putref(shp, shm_rcu_free);
 718         return error;
 719 }
 720
 721 /*
 722  * Called with shm_ids.rwsem and ipcp locked.
 723  */
 724 static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg)
 725 {
 726         struct shmid_kernel *shp;
 727
 728         shp = container_of(ipcp, struct shmid_kernel, shm_perm);
 729         return security_shm_associate(shp, shmflg);
 730 }
 731
 732 /*
 733  * Called with shm_ids.rwsem and ipcp locked.
 734  */
 735 static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
 736                                 struct ipc_params *params)
 737 {
 738         struct shmid_kernel *shp;
 739
 740         shp = container_of(ipcp, struct shmid_kernel, shm_perm);
 741         if (shp->shm_segsz < params->u.size)
 742                 return -EINVAL;
 743
 744         return 0;
 745 }
 746
 747 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
 748 {
 749         struct ipc_namespace *ns;
 750         static const struct ipc_ops shm_ops = {
 751                 .getnew = newseg,
 752                 .associate = shm_security,
 753                 .more_checks = shm_more_checks,
 754         };
 755         struct ipc_params shm_params;
 756
 757         ns = current->nsproxy->ipc_ns;
 758
 759         shm_params.key = key;
 760         shm_params.flg = shmflg;
 761         shm_params.u.size = size;
 762
 763         return ipcget(ns, &shm_ids(ns), &shm_ops, &shm_params);
 764 }
 765
 766 static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
 767 {
 768         switch (version) {
 769         case IPC_64:
 770                 return copy_to_user(buf, in, sizeof(*in));
 771         case IPC_OLD:
 772             {
 773                 struct shmid_ds out;
 774
 775                 memset(&out, 0, sizeof(out));
 776                 ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
 777                 out.shm_segsz   = in->shm_segsz;
 778                 out.shm_atime   = in->shm_atime;
 779                 out.shm_dtime   = in->shm_dtime;
 780                 out.shm_ctime   = in->shm_ctime;
 781                 out.shm_cpid    = in->shm_cpid;
 782                 out.shm_lpid    = in->shm_lpid;
 783                 out.shm_nattch  = in->shm_nattch;
 784
 785                 return copy_to_user(buf, &out, sizeof(out));
 786             }
 787         default:
 788                 return -EINVAL;
 789         }
 790 }
 791
 792 static inline unsigned long
 793 copy_shmid_from_user(struct shmid64_ds *out, void __user *buf, int version)
 794 {
 795         switch (version) {
 796         case IPC_64:
 797                 if (copy_from_user(out, buf, sizeof(*out)))
 798                         return -EFAULT;
 799                 return 0;
 800         case IPC_OLD:
 801             {
 802                 struct shmid_ds tbuf_old;
 803
 804                 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
 805                         return -EFAULT;
 806
 807                 out->shm_perm.uid       = tbuf_old.shm_perm.uid;
 808                 out->shm_perm.gid       = tbuf_old.shm_perm.gid;
 809                 out->shm_perm.mode      = tbuf_old.shm_perm.mode;
 810
 811                 return 0;
 812             }
 813         default:
 814                 return -EINVAL;
 815         }
 816 }
 817
 818 static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
 819 {
 820         switch (version) {
 821         case IPC_64:
 822                 return copy_to_user(buf, in, sizeof(*in));
 823         case IPC_OLD:
 824             {
 825                 struct shminfo out;
 826
 827                 if (in->shmmax > INT_MAX)
 828                         out.shmmax = INT_MAX;
 829                 else
 830                         out.shmmax = (int)in->shmmax;
 831
 832                 out.shmmin      = in->shmmin;
 833                 out.shmmni      = in->shmmni;
 834                 out.shmseg      = in->shmseg;
 835                 out.shmall      = in->shmall;
 836
 837                 return copy_to_user(buf, &out, sizeof(out));
 838             }
 839         default:
 840                 return -EINVAL;
 841         }
 842 }
 843
 844 /*
 845  * Calculate and add used RSS and swap pages of a shm.
