^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * linux/ipc/shm.c
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Copyright (C) 1992, 1993 Krishna Balasubramanian
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Many improvements/fixes by Bruno Haible.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) * support for audit of ipc object properties and permission changes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) * Dustin Kirkland <dustin.kirkland@us.ibm.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) * namespaces support
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) * OpenVZ, SWsoft Inc.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) * Pavel Emelianov <xemul@openvz.org>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) * Better ipc lock (kern_ipc_perm.lock) handling
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) * Davidlohr Bueso <davidlohr.bueso@hp.com>, June 2013.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) #include <linux/mm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) #include <linux/hugetlb.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) #include <linux/shm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) #include <linux/init.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) #include <linux/file.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) #include <linux/mman.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) #include <linux/shmem_fs.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) #include <linux/security.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) #include <linux/syscalls.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) #include <linux/audit.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) #include <linux/capability.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) #include <linux/ptrace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) #include <linux/seq_file.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) #include <linux/rwsem.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) #include <linux/nsproxy.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) #include <linux/mount.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) #include <linux/ipc_namespace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) #include <linux/rhashtable.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) #include <linux/uaccess.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) #include "util.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) struct shmid_kernel /* private to the kernel */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) struct kern_ipc_perm shm_perm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) struct file *shm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) unsigned long shm_nattch;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) unsigned long shm_segsz;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) time64_t shm_atim;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) time64_t shm_dtim;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) time64_t shm_ctim;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) struct pid *shm_cprid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) struct pid *shm_lprid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) struct user_struct *mlock_user;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) * The task created the shm object, for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) * task_lock(shp->shm_creator)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) struct task_struct *shm_creator;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) * List by creator. task_lock(->shm_creator) required for read/write.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) * If list_empty(), then the creator is dead already.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) struct list_head shm_clist;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) struct ipc_namespace *ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) } __randomize_layout;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) /* shm_mode upper byte flags */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) #define SHM_DEST 01000 /* segment will be destroyed on last detach */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) #define SHM_LOCKED 02000 /* segment will not be swapped */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) struct shm_file_data {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) int id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) struct ipc_namespace *ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) struct file *file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) const struct vm_operations_struct *vm_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) #define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) static const struct file_operations shm_file_operations;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) static const struct vm_operations_struct shm_vm_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) #define shm_ids(ns) ((ns)->ids[IPC_SHM_IDS])
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) #define shm_unlock(shp) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) ipc_unlock(&(shp)->shm_perm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) static int newseg(struct ipc_namespace *, struct ipc_params *);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) static void shm_open(struct vm_area_struct *vma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) static void shm_close(struct vm_area_struct *vma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) #ifdef CONFIG_PROC_FS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) void shm_init_ns(struct ipc_namespace *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) ns->shm_ctlmax = SHMMAX;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) ns->shm_ctlall = SHMALL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) ns->shm_ctlmni = SHMMNI;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) ns->shm_rmid_forced = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) ns->shm_tot = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) ipc_init_ids(&shm_ids(ns));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) * Called with shm_ids.rwsem (writer) and the shp structure locked.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) * Only shm_ids.rwsem remains locked on exit.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) shp = container_of(ipcp, struct shmid_kernel, shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) WARN_ON(ns != shp->ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) if (shp->shm_nattch) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) shp->shm_perm.mode |= SHM_DEST;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) /* Do not find it any more */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) ipc_set_key_private(&shm_ids(ns), &shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) shm_unlock(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) shm_destroy(ns, shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) #ifdef CONFIG_IPC_NS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) void shm_exit_ns(struct ipc_namespace *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) free_ipcs(ns, &shm_ids(ns), do_shm_rmid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) idr_destroy(&ns->ids[IPC_SHM_IDS].ipcs_idr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) rhashtable_destroy(&ns->ids[IPC_SHM_IDS].key_ht);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) static int __init ipc_ns_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) shm_init_ns(&init_ipc_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) pure_initcall(ipc_ns_init);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) void __init shm_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) ipc_init_proc_interface("sysvipc/shm",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) #if BITS_PER_LONG <= 32
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) IPC_SHM_IDS, sysvipc_shm_proc_show);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) static inline struct shmid_kernel *shm_obtain_object(struct ipc_namespace *ns, int id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&shm_ids(ns), id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) if (IS_ERR(ipcp))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) return ERR_CAST(ipcp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) return container_of(ipcp, struct shmid_kernel, shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) static inline struct shmid_kernel *shm_obtain_object_check(struct ipc_namespace *ns, int id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&shm_ids(ns), id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) if (IS_ERR(ipcp))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) return ERR_CAST(ipcp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) return container_of(ipcp, struct shmid_kernel, shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) * shm_lock_(check_) routines are called in the paths where the rwsem
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) * is not necessarily held.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) struct kern_ipc_perm *ipcp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) ipcp = ipc_obtain_object_idr(&shm_ids(ns), id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) if (IS_ERR(ipcp))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) ipc_lock_object(ipcp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) * ipc_rmid() may have already freed the ID while ipc_lock_object()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) * was spinning: here verify that the structure is still valid.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) * Upon races with RMID, return -EIDRM, thus indicating that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) * the ID points to a removed identifier.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) if (ipc_valid_object(ipcp)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) /* return a locked ipc object upon success */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) return container_of(ipcp, struct shmid_kernel, shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) ipc_unlock_object(ipcp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) ipcp = ERR_PTR(-EIDRM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) err:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) * Callers of shm_lock() must validate the status of the returned ipc
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) * object pointer and error out as appropriate.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) return ERR_CAST(ipcp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) static inline void shm_lock_by_ptr(struct shmid_kernel *ipcp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) ipc_lock_object(&ipcp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) static void shm_rcu_free(struct rcu_head *head)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) struct kern_ipc_perm *ptr = container_of(head, struct kern_ipc_perm,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) struct shmid_kernel *shp = container_of(ptr, struct shmid_kernel,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) security_shm_free(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) kvfree(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) * It has to be called with shp locked.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) * It must be called before ipc_rmid()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) static inline void shm_clist_rm(struct shmid_kernel *shp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) struct task_struct *creator;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) /* ensure that shm_creator does not disappear */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) * A concurrent exit_shm may do a list_del_init() as well.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) * Just do nothing if exit_shm already did the work
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) if (!list_empty(&shp->shm_clist)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) * shp->shm_creator is guaranteed to be valid *only*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) * if shp->shm_clist is not empty.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) creator = shp->shm_creator;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) task_lock(creator);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) * list_del_init() is a nop if the entry was already removed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) * from the list.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) list_del_init(&shp->shm_clist);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) task_unlock(creator);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) static inline void shm_rmid(struct shmid_kernel *s)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) shm_clist_rm(s);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) ipc_rmid(&shm_ids(s->ns), &s->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) static int __shm_open(struct vm_area_struct *vma)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) struct file *file = vma->vm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) shp = shm_lock(sfd->ns, sfd->id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) if (IS_ERR(shp))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) return PTR_ERR(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) if (shp->shm_file != sfd->file) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) /* ID was reused */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) shm_unlock(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) shp->shm_atim = ktime_get_real_seconds();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) ipc_update_pid(&shp->shm_lprid, task_tgid(current));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) shp->shm_nattch++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) shm_unlock(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) /* This is called by fork, once for every shm attach. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) static void shm_open(struct vm_area_struct *vma)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) int err = __shm_open(vma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) * We raced in the idr lookup or with shm_destroy().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) * Either way, the ID is busted.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) WARN_ON_ONCE(err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) * shm_destroy - free the struct shmid_kernel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) * @ns: namespace
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) * @shp: struct to free
