1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24#include <linux/slab.h>
25#include <linux/mm.h>
26#include <linux/hugetlb.h>
27#include <linux/shm.h>
28#include <linux/init.h>
29#include <linux/file.h>
30#include <linux/mman.h>
31#include <linux/shmem_fs.h>
32#include <linux/security.h>
33#include <linux/syscalls.h>
34#include <linux/audit.h>
35#include <linux/capability.h>
36#include <linux/ptrace.h>
37#include <linux/seq_file.h>
38#include <linux/rwsem.h>
39#include <linux/nsproxy.h>
40#include <linux/mount.h>
41#include <linux/ipc_namespace.h>
42#include <linux/ima.h>
43
44#include <asm/uaccess.h>
45
46#include "util.h"
47
48struct shm_file_data {
49 int id;
50 struct ipc_namespace *ns;
51 struct file *file;
52 const struct vm_operations_struct *vm_ops;
53};
54
55#define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data))
56
57static const struct file_operations shm_file_operations;
58static struct vm_operations_struct shm_vm_ops;
59
60#define shm_ids(ns) ((ns)->ids[IPC_SHM_IDS])
61
62#define shm_unlock(shp) \
63 ipc_unlock(&(shp)->shm_perm)
64
65static int newseg(struct ipc_namespace *, struct ipc_params *);
66static void shm_open(struct vm_area_struct *vma);
67static void shm_close(struct vm_area_struct *vma);
68static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
69#ifdef CONFIG_PROC_FS
70static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
71#endif
72
73void shm_init_ns(struct ipc_namespace *ns)
74{
75 ns->shm_ctlmax = SHMMAX;
76 ns->shm_ctlall = SHMALL;
77 ns->shm_ctlmni = SHMMNI;
78 ns->shm_tot = 0;
79 ipc_init_ids(&shm_ids(ns));
80}
81
82
83
84
85
86static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
87{
88 struct shmid_kernel *shp;
89 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
90
91 if (shp->shm_nattch){
92 shp->shm_perm.mode |= SHM_DEST;
93
94 shp->shm_perm.key = IPC_PRIVATE;
95 shm_unlock(shp);
96 } else
97 shm_destroy(ns, shp);
98}
99
100#ifdef CONFIG_IPC_NS
101void shm_exit_ns(struct ipc_namespace *ns)
102{
103 free_ipcs(ns, &shm_ids(ns), do_shm_rmid);
104}
105#endif
106
107void __init shm_init (void)
108{
109 shm_init_ns(&init_ipc_ns);
110 ipc_init_proc_interface("sysvipc/shm",
111 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime\n",
112 IPC_SHM_IDS, sysvipc_shm_proc_show);
113}
114
115
116
117
118
119static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
120{
121 struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id);
122
123 if (IS_ERR(ipcp))
124 return (struct shmid_kernel *)ipcp;
125
126 return container_of(ipcp, struct shmid_kernel, shm_perm);
127}
128
129static inline struct shmid_kernel *shm_lock_check(struct ipc_namespace *ns,
130 int id)
131{
132 struct kern_ipc_perm *ipcp = ipc_lock_check(&shm_ids(ns), id);
133
134 if (IS_ERR(ipcp))
135 return (struct shmid_kernel *)ipcp;
136
137 return container_of(ipcp, struct shmid_kernel, shm_perm);
138}
139
140static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s)
141{
142 ipc_rmid(&shm_ids(ns), &s->shm_perm);
143}
144
145
146
147static void shm_open(struct vm_area_struct *vma)
148{
149 struct file *file = vma->vm_file;
150 struct shm_file_data *sfd = shm_file_data(file);
151 struct shmid_kernel *shp;
152
153 shp = shm_lock(sfd->ns, sfd->id);
154 BUG_ON(IS_ERR(shp));
155 shp->shm_atim = get_seconds();
156 shp->shm_lprid = task_tgid_vnr(current);
157 shp->shm_nattch++;
158 shm_unlock(shp);
159}
160
161
162
163
