GNU Linux-libre 4.4.289-gnu1
[releases.git] / ipc / shm.c
1 /*
2  * linux/ipc/shm.c
3  * Copyright (C) 1992, 1993 Krishna Balasubramanian
4  *       Many improvements/fixes by Bruno Haible.
5  * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
6  * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
7  *
8  * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
9  * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
10  * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
11  * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
12  * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
13  * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
14  * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
15  *
16  * support for audit of ipc object properties and permission changes
17  * Dustin Kirkland <dustin.kirkland@us.ibm.com>
18  *
19  * namespaces support
20  * OpenVZ, SWsoft Inc.
21  * Pavel Emelianov <xemul@openvz.org>
22  *
23  * Better ipc lock (kern_ipc_perm.lock) handling
24  * Davidlohr Bueso <davidlohr.bueso@hp.com>, June 2013.
25  */
26
27 #include <linux/slab.h>
28 #include <linux/mm.h>
29 #include <linux/hugetlb.h>
30 #include <linux/shm.h>
31 #include <linux/init.h>
32 #include <linux/file.h>
33 #include <linux/mman.h>
34 #include <linux/shmem_fs.h>
35 #include <linux/security.h>
36 #include <linux/syscalls.h>
37 #include <linux/audit.h>
38 #include <linux/capability.h>
39 #include <linux/ptrace.h>
40 #include <linux/seq_file.h>
41 #include <linux/rwsem.h>
42 #include <linux/nsproxy.h>
43 #include <linux/mount.h>
44 #include <linux/ipc_namespace.h>
45
46 #include <linux/uaccess.h>
47
48 #include "util.h"
49
50 struct shm_file_data {
51         int id;
52         struct ipc_namespace *ns;
53         struct file *file;
54         const struct vm_operations_struct *vm_ops;
55 };
56
57 #define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data))
58
59 static const struct file_operations shm_file_operations;
60 static const struct vm_operations_struct shm_vm_ops;
61
62 #define shm_ids(ns)     ((ns)->ids[IPC_SHM_IDS])
63
64 #define shm_unlock(shp)                 \
65         ipc_unlock(&(shp)->shm_perm)
66
67 static int newseg(struct ipc_namespace *, struct ipc_params *);
68 static void shm_open(struct vm_area_struct *vma);
69 static void shm_close(struct vm_area_struct *vma);
70 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp);
71 #ifdef CONFIG_PROC_FS
72 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
73 #endif
74
75 void shm_init_ns(struct ipc_namespace *ns)
76 {
77         ns->shm_ctlmax = SHMMAX;
78         ns->shm_ctlall = SHMALL;
79         ns->shm_ctlmni = SHMMNI;
80         ns->shm_rmid_forced = 0;
81         ns->shm_tot = 0;
82         ipc_init_ids(&shm_ids(ns));
83 }
84
85 /*
86  * Called with shm_ids.rwsem (writer) and the shp structure locked.
87  * Only shm_ids.rwsem remains locked on exit.
88  */
89 static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
90 {
91         struct shmid_kernel *shp;
92         shp = container_of(ipcp, struct shmid_kernel, shm_perm);
93
94         if (shp->shm_nattch) {
95                 shp->shm_perm.mode |= SHM_DEST;
96                 /* Do not find it any more */
97                 shp->shm_perm.key = IPC_PRIVATE;
98                 shm_unlock(shp);
99         } else
100                 shm_destroy(ns, shp);
101 }
102
103 #ifdef CONFIG_IPC_NS
104 void shm_exit_ns(struct ipc_namespace *ns)
105 {
106         free_ipcs(ns, &shm_ids(ns), do_shm_rmid);
107         idr_destroy(&ns->ids[IPC_SHM_IDS].ipcs_idr);
108 }
109 #endif
110
111 static int __init ipc_ns_init(void)
112 {
113         shm_init_ns(&init_ipc_ns);
114         return 0;
115 }
116
117 pure_initcall(ipc_ns_init);
118
119 void __init shm_init(void)
120 {
121         ipc_init_proc_interface("sysvipc/shm",
122 #if BITS_PER_LONG <= 32
123                                 "       key      shmid perms       size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime        rss       swap\n",
124 #else
125                                 "       key      shmid perms                  size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime                   rss                  swap\n",
126 #endif
127                                 IPC_SHM_IDS, sysvipc_shm_proc_show);
128 }
129
130 static inline struct shmid_kernel *shm_obtain_object(struct ipc_namespace *ns, int id)
131 {
132         struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&shm_ids(ns), id);
133
134         if (IS_ERR(ipcp))
135                 return ERR_CAST(ipcp);
136
137         return container_of(ipcp, struct shmid_kernel, shm_perm);
138 }
139
140 static inline struct shmid_kernel *shm_obtain_object_check(struct ipc_namespace *ns, int id)
141 {
142         struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&shm_ids(ns), id);
143
144         if (IS_ERR(ipcp))
145                 return ERR_CAST(ipcp);
146
147         return container_of(ipcp, struct shmid_kernel, shm_perm);
148 }
149
150 /*
151  * shm_lock_(check_) routines are called in the paths where the rwsem
152  * is not necessarily held.
153  */
154 static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
155 {
156         struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id);
157
158         /*
159          * Callers of shm_lock() must validate the status of the returned ipc
160          * object pointer (as returned by ipc_lock()), and error out as
161          * appropriate.