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) * It has to be called with shp and shm_ids.rwsem (writer) locked,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) * but returns with shp unlocked and freed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) struct file *shm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) shm_file = shp->shm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) shp->shm_file = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) shm_rmid(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) shm_unlock(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) if (!is_file_hugepages(shm_file))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) shmem_lock(shm_file, 0, shp->mlock_user);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) else if (shp->mlock_user)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) user_shm_unlock(i_size_read(file_inode(shm_file)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) shp->mlock_user);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) fput(shm_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) ipc_update_pid(&shp->shm_cprid, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) ipc_update_pid(&shp->shm_lprid, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) * shm_may_destroy - identifies whether shm segment should be destroyed now
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) * Returns true if and only if there are no active users of the segment and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) * one of the following is true:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) * 1) shmctl(id, IPC_RMID, NULL) was called for this shp
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) * 2) sysctl kernel.shm_rmid_forced is set to 1.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) static bool shm_may_destroy(struct shmid_kernel *shp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) return (shp->shm_nattch == 0) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) (shp->ns->shm_rmid_forced ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) (shp->shm_perm.mode & SHM_DEST));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) * remove the attach descriptor vma.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) * free memory for segment if it is marked destroyed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) * The descriptor has already been removed from the current->mm->mmap list
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) * and will later be kfree()d.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) static void shm_close(struct vm_area_struct *vma)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) struct file *file = vma->vm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) struct ipc_namespace *ns = sfd->ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) down_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) /* remove from the list of attaches of the shm segment */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) shp = shm_lock(ns, sfd->id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) * We raced in the idr lookup or with shm_destroy().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) * Either way, the ID is busted.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) if (WARN_ON_ONCE(IS_ERR(shp)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) goto done; /* no-op */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) ipc_update_pid(&shp->shm_lprid, task_tgid(current));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) shp->shm_dtim = ktime_get_real_seconds();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) shp->shm_nattch--;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) if (shm_may_destroy(shp))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) shm_destroy(ns, shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) shm_unlock(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) done:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) up_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) /* Called with ns->shm_ids(ns).rwsem locked */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) static int shm_try_destroy_orphaned(int id, void *p, void *data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) struct ipc_namespace *ns = data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) struct kern_ipc_perm *ipcp = p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) struct shmid_kernel *shp = container_of(ipcp, struct shmid_kernel, shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) * We want to destroy segments without users and with already
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) * exit'ed originating process.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) * As shp->* are changed under rwsem, it's safe to skip shp locking.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) if (!list_empty(&shp->shm_clist))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) if (shm_may_destroy(shp)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) shm_lock_by_ptr(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) shm_destroy(ns, shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) void shm_destroy_orphaned(struct ipc_namespace *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) down_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) if (shm_ids(ns).in_use)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) up_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) /* Locking assumes this will only be called with task == current */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) void exit_shm(struct task_struct *task)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) for (;;) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) struct ipc_namespace *ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) task_lock(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) if (list_empty(&task->sysvshm.shm_clist)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) task_unlock(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) shp = list_first_entry(&task->sysvshm.shm_clist, struct shmid_kernel,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) shm_clist);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) * 1) Get pointer to the ipc namespace. It is worth to say
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) * that this pointer is guaranteed to be valid because
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) * shp lifetime is always shorter than namespace lifetime
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) * in which shp lives.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) * We taken task_lock it means that shp won't be freed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) ns = shp->ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) * 2) If kernel.shm_rmid_forced is not set then only keep track of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) * which shmids are orphaned, so that a later set of the sysctl
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) * can clean them up.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) if (!ns->shm_rmid_forced)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) goto unlink_continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) * 3) get a reference to the namespace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) * The refcount could be already 0. If it is 0, then
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) * the shm objects will be free by free_ipc_work().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) ns = get_ipc_ns_not_zero(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) if (!ns) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) unlink_continue:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) list_del_init(&shp->shm_clist);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) task_unlock(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) * 4) get a reference to shp.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) * This cannot fail: shm_clist_rm() is called before
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) * ipc_rmid(), thus the refcount cannot be 0.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) WARN_ON(!ipc_rcu_getref(&shp->shm_perm));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) * 5) unlink the shm segment from the list of segments
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) * created by current.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) * This must be done last. After unlinking,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) * only the refcounts obtained above prevent IPC_RMID
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) * from destroying the segment or the namespace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) list_del_init(&shp->shm_clist);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) task_unlock(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) * 6) we have all references
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) * Thus lock & if needed destroy shp.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) down_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) shm_lock_by_ptr(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) * rcu_read_lock was implicitly taken in shm_lock_by_ptr, it's
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) * safe to call ipc_rcu_putref here
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) if (ipc_valid_object(&shp->shm_perm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) if (shm_may_destroy(shp))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) shm_destroy(ns, shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) shm_unlock(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509) * Someone else deleted the shp from namespace
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510) * idr/kht while we have waited.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) * Just unlock and continue.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513) shm_unlock(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) up_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) put_ipc_ns(ns); /* paired with get_ipc_ns_not_zero */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) static vm_fault_t shm_fault(struct vm_fault *vmf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) struct file *file = vmf->vma->vm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526) return sfd->vm_ops->fault(vmf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529) static int shm_split(struct vm_area_struct *vma, unsigned long addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) struct file *file = vma->vm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534) if (sfd->vm_ops->split)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535) return sfd->vm_ops->split(vma, addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540) static unsigned long shm_pagesize(struct vm_area_struct *vma)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) struct file *file = vma->vm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545) if (sfd->vm_ops->pagesize)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546) return sfd->vm_ops->pagesize(vma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) return PAGE_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551) #ifdef CONFIG_NUMA
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) struct file *file = vma->vm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556) int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) if (sfd->vm_ops->set_policy)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) err = sfd->vm_ops->set_policy(vma, new);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563) static struct mempolicy *shm_get_policy(struct vm_area_struct *vma,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564) unsigned long addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) struct file *file = vma->vm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568) struct mempolicy *pol = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570) if (sfd->vm_ops->get_policy)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 571) pol = sfd->vm_ops->get_policy(vma, addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 572) else if (vma->vm_policy)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 573) pol = vma->vm_policy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 574)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 575) return pol;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 576) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 577) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 578)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 579) static int shm_mmap(struct file *file, struct vm_area_struct *vma)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 580) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 581) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 582) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 583)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 584) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 585) * In case of remap_file_pages() emulation, the file can represent an
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 586) * IPC ID that was removed, and possibly even reused by another shm
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 587) * segment already. Propagate this case as an error to caller.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 588) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 589) ret = __shm_open(vma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 590) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 591) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 592)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 593) ret = call_mmap(sfd->file, vma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 594) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 595) shm_close(vma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 596) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 597) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 598) sfd->vm_ops = vma->vm_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 599) #ifdef CONFIG_MMU