164
165
166
167
168
169
170static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
171{
172 ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
173 shm_rmid(ns, shp);
174 shm_unlock(shp);
175 if (!is_file_hugepages(shp->shm_file))
176 shmem_lock(shp->shm_file, 0, shp->mlock_user);
177 else if (shp->mlock_user)
178 user_shm_unlock(shp->shm_file->f_path.dentry->d_inode->i_size,
179 shp->mlock_user);
180 fput (shp->shm_file);
181 security_shm_free(shp);
182 ipc_rcu_putref(shp);
183}
184
185
186
187
188
189
190
191static void shm_close(struct vm_area_struct *vma)
192{
193 struct file * file = vma->vm_file;
194 struct shm_file_data *sfd = shm_file_data(file);
195 struct shmid_kernel *shp;
196 struct ipc_namespace *ns = sfd->ns;
197
198 down_write(&shm_ids(ns).rw_mutex);
199
200 shp = shm_lock(ns, sfd->id);
201 BUG_ON(IS_ERR(shp));
202 shp->shm_lprid = task_tgid_vnr(current);
203 shp->shm_dtim = get_seconds();
204 shp->shm_nattch--;
205 if(shp->shm_nattch == 0 &&
206 shp->shm_perm.mode & SHM_DEST)
207 shm_destroy(ns, shp);
208 else
209 shm_unlock(shp);
210 up_write(&shm_ids(ns).rw_mutex);
211}
212
213static int shm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
214{
215 struct file *file = vma->vm_file;
216 struct shm_file_data *sfd = shm_file_data(file);
217
218 return sfd->vm_ops->fault(vma, vmf);
219}
220
221#ifdef CONFIG_NUMA
222static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
223{
224 struct file *file = vma->vm_file;
225 struct shm_file_data *sfd = shm_file_data(file);
226 int err = 0;
227 if (sfd->vm_ops->set_policy)
228 err = sfd->vm_ops->set_policy(vma, new);
229 return err;
230}
231
232static struct mempolicy *shm_get_policy(struct vm_area_struct *vma,
233 unsigned long addr)
234{
235 struct file *file = vma->vm_file;
236 struct shm_file_data *sfd = shm_file_data(file);
237 struct mempolicy *pol = NULL;
238
239 if (sfd->vm_ops->get_policy)
240 pol = sfd->vm_ops->get_policy(vma, addr);
241 else if (vma->vm_policy)
242 pol = vma->vm_policy;
243
244 return pol;
245}
246#endif
247
248static int shm_mmap(struct file * file, struct vm_area_struct * vma)
249{
250 struct shm_file_data *sfd = shm_file_data(file);
251 int ret;
252
253 ret = sfd->file->f_op->mmap(sfd->file, vma);
254 if (ret != 0)
255 return ret;
256 sfd->vm_ops = vma->vm_ops;
257#ifdef CONFIG_MMU
258 BUG_ON(!sfd->vm_ops->fault);
259#endif
260 vma->vm_ops = &shm_vm_ops;
261 shm_open(vma);
262
263 return ret;
264}
265
266static int shm_release(struct inode *ino, struct file *file)
267{
268 struct shm_file_data *sfd = shm_file_data(file);
269
270 put_ipc_ns(sfd->ns);
271 shm_file_data(file) = NULL;
272 kfree(sfd);
273 return 0;
274}
275
276static int shm_fsync(struct file *file, struct dentry *dentry, int datasync)
277{
278 int (*fsync) (struct file *, struct dentry *, int datasync);
279 struct shm_file_data *sfd = shm_file_data(file);
280 int ret = -EINVAL;
281
282 fsync = sfd->file->f_op->fsync;
283 if (fsync)
284 ret = fsync(sfd->file, sfd->file->f_path.dentry, datasync);
285 return ret;
286}
287
288static unsigned long shm_get_unmapped_area(struct file *file,
289 unsigned long addr, unsigned long len, unsigned long pgoff,
290 unsigned long flags)
291{
292 struct shm_file_data *sfd = shm_file_data(file);
293 return get_unmapped_area(sfd->file, addr, len, pgoff, flags);
294}
295
296int is_file_shm_hugepages(struct file *file)
297{
298 int ret = 0;
299