 846  * Called with shm_ids.rwsem held as a reader
 847  */
 848 static void shm_add_rss_swap(struct shmid_kernel *shp,
 849         unsigned long *rss_add, unsigned long *swp_add)
 850 {
 851         struct inode *inode;
 852
 853         inode = file_inode(shp->shm_file);
 854
 855         if (is_file_hugepages(shp->shm_file)) {
 856                 struct address_space *mapping = inode->i_mapping;
 857                 struct hstate *h = hstate_file(shp->shm_file);
 858                 *rss_add += pages_per_huge_page(h) * mapping->nrpages;
 859         } else {
 860 #ifdef CONFIG_SHMEM
 861                 struct shmem_inode_info *info = SHMEM_I(inode);
 862                 spin_lock(&info->lock);
 863                 *rss_add += inode->i_mapping->nrpages;
 864                 *swp_add += info->swapped;
 865                 spin_unlock(&info->lock);
 866 #else
 867                 *rss_add += inode->i_mapping->nrpages;
 868 #endif
 869         }
 870 }
 871
 872 /*
 873  * Called with shm_ids.rwsem held as a reader
 874  */
 875 static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
 876                 unsigned long *swp)
 877 {
 878         int next_id;
 879         int total, in_use;
 880
 881         *rss = 0;
 882         *swp = 0;
 883
 884         in_use = shm_ids(ns).in_use;
 885
 886         for (total = 0, next_id = 0; total < in_use; next_id++) {
 887                 struct kern_ipc_perm *ipc;
 888                 struct shmid_kernel *shp;
 889
 890                 ipc = idr_find(&shm_ids(ns).ipcs_idr, next_id);
 891                 if (ipc == NULL)
 892                         continue;
 893                 shp = container_of(ipc, struct shmid_kernel, shm_perm);
 894
 895                 shm_add_rss_swap(shp, rss, swp);
 896
 897                 total++;
 898         }
 899 }
 900
 901 /*
 902  * This function handles some shmctl commands which require the rwsem
 903  * to be held in write mode.
 904  * NOTE: no locks must be held, the rwsem is taken inside this function.
 905  */
 906 static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
 907                        struct shmid_ds __user *buf, int version)
 908 {
 909         struct kern_ipc_perm *ipcp;
 910         struct shmid64_ds shmid64;
 911         struct shmid_kernel *shp;
 912         int err;
 913
 914         if (cmd == IPC_SET) {
 915                 if (copy_shmid_from_user(&shmid64, buf, version))
 916                         return -EFAULT;
 917         }
 918
 919         down_write(&shm_ids(ns).rwsem);
 920         rcu_read_lock();
 921
 922         ipcp = ipcctl_pre_down_nolock(ns, &shm_ids(ns), shmid, cmd,
 923                                       &shmid64.shm_perm, 0);
 924         if (IS_ERR(ipcp)) {
 925                 err = PTR_ERR(ipcp);
 926                 goto out_unlock1;
 927         }
 928
 929         shp = container_of(ipcp, struct shmid_kernel, shm_perm);
 930
 931         err = security_shm_shmctl(shp, cmd);
 932         if (err)
 933                 goto out_unlock1;
 934
 935         switch (cmd) {
 936         case IPC_RMID:
 937                 ipc_lock_object(&shp->shm_perm);
 938                 /* do_shm_rmid unlocks the ipc object and rcu */
 939                 do_shm_rmid(ns, ipcp);
 940                 goto out_up;
 941         case IPC_SET:
 942                 ipc_lock_object(&shp->shm_perm);
 943                 err = ipc_update_perm(&shmid64.shm_perm, ipcp);
 944                 if (err)
 945                         goto out_unlock0;
 946                 shp->shm_ctim = get_seconds();
 947                 break;
 948         default:
 949                 err = -EINVAL;
 950                 goto out_unlock1;
 951         }
 952
 953 out_unlock0:
 954         ipc_unlock_object(&shp->shm_perm);
 955 out_unlock1:
 956         rcu_read_unlock();
 957 out_up:
 958         up_write(&shm_ids(ns).rwsem);
 959         return err;
 960 }
 961
 962 static int shmctl_nolock(struct ipc_namespace *ns, int shmid,
 963                          int cmd, int version, void __user *buf)
 964 {