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 600) WARN_ON(!sfd->vm_ops->fault);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 601) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 602) vma->vm_ops = &shm_vm_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 603) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 604) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 605)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 606) static int shm_release(struct inode *ino, struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 607) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 608) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 609)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 610) put_ipc_ns(sfd->ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 611) fput(sfd->file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 612) shm_file_data(file) = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 613) kfree(sfd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 614) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 615) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 616)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 617) static int shm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 618) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 619) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 620)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 621) if (!sfd->file->f_op->fsync)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 622) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 623) return sfd->file->f_op->fsync(sfd->file, start, end, datasync);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 624) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 625)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 626) static long shm_fallocate(struct file *file, int mode, loff_t offset,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 627) loff_t len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 628) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 629) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 630)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 631) if (!sfd->file->f_op->fallocate)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 632) return -EOPNOTSUPP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 633) return sfd->file->f_op->fallocate(file, mode, offset, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 634) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 635)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 636) static unsigned long shm_get_unmapped_area(struct file *file,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 637) unsigned long addr, unsigned long len, unsigned long pgoff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 638) unsigned long flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 639) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 640) struct shm_file_data *sfd = shm_file_data(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 641)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 642) return sfd->file->f_op->get_unmapped_area(sfd->file, addr, len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 643) pgoff, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 644) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 645)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 646) static const struct file_operations shm_file_operations = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 647) .mmap = shm_mmap,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 648) .fsync = shm_fsync,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 649) .release = shm_release,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 650) .get_unmapped_area = shm_get_unmapped_area,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 651) .llseek = noop_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 652) .fallocate = shm_fallocate,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 653) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 654)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 655) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 656) * shm_file_operations_huge is now identical to shm_file_operations,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 657) * but we keep it distinct for the sake of is_file_shm_hugepages().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 658) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 659) static const struct file_operations shm_file_operations_huge = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 660) .mmap = shm_mmap,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 661) .fsync = shm_fsync,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 662) .release = shm_release,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 663) .get_unmapped_area = shm_get_unmapped_area,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 664) .llseek = noop_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 665) .fallocate = shm_fallocate,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 666) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 667)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 668) bool is_file_shm_hugepages(struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 669) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 670) return file->f_op == &shm_file_operations_huge;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 671) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 672)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 673) static const struct vm_operations_struct shm_vm_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 674) .open = shm_open, /* callback for a new vm-area open */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 675) .close = shm_close, /* callback for when the vm-area is released */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 676) .fault = shm_fault,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 677) .split = shm_split,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 678) .pagesize = shm_pagesize,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 679) #if defined(CONFIG_NUMA)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 680) .set_policy = shm_set_policy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 681) .get_policy = shm_get_policy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 682) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 683) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 684)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 685) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 686) * newseg - Create a new shared memory segment
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 687) * @ns: namespace
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 688) * @params: ptr to the structure that contains key, size and shmflg
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 689) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 690) * Called with shm_ids.rwsem held as a writer.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 691) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 692) static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 693) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 694) key_t key = params->key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 695) int shmflg = params->flg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 696) size_t size = params->u.size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 697) int error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 698) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 699) size_t numpages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 700) struct file *file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 701) char name[13];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 702) vm_flags_t acctflag = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 703)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 704) if (size < SHMMIN || size > ns->shm_ctlmax)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 705) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 706)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 707) if (numpages << PAGE_SHIFT < size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 708) return -ENOSPC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 709)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 710) if (ns->shm_tot + numpages < ns->shm_tot ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 711) ns->shm_tot + numpages > ns->shm_ctlall)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 712) return -ENOSPC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 713)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 714) shp = kvmalloc(sizeof(*shp), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 715) if (unlikely(!shp))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 716) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 717)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 718) shp->shm_perm.key = key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 719) shp->shm_perm.mode = (shmflg & S_IRWXUGO);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 720) shp->mlock_user = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 721)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 722) shp->shm_perm.security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 723) error = security_shm_alloc(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 724) if (error) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 725) kvfree(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 726) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 727) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 728)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 729) sprintf(name, "SYSV%08x", key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 730) if (shmflg & SHM_HUGETLB) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 731) struct hstate *hs;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 732) size_t hugesize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 733)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 734) hs = hstate_sizelog((shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 735) if (!hs) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 736) error = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 737) goto no_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 738) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 739) hugesize = ALIGN(size, huge_page_size(hs));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 740)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 741) /* hugetlb_file_setup applies strict accounting */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 742) if (shmflg & SHM_NORESERVE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 743) acctflag = VM_NORESERVE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 744) file = hugetlb_file_setup(name, hugesize, acctflag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 745) &shp->mlock_user, HUGETLB_SHMFS_INODE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 746) (shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 747) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 748) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 749) * Do not allow no accounting for OVERCOMMIT_NEVER, even
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 750) * if it's asked for.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 751) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 752) if ((shmflg & SHM_NORESERVE) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 753) sysctl_overcommit_memory != OVERCOMMIT_NEVER)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 754) acctflag = VM_NORESERVE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 755) file = shmem_kernel_file_setup(name, size, acctflag);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 756) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 757) error = PTR_ERR(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 758) if (IS_ERR(file))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 759) goto no_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 760)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 761) shp->shm_cprid = get_pid(task_tgid(current));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 762) shp->shm_lprid = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 763) shp->shm_atim = shp->shm_dtim = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 764) shp->shm_ctim = ktime_get_real_seconds();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 765) shp->shm_segsz = size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 766) shp->shm_nattch = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 767) shp->shm_file = file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 768) shp->shm_creator = current;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 769)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 770) /* ipc_addid() locks shp upon success. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 771) error = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 772) if (error < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 773) goto no_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 774)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 775) shp->ns = ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 776)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 777) task_lock(current);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 778) list_add(&shp->shm_clist, ¤t->sysvshm.shm_clist);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 779) task_unlock(current);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 780)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 781) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 782) * shmid gets reported as "inode#" in /proc/pid/maps.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 783) * proc-ps tools use this. Changing this will break them.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 784) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 785) file_inode(file)->i_ino = shp->shm_perm.id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 786)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 787) ns->shm_tot += numpages;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 788) error = shp->shm_perm.id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 789)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 790) ipc_unlock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 791) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 792) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 793)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 794) no_id:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 795) ipc_update_pid(&shp->shm_cprid, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 796) ipc_update_pid(&shp->shm_lprid, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 797) if (is_file_hugepages(file) && shp->mlock_user)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 798) user_shm_unlock(size, shp->mlock_user);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 799) fput(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 800) ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 801) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 802) no_file:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 803) call_rcu(&shp->shm_perm.rcu, shm_rcu_free);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 804) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 805) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 806)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 807) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 808) * Called with shm_ids.rwsem and ipcp locked.