300 if (file->f_op == &shm_file_operations) {
301 struct shm_file_data *sfd;
302 sfd = shm_file_data(file);
303 ret = is_file_hugepages(sfd->file);
304 }
305 return ret;
306}
307
308static const struct file_operations shm_file_operations = {
309 .mmap = shm_mmap,
310 .fsync = shm_fsync,
311 .release = shm_release,
312 .get_unmapped_area = shm_get_unmapped_area,
313};
314
315static struct vm_operations_struct shm_vm_ops = {
316 .open = shm_open,
317 .close = shm_close,
318 .fault = shm_fault,
319#if defined(CONFIG_NUMA)
320 .set_policy = shm_set_policy,
321 .get_policy = shm_get_policy,
322#endif
323};
324
325
326
327
328
329
330
331
332
333static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
334{
335 key_t key = params->key;
336 int shmflg = params->flg;
337 size_t size = params->u.size;
338 int error;
339 struct shmid_kernel *shp;
340 int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
341 struct file * file;
342 char name[13];
343 int id;
344 int acctflag = 0;
345
346 if (size < SHMMIN || size > ns->shm_ctlmax)
347 return -EINVAL;
348
349 if (ns->shm_tot + numpages > ns->shm_ctlall)
350 return -ENOSPC;
351
352 shp = ipc_rcu_alloc(sizeof(*shp));
353 if (!shp)
354 return -ENOMEM;
355
356 shp->shm_perm.key = key;
357 shp->shm_perm.mode = (shmflg & S_IRWXUGO);
358 shp->mlock_user = NULL;
359
360 shp->shm_perm.security = NULL;
361 error = security_shm_alloc(shp);
362 if (error) {
363 ipc_rcu_putref(shp);
364 return error;
365 }
366
367 sprintf (name, "SYSV%08x", key);
368 if (shmflg & SHM_HUGETLB) {
369
370 if (shmflg & SHM_NORESERVE)
371 acctflag = VM_NORESERVE;
372 file = hugetlb_file_setup(name, size, acctflag,
373 &shp->mlock_user);
374 } else {
375
376
377
378
379 if ((shmflg & SHM_NORESERVE) &&
380 sysctl_overcommit_memory != OVERCOMMIT_NEVER)
381 acctflag = VM_NORESERVE;
382 file = shmem_file_setup(name, size, acctflag);
383 }
384 error = PTR_ERR(file);
385 if (IS_ERR(file))
386 goto no_file;
387 ima_shm_check(file);
388
389 id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
390 if (id < 0) {
391 error = id;
392 goto no_id;
393 }
394
395 shp->shm_cprid = task_tgid_vnr(current);
396 shp->shm_lprid = 0;
397 shp->shm_atim = shp->shm_dtim = 0;
398 shp->shm_ctim = get_seconds();
399 shp->shm_segsz = size;
400 shp->shm_nattch = 0;
401 shp->shm_file = file;
402
403
404
405
406 file->f_dentry->d_inode->i_ino = shp->shm_perm.id;
407
408 ns->shm_tot += numpages;
409 error = shp->shm_perm.id;
410 shm_unlock(shp);
411 return error;
412
413no_id:
414 if (shp->mlock_user)
415 user_shm_unlock(size, shp->mlock_user);
416 fput(file);
417no_file:
418 security_shm_free(shp);
419 ipc_rcu_putref(shp);
420 return error;
421}
422
423
424
425
426static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg)
427{
428 struct shmid_kernel *shp;
429
430 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
431 return security_shm_associate(shp, shmflg);
432}
433
434
435
436
437static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
438 struct ipc_params *params)
439{
440 struct shmid_kernel *shp;
441
442 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
443 if (shp->shm_segsz < params->u.size)
444 return -EINVAL;
445
446 return 0;
447}
448
449SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
450{
451 struct ipc_namespace *ns;
452 struct ipc_ops shm_ops;
453 struct ipc_params shm_params;
454
455 ns = current->nsproxy->ipc_ns;
456
457 shm_ops.getnew = newseg;
458 shm_ops.associate = shm_security;
459 shm_ops.more_checks = shm_more_checks;
460
461 shm_params.key = key;
462 shm_params.flg = shmflg;
463 shm_params.u.size = size;
464
465 return ipcget(ns, &shm_ids(ns), &shm_ops, &shm_params);
466}
467
468static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
469{
470 switch(version) {
471 case IPC_64:
472 return copy_to_user(buf, in, sizeof(*in));
473 case IPC_OLD:
474 {
475 struct shmid_ds out;
476
477 ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
478 out.shm_segsz = in->shm_segsz;
479 out.shm_atime = in->shm_atime;
480 out.shm_dtime = in->shm_dtime;
481 out.shm_ctime = in->shm_ctime;
482 out.shm_cpid = in->shm_cpid;
483 out.shm_lpid = in->shm_lpid;
484 out.shm_nattch = in->shm_nattch;
485
486 return copy_to_user(buf, &out, sizeof(out));
487 }
488 default:
489 return -EINVAL;
490 }
491}
492
493static inline unsigned long
494copy_shmid_from_user(struct shmid64_ds *out, void __user *buf, int version)
495{
496 switch(version) {
497 case IPC_64:
498 if (copy_from_user(out, buf, sizeof(*out)))
499 return -EFAULT;
500 return 0;
501 case IPC_OLD:
502 {
503 struct shmid_ds tbuf_old;
504
505 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
506 return -EFAULT;
507
508 out->shm_perm.uid = tbuf_old.shm_perm.uid;
509 out->shm_perm.gid = tbuf_old.shm_perm.gid;
510 out->shm_perm.mode = tbuf_old.shm_perm.mode;
511
512 return 0;
513 }
514 default:
515 return -EINVAL;
516 }
517}
518
519static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
520{
521 switch(version) {
522 case IPC_64:
523 return copy_to_user(buf, in, sizeof(*in));
524 case IPC_OLD:
525 {
526 struct shminfo out;
527
528 if(in->shmmax > INT_MAX)
529 out.shmmax = INT_MAX;
530 else
531 out.shmmax = (int)in->shmmax;
532
533 out.shmmin = in->shmmin;
534 out.shmmni = in->shmmni;
535 out.shmseg = in->shmseg;
536 out.shmall = in->shmall;
537
538 return copy_to_user(buf, &out, sizeof(out));
539 }
540 default:
541 return -EINVAL;
542 }
543}
544
545
546
547
548static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
549 unsigned long *swp)
550{
551 int next_id;
552 int total, in_use;
553
554 *rss = 0;
555 *swp = 0;
556
557 in_use = shm_ids(ns).in_use;
558
559 for (total = 0, next_id = 0; total < in_use; next_id++) {
560 struct kern_ipc_perm *ipc;
561 struct shmid_kernel *shp;
562 struct inode *inode;
563
564 ipc = idr_find(&shm_ids(ns).ipcs_idr, next_id);
565 if (ipc == NULL)
566 continue;
567 shp = container_of(ipc, struct shmid_kernel, shm_perm);
568
569 inode = shp->shm_file->f_path.dentry->d_inode;
570
571 if (is_file_hugepages(shp->shm_file)) {
572 struct address_space *mapping = inode->i_mapping;
573 struct hstate *h = hstate_file(shp->shm_file);
574 *rss += pages_per_huge_page(h) * mapping->nrpages;
575 } else {
576#ifdef CONFIG_SHMEM
577 struct shmem_inode_info *info = SHMEM_I(inode);
578 spin_lock(&info->lock);
579 *rss += inode->i_mapping->nrpages;
580 *swp += info->swapped;
581 spin_unlock(&info->lock);
582#else
583 *rss += inode->i_mapping->nrpages;
584#endif
585 }
586
587 total++;
588 }
589}
590
591
592
593
594
595
596static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
597 struct shmid_ds __user *buf, int version)
598{
599 struct kern_ipc_perm *ipcp;
600 struct shmid64_ds shmid64;
601 struct shmid_kernel *shp;
602 int err;
603
604 if (cmd == IPC_SET) {
605 if (copy_shmid_from_user(&shmid64, buf, version))