 965         int err;
 966         struct shmid_kernel *shp;
 967
 968         /* preliminary security checks for *_INFO */
 969         if (cmd == IPC_INFO || cmd == SHM_INFO) {
 970                 err = security_shm_shmctl(NULL, cmd);
 971                 if (err)
 972                         return err;
 973         }
 974
 975         switch (cmd) {
 976         case IPC_INFO:
 977         {
 978                 struct shminfo64 shminfo;
 979
 980                 memset(&shminfo, 0, sizeof(shminfo));
 981                 shminfo.shmmni = shminfo.shmseg = ns->shm_ctlmni;
 982                 shminfo.shmmax = ns->shm_ctlmax;
 983                 shminfo.shmall = ns->shm_ctlall;
 984
 985                 shminfo.shmmin = SHMMIN;
 986                 if (copy_shminfo_to_user(buf, &shminfo, version))
 987                         return -EFAULT;
 988
 989                 down_read(&shm_ids(ns).rwsem);
 990                 err = ipc_get_maxid(&shm_ids(ns));
 991                 up_read(&shm_ids(ns).rwsem);
 992
 993                 if (err < 0)
 994                         err = 0;
 995                 goto out;
 996         }
 997         case SHM_INFO:
 998         {
 999                 struct shm_info shm_info;
1000
1001                 memset(&shm_info, 0, sizeof(shm_info));
1002                 down_read(&shm_ids(ns).rwsem);
1003                 shm_info.used_ids = shm_ids(ns).in_use;
1004                 shm_get_stat(ns, &shm_info.shm_rss, &shm_info.shm_swp);
1005                 shm_info.shm_tot = ns->shm_tot;
1006                 shm_info.swap_attempts = 0;
1007                 shm_info.swap_successes = 0;
1008                 err = ipc_get_maxid(&shm_ids(ns));
1009                 up_read(&shm_ids(ns).rwsem);
1010                 if (copy_to_user(buf, &shm_info, sizeof(shm_info))) {
1011                         err = -EFAULT;
1012                         goto out;
1013                 }
1014
1015                 err = err < 0 ? 0 : err;
1016                 goto out;
1017         }
1018         case SHM_STAT:
1019         case IPC_STAT:
1020         {
1021                 struct shmid64_ds tbuf;
1022                 int result;
1023
1024                 rcu_read_lock();
1025                 if (cmd == SHM_STAT) {
1026                         shp = shm_obtain_object(ns, shmid);
1027                         if (IS_ERR(shp)) {
1028                                 err = PTR_ERR(shp);
1029                                 goto out_unlock;
1030                         }
1031                         result = shp->shm_perm.id;
1032                 } else {
1033                         shp = shm_obtain_object_check(ns, shmid);
1034                         if (IS_ERR(shp)) {
1035                                 err = PTR_ERR(shp);
1036                                 goto out_unlock;
1037                         }
1038                         result = 0;
1039                 }
1040
1041                 err = -EACCES;
1042                 if (ipcperms(ns, &shp->shm_perm, S_IRUGO))
1043                         goto out_unlock;
1044
1045                 err = security_shm_shmctl(shp, cmd);
1046                 if (err)
1047                         goto out_unlock;
1048
1049                 memset(&tbuf, 0, sizeof(tbuf));
1050                 kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm);
1051                 tbuf.shm_segsz  = shp->shm_segsz;
1052                 tbuf.shm_atime  = shp->shm_atim;
1053                 tbuf.shm_dtime  = shp->shm_dtim;
1054                 tbuf.shm_ctime  = shp->shm_ctim;
1055                 tbuf.shm_cpid   = shp->shm_cprid;
1056                 tbuf.shm_lpid   = shp->shm_lprid;
1057                 tbuf.shm_nattch = shp->shm_nattch;
1058                 rcu_read_unlock();
1059
1060                 if (copy_shmid_to_user(buf, &tbuf, version))
1061                         err = -EFAULT;
1062                 else
1063                         err = result;
1064                 goto out;
1065         }
1066         default:
1067                 return -EINVAL;
1068         }
1069
1070 out_unlock:
1071         rcu_read_unlock();
1072 out:
1073         return err;
1074 }
1075
1076 SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
1077 {
1078         struct shmid_kernel *shp;
1079         int err, version;
1080         struct ipc_namespace *ns;
1081
1082         if (cmd < 0 || shmid < 0)
1083                 return -EINVAL;
1084
1085         version = ipc_parse_version(&cmd);
1086         ns = current->nsproxy->ipc_ns;
1087
1088         switch (cmd) {
1089         case IPC_INFO:
1090         case SHM_INFO:
1091         case SHM_STAT:
1092         case IPC_STAT:
1093                 return shmctl_nolock(ns, shmid, cmd, version, buf);
1094         case IPC_RMID:
1095         case IPC_SET:
1096                 return shmctl_down(ns, shmid, cmd, buf, version);
1097         case SHM_LOCK:
1098         case SHM_UNLOCK:
1099         {
1100                 struct file *shm_file;
1101
1102                 rcu_read_lock();
1103                 shp = shm_obtain_object_check(ns, shmid);
1104                 if (IS_ERR(shp)) {
1105                         err = PTR_ERR(shp);
1106                         goto out_unlock1;
1107                 }
1108
1109                 audit_ipc_obj(&(shp->shm_perm));
1110                 err = security_shm_shmctl(shp, cmd);
1111                 if (err)
1112                         goto out_unlock1;
1113
1114                 ipc_lock_object(&shp->shm_perm);
1115
1116                 /* check if shm_destroy() is tearing down shp */
1117                 if (!ipc_valid_object(&shp->shm_perm)) {
1118                         err = -EIDRM;
1119                         goto out_unlock0;
1120                 }
1121
1122                 if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
1123                         kuid_t euid = current_euid();
1124                         if (!uid_eq(euid, shp->shm_perm.uid) &&
1125                             !uid_eq(euid, shp->shm_perm.cuid)) {
1126                                 err = -EPERM;
1127                                 goto out_unlock0;
1128                         }
1129                         if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
1130                                 err = -EPERM;
1131                                 goto out_unlock0;
1132                         }
1133                 }
1134
1135                 shm_file = shp->shm_file;
1136                 if (is_file_hugepages(shm_file))
1137                         goto out_unlock0;
1138
1139                 if (cmd == SHM_LOCK) {
1140                         struct user_struct *user = current_user();
1141                         err = shmem_lock(shm_file, 1, user);
1142                         if (!err && !(shp->shm_perm.mode & SHM_LOCKED)) {
1143                                 shp->shm_perm.mode |= SHM_LOCKED;
1144                                 shp->mlock_user = user;
1145                         }
1146                         goto out_unlock0;
1147                 }
1148
1149                 /* SHM_UNLOCK */
1150                 if (!(shp->shm_perm.mode & SHM_LOCKED))
1151                         goto out_unlock0;
1152                 shmem_lock(shm_file, 0, shp->mlock_user);
1153                 shp->shm_perm.mode &= ~SHM_LOCKED;
1154                 shp->mlock_user = NULL;
1155                 get_file(shm_file);
1156                 ipc_unlock_object(&shp->shm_perm);
1157                 rcu_read_unlock();
1158                 shmem_unlock_mapping(shm_file->f_mapping);
1159
1160                 fput(shm_file);
1161                 return err;
1162         }
1163         default:
1164                 return -EINVAL;
1165         }
1166
1167 out_unlock0:
1168         ipc_unlock_object(&shp->shm_perm);
1169 out_unlock1:
1170         rcu_read_unlock();
1171         return err;
1172 }
1173
1174 /*
1175  * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
1176  *
1177  * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
1178  * "raddr" thing points to kernel space, and there has to be a wrapper around
1179  * this.
1180  */
1181 long do_shmat(int shmid, char __user *shmaddr, int shmflg,
1182               ulong *raddr, unsigned long shmlba)
1183 {
1184         struct shmid_kernel *shp;
1185         unsigned long addr;
1186         unsigned long size;
1187         struct file *file;
1188         int    err;
1189         unsigned long flags;
1190         unsigned long prot;
1191         int acc_mode;
1192         struct ipc_namespace *ns;
1193         struct shm_file_data *sfd;
1194         struct path path;
1195         fmode_t f_mode;
1196         unsigned long populate = 0;
1197
1198         err = -EINVAL;
1199         if (shmid < 0)
1200                 goto out;
1201         else if ((addr = (ulong)shmaddr)) {
1202                 if (addr & (shmlba - 1)) {
1203                         if (shmflg & SHM_RND) {
1204                                 addr &= ~(shmlba - 1);  /* round down */
1205
1206                                 /*
1207                                  * Ensure that the round-down is non-nil
1208                                  * when remapping. This can happen for
1209                                  * cases when addr < shmlba.
1210                                  */
1211                                 if (!addr && (shmflg & SHM_REMAP))
1212                                         goto out;
1213                         } else
1214 #ifndef __ARCH_FORCE_SHMLBA
1215                                 if (addr & ~PAGE_MASK)
1216 #endif
1217                                         goto out;
1218                 }
1219                 flags = MAP_SHARED | MAP_FIXED;
1220         } else {
1221                 if ((shmflg & SHM_REMAP))
1222                         goto out;
1223
1224                 flags = MAP_SHARED;
1225         }
1226
1227         if (shmflg & SHM_RDONLY) {
1228                 prot = PROT_READ;
1229                 acc_mode = S_IRUGO;
1230                 f_mode = FMODE_READ;
1231         } else {
1232                 prot = PROT_READ | PROT_WRITE;
1233                 acc_mode = S_IRUGO | S_IWUGO;
1234                 f_mode = FMODE_READ | FMODE_WRITE;
1235         }
1236         if (shmflg & SHM_EXEC) {
1237                 prot |= PROT_EXEC;
1238                 acc_mode |= S_IXUGO;
1239         }
1240
1241         /*
1242          * We cannot rely on the fs check since SYSV IPC does have an
1243          * additional creator id...
1244          */
1245         ns = current->nsproxy->ipc_ns;
1246         rcu_read_lock();
1247         shp = shm_obtain_object_check(ns, shmid);
1248         if (IS_ERR(shp)) {
1249                 err = PTR_ERR(shp);
1250                 goto out_unlock;
1251         }
1252
1253         err = -EACCES;
1254         if (ipcperms(ns, &shp->shm_perm, acc_mode))
1255                 goto out_unlock;
1256
1257         err = security_shm_shmat(shp, shmaddr, shmflg);
1258         if (err)
1259                 goto out_unlock;
1260
1261         ipc_lock_object(&shp->shm_perm);
1262
1263         /* check if shm_destroy() is tearing down shp */
1264         if (!ipc_valid_object(&shp->shm_perm)) {
1265                 ipc_unlock_object(&shp->shm_perm);
1266                 err = -EIDRM;
1267                 goto out_unlock;
1268         }
1269
1270         path = shp->shm_file->f_path;
1271         path_get(&path);
1272         shp->shm_nattch++;
1273         size = i_size_read(d_inode(path.dentry));
1274         ipc_unlock_object(&shp->shm_perm);
1275         rcu_read_unlock();
1276
1277         err = -ENOMEM;
1278         sfd = kzalloc(sizeof(*sfd), GFP_KERNEL);
1279         if (!sfd) {
1280                 path_put(&path);
1281                 goto out_nattch;
1282         }
1283
1284         file = alloc_file(&path, f_mode,
1285                           is_file_hugepages(shp->shm_file) ?
1286                                 &shm_file_operations_huge :
1287                                 &shm_file_operations);
1288         err = PTR_ERR(file);
1289         if (IS_ERR(file)) {
1290                 kfree(sfd);
1291                 path_put(&path);
1292                 goto out_nattch;
1293         }
1294
1295         file->private_data = sfd;
1296         file->f_mapping = shp->shm_file->f_mapping;
1297         sfd->id = shp->shm_perm.id;
1298         sfd->ns = get_ipc_ns(ns);
1299         /*
1300          * We need to take a reference to the real shm file to prevent the
1301          * pointer from becoming stale in cases where the lifetime of the outer
1302          * file extends beyond that of the shm segment.  It's not usually
1303          * possible, but it can happen during remap_file_pages() emulation as
1304          * that unmaps the memory, then does ->mmap() via file reference only.
1305          * We'll deny the ->mmap() if the shm segment was since removed, but to
1306          * detect shm ID reuse we need to compare the file pointers.
1307          */
1308         sfd->file = get_file(shp->shm_file);
1309         sfd->vm_ops = NULL;
1310
1311         err = security_mmap_file(file, prot, flags);
1312         if (err)
1313                 goto out_fput;
1314
1315         down_write(&current->mm->mmap_sem);
1316         if (addr && !(shmflg & SHM_REMAP)) {
1317                 err = -EINVAL;
1318                 if (addr + size < addr)
1319                         goto invalid;
1320
1321                 if (find_vma_intersection(current->mm, addr, addr + size))
1322                         goto invalid;
1323         }
1324
1325         addr = do_mmap_pgoff(file, addr, size, prot, flags, 0, &populate);
1326         *raddr = addr;
1327         err = 0;
1328         if (IS_ERR_VALUE(addr))
1329                 err = (long)addr;
1330 invalid:
1331         up_write(&current->mm->mmap_sem);
1332         if (populate)
1333                 mm_populate(addr, populate);
1334
1335 out_fput:
1336         fput(file);
1337
1338 out_nattch:
1339         down_write(&shm_ids(ns).rwsem);
1340         shp = shm_lock(ns, shmid);
1341         shp->shm_nattch--;
1342
1343         if (shm_may_destroy(shp))
1344                 shm_destroy(ns, shp);
1345         else
1346                 shm_unlock(shp);
1347         up_write(&shm_ids(ns).rwsem);
1348         return err;
1349
1350 out_unlock:
1351         rcu_read_unlock();
1352 out:
1353         return err;
1354 }
1355
1356 SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
1357 {
1358         unsigned long ret;
1359         long err;
1360
1361         err = do_shmat(shmid, shmaddr, shmflg, &ret, SHMLBA);
1362         if (err)
1363                 return err;
1364         force_successful_syscall_return();
1365         return (long)ret;
1366 }
1367
1368 /*
1369  * detach and kill segment if marked destroyed.
1370  * The work is done in shm_close.
1371  */
1372 SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
1373 {
1374         struct mm_struct *mm = current->mm;
1375         struct vm_area_struct *vma;
1376         unsigned long addr = (unsigned long)shmaddr;
1377         int retval = -EINVAL;
1378 #ifdef CONFIG_MMU
1379         loff_t size = 0;
1380         struct file *file;
1381         struct vm_area_struct *next;
1382 #endif
1383
1384         if (addr & ~PAGE_MASK)
1385                 return retval;
1386
1387         down_write(&mm->mmap_sem);
1388
1389         /*
1390          * This function tries to be smart and unmap shm segments that
1391          * were modified by partial mlock or munmap calls:
1392          * - It first determines the size of the shm segment that should be
1393          *   unmapped: It searches for a vma that is backed by shm and that
1394          *   started at address shmaddr. It records it's size and then unmaps
1395          *   it.
1396          * - Then it unmaps all shm vmas that started at shmaddr and that
1397          *   are within the initially determined size and that are from the
1398          *   same shm segment from which we determined the size.
1399          * Errors from do_munmap are ignored: the function only fails if
1400          * it's called with invalid parameters or if it's called to unmap
1401          * a part of a vma. Both calls in this function are for full vmas,
1402          * the parameters are directly copied from the vma itself and always
1403          * valid - therefore do_munmap cannot fail. (famous last words?)
1404          */
1405         /*
1406          * If it had been mremap()'d, the starting address would not
1407          * match the usual checks anyway. So assume all vma's are
1408          * above the starting address given.
1409          */
1410         vma = find_vma(mm, addr);
1411
1412 #ifdef CONFIG_MMU
1413         while (vma) {
1414                 next = vma->vm_next;
1415
1416                 /*
1417                  * Check if the starting address would match, i.e. it's
1418                  * a fragment created by mprotect() and/or munmap(), or it
1419                  * otherwise it starts at this address with no hassles.
1420                  */
1421                 if ((vma->vm_ops == &shm_vm_ops) &&
1422                         (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) {
1423
1424                         /*
1425                          * Record the file of the shm segment being
1426                          * unmapped.  With mremap(), someone could place
1427                          * page from another segment but with equal offsets
1428                          * in the range we are unmapping.
1429                          */
1430                         file = vma->vm_file;
1431                         size = i_size_read(file_inode(vma->vm_file));
1432                         do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1433                         /*
1434                          * We discovered the size of the shm segment, so
1435                          * break out of here and fall through to the next
1436                          * loop that uses the size information to stop
1437                          * searching for matching vma's.
1438                          */
1439                         retval = 0;
1440                         vma = next;
1441                         break;
1442                 }
1443                 vma = next;
1444         }
1445
1446         /*
1447          * We need look no further than the maximum address a fragment
1448          * could possibly have landed at. Also cast things to loff_t to
1449          * prevent overflows and make comparisons vs. equal-width types.
1450          */
1451         size = PAGE_ALIGN(size);
1452         while (vma && (loff_t)(vma->vm_end - addr) <= size) {
1453                 next = vma->vm_next;
1454
1455                 /* finding a matching vma now does not alter retval */
1456                 if ((vma->vm_ops == &shm_vm_ops) &&
1457                     ((vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) &&
1458                     (vma->vm_file == file))
1459                         do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1460                 vma = next;
1461         }
1462
1463 #else /* CONFIG_MMU */
1464         /* under NOMMU conditions, the exact address to be destroyed must be
1465          * given */
1466         if (vma && vma->vm_start == addr && vma->vm_ops == &shm_vm_ops) {
1467                 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1468                 retval = 0;
1469         }
1470
1471 #endif
1472
1473         up_write(&mm->mmap_sem);
1474         return retval;
1475 }
1476
1477 #ifdef CONFIG_PROC_FS
1478 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
1479 {
1480         struct user_namespace *user_ns = seq_user_ns(s);
1481         struct shmid_kernel *shp = it;
1482         unsigned long rss = 0, swp = 0;
1483
1484         shm_add_rss_swap(shp, &rss, &swp);
1485
1486 #if BITS_PER_LONG <= 32
1487 #define SIZE_SPEC "%10lu"
1488 #else
1489 #define SIZE_SPEC "%21lu"
1490 #endif
1491
1492         seq_printf(s,
1493                    "%10d %10d  %4o " SIZE_SPEC " %5u %5u  "
1494                    "%5lu %5u %5u %5u %5u %10lu %10lu %10lu "
1495                    SIZE_SPEC " " SIZE_SPEC "\n",
1496                    shp->shm_perm.key,
1497                    shp->shm_perm.id,
1498                    shp->shm_perm.mode,
1499                    shp->shm_segsz,
1500                    shp->shm_cprid,
1501                    shp->shm_lprid,
1502                    shp->shm_nattch,
1503                    from_kuid_munged(user_ns, shp->shm_perm.uid),
1504                    from_kgid_munged(user_ns, shp->shm_perm.gid),
1505                    from_kuid_munged(user_ns, shp->shm_perm.cuid),
1506                    from_kgid_munged(user_ns, shp->shm_perm.cgid),
1507                    shp->shm_atim,
1508                    shp->shm_dtim,
1509                    shp->shm_ctim,
1510                    rss * PAGE_SIZE,
1511                    swp * PAGE_SIZE);
1512
1513         return 0;
1514 }
1515 #endif