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 809) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 810) static int shm_more_checks(struct kern_ipc_perm *ipcp, struct ipc_params *params)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 811) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 812) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 813)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 814) shp = container_of(ipcp, struct shmid_kernel, shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 815) if (shp->shm_segsz < params->u.size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 816) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 817)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 818) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 819) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 820)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 821) long ksys_shmget(key_t key, size_t size, int shmflg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 822) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 823) struct ipc_namespace *ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 824) static const struct ipc_ops shm_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 825) .getnew = newseg,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 826) .associate = security_shm_associate,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 827) .more_checks = shm_more_checks,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 828) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 829) struct ipc_params shm_params;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 830)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 831) ns = current->nsproxy->ipc_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 832)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 833) shm_params.key = key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 834) shm_params.flg = shmflg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 835) shm_params.u.size = size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 836)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 837) return ipcget(ns, &shm_ids(ns), &shm_ops, &shm_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 838) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 839)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 840) SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 841) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 842) return ksys_shmget(key, size, shmflg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 843) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 844)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 845) static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 846) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 847) switch (version) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 848) case IPC_64:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 849) return copy_to_user(buf, in, sizeof(*in));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 850) case IPC_OLD:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 851) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 852) struct shmid_ds out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 853)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 854) memset(&out, 0, sizeof(out));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 855) ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 856) out.shm_segsz = in->shm_segsz;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 857) out.shm_atime = in->shm_atime;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 858) out.shm_dtime = in->shm_dtime;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 859) out.shm_ctime = in->shm_ctime;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 860) out.shm_cpid = in->shm_cpid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 861) out.shm_lpid = in->shm_lpid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 862) out.shm_nattch = in->shm_nattch;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 863)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 864) return copy_to_user(buf, &out, sizeof(out));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 865) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 866) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 867) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 868) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 869) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 870)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 871) static inline unsigned long
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 872) copy_shmid_from_user(struct shmid64_ds *out, void __user *buf, int version)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 873) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 874) switch (version) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 875) case IPC_64:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 876) if (copy_from_user(out, buf, sizeof(*out)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 877) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 878) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 879) case IPC_OLD:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 880) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 881) struct shmid_ds tbuf_old;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 882)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 883) if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 884) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 885)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 886) out->shm_perm.uid = tbuf_old.shm_perm.uid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 887) out->shm_perm.gid = tbuf_old.shm_perm.gid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 888) out->shm_perm.mode = tbuf_old.shm_perm.mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 889)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 890) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 891) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 892) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 893) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 894) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 895) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 896)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 897) static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 898) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 899) switch (version) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 900) case IPC_64:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 901) return copy_to_user(buf, in, sizeof(*in));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 902) case IPC_OLD:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 903) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 904) struct shminfo out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 905)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 906) if (in->shmmax > INT_MAX)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 907) out.shmmax = INT_MAX;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 908) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 909) out.shmmax = (int)in->shmmax;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 910)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 911) out.shmmin = in->shmmin;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 912) out.shmmni = in->shmmni;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 913) out.shmseg = in->shmseg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 914) out.shmall = in->shmall;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 915)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 916) return copy_to_user(buf, &out, sizeof(out));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 917) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 918) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 919) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 920) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 921) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 922)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 923) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 924) * Calculate and add used RSS and swap pages of a shm.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 925) * Called with shm_ids.rwsem held as a reader
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 926) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 927) static void shm_add_rss_swap(struct shmid_kernel *shp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 928) unsigned long *rss_add, unsigned long *swp_add)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 929) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 930) struct inode *inode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 931)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 932) inode = file_inode(shp->shm_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 933)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 934) if (is_file_hugepages(shp->shm_file)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 935) struct address_space *mapping = inode->i_mapping;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 936) struct hstate *h = hstate_file(shp->shm_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 937) *rss_add += pages_per_huge_page(h) * mapping->nrpages;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 938) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 939) #ifdef CONFIG_SHMEM
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 940) struct shmem_inode_info *info = SHMEM_I(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 941)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 942) spin_lock_irq(&info->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 943) *rss_add += inode->i_mapping->nrpages;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 944) *swp_add += info->swapped;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 945) spin_unlock_irq(&info->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 946) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 947) *rss_add += inode->i_mapping->nrpages;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 948) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 949) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 950) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 951)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 952) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 953) * Called with shm_ids.rwsem held as a reader
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 954) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 955) static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 956) unsigned long *swp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 957) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 958) int next_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 959) int total, in_use;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 960)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 961) *rss = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 962) *swp = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 963)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 964) in_use = shm_ids(ns).in_use;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 965)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 966) for (total = 0, next_id = 0; total < in_use; next_id++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 967) struct kern_ipc_perm *ipc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 968) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 969)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 970) ipc = idr_find(&shm_ids(ns).ipcs_idr, next_id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 971) if (ipc == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 972) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 973) shp = container_of(ipc, struct shmid_kernel, shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 974)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 975) shm_add_rss_swap(shp, rss, swp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 976)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 977) total++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 978) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 979) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 980)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 981) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 982) * This function handles some shmctl commands which require the rwsem
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 983) * to be held in write mode.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 984) * NOTE: no locks must be held, the rwsem is taken inside this function.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 985) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 986) static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 987) struct shmid64_ds *shmid64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 988) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 989) struct kern_ipc_perm *ipcp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 990) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 991) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 992)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 993) down_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 994) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 995)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 996) ipcp = ipcctl_obtain_check(ns, &shm_ids(ns), shmid, cmd,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 997) &shmid64->shm_perm, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 998) if (IS_ERR(ipcp)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 999) err = PTR_ERR(ipcp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1000) goto out_unlock1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1001) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1002)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1003) shp = container_of(ipcp, struct shmid_kernel, shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1004)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1005) err = security_shm_shmctl(&shp->shm_perm, cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1006) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1007) goto out_unlock1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1008)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1009) switch (cmd) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1010) case IPC_RMID:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1011) ipc_lock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1012) /* do_shm_rmid unlocks the ipc object and rcu */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1013) do_shm_rmid(ns, ipcp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1014) goto out_up;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1015) case IPC_SET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1016) ipc_lock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1017) err = ipc_update_perm(&shmid64->shm_perm, ipcp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1018) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1019) goto out_unlock0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1020) shp->shm_ctim = ktime_get_real_seconds();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1021) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1022) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1023) err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1024) goto out_unlock1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1025) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1026)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1027) out_unlock0:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1028) ipc_unlock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1029) out_unlock1:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1030) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1031) out_up:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1032) up_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1033) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1034) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1035)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1036) static int shmctl_ipc_info(struct ipc_namespace *ns,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1037) struct shminfo64 *shminfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1038) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1039) int err = security_shm_shmctl(NULL, IPC_INFO);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1040) if (!err) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1041) memset(shminfo, 0, sizeof(*shminfo));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1042) shminfo->shmmni = shminfo->shmseg = ns->shm_ctlmni;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1043) shminfo->shmmax = ns->shm_ctlmax;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1044) shminfo->shmall = ns->shm_ctlall;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1045) shminfo->shmmin = SHMMIN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1046) down_read(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1047) err = ipc_get_maxidx(&shm_ids(ns));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1048) up_read(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1049) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1050) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1051) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1052) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1053) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1054)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1055) static int shmctl_shm_info(struct ipc_namespace *ns,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1056) struct shm_info *shm_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1057) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1058) int err = security_shm_shmctl(NULL, SHM_INFO);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1059) if (!err) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1060) memset(shm_info, 0, sizeof(*shm_info));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1061) down_read(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1062) shm_info->used_ids = shm_ids(ns).in_use;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1063) shm_get_stat(ns, &shm_info->shm_rss, &shm_info->shm_swp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1064) shm_info->shm_tot = ns->shm_tot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1065) shm_info->swap_attempts = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1066) shm_info->swap_successes = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1067) err = ipc_get_maxidx(&shm_ids(ns));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1068) up_read(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1069) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1070) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1071) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1072) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1073) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1074)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1075) static int shmctl_stat(struct ipc_namespace *ns, int shmid,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1076) int cmd, struct shmid64_ds *tbuf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1077) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1078) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1079) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1080)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1081) memset(tbuf, 0, sizeof(*tbuf));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1082)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1083) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1084) if (cmd == SHM_STAT || cmd == SHM_STAT_ANY) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1085) shp = shm_obtain_object(ns, shmid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1086) if (IS_ERR(shp)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1087) err = PTR_ERR(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1088) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1089) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1090) } else { /* IPC_STAT */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1091) shp = shm_obtain_object_check(ns, shmid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1092) if (IS_ERR(shp)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1093) err = PTR_ERR(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1094) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1095) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1096) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1097)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1098) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1099) * Semantically SHM_STAT_ANY ought to be identical to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1100) * that functionality provided by the /proc/sysvipc/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1101) * interface. As such, only audit these calls and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1102) * do not do traditional S_IRUGO permission checks on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1103) * the ipc object.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1104) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1105) if (cmd == SHM_STAT_ANY)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1106) audit_ipc_obj(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1107) else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1108) err = -EACCES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1109) if (ipcperms(ns, &shp->shm_perm, S_IRUGO))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1110) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1111) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1112)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1113) err = security_shm_shmctl(&shp->shm_perm, cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1114) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1115) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1116)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1117) ipc_lock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1119) if (!ipc_valid_object(&shp->shm_perm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1120) ipc_unlock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1121) err = -EIDRM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1122) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1123) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1125) kernel_to_ipc64_perm(&shp->shm_perm, &tbuf->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1126) tbuf->shm_segsz = shp->shm_segsz;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1127) tbuf->shm_atime = shp->shm_atim;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1128) tbuf->shm_dtime = shp->shm_dtim;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1129) tbuf->shm_ctime = shp->shm_ctim;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1130) #ifndef CONFIG_64BIT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1131) tbuf->shm_atime_high = shp->shm_atim >> 32;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1132) tbuf->shm_dtime_high = shp->shm_dtim >> 32;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1133) tbuf->shm_ctime_high = shp->shm_ctim >> 32;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1134) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1135) tbuf->shm_cpid = pid_vnr(shp->shm_cprid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1136) tbuf->shm_lpid = pid_vnr(shp->shm_lprid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1137) tbuf->shm_nattch = shp->shm_nattch;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1139) if (cmd == IPC_STAT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1140) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1141) * As defined in SUS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1142) * Return 0 on success
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1143) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1144) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1145) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1146) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1147) * SHM_STAT and SHM_STAT_ANY (both Linux specific)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1148) * Return the full id, including the sequence number
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1149) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1150) err = shp->shm_perm.id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1151) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1153) ipc_unlock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1154) out_unlock:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1155) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1156) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1157) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1158)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1159) static int shmctl_do_lock(struct ipc_namespace *ns, int shmid, int cmd)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1160) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1161) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1162) struct file *shm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1163) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1164)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1165) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1166) shp = shm_obtain_object_check(ns, shmid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1167) if (IS_ERR(shp)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1168) err = PTR_ERR(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1169) goto out_unlock1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1170) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1171)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1172) audit_ipc_obj(&(shp->shm_perm));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1173) err = security_shm_shmctl(&shp->shm_perm, cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1174) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1175) goto out_unlock1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1176)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1177) ipc_lock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1178)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1179) /* check if shm_destroy() is tearing down shp */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1180) if (!ipc_valid_object(&shp->shm_perm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1181) err = -EIDRM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1182) goto out_unlock0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1183) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1184)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1185) if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1186) kuid_t euid = current_euid();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1187)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1188) if (!uid_eq(euid, shp->shm_perm.uid) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1189) !uid_eq(euid, shp->shm_perm.cuid)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1190) err = -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1191) goto out_unlock0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1192) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1193) if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1194) err = -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1195) goto out_unlock0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1196) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1197) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1198)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1199) shm_file = shp->shm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1200) if (is_file_hugepages(shm_file))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1201) goto out_unlock0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1202)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1203) if (cmd == SHM_LOCK) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1204) struct user_struct *user = current_user();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1205)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1206) err = shmem_lock(shm_file, 1, user);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1207) if (!err && !(shp->shm_perm.mode & SHM_LOCKED)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1208) shp->shm_perm.mode |= SHM_LOCKED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1209) shp->mlock_user = user;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1210) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1211) goto out_unlock0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1212) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1214) /* SHM_UNLOCK */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1215) if (!