606 return -EFAULT;
607 }
608
609 ipcp = ipcctl_pre_down(&shm_ids(ns), shmid, cmd, &shmid64.shm_perm, 0);
610 if (IS_ERR(ipcp))
611 return PTR_ERR(ipcp);
612
613 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
614
615 err = security_shm_shmctl(shp, cmd);
616 if (err)
617 goto out_unlock;
618 switch (cmd) {
619 case IPC_RMID:
620 do_shm_rmid(ns, ipcp);
621 goto out_up;
622 case IPC_SET:
623 ipc_update_perm(&shmid64.shm_perm, ipcp);
624 shp->shm_ctim = get_seconds();
625 break;
626 default:
627 err = -EINVAL;
628 }
629out_unlock:
630 shm_unlock(shp);
631out_up:
632 up_write(&shm_ids(ns).rw_mutex);
633 return err;
634}
635
636SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
637{
638 struct shmid_kernel *shp;
639 int err, version;
640 struct ipc_namespace *ns;
641
642 if (cmd < 0 || shmid < 0) {
643 err = -EINVAL;
644 goto out;
645 }
646
647 version = ipc_parse_version(&cmd);
648 ns = current->nsproxy->ipc_ns;
649
650 switch (cmd) {
651 case IPC_INFO:
652 {
653 struct shminfo64 shminfo;
654
655 err = security_shm_shmctl(NULL, cmd);
656 if (err)
657 return err;
658
659 memset(&shminfo, 0, sizeof(shminfo));
660 shminfo.shmmni = shminfo.shmseg = ns->shm_ctlmni;
661 shminfo.shmmax = ns->shm_ctlmax;
662 shminfo.shmall = ns->shm_ctlall;
663
664 shminfo.shmmin = SHMMIN;
665 if(copy_shminfo_to_user (buf, &shminfo, version))
666 return -EFAULT;
667
668 down_read(&shm_ids(ns).rw_mutex);
669 err = ipc_get_maxid(&shm_ids(ns));
670 up_read(&shm_ids(ns).rw_mutex);
671
672 if(err<0)
673 err = 0;
674 goto out;
675 }
676 case SHM_INFO:
677 {
678 struct shm_info shm_info;
679
680 err = security_shm_shmctl(NULL, cmd);
681 if (err)
682 return err;
683
684 memset(&shm_info, 0, sizeof(shm_info));
685 down_read(&shm_ids(ns).rw_mutex);
686 shm_info.used_ids = shm_ids(ns).in_use;
687 shm_get_stat (ns, &shm_info.shm_rss, &shm_info.shm_swp);
688 shm_info.shm_tot = ns->shm_tot;
689 shm_info.swap_attempts = 0;
690 shm_info.swap_successes = 0;
691 err = ipc_get_maxid(&shm_ids(ns));
692 up_read(&shm_ids(ns).rw_mutex);
693 if (copy_to_user(buf, &shm_info, sizeof(shm_info))) {
694 err = -EFAULT;
695 goto out;
696 }
697
698 err = err < 0 ? 0 : err;
699 goto out;
700 }
701 case SHM_STAT:
702 case IPC_STAT:
703 {
704 struct shmid64_ds tbuf;
705 int result;
706
707 if (cmd == SHM_STAT) {
708 shp = shm_lock(ns, shmid);
709 if (IS_ERR(shp)) {
710 err = PTR_ERR(shp);
711 goto out;
712 }
713 result = shp->shm_perm.id;
714 } else {
715 shp = shm_lock_check(ns, shmid);
716 if (IS_ERR(shp)) {
717 err = PTR_ERR(shp);
718 goto out;
719 }
720 result = 0;
721 }
722 err = -EACCES;
723 if (ipcperms (&shp->shm_perm, S_IRUGO))
724 goto out_unlock;
725 err = security_shm_shmctl(shp, cmd);
726 if (err)
727 goto out_unlock;
728 memset(&tbuf, 0, sizeof(tbuf));
729 kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm);
730 tbuf.shm_segsz = shp->shm_segsz;
731 tbuf.shm_atime = shp->shm_atim;
732 tbuf.shm_dtime = shp->shm_dtim;
733 tbuf.shm_ctime = shp->shm_ctim;
734 tbuf.shm_cpid = shp->shm_cprid;
735 tbuf.shm_lpid = shp->shm_lprid;
736 tbuf.shm_nattch = shp->shm_nattch;
737 shm_unlock(shp);
738 if(copy_shmid_to_user (buf, &tbuf, version))
739 err = -EFAULT;
740 else
741 err = result;
742 goto out;
743 }
744 case SHM_LOCK:
745 case SHM_UNLOCK:
746 {
747 struct file *uninitialized_var(shm_file);
748
749 lru_add_drain_all();
750
751 shp = shm_lock_check(ns, shmid);
752 if (IS_ERR(shp)) {
753 err = PTR_ERR(shp);
754 goto out;
755 }
756
757 audit_ipc_obj(&(shp->shm_perm));
758
759 if (!capable(CAP_IPC_LOCK)) {
760 uid_t euid = current_euid();
761 err = -EPERM;
762 if (euid != shp->shm_perm.uid &&
763 euid != shp->shm_perm.cuid)
764 goto out_unlock;
765 if (cmd == SHM_LOCK &&
766 !current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur)
767 goto out_unlock;
768 }
769
770 err = security_shm_shmctl(shp, cmd);
771 if (err)
772 goto out_unlock;
773
774 if(cmd==SHM_LOCK) {
775 struct user_struct *user = current_user();
776 if (!is_file_hugepages(shp->shm_file)) {
777 err = shmem_lock(shp->shm_file, 1, user);
778 if (!err && !(shp->shm_perm.mode & SHM_LOCKED)){
779 shp->shm_perm.mode |= SHM_LOCKED;
780 shp->mlock_user = user;
781 }
782 }
783 } else if (!is_file_hugepages(shp->shm_file)) {
784 shmem_lock(shp->shm_file, 0, shp->mlock_user);
785 shp->shm_perm.mode &= ~SHM_LOCKED;
786 shp->mlock_user = NULL;
787 }
788 shm_unlock(shp);
789 goto out;
790 }
791 case IPC_RMID:
792 case IPC_SET:
793 err = shmctl_down(ns, shmid, cmd, buf, version);
794 return err;
795 default:
796 return -EINVAL;
797 }
798
799out_unlock:
800 shm_unlock(shp);
801out:
802 return err;
803}
804
805
806
807
808
809
810
811
812long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
813{
814 struct shmid_kernel *shp;
815 unsigned long addr;
816 unsigned long size;
817 struct file * file;
818 int err;
819 unsigned long flags;
820 unsigned long prot;
821 int acc_mode;
822 unsigned long user_addr;
823 struct ipc_namespace *ns;
824 struct shm_file_data *sfd;
825 struct path path;
826 fmode_t f_mode;
827
828 err = -EINVAL;
829 if (shmid < 0)
830 goto out;
831 else if ((addr = (ulong)shmaddr)) {
832 if (addr & (SHMLBA-1)) {
833 if (shmflg & SHM_RND)
834 addr &= ~(SHMLBA-1);
835 else
836#ifndef __ARCH_FORCE_SHMLBA
837 if (addr & ~PAGE_MASK)
838#endif
839 goto out;
840 }
841 flags = MAP_SHARED | MAP_FIXED;
842 } else {
843 if ((shmflg & SHM_REMAP))
844 goto out;
845
846 flags = MAP_SHARED;
847 }
848
849 if (shmflg & SHM_RDONLY) {
850 prot = PROT_READ;
851 acc_mode = S_IRUGO;
852 f_mode = FMODE_READ;
853 } else {
854 prot = PROT_READ | PROT_WRITE;
855 acc_mode = S_IRUGO | S_IWUGO;
856 f_mode = FMODE_READ | FMODE_WRITE;
857 }
858 if (shmflg & SHM_EXEC) {
859 prot |= PROT_EXEC;
860 acc_mode |= S_IXUGO;
861 }
862
863
864
865
866
867 ns = current->nsproxy->ipc_ns;
868 shp = shm_lock_check(ns, shmid);
869 if (IS_ERR(shp)) {
870 err = PTR_ERR(shp);
871 goto out;
872 }
873
874 err = -EACCES;
875 if (ipcperms(&shp->shm_perm, acc_mode))
876 goto out_unlock;
877
878 err = security_shm_shmat(shp, shmaddr, shmflg);
879 if (err)
880 goto out_unlock;
881
882 path.dentry = dget(shp->shm_file->f_path.dentry);
883 path.mnt = shp->shm_file->f_path.mnt;
884 shp->shm_nattch++;
885 size = i_size_read(path.dentry->d_inode);
886 shm_unlock(shp);
887
888 err = -ENOMEM;
889 sfd = kzalloc(sizeof(*sfd), GFP_KERNEL);
890 if (!sfd)
891 goto out_put_dentry;
892
893 file = alloc_file(path.mnt, path.dentry, f_mode, &shm_file_operations);
894 if (!file)
895 goto out_free;
896 ima_shm_check(file);
897
898 file->private_data = sfd;
899 file->f_mapping = shp->shm_file->f_mapping;
900 sfd->id = shp->shm_perm.id;
901 sfd->ns = get_ipc_ns(ns);
902 sfd->file = shp->shm_file;
903 sfd->vm_ops = NULL;
904
905 down_write(¤t->mm->mmap_sem);
906 if (addr && !(shmflg & SHM_REMAP)) {
907 err = -EINVAL;
908 if (find_vma_intersection(current->mm, addr, addr + size))
909 goto invalid;
910
911
912
913
914 if (addr < current->mm->start_stack &&
915 addr > current->mm->start_stack - size - PAGE_SIZE * 5)
916 goto invalid;
917 }
918
919 user_addr = do_mmap (file, addr, size, prot, flags, 0);
920 *raddr = user_addr;
921 err = 0;
922 if (IS_ERR_VALUE(user_addr))
923 err = (long)user_addr;
924invalid:
925 up_write(¤t->mm->mmap_sem);
926
927 fput(file);
928
929out_nattch:
930 down_write(&shm_ids(ns).rw_mutex);
931 shp = shm_lock(ns, shmid);
932 BUG_ON(IS_ERR(shp));
933 shp->shm_nattch--;
934 if(shp->shm_nattch == 0 &&
935 shp->shm_perm.mode & SHM_DEST)
936 shm_destroy(ns, shp);
937 else
938 shm_unlock(shp);
939 up_write(&shm_ids(ns).rw_mutex);
940
941out:
942 return err;
943
944out_unlock:
945 shm_unlock(shp);
946 goto out;
947
948out_free:
949 kfree(sfd);
950out_put_dentry:
951 dput(path.dentry);
952 goto out_nattch;
953}
954
955SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
956{
957 unsigned long ret;
958 long err;
959
960 err = do_shmat(shmid, shmaddr, shmflg, &ret);
961 if (err)
962 return err;
963 force_successful_syscall_return();
964 return (long)ret;
965}
966
967
968
969
970
971SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
972{
973 struct mm_struct *mm = current->mm;
974 struct vm_area_struct *vma;
975 unsigned long addr = (unsigned long)shmaddr;
976 int retval = -EINVAL;
977#ifdef CONFIG_MMU
978 loff_t size = 0;
979 struct vm_area_struct *next;
980#endif
981
982 if (addr & ~PAGE_MASK)
983 return retval;
984
985 down_write(&mm->mmap_sem);
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007 vma = find_vma(mm, addr);
1008
1009#ifdef CONFIG_MMU
1010 while (vma) {
1011 next = vma->vm_next;
1012
1013
1014
1015
1016
1017
1018 if ((vma->vm_ops == &shm_vm_ops) &&
1019 (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) {
1020
1021
1022 size = vma->vm_file->f_path.dentry->d_inode->i_size;
1023 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1024
1025
1026
1027
1028
1029
1030 retval = 0;
1031 vma = next;
1032 break;
1033 }
1034 vma = next;
1035 }
1036
1037
1038
1039
1040
1041
1042 size = PAGE_ALIGN(size);
1043 while (vma && (loff_t)(vma->vm_end - addr) <= size) {
1044 next = vma->vm_next;
1045
1046
1047 if ((vma->vm_ops == &shm_vm_ops) &&
1048 (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff)
1049
1050 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1051 vma = next;
1052 }
1053
1054#else
1055
1056
1057 retval = -EINVAL;
1058 if (vma->vm_start == addr && vma->vm_ops == &shm_vm_ops) {
1059 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1060 retval = 0;
1061 }
1062
1063#endif
1064
1065 up_write(&mm->mmap_sem);
1066 return retval;
1067}
1068
1069#ifdef CONFIG_PROC_FS
1070static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
1071{
1072 struct shmid_kernel *shp = it;
1073
1074#if BITS_PER_LONG <= 32
1075#define SIZE_SPEC "%10lu"
1076#else
1077#define SIZE_SPEC "%21lu"
1078#endif
1079
1080 return seq_printf(s,
1081 "%10d %10d %4o " SIZE_SPEC " %5u %5u "
1082 "%5lu %5u %5u %5u %5u %10lu %10lu %10lu\n",
1083 shp->shm_perm.key,
1084 shp->shm_perm.id,
1085 shp->shm_perm.mode,
1086 shp->shm_segsz,
1087 shp->shm_cprid,
1088 shp->shm_lprid,
1089 shp->shm_nattch,
1090 shp->shm_perm.uid,
1091 shp->shm_perm.gid,
1092 shp->shm_perm.cuid,
1093 shp->shm_perm.cgid,
1094 shp->shm_atim,
1095 shp->shm_dtim,
1096 shp->shm_ctim);
1097}
1098#endif
1099