162          */
163         if (IS_ERR(ipcp))
164                 return (void *)ipcp;
165         return container_of(ipcp, struct shmid_kernel, shm_perm);
166 }
167
168 static inline void shm_lock_by_ptr(struct shmid_kernel *ipcp)
169 {
170         rcu_read_lock();
171         ipc_lock_object(&ipcp->shm_perm);
172 }
173
174 static void shm_rcu_free(struct rcu_head *head)
175 {
176         struct ipc_rcu *p = container_of(head, struct ipc_rcu, rcu);
177         struct shmid_kernel *shp = ipc_rcu_to_struct(p);
178
179         security_shm_free(shp);
180         ipc_rcu_free(head);
181 }
182
183 static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s)
184 {
185         list_del(&s->shm_clist);
186         ipc_rmid(&shm_ids(ns), &s->shm_perm);
187 }
188
189
190 static int __shm_open(struct vm_area_struct *vma)
191 {
192         struct file *file = vma->vm_file;
193         struct shm_file_data *sfd = shm_file_data(file);
194         struct shmid_kernel *shp;
195
196         shp = shm_lock(sfd->ns, sfd->id);
197
198         if (IS_ERR(shp))
199                 return PTR_ERR(shp);
200
201         if (shp->shm_file != sfd->file) {
202                 /* ID was reused */
203                 shm_unlock(shp);
204                 return -EINVAL;
205         }
206
207         shp->shm_atim = get_seconds();
208         shp->shm_lprid = task_tgid_vnr(current);
209         shp->shm_nattch++;
210         shm_unlock(shp);
211         return 0;
212 }
213
214 /* This is called by fork, once for every shm attach. */
215 static void shm_open(struct vm_area_struct *vma)
216 {
217         int err = __shm_open(vma);
218         /*
219          * We raced in the idr lookup or with shm_destroy().
220          * Either way, the ID is busted.
221          */
222         WARN_ON_ONCE(err);
223 }
224
225 /*
226  * shm_destroy - free the struct shmid_kernel
227  *
228  * @ns: namespace
229  * @shp: struct to free
230  *
231  * It has to be called with shp and shm_ids.rwsem (writer) locked,
232  * but returns with shp unlocked and freed.
233  */
234 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
235 {
236         struct file *shm_file;
237
238         shm_file = shp->shm_file;
239         shp->shm_file = NULL;
240         ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
241         shm_rmid(ns, shp);
242         shm_unlock(shp);
243         if (!is_file_hugepages(shm_file))
244                 shmem_lock(shm_file, 0, shp->mlock_user);
245         else if (shp->mlock_user)
246                 user_shm_unlock(i_size_read(file_inode(shm_file)),
247                                 shp->mlock_user);
248         fput(shm_file);
249         ipc_rcu_putref(shp, shm_rcu_free);
250 }
251
252 /*
253  * shm_may_destroy - identifies whether shm segment should be destroyed now
254  *
255  * Returns true if and only if there are no active users of the segment and
256  * one of the following is true:
257  *
258  * 1) shmctl(id, IPC_RMID, NULL) was called for this shp
259  *
260  * 2) sysctl kernel.shm_rmid_forced is set to 1.
261  */
262 static bool shm_may_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
263 {
264         return (shp->shm_nattch == 0) &&
265                (ns->shm_rmid_forced ||
266                 (shp->shm_perm.mode & SHM_DEST));
267 }
268
269 /*
270  * remove the attach descriptor vma.
271  * free memory for segment if it is marked destroyed.
272  * The descriptor has already been removed from the current->mm->mmap list
273  * and will later be kfree()d.
274  */
275 static void shm_close(struct vm_area_struct *vma)
276 {
277         struct file *file = vma->vm_file;
278         struct shm_file_data *sfd = shm_file_data(file);
279         struct shmid_kernel *shp;
280         struct ipc_namespace *ns = sfd->ns;
281
282         down_write(&shm_ids(ns).rwsem);
283         /* remove from the list of attaches of the shm segment */
284         shp = shm_lock(ns, sfd->id);
285
286         /*
287          * We raced in the idr lookup or with shm_destroy().
288          * Either way, the ID is busted.
289          */
290         if (WARN_ON_ONCE(IS_ERR(shp)))
291                 goto done; /* no-op */
292
293         shp->shm_lprid = task_tgid_vnr(current);
294         shp->shm_dtim = get_seconds();
295         shp->shm_nattch--;
296         if (shm_may_destroy(ns, shp))
297                 shm_destroy(ns, shp);
298         else
299                 shm_unlock(shp);
300 done:
301         up_write(&shm_ids(ns).rwsem);
302 }
303
304 /* Called with ns->shm_ids(ns).rwsem locked */
305 static int shm_try_destroy_orphaned(int id, void *p, void *data)
306 {
307         struct ipc_namespace *ns = data;
308         struct kern_ipc_perm *ipcp = p;
309         struct shmid_kernel *shp = container_of(ipcp, struct shmid_kernel, shm_perm);
310
311         /*
312          * We want to destroy segments without users and with already
313          * exit'ed originating process.
314          *
315          * As shp->* are changed under rwsem, it's safe to skip shp locking.
316          */
317         if (shp->shm_creator != NULL)
318                 return 0;
319
320         if (shm_may_destroy(ns, shp)) {
321                 shm_lock_by_ptr(shp);
322                 shm_destroy(ns, shp);
323         }
324         return 0;
325 }
326
327 void shm_destroy_orphaned(struct ipc_namespace *ns)
328 {
329         down_write(&shm_ids(ns).rwsem);
330         if (shm_ids(ns).in_use)
331                 idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns);
332         up_write(&shm_ids(ns).rwsem);
333 }
334
335 /* Locking assumes this will only be called with task == current */
336 void exit_shm(struct task_struct *task)
337 {
338         struct ipc_namespace *ns = task->nsproxy->ipc_ns;
339         struct shmid_kernel *shp, *n;
340
341         if (list_empty(&task->sysvshm.shm_clist))
342                 return;
343
344         /*
345          * If kernel.shm_rmid_forced is not set then only keep track of
346          * which shmids are orphaned, so that a later set of the sysctl
347          * can clean them up.
348          */
349         if (!ns->shm_rmid_forced) {
350                 down_read(&shm_ids(ns).rwsem);
351                 list_for_each_entry(shp, &task->sysvshm.shm_clist, shm_clist)
352                         shp->shm_creator = NULL;
353                 /*
354                  * Only under read lock but we are only called on current
355                  * so no entry on the list will be shared.
356                  */
357                 list_del(&task->sysvshm.shm_clist);
358                 up_read(&shm_ids(ns).rwsem);
359                 return;
360         }
361
362         /*
363          * Destroy all already created segments, that were not yet mapped,
364          * and mark any mapped as orphan to cover the sysctl toggling.
365          * Destroy is skipped if shm_may_destroy() returns false.
366          */
367         down_write(&shm_ids(ns).rwsem);
368         list_for_each_entry_safe(shp, n, &task->sysvshm.shm_clist, shm_clist) {
369                 shp->shm_creator = NULL;
370
371                 if (shm_may_destroy(ns, shp)) {
372                         shm_lock_by_ptr(shp);
373                         shm_destroy(ns, shp);
374                 }
375         }
376
377         /* Remove the list head from any segments still attached. */
378         list_del(&task->sysvshm.shm_clist);
379         up_write(&shm_ids(ns).rwsem);
380 }
381
382 static int shm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
383 {
384         struct file *file = vma->vm_file;
385         struct shm_file_data *sfd = shm_file_data(file);
386
387         return sfd->vm_ops->fault(vma, vmf);
388 }
389
390 #ifdef CONFIG_NUMA
391 static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
392 {
393         struct file *file = vma->vm_file;
394         struct shm_file_data *sfd = shm_file_data(file);
395         int err = 0;
396         if (sfd->vm_ops->set_policy)
397                 err = sfd->vm_ops->set_policy(vma, new);
398         return err;
399 }
400
401 static struct mempolicy *shm_get_policy(struct vm_area_struct *vma,
402                                         unsigned long addr)
403 {
404         struct file *file = vma->vm_file;
405         struct shm_file_data *sfd = shm_file_data(file);
406         struct mempolicy *pol = NULL;
407
408         if (sfd->vm_ops->get_policy)
409                 pol = sfd->vm_ops->get_policy(vma, addr);
410         else if (vma->vm_policy)
411                 pol = vma->vm_policy;
412
413         return pol;
414 }
415 #endif
416
417 static int shm_mmap(struct file *file, struct vm_area_struct *vma)
418 {
419         struct shm_file_data *sfd = shm_file_data(file);
420         int ret;
421
422         /*
423          * In case of remap_file_pages() emulation, the file can represent an
424          * IPC ID that was removed, and possibly even reused by another shm
425          * segment already.  Propagate this case as an error to caller.
426          */
427         ret =__shm_open(vma);
428         if (ret)
429                 return ret;
430
431         ret = sfd->file->f_op->mmap(sfd->file, vma);
432         if (ret) {
433                 shm_close(vma);
434                 return ret;
435         }
436         sfd->vm_ops = vma->vm_ops;
437 #ifdef CONFIG_MMU
438         WARN_ON(!sfd->vm_ops->fault);
439 #endif
440         vma->vm_ops = &shm_vm_ops;
441         return 0;
442 }
443
444 static int shm_release(struct inode *ino, struct file *file)
445 {
446         struct shm_file_data *sfd = shm_file_data(file);
447
448         put_ipc_ns(sfd->ns);
449         fput(sfd->file);
450         shm_file_data(file) = NULL;
451         kfree(sfd);
452         return 0;
453 }
454
455 static int shm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
456 {
457         struct shm_file_data *sfd = shm_file_data(file);
458
459         if (!sfd->file->f_op->fsync)
460                 return -EINVAL;
461         return sfd->file->f_op->fsync(sfd->file, start, end, datasync);
462 }
463
464 static long shm_fallocate(struct file *file, int mode, loff_t offset,
465                           loff_t len)
466 {
467         struct shm_file_data *sfd = shm_file_data(file);
468
469         if (!sfd->file->f_op->fallocate)
470                 return -EOPNOTSUPP;
471         return sfd->file->f_op->fallocate(file, mode, offset, len);
472 }
473
474 static unsigned long shm_get_unmapped_area(struct file *file,
475         unsigned long addr, unsigned long len, unsigned long pgoff,
476         unsigned long flags)
477 {
478         struct shm_file_data *sfd = shm_file_data(file);
479         return sfd->file->f_op->get_unmapped_area(sfd->file, addr, len,
480                                                 pgoff, flags);
481 }
482
483 static const struct file_operations shm_file_operations = {
484         .mmap           = shm_mmap,
485         .fsync          = shm_fsync,
486         .release        = shm_release,
487 #ifndef CONFIG_MMU
488         .get_unmapped_area      = shm_get_unmapped_area,
489 #endif
490         .llseek         = noop_llseek,
491         .fallocate      = shm_fallocate,
492 };
493
494 static const struct file_operations shm_file_operations_huge = {
495         .mmap           = shm_mmap,
496         .fsync          = shm_fsync,
497         .release        = shm_release,
498         .get_unmapped_area      = shm_get_unmapped_area,
499         .llseek         = noop_llseek,
500         .fallocate      = shm_fallocate,
501 };
502
503 int is_file_shm_hugepages(struct file *file)
504 {
505         return file->f_op == &shm_file_operations_huge;
506 }
507
508 static const struct vm_operations_struct shm_vm_ops = {
509         .open   = shm_open,     /* callback for a new vm-area open */
510         .close  = shm_close,    /* callback for when the vm-area is released */
511         .fault  = shm_fault,
512 #if defined(CONFIG_NUMA)
513         .set_policy = shm_set_policy,
514         .get_policy = shm_get_policy,
515 #endif
516 };
517
518 /**
519  * newseg - Create a new shared memory segment
520  * @ns: namespace
521  * @params: ptr to the structure that contains key, size and shmflg
522  *
523  * Called with shm_ids.rwsem held as a writer.
524  */
525 static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
526 {
527         key_t key = params->key;
528         int shmflg = params->flg;
529         size_t size = params->u.size;
530         int error;
531         struct shmid_kernel *shp;
532         size_t numpages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
533         struct file *file;
534         char name[13];
535         int id;
536         vm_flags_t acctflag = 0;
537
538         if (size < SHMMIN || size > ns->shm_ctlmax)
539                 return -EINVAL;
540
541         if (numpages << PAGE_SHIFT < size)
542                 return -ENOSPC;
543
544         if (ns->shm_tot + numpages < ns->shm_tot ||
545                         ns->shm_tot + numpages > ns->shm_ctlall)
546                 return -ENOSPC;
547
548         shp = ipc_rcu_alloc(sizeof(*shp));
549         if (!shp)
550                 return -ENOMEM;
551
552         shp->shm_perm.key = key;
553         shp->shm_perm.mode = (shmflg & S_IRWXUGO);
554         shp->mlock_user = NULL;
555
556         shp->shm_perm.security = NULL;
557         error = security_shm_alloc(shp);
558         if (error) {
559                 ipc_rcu_putref(shp, ipc_rcu_free);
560                 return error;
561         }
562
563         sprintf(name, "SYSV%08x", key);
564         if (shmflg & SHM_HUGETLB) {
565                 struct hstate *hs;
566                 size_t hugesize;
567
568                 hs = hstate_sizelog((shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK);
569                 if (!hs) {
570                         error = -EINVAL;
571                         goto no_file;
572                 }
573                 hugesize = ALIGN(size, huge_page_size(hs));
574
575                 /* hugetlb_file_setup applies strict accounting */
576                 if (shmflg & SHM_NORESERVE)
577                         acctflag = VM_NORESERVE;
578                 file = hugetlb_file_setup(name, hugesize, acctflag,
579                                   &shp->mlock_user, HUGETLB_SHMFS_INODE,
580                                 (shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK);
581         } else {
582                 /*
583                  * Do not allow no accounting for OVERCOMMIT_NEVER, even
584                  * if it's asked for.
585                  */
586                 if  ((shmflg & SHM_NORESERVE) &&
587                                 sysctl_overcommit_memory != OVERCOMMIT_NEVER)
588                         acctflag = VM_NORESERVE;
589                 file = shmem_kernel_file_setup(name, size, acctflag);
590         }
591         error = PTR_ERR(file);
592         if (IS_ERR(file))
593                 goto no_file;
594
595         shp->shm_cprid = task_tgid_vnr(current);
596         shp->shm_lprid = 0;
597         shp->shm_atim = shp->shm_dtim = 0;
598         shp->shm_ctim = get_seconds();
599         shp->shm_segsz = size;
600         shp->shm_nattch = 0;
601         shp->shm_file = file;
602         shp->shm_creator = current;
603
604         id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
605         if (id < 0) {
606                 error = id;
607                 goto no_id;
608         }
609
610         list_add(&shp->shm_clist, &current->sysvshm.shm_clist);
611
612         /*
613          * shmid gets reported as "inode#" in /proc/pid/maps.
614          * proc-ps tools use this. Changing this will break them.
615          */
616         file_inode(file)->i_ino = shp->shm_perm.id;
617
618         ns->shm_tot += numpages;
619         error = shp->shm_perm.id;
620
621         ipc_unlock_object(&shp->shm_perm);
622         rcu_read_unlock();
623         return error;
624
625 no_id:
626         if (is_file_hugepages(file) && shp->mlock_user)
627                 user_shm_unlock(size, shp->mlock_user);
628         fput(file);
629 no_file:
630         ipc_rcu_putref(shp, shm_rcu_free);
631         return error;
632 }
633
634 /*
635  * Called with shm_ids.rwsem and ipcp locked.
636  */
637 static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg)
638 {
639         struct shmid_kernel *shp;
640
641         shp = container_of(ipcp, struct shmid_kernel, shm_perm);
642         return security_shm_associate(shp, shmflg);
643 }
644
645 /*
646  * Called with shm_ids.rwsem and ipcp locked.
647  */
648 static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
649                                 struct ipc_params *params)
650 {
651         struct shmid_kernel *shp;
652
653         shp = container_of(ipcp, struct shmid_kernel, shm_perm);
654         if (shp->shm_segsz < params->u.size)
655                 return -EINVAL;
656
657         return 0;
658 }
659
660 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
661 {
662         struct ipc_namespace *ns;
663         static const struct ipc_ops shm_ops = {
664                 .getnew = newseg,
665                 .associate = shm_security,
666                 .more_checks = shm_more_checks,
667         };
668         struct ipc_params shm_params;
669
670         ns = current->nsproxy->ipc_ns;
671
672         shm_params.key = key;
673         shm_params.flg = shmflg;
674         shm_params.u.size = size;
675
676         return ipcget(ns, &shm_ids(ns), &shm_ops, &shm_params);
677 }
678
679 static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
680 {
681         switch (version) {
682         case IPC_64:
683                 return copy_to_user(buf, in, sizeof(*in));
684         case IPC_OLD:
685             {
686                 struct shmid_ds out;
687
688                 memset(&out, 0, sizeof(out));
689                 ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
690                 out.shm_segsz   = in->shm_segsz;
691                 out.shm_atime   = in->shm_atime;
692                 out.shm_dtime   = in->shm_dtime;
693                 out.shm_ctime   = in->shm_ctime;
694                 out.shm_cpid    = in->shm_cpid;
695                 out.shm_lpid    = in->shm_lpid;
696                 out.shm_nattch  = in->shm_nattch;
697
698                 return copy_to_user(buf, &out, sizeof(out));
699             }
700         default:
701                 return -EINVAL;
702         }
703 }
704
705 static inline unsigned long
706 copy_shmid_from_user(struct shmid64_ds *out, void __user *buf, int version)
707 {
708         switch (version) {
709         case IPC_64:
710                 if (copy_from_user(out, buf, sizeof(*out)))
711                         return -EFAULT;
712                 return 0;
713         case IPC_OLD:
714             {
715                 struct shmid_ds tbuf_old;
716
717                 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
718                         return -EFAULT;
719
720                 out->shm_perm.uid       = tbuf_old.shm_perm.uid;
721                 out->shm_perm.gid       = tbuf_old.shm_perm.gid;
722                 out->shm_perm.mode      = tbuf_old.shm_perm.mode;
723
724                 return 0;
725             }
726         default:
727                 return -EINVAL;
728         }
729 }
730
731 static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
732 {
733         switch (version) {
734         case IPC_64:
735                 return copy_to_user(buf, in, sizeof(*in));
736         case IPC_OLD:
737             {
738                 struct shminfo out;
739
740                 if (in->shmmax > INT_MAX)
741                         out.shmmax = INT_MAX;
742                 else
743                         out.shmmax = (int)in->shmmax;
744
745                 out.shmmin      = in->shmmin;
746                 out.shmmni      = in->shmmni;
747                 out.shmseg      = in->shmseg;
748                 out.shmall      = in->shmall;
749
750                 return copy_to_user(buf, &out, sizeof(out));
751             }
752         default:
753                 return -EINVAL;
754         }
755 }
756
757 /*
758  * Calculate and add used RSS and swap pages of a shm.
759  * Called with shm_ids.rwsem held as a reader
760  */
761 static void shm_add_rss_swap(struct shmid_kernel *shp,
762         unsigned long *rss_add, unsigned long *swp_add)
763 {
764         struct inode *inode;
765
766         inode = file_inode(shp->shm_file);
767
768         if (is_file_hugepages(shp->shm_file)) {
769                 struct address_space *mapping = inode->i_mapping;
770                 struct hstate *h = hstate_file(shp->shm_file);
771                 *rss_add += pages_per_huge_page(h) * mapping->nrpages;
772         } else {
773 #ifdef CONFIG_SHMEM
774                 struct shmem_inode_info *info = SHMEM_I(inode);
775                 spin_lock(&info->lock);
776                 *rss_add += inode->i_mapping->nrpages;
777                 *swp_add += info->swapped;
778                 spin_unlock(&info->lock);
779 #else
780                 *rss_add += inode->i_mapping->nrpages;
781 #endif
782         }
783 }
784
785 /*
786  * Called with shm_ids.rwsem held as a reader
787  */
788 static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
789                 unsigned long *swp)
790 {
791         int next_id;
792         int total, in_use;
793
794         *rss = 0;
795         *swp = 0;
796
797         in_use = shm_ids(ns).in_use;
798
799         for (total = 0, next_id = 0; total < in_use; next_id++) {
800                 struct kern_ipc_perm *ipc;
801                 struct shmid_kernel *shp;
802
803                 ipc = idr_find(&shm_ids(ns).ipcs_idr, next_id);
804                 if (ipc == NULL)
805                         continue;
806                 shp = container_of(ipc, struct shmid_kernel, shm_perm);
807
808                 shm_add_rss_swap(shp, rss, swp);
809
810                 total++;
811         }
812 }
813
814 /*
815  * This function handles some shmctl commands which require the rwsem
816  * to be held in write mode.
817  * NOTE: no locks must be held, the rwsem is taken inside this function.
818  */
819 static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
820                        struct shmid_ds __user *buf, int version)
821 {
822         struct kern_ipc_perm *ipcp;
823         struct shmid64_ds shmid64;
824         struct shmid_kernel *shp;
825         int err;
826
827         if (cmd == IPC_SET) {
828                 if (copy_shmid_from_user(&shmid64, buf, version))
829                         return -EFAULT;
830         }
831
832         down_write(&shm_ids(ns).rwsem);
833         rcu_read_lock();
834
835         ipcp = ipcctl_pre_down_nolock(ns, &shm_ids(ns), shmid, cmd,
836                                       &shmid64.shm_perm, 0);
837         if (IS_ERR(ipcp)) {
838                 err = PTR_ERR(ipcp);
839                 goto out_unlock1;
840         }
841
842         shp = container_of(ipcp, struct shmid_kernel, shm_perm);
843
844         err = security_shm_shmctl(shp, cmd);
845         if (err)
846                 goto out_unlock1;
847
848         switch (cmd) {
849         case IPC_RMID:
850                 ipc_lock_object(&shp->shm_perm);
851                 /* do_shm_rmid unlocks the ipc object and rcu */
852                 do_shm_rmid(ns, ipcp);
853                 goto out_up;
854         case IPC_SET:
855                 ipc_lock_object(&shp->shm_perm);
856                 err = ipc_update_perm(&shmid64.shm_perm, ipcp);
857                 if (err)
858                         goto out_unlock0;
859                 shp->shm_ctim = get_seconds();
860                 break;
861         default:
862                 err = -EINVAL;
863                 goto out_unlock1;
864         }
865
866 out_unlock0:
867         ipc_unlock_object(&shp->shm_perm);
868 out_unlock1:
869         rcu_read_unlock();
870 out_up:
871         up_write(&shm_ids(ns).rwsem);
872         return err;
873 }
874
875 static int shmctl_nolock(struct ipc_namespace *ns, int shmid,
876                          int cmd, int version, void __user *buf)
877 {
878         int err;
879         struct shmid_kernel *shp;
880
881         /* preliminary security checks for *_INFO */
882         if (cmd == IPC_INFO || cmd == SHM_INFO) {
883                 err = security_shm_shmctl(NULL, cmd);
884                 if (err)
885                         return err;
886         }
887
888         switch (cmd) {
889         case IPC_INFO:
890         {
891                 struct shminfo64 shminfo;
892
893                 memset(&shminfo, 0, sizeof(shminfo));
894                 shminfo.shmmni = shminfo.shmseg = ns->shm_ctlmni;
895                 shminfo.shmmax = ns->shm_ctlmax;
896                 shminfo.shmall = ns->shm_ctlall;
897
898                 shminfo.shmmin = SHMMIN;
899                 if (copy_shminfo_to_user(buf, &shminfo, version))
900                         return -EFAULT;
901
902                 down_read(&shm_ids(ns).rwsem);
903                 err = ipc_get_maxid(&shm_ids(ns));
904                 up_read(&shm_ids(ns).rwsem);
905
906                 if (err < 0)
907                         err = 0;
908                 goto out;
909         }
910         case SHM_INFO:
911         {
912                 struct shm_info shm_info;
913
914                 memset(&shm_info, 0, sizeof(shm_info));
915                 down_read(&shm_ids(ns).rwsem);
916                 shm_info.used_ids = shm_ids(ns).in_use;
917                 shm_get_stat(ns, &shm_info.shm_rss, &shm_info.shm_swp);
918                 shm_info.shm_tot = ns->shm_tot;
919                 shm_info.swap_attempts = 0;
920                 shm_info.swap_successes = 0;
921                 err = ipc_get_maxid(&shm_ids(ns));
922                 up_read(&shm_ids(ns).rwsem);
923                 if (copy_to_user(buf, &shm_info, sizeof(shm_info))) {
924                         err = -EFAULT;
925                         goto out;
926                 }
927
928                 err = err < 0 ? 0 : err;
929                 goto out;
930         }
931         case SHM_STAT:
932         case IPC_STAT:
933         {
934                 struct shmid64_ds tbuf;
935                 int result;
936
937                 rcu_read_lock();
938                 if (cmd == SHM_STAT) {
939                         shp = shm_obtain_object(ns, shmid);
940                         if (IS_ERR(shp)) {
941                                 err = PTR_ERR(shp);
942                                 goto out_unlock;
943                         }
944                         result = shp->shm_perm.id;
945                 } else {
946                         shp = shm_obtain_object_check(ns, shmid);
947                         if (IS_ERR(shp)) {
948                                 err = PTR_ERR(shp);
949                                 goto out_unlock;
950                         }
951                         result = 0;
952                 }
953
954                 err = -EACCES;
955                 if (ipcperms(ns, &shp->shm_perm, S_IRUGO))
956                         goto out_unlock;
957
958                 err = security_shm_shmctl(shp, cmd);
959                 if (err)
960                         goto out_unlock;
961
962                 memset(&tbuf, 0, sizeof(tbuf));
963                 kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm);
964                 tbuf.shm_segsz  = shp->shm_segsz;
965                 tbuf.shm_atime  = shp->shm_atim;
966                 tbuf.shm_dtime  = shp->shm_dtim;
967                 tbuf.shm_ctime  = shp->shm_ctim;
968                 tbuf.shm_cpid   = shp->shm_cprid;
969                 tbuf.shm_lpid   = shp->shm_lprid;
970                 tbuf.shm_nattch = shp->shm_nattch;
971                 rcu_read_unlock();
972
973                 if (copy_shmid_to_user(buf, &tbuf, version))
974                         err = -EFAULT;
975                 else
976                         err = result;
977                 goto out;
978         }
979         default:
980                 return -EINVAL;
981         }
982
983 out_unlock:
984         rcu_read_unlock();
985 out:
986         return err;
987 }
988
989 SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
990 {
991         struct shmid_kernel *shp;
992         int err, version;
993         struct ipc_namespace *ns;
994
995         if (cmd < 0 || shmid < 0)
996                 return -EINVAL;
997
998         version = ipc_parse_version(&cmd);
999         ns = current->nsproxy->ipc_ns;
1000
1001         switch (cmd) {
1002         case IPC_INFO:
1003         case SHM_INFO:
1004         case SHM_STAT:
1005         case IPC_STAT:
1006                 return shmctl_nolock(ns, shmid, cmd, version, buf);
1007         case IPC_RMID:
1008         case IPC_SET:
1009                 return shmctl_down(ns, shmid, cmd, buf, version);
1010         case SHM_LOCK:
1011         case SHM_UNLOCK:
1012         {
1013                 struct file *shm_file;
1014
1015                 rcu_read_lock();
1016                 shp = shm_obtain_object_check(ns, shmid);
1017                 if (IS_ERR(shp)) {
1018                         err = PTR_ERR(shp);
1019                         goto out_unlock1;
1020                 }
1021
1022                 audit_ipc_obj(&(shp->shm_perm));
1023                 err = security_shm_shmctl(shp, cmd);
1024                 if (err)
1025                         goto out_unlock1;
1026
1027                 ipc_lock_object(&shp->shm_perm);
1028
1029                 /* check if shm_destroy() is tearing down shp */
1030                 if (!ipc_valid_object(&shp->shm_perm)) {
1031                         err = -EIDRM;
1032                         goto out_unlock0;
1033                 }
1034
1035                 if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
1036                         kuid_t euid = current_euid();
1037                         if (!uid_eq(euid, shp->shm_perm.uid) &&
1038                             !uid_eq(euid, shp->shm_perm.cuid)) {
1039                                 err = -EPERM;
1040                                 goto out_unlock0;
1041                         }
1042                         if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
1043                                 err = -EPERM;
1044                                 goto out_unlock0;
1045                         }
1046                 }
1047
1048                 shm_file = shp->shm_file;
1049                 if (is_file_hugepages(shm_file))
1050                         goto out_unlock0;
1051
1052                 if (cmd == SHM_LOCK) {
1053                         struct user_struct *user = current_user();
1054                         err = shmem_lock(shm_file, 1, user);
1055                         if (!err && !(shp->shm_perm.mode & SHM_LOCKED)) {
1056                                 shp->shm_perm.mode |= SHM_LOCKED;
1057                                 shp->mlock_user = user;
1058                         }
1059                         goto out_unlock0;
1060                 }
1061
1062                 /* SHM_UNLOCK */
1063                 if (!(shp->shm_perm.mode & SHM_LOCKED))
1064                         goto out_unlock0;
1065                 shmem_lock(shm_file, 0, shp->mlock_user);
1066                 shp->shm_perm.mode &= ~SHM_LOCKED;
1067                 shp->mlock_user = NULL;
1068                 get_file(shm_file);
1069                 ipc_unlock_object(&shp->shm_perm);
1070                 rcu_read_unlock();
1071                 shmem_unlock_mapping(shm_file->f_mapping);
1072
1073                 fput(shm_file);
1074                 return err;
1075         }
1076         default:
1077                 return -EINVAL;
1078         }
1079
1080 out_unlock0:
1081         ipc_unlock_object(&shp->shm_perm);
1082 out_unlock1:
1083         rcu_read_unlock();
1084         return err;
1085 }
1086
1087 /*
1088  * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
1089  *
1090  * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
1091  * "raddr" thing points to kernel space, and there has to be a wrapper around
1092  * this.
1093  */
1094 long do_shmat(int shmid, char __user *shmaddr, int shmflg,
1095               ulong *raddr, unsigned long shmlba)
1096 {
1097         struct shmid_kernel *shp;
1098         unsigned long addr;
1099         unsigned long size;
1100         struct file *file;
1101         int    err;
1102         unsigned long flags;
1103         unsigned long prot;
1104         int acc_mode;
1105         struct ipc_namespace *ns;
1106         struct shm_file_data *sfd;
1107         struct path path;
1108         fmode_t f_mode;
1109         unsigned long populate = 0;
1110
1111         err = -EINVAL;
1112         if (shmid < 0)
1113                 goto out;
1114         else if ((addr = (ulong)shmaddr)) {
1115                 if (addr & (shmlba - 1)) {
1116                         if (shmflg & SHM_RND) {
1117                                 addr &= ~(shmlba - 1);  /* round down */
1118
1119                                 /*
1120                                  * Ensure that the round-down is non-nil
1121                                  * when remapping. This can happen for
1122                                  * cases when addr < shmlba.
1123                                  */
1124                                 if (!addr && (shmflg & SHM_REMAP))
1125                                         goto out;
1126                         } else
1127 #ifndef __ARCH_FORCE_SHMLBA
1128                                 if (addr & ~PAGE_MASK)
1129 #endif
1130                                         goto out;
1131                 }
1132                 flags = MAP_SHARED | MAP_FIXED;
1133         } else {
1134                 if ((shmflg & SHM_REMAP))
1135                         goto out;
1136
1137                 flags = MAP_SHARED;
1138         }
1139
1140         if (shmflg & SHM_RDONLY) {
1141                 prot = PROT_READ;
1142                 acc_mode = S_IRUGO;
1143                 f_mode = FMODE_READ;
1144         } else {
1145                 prot = PROT_READ | PROT_WRITE;
1146                 acc_mode = S_IRUGO | S_IWUGO;
1147                 f_mode = FMODE_READ | FMODE_WRITE;
1148         }
1149         if (shmflg & SHM_EXEC) {
1150                 prot |= PROT_EXEC;
1151                 acc_mode |= S_IXUGO;
1152         }
1153
1154         /*
1155          * We cannot rely on the fs check since SYSV IPC does have an
1156          * additional creator id...
1157          */
1158         ns = current->nsproxy->ipc_ns;
1159         rcu_read_lock();
1160         shp = shm_obtain_object_check(ns, shmid);
1161         if (IS_ERR(shp)) {
1162                 err = PTR_ERR(shp);
1163                 goto out_unlock;
1164         }
1165
1166         err = -EACCES;
1167         if (ipcperms(ns, &shp->shm_perm, acc_mode))
1168                 goto out_unlock;
1169
1170         err = security_shm_shmat(shp, shmaddr, shmflg);
1171         if (err)
1172                 goto out_unlock;
1173
1174         ipc_lock_object(&shp->shm_perm);
1175
1176         /* check if shm_destroy() is tearing down shp */
1177         if (!ipc_valid_object(&shp->shm_perm)) {
1178                 ipc_unlock_object(&shp->shm_perm);
1179                 err = -EIDRM;
1180                 goto out_unlock;
1181         }
1182
1183         path = shp->shm_file->f_path;
1184         path_get(&path);
1185         shp->shm_nattch++;
1186         size = i_size_read(d_inode(path.dentry));
1187         ipc_unlock_object(&shp->shm_perm);
1188         rcu_read_unlock();
1189
1190         err = -ENOMEM;
1191         sfd = kzalloc(sizeof(*sfd), GFP_KERNEL);
1192         if (!sfd) {
1193                 path_put(&path);
1194                 goto out_nattch;
1195         }
1196
1197         file = alloc_file(&path, f_mode,
1198                           is_file_hugepages(shp->shm_file) ?
1199                                 &shm_file_operations_huge :
1200                                 &shm_file_operations);
1201         err = PTR_ERR(file);
1202         if (IS_ERR(file)) {
1203                 kfree(sfd);
1204                 path_put(&path);
1205                 goto out_nattch;
1206         }
1207
1208         file->private_data = sfd;
1209         file->f_mapping = shp->shm_file->f_mapping;
1210         sfd->id = shp->shm_perm.id;
1211         sfd->ns = get_ipc_ns(ns);
1212         /*
1213          * We need to take a reference to the real shm file to prevent the
1214          * pointer from becoming stale in cases where the lifetime of the outer
1215          * file extends beyond that of the shm segment.  It's not usually
1216          * possible, but it can happen during remap_file_pages() emulation as
1217          * that unmaps the memory, then does ->mmap() via file reference only.
1218          * We'll deny the ->mmap() if the shm segment was since removed, but to
1219          * detect shm ID reuse we need to compare the file pointers.
1220          */
1221         sfd->file = get_file(shp->shm_file);
1222         sfd->vm_ops = NULL;
1223
1224         err = security_mmap_file(file, prot, flags);
1225         if (err)
1226                 goto out_fput;
1227
1228         down_write(&current->mm->mmap_sem);
1229         if (addr && !(shmflg & SHM_REMAP)) {
1230                 err = -EINVAL;
1231                 if (addr + size < addr)
1232                         goto invalid;
1233
1234                 if (find_vma_intersection(current->mm, addr, addr + size))
1235                         goto invalid;
1236         }
1237
1238         addr = do_mmap_pgoff(file, addr, size, prot, flags, 0, &populate);
1239         *raddr = addr;
1240         err = 0;
1241         if (IS_ERR_VALUE(addr))
1242                 err = (long)addr;
1243 invalid:
1244         up_write(&current->mm->mmap_sem);
1245         if (populate)
1246                 mm_populate(addr, populate);
1247
1248 out_fput:
1249         fput(file);
1250
1251 out_nattch:
1252         down_write(&shm_ids(ns).rwsem);
1253         shp = shm_lock(ns, shmid);
1254         shp->shm_nattch--;
1255         if (shm_may_destroy(ns, shp))
1256                 shm_destroy(ns, shp);
1257         else
1258                 shm_unlock(shp);
1259         up_write(&shm_ids(ns).rwsem);
1260         return err;
1261
1262 out_unlock:
1263         rcu_read_unlock();
1264 out:
1265         return err;
1266 }
1267
1268 SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
1269 {
1270         unsigned long ret;
1271         long err;
1272
1273         err = do_shmat(shmid, shmaddr, shmflg, &ret, SHMLBA);
1274         if (err)
1275                 return err;
1276         force_successful_syscall_return();
1277         return (long)ret;
1278 }
1279
1280 /*
1281  * detach and kill segment if marked destroyed.
1282  * The work is done in shm_close.
1283  */
1284 SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
1285 {
1286         struct mm_struct *mm = current->mm;
1287         struct vm_area_struct *vma;
1288         unsigned long addr = (unsigned long)shmaddr;
1289         int retval = -EINVAL;
1290 #ifdef CONFIG_MMU
1291         loff_t size = 0;
1292         struct file *file;
1293         struct vm_area_struct *next;
1294 #endif
1295
1296         if (addr & ~PAGE_MASK)
1297                 return retval;
1298
1299         down_write(&mm->mmap_sem);
1300
1301         /*
1302          * This function tries to be smart and unmap shm segments that
1303          * were modified by partial mlock or munmap calls:
1304          * - It first determines the size of the shm segment that should be
1305          *   unmapped: It searches for a vma that is backed by shm and that
1306          *   started at address shmaddr. It records it's size and then unmaps
1307          *   it.
1308          * - Then it unmaps all shm vmas that started at shmaddr and that
1309          *   are within the initially determined size and that are from the
1310          *   same shm segment from which we determined the size.
1311          * Errors from do_munmap are ignored: the function only fails if
1312          * it's called with invalid parameters or if it's called to unmap
1313          * a part of a vma. Both calls in this function are for full vmas,
1314          * the parameters are directly copied from the vma itself and always
1315          * valid - therefore do_munmap cannot fail. (famous last words?)
1316          */
1317         /*
1318          * If it had been mremap()'d, the starting address would not
1319          * match the usual checks anyway. So assume all vma's are
1320          * above the starting address given.
1321          */
1322         vma = find_vma(mm, addr);
1323
1324 #ifdef CONFIG_MMU
1325         while (vma) {
1326                 next = vma->vm_next;
1327
1328                 /*
1329                  * Check if the starting address would match, i.e. it's
1330                  * a fragment created by mprotect() and/or munmap(), or it
1331                  * otherwise it starts at this address with no hassles.
1332                  */
1333                 if ((vma->vm_ops == &shm_vm_ops) &&
1334                         (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) {
1335
1336                         /*
1337                          * Record the file of the shm segment being
1338                          * unmapped.  With mremap(), someone could place
1339                          * page from another segment but with equal offsets
1340                          * in the range we are unmapping.
1341                          */
1342                         file = vma->vm_file;
1343                         size = i_size_read(file_inode(vma->vm_file));
1344                         do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1345                         /*
1346                          * We discovered the size of the shm segment, so
1347                          * break out of here and fall through to the next
1348                          * loop that uses the size information to stop
1349                          * searching for matching vma's.
1350                          */
1351                         retval = 0;
1352                         vma = next;
1353                         break;
1354                 }
1355                 vma = next;
1356         }
1357
1358         /*
1359          * We need look no further than the maximum address a fragment
1360          * could possibly have landed at. Also cast things to loff_t to
1361          * prevent overflows and make comparisons vs. equal-width types.
1362          */
1363         size = PAGE_ALIGN(size);
1364         while (vma && (loff_t)(vma->vm_end - addr) <= size) {
1365                 next = vma->vm_next;
1366
1367                 /* finding a matching vma now does not alter retval */
1368                 if ((vma->vm_ops == &shm_vm_ops) &&
1369                     ((vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) &&
1370                     (vma->vm_file == file))
1371                         do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1372                 vma = next;
1373         }
1374
1375 #else /* CONFIG_MMU */
1376         /* under NOMMU conditions, the exact address to be destroyed must be
1377          * given */
1378         if (vma && vma->vm_start == addr && vma->vm_ops == &shm_vm_ops) {
1379                 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1380                 retval = 0;
1381         }
1382
1383 #endif
1384
1385         up_write(&mm->mmap_sem);
1386         return retval;
1387 }
1388
1389 #ifdef CONFIG_PROC_FS
1390 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
1391 {
1392         struct user_namespace *user_ns = seq_user_ns(s);
1393         struct shmid_kernel *shp = it;
1394         unsigned long rss = 0, swp = 0;
1395
1396         shm_add_rss_swap(shp, &rss, &swp);
1397
1398 #if BITS_PER_LONG <= 32
1399 #define SIZE_SPEC "%10lu"
1400 #else
1401 #define SIZE_SPEC "%21lu"
1402 #endif
1403
1404         seq_printf(s,
1405                    "%10d %10d  %4o " SIZE_SPEC " %5u %5u  "
1406                    "%5lu %5u %5u %5u %5u %10lu %10lu %10lu "
1407                    SIZE_SPEC " " SIZE_SPEC "\n",
1408                    shp->shm_perm.key,
1409                    shp->shm_perm.id,
1410                    shp->shm_perm.mode,
1411                    shp->shm_segsz,
1412                    shp->shm_cprid,
1413                    shp->shm_lprid,
1414                    shp->shm_nattch,
1415                    from_kuid_munged(user_ns, shp->shm_perm.uid),
1416                    from_kgid_munged(user_ns, shp->shm_perm.gid),
1417                    from_kuid_munged(user_ns, shp->shm_perm.cuid),
1418                    from_kgid_munged(user_ns, shp->shm_perm.cgid),
1419                    shp->shm_atim,
1420                    shp->shm_dtim,
1421                    shp->shm_ctim,
1422                    rss * PAGE_SIZE,
1423                    swp * PAGE_SIZE);
1424
1425         return 0;
1426 }
1427 #endif