(shp->shm_perm.mode & SHM_LOCKED))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1216) goto out_unlock0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1217) shmem_lock(shm_file, 0, shp->mlock_user);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1218) shp->shm_perm.mode &= ~SHM_LOCKED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1219) shp->mlock_user = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1220) get_file(shm_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1221) ipc_unlock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1222) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1223) shmem_unlock_mapping(shm_file->f_mapping);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1224)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1225) fput(shm_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1226) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1227)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1228) out_unlock0:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1229) ipc_unlock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1230) out_unlock1:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1231) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1232) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1233) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1234)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1235) static long ksys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf, int version)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1236) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1237) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1238) struct ipc_namespace *ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1239) struct shmid64_ds sem64;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1240)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1241) if (cmd < 0 || shmid < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1242) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1243)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1244) ns = current->nsproxy->ipc_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1245)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1246) switch (cmd) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1247) case IPC_INFO: {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1248) struct shminfo64 shminfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1249) err = shmctl_ipc_info(ns, &shminfo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1250) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1251) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1252) if (copy_shminfo_to_user(buf, &shminfo, version))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1253) err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1254) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1255) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1256) case SHM_INFO: {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1257) struct shm_info shm_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1258) err = shmctl_shm_info(ns, &shm_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1259) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1260) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1261) if (copy_to_user(buf, &shm_info, sizeof(shm_info)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1262) err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1263) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1264) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1265) case SHM_STAT:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1266) case SHM_STAT_ANY:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1267) case IPC_STAT: {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1268) err = shmctl_stat(ns, shmid, cmd, &sem64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1269) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1270) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1271) if (copy_shmid_to_user(buf, &sem64, version))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1272) err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1273) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1274) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1275) case IPC_SET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1276) if (copy_shmid_from_user(&sem64, buf, version))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1277) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1278) fallthrough;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1279) case IPC_RMID:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1280) return shmctl_down(ns, shmid, cmd, &sem64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1281) case SHM_LOCK:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1282) case SHM_UNLOCK:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1283) return shmctl_do_lock(ns, shmid, cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1284) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1285) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1286) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1287) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1288)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1289) SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1290) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1291) return ksys_shmctl(shmid, cmd, buf, IPC_64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1292) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1293)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1294) #ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1295) long ksys_old_shmctl(int shmid, int cmd, struct shmid_ds __user *buf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1296) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1297) int version = ipc_parse_version(&cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1298)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1299) return ksys_shmctl(shmid, cmd, buf, version);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1300) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1301)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1302) SYSCALL_DEFINE3(old_shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1303) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1304) return ksys_old_shmctl(shmid, cmd, buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1305) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1306) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1307)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1308) #ifdef CONFIG_COMPAT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1309)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1310) struct compat_shmid_ds {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1311) struct compat_ipc_perm shm_perm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1312) int shm_segsz;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1313) old_time32_t shm_atime;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1314) old_time32_t shm_dtime;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1315) old_time32_t shm_ctime;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1316) compat_ipc_pid_t shm_cpid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1317) compat_ipc_pid_t shm_lpid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1318) unsigned short shm_nattch;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1319) unsigned short shm_unused;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1320) compat_uptr_t shm_unused2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1321) compat_uptr_t shm_unused3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1322) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1323)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1324) struct compat_shminfo64 {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1325) compat_ulong_t shmmax;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1326) compat_ulong_t shmmin;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1327) compat_ulong_t shmmni;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1328) compat_ulong_t shmseg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1329) compat_ulong_t shmall;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1330) compat_ulong_t __unused1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1331) compat_ulong_t __unused2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1332) compat_ulong_t __unused3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1333) compat_ulong_t __unused4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1334) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1335)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1336) struct compat_shm_info {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1337) compat_int_t used_ids;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1338) compat_ulong_t shm_tot, shm_rss, shm_swp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1339) compat_ulong_t swap_attempts, swap_successes;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1340) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1341)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1342) static int copy_compat_shminfo_to_user(void __user *buf, struct shminfo64 *in,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1343) int version)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1344) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1345) if (in->shmmax > INT_MAX)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1346) in->shmmax = INT_MAX;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1347) if (version == IPC_64) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1348) struct compat_shminfo64 info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1349) memset(&info, 0, sizeof(info));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1350) info.shmmax = in->shmmax;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1351) info.shmmin = in->shmmin;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1352) info.shmmni = in->shmmni;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1353) info.shmseg = in->shmseg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1354) info.shmall = in->shmall;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1355) return copy_to_user(buf, &info, sizeof(info));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1356) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1357) struct shminfo info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1358) memset(&info, 0, sizeof(info));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1359) info.shmmax = in->shmmax;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1360) info.shmmin = in->shmmin;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1361) info.shmmni = in->shmmni;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1362) info.shmseg = in->shmseg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1363) info.shmall = in->shmall;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1364) return copy_to_user(buf, &info, sizeof(info));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1365) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1366) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1367)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1368) static int put_compat_shm_info(struct shm_info *ip,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1369) struct compat_shm_info __user *uip)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1370) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1371) struct compat_shm_info info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1372)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1373) memset(&info, 0, sizeof(info));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1374) info.used_ids = ip->used_ids;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1375) info.shm_tot = ip->shm_tot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1376) info.shm_rss = ip->shm_rss;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1377) info.shm_swp = ip->shm_swp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1378) info.swap_attempts = ip->swap_attempts;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1379) info.swap_successes = ip->swap_successes;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1380) return copy_to_user(uip, &info, sizeof(info));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1381) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1382)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1383) static int copy_compat_shmid_to_user(void __user *buf, struct shmid64_ds *in,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1384) int version)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1385) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1386) if (version == IPC_64) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1387) struct compat_shmid64_ds v;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1388) memset(&v, 0, sizeof(v));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1389) to_compat_ipc64_perm(&v.shm_perm, &in->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1390) v.shm_atime = lower_32_bits(in->shm_atime);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1391) v.shm_atime_high = upper_32_bits(in->shm_atime);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1392) v.shm_dtime = lower_32_bits(in->shm_dtime);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1393) v.shm_dtime_high = upper_32_bits(in->shm_dtime);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1394) v.shm_ctime = lower_32_bits(in->shm_ctime);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1395) v.shm_ctime_high = upper_32_bits(in->shm_ctime);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1396) v.shm_segsz = in->shm_segsz;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1397) v.shm_nattch = in->shm_nattch;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1398) v.shm_cpid = in->shm_cpid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1399) v.shm_lpid = in->shm_lpid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1400) return copy_to_user(buf, &v, sizeof(v));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1401) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1402) struct compat_shmid_ds v;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1403) memset(&v, 0, sizeof(v));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1404) to_compat_ipc_perm(&v.shm_perm, &in->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1405) v.shm_perm.key = in->shm_perm.key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1406) v.shm_atime = in->shm_atime;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1407) v.shm_dtime = in->shm_dtime;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1408) v.shm_ctime = in->shm_ctime;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1409) v.shm_segsz = in->shm_segsz;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1410) v.shm_nattch = in->shm_nattch;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1411) v.shm_cpid = in->shm_cpid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1412) v.shm_lpid = in->shm_lpid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1413) return copy_to_user(buf, &v, sizeof(v));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1414) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1415) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1416)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1417) static int copy_compat_shmid_from_user(struct shmid64_ds *out, void __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1418) int version)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1419) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1420) memset(out, 0, sizeof(*out));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1421) if (version == IPC_64) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1422) struct compat_shmid64_ds __user *p = buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1423) return get_compat_ipc64_perm(&out->shm_perm, &p->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1424) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1425) struct compat_shmid_ds __user *p = buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1426) return get_compat_ipc_perm(&out->shm_perm, &p->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1427) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1428) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1429)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1430) static long compat_ksys_shmctl(int shmid, int cmd, void __user *uptr, int version)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1431) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1432) struct ipc_namespace *ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1433) struct shmid64_ds sem64;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1434) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1435)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1436) ns = current->nsproxy->ipc_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1437)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1438) if (cmd < 0 || shmid < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1439) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1440)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1441) switch (cmd) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1442) case IPC_INFO: {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1443) struct shminfo64 shminfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1444) err = shmctl_ipc_info(ns, &shminfo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1445) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1446) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1447) if (copy_compat_shminfo_to_user(uptr, &shminfo, version))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1448) err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1449) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1450) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1451) case SHM_INFO: {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1452) struct shm_info shm_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1453) err = shmctl_shm_info(ns, &shm_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1454) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1455) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1456) if (put_compat_shm_info(&shm_info, uptr))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1457) err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1458) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1459) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1460) case IPC_STAT:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1461) case SHM_STAT_ANY:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1462) case SHM_STAT:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1463) err = shmctl_stat(ns, shmid, cmd, &sem64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1464) if (err < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1465) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1466) if (copy_compat_shmid_to_user(uptr, &sem64, version))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1467) err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1468) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1469)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1470) case IPC_SET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1471) if (copy_compat_shmid_from_user(&sem64, uptr, version))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1472) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1473) fallthrough;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1474) case IPC_RMID:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1475) return shmctl_down(ns, shmid, cmd, &sem64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1476) case SHM_LOCK:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1477) case SHM_UNLOCK:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1478) return shmctl_do_lock(ns, shmid, cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1479) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1480) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1481) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1482) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1483) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1484)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1485) COMPAT_SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, void __user *, uptr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1486) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1487) return compat_ksys_shmctl(shmid, cmd, uptr, IPC_64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1488) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1489)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1490) #ifdef CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1491) long compat_ksys_old_shmctl(int shmid, int cmd, void __user *uptr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1492) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1493) int version = compat_ipc_parse_version(&cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1494)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1495) return compat_ksys_shmctl(shmid, cmd, uptr, version);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1496) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1497)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1498) COMPAT_SYSCALL_DEFINE3(old_shmctl, int, shmid, int, cmd, void __user *, uptr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1499) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1500) return compat_ksys_old_shmctl(shmid, cmd, uptr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1501) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1502) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1503) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1504)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1505) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1506) * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1507) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1508) * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1509) * "raddr" thing points to kernel space, and there has to be a wrapper around
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1510) * this.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1511) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1512) long do_shmat(int shmid, char __user *shmaddr, int shmflg,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1513) ulong *raddr, unsigned long shmlba)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1514) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1515) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1516) unsigned long addr = (unsigned long)shmaddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1517) unsigned long size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1518) struct file *file, *base;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1519) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1520) unsigned long flags = MAP_SHARED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1521) unsigned long prot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1522) int acc_mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1523) struct ipc_namespace *ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1524) struct shm_file_data *sfd;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1525) int f_flags;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1526) unsigned long populate = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1527)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1528) err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1529) if (shmid < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1530) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1531)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1532) if (addr) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1533) if (addr & (shmlba - 1)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1534) if (shmflg & SHM_RND) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1535) addr &= ~(shmlba - 1); /* round down */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1536)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1537) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1538) * Ensure that the round-down is non-nil
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1539) * when remapping. This can happen for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1540) * cases when addr < shmlba.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1541) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1542) if (!addr && (shmflg & SHM_REMAP))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1543) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1544) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1545) #ifndef __ARCH_FORCE_SHMLBA
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1546) if (addr & ~PAGE_MASK)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1547) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1548) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1549) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1550)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1551) flags |= MAP_FIXED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1552) } else if ((shmflg & SHM_REMAP))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1553) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1554)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1555) if (shmflg & SHM_RDONLY) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1556) prot = PROT_READ;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1557) acc_mode = S_IRUGO;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1558) f_flags = O_RDONLY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1559) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1560) prot = PROT_READ | PROT_WRITE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1561) acc_mode = S_IRUGO | S_IWUGO;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1562) f_flags = O_RDWR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1563) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1564) if (shmflg & SHM_EXEC) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1565) prot |= PROT_EXEC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1566) acc_mode |= S_IXUGO;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1567) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1568)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1569) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1570) * We cannot rely on the fs check since SYSV IPC does have an
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1571) * additional creator id...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1572) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1573) ns = current->nsproxy->ipc_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1574) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1575) shp = shm_obtain_object_check(ns, shmid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1576) if (IS_ERR(shp)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1577) err = PTR_ERR(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1578) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1579) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1580)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1581) err = -EACCES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1582) if (ipcperms(ns, &shp->shm_perm, acc_mode))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1583) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1584)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1585) err = security_shm_shmat(&shp->shm_perm, shmaddr, shmflg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1586) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1587) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1588)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1589) ipc_lock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1590)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1591) /* check if shm_destroy() is tearing down shp */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1592) if (!ipc_valid_object(&shp->shm_perm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1593) ipc_unlock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1594) err = -EIDRM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1595) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1596) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1597)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1598) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1599) * We need to take a reference to the real shm file to prevent the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1600) * pointer from becoming stale in cases where the lifetime of the outer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1601) * file extends beyond that of the shm segment. It's not usually
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1602) * possible, but it can happen during remap_file_pages() emulation as
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1603) * that unmaps the memory, then does ->mmap() via file reference only.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1604) * We'll deny the ->mmap() if the shm segment was since removed, but to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1605) * detect shm ID reuse we need to compare the file pointers.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1606) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1607) base = get_file(shp->shm_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1608) shp->shm_nattch++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1609) size = i_size_read(file_inode(base));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1610) ipc_unlock_object(&shp->shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1611) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1612)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1613) err = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1614) sfd = kzalloc(sizeof(*sfd), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1615) if (!sfd) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1616) fput(base);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1617) goto out_nattch;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1618) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1619)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1620) file = alloc_file_clone(base, f_flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1621) is_file_hugepages(base) ?
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1622) &shm_file_operations_huge :
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1623) &shm_file_operations);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1624) err = PTR_ERR(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1625) if (IS_ERR(file)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1626) kfree(sfd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1627) fput(base);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1628) goto out_nattch;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1629) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1630)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1631) sfd->id = shp->shm_perm.id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1632) sfd->ns = get_ipc_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1633) sfd->file = base;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1634) sfd->vm_ops = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1635) file->private_data = sfd;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1636)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1637) err = security_mmap_file(file, prot, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1638) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1639) goto out_fput;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1640)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1641) if (mmap_write_lock_killable(current->mm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1642) err = -EINTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1643) goto out_fput;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1644) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1645)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1646) if (addr && !(shmflg & SHM_REMAP)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1647) err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1648) if (addr + size < addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1649) goto invalid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1650)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1651) if (find_vma_intersection(current->mm, addr, addr + size))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1652) goto invalid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1653) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1654)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1655) addr = do_mmap(file, addr, size, prot, flags, 0, &populate, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1656) *raddr = addr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1657) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1658) if (IS_ERR_VALUE(addr))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1659) err = (long)addr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1660) invalid:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1661) mmap_write_unlock(current->mm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1662) if (populate)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1663) mm_populate(addr, populate);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1664)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1665) out_fput:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1666) fput(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1667)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1668) out_nattch:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1669) down_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1670) shp = shm_lock(ns, shmid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1671) shp->shm_nattch--;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1672)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1673) if (shm_may_destroy(shp))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1674) shm_destroy(ns, shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1675) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1676) shm_unlock(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1677) up_write(&shm_ids(ns).rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1678) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1679)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1680) out_unlock:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1681) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1682) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1683) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1684) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1685)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1686) SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1687) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1688) unsigned long ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1689) long err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1690)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1691) err = do_shmat(shmid, shmaddr, shmflg, &ret, SHMLBA);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1692) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1693) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1694) force_successful_syscall_return();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1695) return (long)ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1696) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1697)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1698) #ifdef CONFIG_COMPAT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1699)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1700) #ifndef COMPAT_SHMLBA
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1701) #define COMPAT_SHMLBA SHMLBA
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1702) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1703)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1704) COMPAT_SYSCALL_DEFINE3(shmat, int, shmid, compat_uptr_t, shmaddr, int, shmflg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1705) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1706) unsigned long ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1707) long err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1708)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1709) err = do_shmat(shmid, compat_ptr(shmaddr), shmflg, &ret, COMPAT_SHMLBA);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1710) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1711) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1712) force_successful_syscall_return();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1713) return (long)ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1714) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1715) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1716)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1717) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1718) * detach and kill segment if marked destroyed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1719) * The work is done in shm_close.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1720) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1721) long ksys_shmdt(char __user *shmaddr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1722) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1723) struct mm_struct *mm = current->mm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1724) struct vm_area_struct *vma;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1725) unsigned long addr = (unsigned long)shmaddr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1726) int retval = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1727) #ifdef CONFIG_MMU
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1728) loff_t size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1729) struct file *file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1730) struct vm_area_struct *next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1731) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1732)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1733) if (addr & ~PAGE_MASK)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1734) return retval;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1735)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1736) if (mmap_write_lock_killable(mm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1737) return -EINTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1738)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1739) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1740) * This function tries to be smart and unmap shm segments that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1741) * were modified by partial mlock or munmap calls:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1742) * - It first determines the size of the shm segment that should be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1743) * unmapped: It searches for a vma that is backed by shm and that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1744) * started at address shmaddr. It records it's size and then unmaps
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1745) * it.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1746) * - Then it unmaps all shm vmas that started at shmaddr and that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1747) * are within the initially determined size and that are from the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1748) * same shm segment from which we determined the size.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1749) * Errors from do_munmap are ignored: the function only fails if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1750) * it's called with invalid parameters or if it's called to unmap
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1751) * a part of a vma. Both calls in this function are for full vmas,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1752) * the parameters are directly copied from the vma itself and always
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1753) * valid - therefore do_munmap cannot fail. (famous last words?)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1754) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1755) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1756) * If it had been mremap()'d, the starting address would not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1757) * match the usual checks anyway. So assume all vma's are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1758) * above the starting address given.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1759) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1760) vma = find_vma(mm, addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1761)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1762) #ifdef CONFIG_MMU
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1763) while (vma) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1764) next = vma->vm_next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1765)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1766) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1767) * Check if the starting address would match, i.e. it's
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1768) * a fragment created by mprotect() and/or munmap(), or it
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1769) * otherwise it starts at this address with no hassles.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1770) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1771) if ((vma->vm_ops == &shm_vm_ops) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1772) (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1773)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1774) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1775) * Record the file of the shm segment being
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1776) * unmapped. With mremap(), someone could place
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1777) * page from another segment but with equal offsets
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1778) * in the range we are unmapping.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1779) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1780) file = vma->vm_file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1781) size = i_size_read(file_inode(vma->vm_file));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1782) do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1783) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1784) * We discovered the size of the shm segment, so
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1785) * break out of here and fall through to the next
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1786) * loop that uses the size information to stop
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1787) * searching for matching vma's.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1788) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1789) retval = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1790) vma = next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1791) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1792) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1793) vma = next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1794) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1795)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1796) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1797) * We need look no further than the maximum address a fragment
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1798) * could possibly have landed at. Also cast things to loff_t to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1799) * prevent overflows and make comparisons vs. equal-width types.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1800) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1801) size = PAGE_ALIGN(size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1802) while (vma && (loff_t)(vma->vm_end - addr) <= size) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1803) next = vma->vm_next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1804)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1805) /* finding a matching vma now does not alter retval */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1806) if ((vma->vm_ops == &shm_vm_ops) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1807) ((vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1808) (vma->vm_file == file))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1809) do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1810) vma = next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1811) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1812)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1813) #else /* CONFIG_MMU */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1814) /* under NOMMU conditions, the exact address to be destroyed must be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1815) * given
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1816) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1817) if (vma && vma->vm_start == addr && vma->vm_ops == &shm_vm_ops) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1818) do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1819) retval = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1820) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1821)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1822) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1823)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1824) mmap_write_unlock(mm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1825) return retval;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1826) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1827)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1828) SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1829) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1830) return ksys_shmdt(shmaddr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1831) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1832)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1833) #ifdef CONFIG_PROC_FS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1834) static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1835) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1836) struct pid_namespace *pid_ns = ipc_seq_pid_ns(s);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1837) struct user_namespace *user_ns = seq_user_ns(s);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1838) struct kern_ipc_perm *ipcp = it;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1839) struct shmid_kernel *shp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1840) unsigned long rss = 0, swp = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1841)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1842) shp = container_of(ipcp, struct shmid_kernel, shm_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1843) shm_add_rss_swap(shp, &rss, &swp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1844)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1845) #if BITS_PER_LONG <= 32
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1846) #define SIZE_SPEC "%10lu"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1847) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1848) #define SIZE_SPEC "%21lu"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1849) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1850)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1851) seq_printf(s,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1852) "%10d %10d %4o " SIZE_SPEC " %5u %5u "
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1853) "%5lu %5u %5u %5u %5u %10llu %10llu %10llu "
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1854) SIZE_SPEC " " SIZE_SPEC "\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1855) shp->shm_perm.key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1856) shp->shm_perm.id,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1857) shp->shm_perm.mode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1858) shp->shm_segsz,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1859) pid_nr_ns(shp->shm_cprid, pid_ns),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1860) pid_nr_ns(shp->shm_lprid, pid_ns),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1861) shp->shm_nattch,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1862) from_kuid_munged(user_ns, shp->shm_perm.uid),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1863) from_kgid_munged(user_ns, shp->shm_perm.gid),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1864) from_kuid_munged(user_ns, shp->shm_perm.cuid),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1865) from_kgid_munged(user_ns, shp->shm_perm.cgid),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1866) shp->shm_atim,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1867) shp->shm_dtim,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1868) shp->shm_ctim,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1869) rss * PAGE_SIZE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1870) swp * PAGE_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1871)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1872) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1873) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1874) #endif
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags