Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 7d8a45695cc8f9fcdf4121fcbd897ecb63f758e4

Authored by Will Deacon
Committed by Linus Torvalds
1 parent 4e791c98ae
Exists in smarc-l5.0.0_1.0.0-ga and in 5 other branches imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga

ipc: shm: restore MADV_REMOVE functionality on shared memory segments 

Commit 17cf28afea2a ("mm/fs: remove truncate_range") removed the
truncate_range inode operation in favour of the fallocate file
operation.

When using SYSV IPC shared memory segments, calling madvise with the
MADV_REMOVE advice on an area of shared memory will attempt to invoke
the .fallocate function for the shm_file_operations, which is NULL and
therefore returns -EOPNOTSUPP to userspace.  The previous behaviour
would inherit the inode_operations from the underlying tmpfs file and
invoke truncate_range there.

This patch restores the previous behaviour by wrapping the underlying
fallocate function in shm_fallocate, as we do for fsync.

[hughd@google.com: use -ENOTSUPP in shm_fallocate()]
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 12 additions and 0 deletions Inline Diff

1 /* 1 /*
2 * linux/ipc/shm.c 2 * linux/ipc/shm.c
3 * Copyright (C) 1992, 1993 Krishna Balasubramanian 3 * Copyright (C) 1992, 1993 Krishna Balasubramanian
4 * Many improvements/fixes by Bruno Haible. 4 * Many improvements/fixes by Bruno Haible.
5 * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994. 5 * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
6 * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli. 6 * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
7 * 7 *
8 * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com> 8 * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
9 * BIGMEM support, Andrea Arcangeli <andrea@suse.de> 9 * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
10 * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr> 10 * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
11 * HIGHMEM support, Ingo Molnar <mingo@redhat.com> 11 * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
12 * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com> 12 * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
13 * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com> 13 * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
14 * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com> 14 * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
15 * 15 *
16 * support for audit of ipc object properties and permission changes 16 * support for audit of ipc object properties and permission changes
17 * Dustin Kirkland <dustin.kirkland@us.ibm.com> 17 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
18 * 18 *
19 * namespaces support 19 * namespaces support
20 * OpenVZ, SWsoft Inc. 20 * OpenVZ, SWsoft Inc.
21 * Pavel Emelianov <xemul@openvz.org> 21 * Pavel Emelianov <xemul@openvz.org>
22 */ 22 */
23 23
24 #include <linux/slab.h> 24 #include <linux/slab.h>
25 #include <linux/mm.h> 25 #include <linux/mm.h>
26 #include <linux/hugetlb.h> 26 #include <linux/hugetlb.h>
27 #include <linux/shm.h> 27 #include <linux/shm.h>
28 #include <linux/init.h> 28 #include <linux/init.h>
29 #include <linux/file.h> 29 #include <linux/file.h>
30 #include <linux/mman.h> 30 #include <linux/mman.h>
31 #include <linux/shmem_fs.h> 31 #include <linux/shmem_fs.h>
32 #include <linux/security.h> 32 #include <linux/security.h>
33 #include <linux/syscalls.h> 33 #include <linux/syscalls.h>
34 #include <linux/audit.h> 34 #include <linux/audit.h>
35 #include <linux/capability.h> 35 #include <linux/capability.h>
36 #include <linux/ptrace.h> 36 #include <linux/ptrace.h>
37 #include <linux/seq_file.h> 37 #include <linux/seq_file.h>
38 #include <linux/rwsem.h> 38 #include <linux/rwsem.h>
39 #include <linux/nsproxy.h> 39 #include <linux/nsproxy.h>
40 #include <linux/mount.h> 40 #include <linux/mount.h>
41 #include <linux/ipc_namespace.h> 41 #include <linux/ipc_namespace.h>
42 42
43 #include <asm/uaccess.h> 43 #include <asm/uaccess.h>
44 44
45 #include "util.h" 45 #include "util.h"
46 46
47 struct shm_file_data { 47 struct shm_file_data {
48 int id; 48 int id;
49 struct ipc_namespace *ns; 49 struct ipc_namespace *ns;
50 struct file *file; 50 struct file *file;
51 const struct vm_operations_struct *vm_ops; 51 const struct vm_operations_struct *vm_ops;
52 }; 52 };
53 53
54 #define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data)) 54 #define shm_file_data(file) (*((struct shm_file_data **)&(file)->private_data))
55 55
56 static const struct file_operations shm_file_operations; 56 static const struct file_operations shm_file_operations;
57 static const struct vm_operations_struct shm_vm_ops; 57 static const struct vm_operations_struct shm_vm_ops;
58 58
59 #define shm_ids(ns) ((ns)->ids[IPC_SHM_IDS]) 59 #define shm_ids(ns) ((ns)->ids[IPC_SHM_IDS])
60 60
61 #define shm_unlock(shp) \ 61 #define shm_unlock(shp) \
62 ipc_unlock(&(shp)->shm_perm) 62 ipc_unlock(&(shp)->shm_perm)
63 63
64 static int newseg(struct ipc_namespace *, struct ipc_params *); 64 static int newseg(struct ipc_namespace *, struct ipc_params *);
65 static void shm_open(struct vm_area_struct *vma); 65 static void shm_open(struct vm_area_struct *vma);
66 static void shm_close(struct vm_area_struct *vma); 66 static void shm_close(struct vm_area_struct *vma);
67 static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp); 67 static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
68 #ifdef CONFIG_PROC_FS 68 #ifdef CONFIG_PROC_FS
69 static int sysvipc_shm_proc_show(struct seq_file *s, void *it); 69 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
70 #endif 70 #endif
71 71
72 void shm_init_ns(struct ipc_namespace *ns) 72 void shm_init_ns(struct ipc_namespace *ns)
73 { 73 {
74 ns->shm_ctlmax = SHMMAX; 74 ns->shm_ctlmax = SHMMAX;
75 ns->shm_ctlall = SHMALL; 75 ns->shm_ctlall = SHMALL;
76 ns->shm_ctlmni = SHMMNI; 76 ns->shm_ctlmni = SHMMNI;
77 ns->shm_rmid_forced = 0; 77 ns->shm_rmid_forced = 0;
78 ns->shm_tot = 0; 78 ns->shm_tot = 0;
79 ipc_init_ids(&shm_ids(ns)); 79 ipc_init_ids(&shm_ids(ns));
80 } 80 }
81 81
82 /* 82 /*
83 * Called with shm_ids.rw_mutex (writer) and the shp structure locked. 83 * Called with shm_ids.rw_mutex (writer) and the shp structure locked.
84 * Only shm_ids.rw_mutex remains locked on exit. 84 * Only shm_ids.rw_mutex remains locked on exit.
85 */ 85 */
86 static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp) 86 static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
87 { 87 {
88 struct shmid_kernel *shp; 88 struct shmid_kernel *shp;
89 shp = container_of(ipcp, struct shmid_kernel, shm_perm); 89 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
90 90
91 if (shp->shm_nattch){ 91 if (shp->shm_nattch){
92 shp->shm_perm.mode |= SHM_DEST; 92 shp->shm_perm.mode |= SHM_DEST;
93 /* Do not find it any more */ 93 /* Do not find it any more */
94 shp->shm_perm.key = IPC_PRIVATE; 94 shp->shm_perm.key = IPC_PRIVATE;
95 shm_unlock(shp); 95 shm_unlock(shp);
96 } else 96 } else
97 shm_destroy(ns, shp); 97 shm_destroy(ns, shp);
98 } 98 }
99 99
100 #ifdef CONFIG_IPC_NS 100 #ifdef CONFIG_IPC_NS
101 void shm_exit_ns(struct ipc_namespace *ns) 101 void shm_exit_ns(struct ipc_namespace *ns)
102 { 102 {
103 free_ipcs(ns, &shm_ids(ns), do_shm_rmid); 103 free_ipcs(ns, &shm_ids(ns), do_shm_rmid);
104 idr_destroy(&ns->ids[IPC_SHM_IDS].ipcs_idr); 104 idr_destroy(&ns->ids[IPC_SHM_IDS].ipcs_idr);
105 } 105 }
106 #endif 106 #endif
107 107
108 static int __init ipc_ns_init(void) 108 static int __init ipc_ns_init(void)
109 { 109 {
110 shm_init_ns(&init_ipc_ns); 110 shm_init_ns(&init_ipc_ns);
111 return 0; 111 return 0;
112 } 112 }
113 113
114 pure_initcall(ipc_ns_init); 114 pure_initcall(ipc_ns_init);
115 115
116 void __init shm_init (void) 116 void __init shm_init (void)
117 { 117 {
118 ipc_init_proc_interface("sysvipc/shm", 118 ipc_init_proc_interface("sysvipc/shm",
119 #if BITS_PER_LONG <= 32 119 #if BITS_PER_LONG <= 32
120 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n", 120 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n",
121 #else 121 #else
122 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n", 122 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime rss swap\n",
123 #endif 123 #endif
124 IPC_SHM_IDS, sysvipc_shm_proc_show); 124 IPC_SHM_IDS, sysvipc_shm_proc_show);
125 } 125 }
126 126
127 /* 127 /*
128 * shm_lock_(check_) routines are called in the paths where the rw_mutex 128 * shm_lock_(check_) routines are called in the paths where the rw_mutex
129 * is not necessarily held. 129 * is not necessarily held.
130 */ 130 */
131 static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id) 131 static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
132 { 132 {
133 struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id); 133 struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id);
134 134
135 if (IS_ERR(ipcp)) 135 if (IS_ERR(ipcp))
136 return (struct shmid_kernel *)ipcp; 136 return (struct shmid_kernel *)ipcp;
137 137
138 return container_of(ipcp, struct shmid_kernel, shm_perm); 138 return container_of(ipcp, struct shmid_kernel, shm_perm);
139 } 139 }
140 140
141 static inline void shm_lock_by_ptr(struct shmid_kernel *ipcp) 141 static inline void shm_lock_by_ptr(struct shmid_kernel *ipcp)
142 { 142 {
143 rcu_read_lock(); 143 rcu_read_lock();
144 spin_lock(&ipcp->shm_perm.lock); 144 spin_lock(&ipcp->shm_perm.lock);
145 } 145 }
146 146
147 static inline struct shmid_kernel *shm_lock_check(struct ipc_namespace *ns, 147 static inline struct shmid_kernel *shm_lock_check(struct ipc_namespace *ns,
148 int id) 148 int id)
149 { 149 {
150 struct kern_ipc_perm *ipcp = ipc_lock_check(&shm_ids(ns), id); 150 struct kern_ipc_perm *ipcp = ipc_lock_check(&shm_ids(ns), id);
151 151
152 if (IS_ERR(ipcp)) 152 if (IS_ERR(ipcp))
153 return (struct shmid_kernel *)ipcp; 153 return (struct shmid_kernel *)ipcp;
154 154
155 return container_of(ipcp, struct shmid_kernel, shm_perm); 155 return container_of(ipcp, struct shmid_kernel, shm_perm);
156 } 156 }
157 157
158 static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s) 158 static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s)
159 { 159 {
160 ipc_rmid(&shm_ids(ns), &s->shm_perm); 160 ipc_rmid(&shm_ids(ns), &s->shm_perm);
161 } 161 }
162 162
163 163
164 /* This is called by fork, once for every shm attach. */ 164 /* This is called by fork, once for every shm attach. */
165 static void shm_open(struct vm_area_struct *vma) 165 static void shm_open(struct vm_area_struct *vma)
166 { 166 {
167 struct file *file = vma->vm_file; 167 struct file *file = vma->vm_file;
168 struct shm_file_data *sfd = shm_file_data(file); 168 struct shm_file_data *sfd = shm_file_data(file);
169 struct shmid_kernel *shp; 169 struct shmid_kernel *shp;
170 170
171 shp = shm_lock(sfd->ns, sfd->id); 171 shp = shm_lock(sfd->ns, sfd->id);
172 BUG_ON(IS_ERR(shp)); 172 BUG_ON(IS_ERR(shp));
173 shp->shm_atim = get_seconds(); 173 shp->shm_atim = get_seconds();
174 shp->shm_lprid = task_tgid_vnr(current); 174 shp->shm_lprid = task_tgid_vnr(current);
175 shp->shm_nattch++; 175 shp->shm_nattch++;
176 shm_unlock(shp); 176 shm_unlock(shp);
177 } 177 }
178 178
179 /* 179 /*
180 * shm_destroy - free the struct shmid_kernel 180 * shm_destroy - free the struct shmid_kernel
181 * 181 *
182 * @ns: namespace 182 * @ns: namespace
183 * @shp: struct to free 183 * @shp: struct to free
184 * 184 *
185 * It has to be called with shp and shm_ids.rw_mutex (writer) locked, 185 * It has to be called with shp and shm_ids.rw_mutex (writer) locked,
186 * but returns with shp unlocked and freed. 186 * but returns with shp unlocked and freed.
187 */ 187 */
188 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) 188 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
189 { 189 {
190 ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT; 190 ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
191 shm_rmid(ns, shp); 191 shm_rmid(ns, shp);
192 shm_unlock(shp); 192 shm_unlock(shp);
193 if (!is_file_hugepages(shp->shm_file)) 193 if (!is_file_hugepages(shp->shm_file))
194 shmem_lock(shp->shm_file, 0, shp->mlock_user); 194 shmem_lock(shp->shm_file, 0, shp->mlock_user);
195 else if (shp->mlock_user) 195 else if (shp->mlock_user)
196 user_shm_unlock(shp->shm_file->f_path.dentry->d_inode->i_size, 196 user_shm_unlock(shp->shm_file->f_path.dentry->d_inode->i_size,
197 shp->mlock_user); 197 shp->mlock_user);
198 fput (shp->shm_file); 198 fput (shp->shm_file);
199 security_shm_free(shp); 199 security_shm_free(shp);
200 ipc_rcu_putref(shp); 200 ipc_rcu_putref(shp);
201 } 201 }
202 202
203 /* 203 /*
204 * shm_may_destroy - identifies whether shm segment should be destroyed now 204 * shm_may_destroy - identifies whether shm segment should be destroyed now
205 * 205 *
206 * Returns true if and only if there are no active users of the segment and 206 * Returns true if and only if there are no active users of the segment and
207 * one of the following is true: 207 * one of the following is true:
208 * 208 *
209 * 1) shmctl(id, IPC_RMID, NULL) was called for this shp 209 * 1) shmctl(id, IPC_RMID, NULL) was called for this shp
210 * 210 *
211 * 2) sysctl kernel.shm_rmid_forced is set to 1. 211 * 2) sysctl kernel.shm_rmid_forced is set to 1.
212 */ 212 */
213 static bool shm_may_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) 213 static bool shm_may_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
214 { 214 {
215 return (shp->shm_nattch == 0) && 215 return (shp->shm_nattch == 0) &&
216 (ns->shm_rmid_forced || 216 (ns->shm_rmid_forced ||
217 (shp->shm_perm.mode & SHM_DEST)); 217 (shp->shm_perm.mode & SHM_DEST));
218 } 218 }
219 219
220 /* 220 /*
221 * remove the attach descriptor vma. 221 * remove the attach descriptor vma.
222 * free memory for segment if it is marked destroyed. 222 * free memory for segment if it is marked destroyed.
223 * The descriptor has already been removed from the current->mm->mmap list 223 * The descriptor has already been removed from the current->mm->mmap list
224 * and will later be kfree()d. 224 * and will later be kfree()d.
225 */ 225 */
226 static void shm_close(struct vm_area_struct *vma) 226 static void shm_close(struct vm_area_struct *vma)
227 { 227 {
228 struct file * file = vma->vm_file; 228 struct file * file = vma->vm_file;
229 struct shm_file_data *sfd = shm_file_data(file); 229 struct shm_file_data *sfd = shm_file_data(file);
230 struct shmid_kernel *shp; 230 struct shmid_kernel *shp;
231 struct ipc_namespace *ns = sfd->ns; 231 struct ipc_namespace *ns = sfd->ns;
232 232
233 down_write(&shm_ids(ns).rw_mutex); 233 down_write(&shm_ids(ns).rw_mutex);
234 /* remove from the list of attaches of the shm segment */ 234 /* remove from the list of attaches of the shm segment */
235 shp = shm_lock(ns, sfd->id); 235 shp = shm_lock(ns, sfd->id);
236 BUG_ON(IS_ERR(shp)); 236 BUG_ON(IS_ERR(shp));
237 shp->shm_lprid = task_tgid_vnr(current); 237 shp->shm_lprid = task_tgid_vnr(current);
238 shp->shm_dtim = get_seconds(); 238 shp->shm_dtim = get_seconds();
239 shp->shm_nattch--; 239 shp->shm_nattch--;
240 if (shm_may_destroy(ns, shp)) 240 if (shm_may_destroy(ns, shp))
241 shm_destroy(ns, shp); 241 shm_destroy(ns, shp);
242 else 242 else
243 shm_unlock(shp); 243 shm_unlock(shp);
244 up_write(&shm_ids(ns).rw_mutex); 244 up_write(&shm_ids(ns).rw_mutex);
245 } 245 }
246 246
247 /* Called with ns->shm_ids(ns).rw_mutex locked */ 247 /* Called with ns->shm_ids(ns).rw_mutex locked */
248 static int shm_try_destroy_current(int id, void *p, void *data) 248 static int shm_try_destroy_current(int id, void *p, void *data)
249 { 249 {
250 struct ipc_namespace *ns = data; 250 struct ipc_namespace *ns = data;
251 struct kern_ipc_perm *ipcp = p; 251 struct kern_ipc_perm *ipcp = p;
252 struct shmid_kernel *shp = container_of(ipcp, struct shmid_kernel, shm_perm); 252 struct shmid_kernel *shp = container_of(ipcp, struct shmid_kernel, shm_perm);
253 253
254 if (shp->shm_creator != current) 254 if (shp->shm_creator != current)
255 return 0; 255 return 0;
256 256
257 /* 257 /*
258 * Mark it as orphaned to destroy the segment when 258 * Mark it as orphaned to destroy the segment when
259 * kernel.shm_rmid_forced is changed. 259 * kernel.shm_rmid_forced is changed.
260 * It is noop if the following shm_may_destroy() returns true. 260 * It is noop if the following shm_may_destroy() returns true.
261 */ 261 */
262 shp->shm_creator = NULL; 262 shp->shm_creator = NULL;
263 263
264 /* 264 /*
265 * Don't even try to destroy it. If shm_rmid_forced=0 and IPC_RMID 265 * Don't even try to destroy it. If shm_rmid_forced=0 and IPC_RMID
266 * is not set, it shouldn't be deleted here. 266 * is not set, it shouldn't be deleted here.
267 */ 267 */
268 if (!ns->shm_rmid_forced) 268 if (!ns->shm_rmid_forced)
269 return 0; 269 return 0;
270 270
271 if (shm_may_destroy(ns, shp)) { 271 if (shm_may_destroy(ns, shp)) {
272 shm_lock_by_ptr(shp); 272 shm_lock_by_ptr(shp);
273 shm_destroy(ns, shp); 273 shm_destroy(ns, shp);
274 } 274 }
275 return 0; 275 return 0;
276 } 276 }
277 277
278 /* Called with ns->shm_ids(ns).rw_mutex locked */ 278 /* Called with ns->shm_ids(ns).rw_mutex locked */
279 static int shm_try_destroy_orphaned(int id, void *p, void *data) 279 static int shm_try_destroy_orphaned(int id, void *p, void *data)
280 { 280 {
281 struct ipc_namespace *ns = data; 281 struct ipc_namespace *ns = data;
282 struct kern_ipc_perm *ipcp = p; 282 struct kern_ipc_perm *ipcp = p;
283 struct shmid_kernel *shp = container_of(ipcp, struct shmid_kernel, shm_perm); 283 struct shmid_kernel *shp = container_of(ipcp, struct shmid_kernel, shm_perm);
284 284
285 /* 285 /*
286 * We want to destroy segments without users and with already 286 * We want to destroy segments without users and with already
287 * exit'ed originating process. 287 * exit'ed originating process.
288 * 288 *
289 * As shp->* are changed under rw_mutex, it's safe to skip shp locking. 289 * As shp->* are changed under rw_mutex, it's safe to skip shp locking.
290 */ 290 */
291 if (shp->shm_creator != NULL) 291 if (shp->shm_creator != NULL)
292 return 0; 292 return 0;
293 293
294 if (shm_may_destroy(ns, shp)) { 294 if (shm_may_destroy(ns, shp)) {
295 shm_lock_by_ptr(shp); 295 shm_lock_by_ptr(shp);
296 shm_destroy(ns, shp); 296 shm_destroy(ns, shp);
297 } 297 }
298 return 0; 298 return 0;
299 } 299 }
300 300
301 void shm_destroy_orphaned(struct ipc_namespace *ns) 301 void shm_destroy_orphaned(struct ipc_namespace *ns)
302 { 302 {
303 down_write(&shm_ids(ns).rw_mutex); 303 down_write(&shm_ids(ns).rw_mutex);
304 if (shm_ids(ns).in_use) 304 if (shm_ids(ns).in_use)
305 idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns); 305 idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns);
306 up_write(&shm_ids(ns).rw_mutex); 306 up_write(&shm_ids(ns).rw_mutex);
307 } 307 }
308 308
309 309
310 void exit_shm(struct task_struct *task) 310 void exit_shm(struct task_struct *task)
311 { 311 {
312 struct ipc_namespace *ns = task->nsproxy->ipc_ns; 312 struct ipc_namespace *ns = task->nsproxy->ipc_ns;
313 313
314 if (shm_ids(ns).in_use == 0) 314 if (shm_ids(ns).in_use == 0)
315 return; 315 return;
316 316
317 /* Destroy all already created segments, but not mapped yet */ 317 /* Destroy all already created segments, but not mapped yet */
318 down_write(&shm_ids(ns).rw_mutex); 318 down_write(&shm_ids(ns).rw_mutex);
319 if (shm_ids(ns).in_use) 319 if (shm_ids(ns).in_use)
320 idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_current, ns); 320 idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_current, ns);
321 up_write(&shm_ids(ns).rw_mutex); 321 up_write(&shm_ids(ns).rw_mutex);
322 } 322 }
323 323
324 static int shm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) 324 static int shm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
325 { 325 {
326 struct file *file = vma->vm_file; 326 struct file *file = vma->vm_file;
327 struct shm_file_data *sfd = shm_file_data(file); 327 struct shm_file_data *sfd = shm_file_data(file);
328 328
329 return sfd->vm_ops->fault(vma, vmf); 329 return sfd->vm_ops->fault(vma, vmf);
330 } 330 }
331 331
332 #ifdef CONFIG_NUMA 332 #ifdef CONFIG_NUMA
333 static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new) 333 static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
334 { 334 {
335 struct file *file = vma->vm_file; 335 struct file *file = vma->vm_file;
336 struct shm_file_data *sfd = shm_file_data(file); 336 struct shm_file_data *sfd = shm_file_data(file);
337 int err = 0; 337 int err = 0;
338 if (sfd->vm_ops->set_policy) 338 if (sfd->vm_ops->set_policy)
339 err = sfd->vm_ops->set_policy(vma, new); 339 err = sfd->vm_ops->set_policy(vma, new);
340 return err; 340 return err;
341 } 341 }
342 342
343 static struct mempolicy *shm_get_policy(struct vm_area_struct *vma, 343 static struct mempolicy *shm_get_policy(struct vm_area_struct *vma,
344 unsigned long addr) 344 unsigned long addr)
345 { 345 {
346 struct file *file = vma->vm_file; 346 struct file *file = vma->vm_file;
347 struct shm_file_data *sfd = shm_file_data(file); 347 struct shm_file_data *sfd = shm_file_data(file);
348 struct mempolicy *pol = NULL; 348 struct mempolicy *pol = NULL;
349 349
350 if (sfd->vm_ops->get_policy) 350 if (sfd->vm_ops->get_policy)
351 pol = sfd->vm_ops->get_policy(vma, addr); 351 pol = sfd->vm_ops->get_policy(vma, addr);
352 else if (vma->vm_policy) 352 else if (vma->vm_policy)
353 pol = vma->vm_policy; 353 pol = vma->vm_policy;
354 354
355 return pol; 355 return pol;
356 } 356 }
357 #endif 357 #endif
358 358
359 static int shm_mmap(struct file * file, struct vm_area_struct * vma) 359 static int shm_mmap(struct file * file, struct vm_area_struct * vma)
360 { 360 {
361 struct shm_file_data *sfd = shm_file_data(file); 361 struct shm_file_data *sfd = shm_file_data(file);
362 int ret; 362 int ret;
363 363
364 ret = sfd->file->f_op->mmap(sfd->file, vma); 364 ret = sfd->file->f_op->mmap(sfd->file, vma);
365 if (ret != 0) 365 if (ret != 0)
366 return ret; 366 return ret;
367 sfd->vm_ops = vma->vm_ops; 367 sfd->vm_ops = vma->vm_ops;
368 #ifdef CONFIG_MMU 368 #ifdef CONFIG_MMU
369 BUG_ON(!sfd->vm_ops->fault); 369 BUG_ON(!sfd->vm_ops->fault);
370 #endif 370 #endif
371 vma->vm_ops = &shm_vm_ops; 371 vma->vm_ops = &shm_vm_ops;
372 shm_open(vma); 372 shm_open(vma);
373 373
374 return ret; 374 return ret;
375 } 375 }
376 376
377 static int shm_release(struct inode *ino, struct file *file) 377 static int shm_release(struct inode *ino, struct file *file)
378 { 378 {
379 struct shm_file_data *sfd = shm_file_data(file); 379 struct shm_file_data *sfd = shm_file_data(file);
380 380
381 put_ipc_ns(sfd->ns); 381 put_ipc_ns(sfd->ns);
382 shm_file_data(file) = NULL; 382 shm_file_data(file) = NULL;
383 kfree(sfd); 383 kfree(sfd);
384 return 0; 384 return 0;
385 } 385 }
386 386
387 static int shm_fsync(struct file *file, loff_t start, loff_t end, int datasync) 387 static int shm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
388 { 388 {
389 struct shm_file_data *sfd = shm_file_data(file); 389 struct shm_file_data *sfd = shm_file_data(file);
390 390
391 if (!sfd->file->f_op->fsync) 391 if (!sfd->file->f_op->fsync)
392 return -EINVAL; 392 return -EINVAL;
393 return sfd->file->f_op->fsync(sfd->file, start, end, datasync); 393 return sfd->file->f_op->fsync(sfd->file, start, end, datasync);
394 } 394 }
395 395
396 static long shm_fallocate(struct file *file, int mode, loff_t offset,
397 loff_t len)
398 {
399 struct shm_file_data *sfd = shm_file_data(file);
400
401 if (!sfd->file->f_op->fallocate)
402 return -EOPNOTSUPP;
403 return sfd->file->f_op->fallocate(file, mode, offset, len);
404 }
405
396 static unsigned long shm_get_unmapped_area(struct file *file, 406 static unsigned long shm_get_unmapped_area(struct file *file,
397 unsigned long addr, unsigned long len, unsigned long pgoff, 407 unsigned long addr, unsigned long len, unsigned long pgoff,
398 unsigned long flags) 408 unsigned long flags)
399 { 409 {
400 struct shm_file_data *sfd = shm_file_data(file); 410 struct shm_file_data *sfd = shm_file_data(file);
401 return sfd->file->f_op->get_unmapped_area(sfd->file, addr, len, 411 return sfd->file->f_op->get_unmapped_area(sfd->file, addr, len,
402 pgoff, flags); 412 pgoff, flags);
403 } 413 }
404 414
405 static const struct file_operations shm_file_operations = { 415 static const struct file_operations shm_file_operations = {
406 .mmap = shm_mmap, 416 .mmap = shm_mmap,
407 .fsync = shm_fsync, 417 .fsync = shm_fsync,
408 .release = shm_release, 418 .release = shm_release,
409 #ifndef CONFIG_MMU 419 #ifndef CONFIG_MMU
410 .get_unmapped_area = shm_get_unmapped_area, 420 .get_unmapped_area = shm_get_unmapped_area,
411 #endif 421 #endif
412 .llseek = noop_llseek, 422 .llseek = noop_llseek,
423 .fallocate = shm_fallocate,
413 }; 424 };
414 425
415 static const struct file_operations shm_file_operations_huge = { 426 static const struct file_operations shm_file_operations_huge = {
416 .mmap = shm_mmap, 427 .mmap = shm_mmap,
417 .fsync = shm_fsync, 428 .fsync = shm_fsync,
418 .release = shm_release, 429 .release = shm_release,
419 .get_unmapped_area = shm_get_unmapped_area, 430 .get_unmapped_area = shm_get_unmapped_area,
420 .llseek = noop_llseek, 431 .llseek = noop_llseek,
432 .fallocate = shm_fallocate,
421 }; 433 };
422 434
423 int is_file_shm_hugepages(struct file *file) 435 int is_file_shm_hugepages(struct file *file)
424 { 436 {
425 return file->f_op == &shm_file_operations_huge; 437 return file->f_op == &shm_file_operations_huge;
426 } 438 }
427 439
428 static const struct vm_operations_struct shm_vm_ops = { 440 static const struct vm_operations_struct shm_vm_ops = {
429 .open = shm_open, /* callback for a new vm-area open */ 441 .open = shm_open, /* callback for a new vm-area open */
430 .close = shm_close, /* callback for when the vm-area is released */ 442 .close = shm_close, /* callback for when the vm-area is released */
431 .fault = shm_fault, 443 .fault = shm_fault,
432 #if defined(CONFIG_NUMA) 444 #if defined(CONFIG_NUMA)
433 .set_policy = shm_set_policy, 445 .set_policy = shm_set_policy,
434 .get_policy = shm_get_policy, 446 .get_policy = shm_get_policy,
435 #endif 447 #endif
436 }; 448 };
437 449
438 /** 450 /**
439 * newseg - Create a new shared memory segment 451 * newseg - Create a new shared memory segment
440 * @ns: namespace 452 * @ns: namespace
441 * @params: ptr to the structure that contains key, size and shmflg 453 * @params: ptr to the structure that contains key, size and shmflg
442 * 454 *
443 * Called with shm_ids.rw_mutex held as a writer. 455 * Called with shm_ids.rw_mutex held as a writer.
444 */ 456 */
445 457
446 static int newseg(struct ipc_namespace *ns, struct ipc_params *params) 458 static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
447 { 459 {
448 key_t key = params->key; 460 key_t key = params->key;
449 int shmflg = params->flg; 461 int shmflg = params->flg;
450 size_t size = params->u.size; 462 size_t size = params->u.size;
451 int error; 463 int error;
452 struct shmid_kernel *shp; 464 struct shmid_kernel *shp;
453 int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT; 465 int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
454 struct file * file; 466 struct file * file;
455 char name[13]; 467 char name[13];
456 int id; 468 int id;
457 vm_flags_t acctflag = 0; 469 vm_flags_t acctflag = 0;
458 470
459 if (size < SHMMIN || size > ns->shm_ctlmax) 471 if (size < SHMMIN || size > ns->shm_ctlmax)
460 return -EINVAL; 472 return -EINVAL;
461 473
462 if (ns->shm_tot + numpages > ns->shm_ctlall) 474 if (ns->shm_tot + numpages > ns->shm_ctlall)
463 return -ENOSPC; 475 return -ENOSPC;
464 476
465 shp = ipc_rcu_alloc(sizeof(*shp)); 477 shp = ipc_rcu_alloc(sizeof(*shp));
466 if (!shp) 478 if (!shp)
467 return -ENOMEM; 479 return -ENOMEM;
468 480
469 shp->shm_perm.key = key; 481 shp->shm_perm.key = key;
470 shp->shm_perm.mode = (shmflg & S_IRWXUGO); 482 shp->shm_perm.mode = (shmflg & S_IRWXUGO);
471 shp->mlock_user = NULL; 483 shp->mlock_user = NULL;
472 484
473 shp->shm_perm.security = NULL; 485 shp->shm_perm.security = NULL;
474 error = security_shm_alloc(shp); 486 error = security_shm_alloc(shp);
475 if (error) { 487 if (error) {
476 ipc_rcu_putref(shp); 488 ipc_rcu_putref(shp);
477 return error; 489 return error;
478 } 490 }
479 491
480 sprintf (name, "SYSV%08x", key); 492 sprintf (name, "SYSV%08x", key);
481 if (shmflg & SHM_HUGETLB) { 493 if (shmflg & SHM_HUGETLB) {
482 /* hugetlb_file_setup applies strict accounting */ 494 /* hugetlb_file_setup applies strict accounting */
483 if (shmflg & SHM_NORESERVE) 495 if (shmflg & SHM_NORESERVE)
484 acctflag = VM_NORESERVE; 496 acctflag = VM_NORESERVE;
485 file = hugetlb_file_setup(name, 0, size, acctflag, 497 file = hugetlb_file_setup(name, 0, size, acctflag,
486 &shp->mlock_user, HUGETLB_SHMFS_INODE); 498 &shp->mlock_user, HUGETLB_SHMFS_INODE);
487 } else { 499 } else {
488 /* 500 /*
489 * Do not allow no accounting for OVERCOMMIT_NEVER, even 501 * Do not allow no accounting for OVERCOMMIT_NEVER, even
490 * if it's asked for. 502 * if it's asked for.
491 */ 503 */
492 if ((shmflg & SHM_NORESERVE) && 504 if ((shmflg & SHM_NORESERVE) &&
493 sysctl_overcommit_memory != OVERCOMMIT_NEVER) 505 sysctl_overcommit_memory != OVERCOMMIT_NEVER)
494 acctflag = VM_NORESERVE; 506 acctflag = VM_NORESERVE;
495 file = shmem_file_setup(name, size, acctflag); 507 file = shmem_file_setup(name, size, acctflag);
496 } 508 }
497 error = PTR_ERR(file); 509 error = PTR_ERR(file);
498 if (IS_ERR(file)) 510 if (IS_ERR(file))
499 goto no_file; 511 goto no_file;
500 512
501 id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni); 513 id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
502 if (id < 0) { 514 if (id < 0) {
503 error = id; 515 error = id;
504 goto no_id; 516 goto no_id;
505 } 517 }
506 518
507 shp->shm_cprid = task_tgid_vnr(current); 519 shp->shm_cprid = task_tgid_vnr(current);
508 shp->shm_lprid = 0; 520 shp->shm_lprid = 0;
509 shp->shm_atim = shp->shm_dtim = 0; 521 shp->shm_atim = shp->shm_dtim = 0;
510 shp->shm_ctim = get_seconds(); 522 shp->shm_ctim = get_seconds();
511 shp->shm_segsz = size; 523 shp->shm_segsz = size;
512 shp->shm_nattch = 0; 524 shp->shm_nattch = 0;
513 shp->shm_file = file; 525 shp->shm_file = file;
514 shp->shm_creator = current; 526 shp->shm_creator = current;
515 /* 527 /*
516 * shmid gets reported as "inode#" in /proc/pid/maps. 528 * shmid gets reported as "inode#" in /proc/pid/maps.
517 * proc-ps tools use this. Changing this will break them. 529 * proc-ps tools use this. Changing this will break them.
518 */ 530 */
519 file->f_dentry->d_inode->i_ino = shp->shm_perm.id; 531 file->f_dentry->d_inode->i_ino = shp->shm_perm.id;
520 532
521 ns->shm_tot += numpages; 533 ns->shm_tot += numpages;
522 error = shp->shm_perm.id; 534 error = shp->shm_perm.id;
523 shm_unlock(shp); 535 shm_unlock(shp);
524 return error; 536 return error;
525 537
526 no_id: 538 no_id:
527 if (is_file_hugepages(file) && shp->mlock_user) 539 if (is_file_hugepages(file) && shp->mlock_user)
528 user_shm_unlock(size, shp->mlock_user); 540 user_shm_unlock(size, shp->mlock_user);
529 fput(file); 541 fput(file);
530 no_file: 542 no_file:
531 security_shm_free(shp); 543 security_shm_free(shp);
532 ipc_rcu_putref(shp); 544 ipc_rcu_putref(shp);
533 return error; 545 return error;
534 } 546 }
535 547
536 /* 548 /*
537 * Called with shm_ids.rw_mutex and ipcp locked. 549 * Called with shm_ids.rw_mutex and ipcp locked.
538 */ 550 */
539 static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg) 551 static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg)
540 { 552 {
541 struct shmid_kernel *shp; 553 struct shmid_kernel *shp;
542 554
543 shp = container_of(ipcp, struct shmid_kernel, shm_perm); 555 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
544 return security_shm_associate(shp, shmflg); 556 return security_shm_associate(shp, shmflg);
545 } 557 }
546 558
547 /* 559 /*
548 * Called with shm_ids.rw_mutex and ipcp locked. 560 * Called with shm_ids.rw_mutex and ipcp locked.
549 */ 561 */
550 static inline int shm_more_checks(struct kern_ipc_perm *ipcp, 562 static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
551 struct ipc_params *params) 563 struct ipc_params *params)
552 { 564 {
553 struct shmid_kernel *shp; 565 struct shmid_kernel *shp;
554 566
555 shp = container_of(ipcp, struct shmid_kernel, shm_perm); 567 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
556 if (shp->shm_segsz < params->u.size) 568 if (shp->shm_segsz < params->u.size)
557 return -EINVAL; 569 return -EINVAL;
558 570
559 return 0; 571 return 0;
560 } 572 }
561 573
562 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg) 574 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
563 { 575 {
564 struct ipc_namespace *ns; 576 struct ipc_namespace *ns;
565 struct ipc_ops shm_ops; 577 struct ipc_ops shm_ops;
566 struct ipc_params shm_params; 578 struct ipc_params shm_params;
567 579
568 ns = current->nsproxy->ipc_ns; 580 ns = current->nsproxy->ipc_ns;
569 581
570 shm_ops.getnew = newseg; 582 shm_ops.getnew = newseg;
571 shm_ops.associate = shm_security; 583 shm_ops.associate = shm_security;
572 shm_ops.more_checks = shm_more_checks; 584 shm_ops.more_checks = shm_more_checks;
573 585
574 shm_params.key = key; 586 shm_params.key = key;
575 shm_params.flg = shmflg; 587 shm_params.flg = shmflg;
576 shm_params.u.size = size; 588 shm_params.u.size = size;
577 589
578 return ipcget(ns, &shm_ids(ns), &shm_ops, &shm_params); 590 return ipcget(ns, &shm_ids(ns), &shm_ops, &shm_params);
579 } 591 }
580 592
581 static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version) 593 static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
582 { 594 {
583 switch(version) { 595 switch(version) {
584 case IPC_64: 596 case IPC_64:
585 return copy_to_user(buf, in, sizeof(*in)); 597 return copy_to_user(buf, in, sizeof(*in));
586 case IPC_OLD: 598 case IPC_OLD:
587 { 599 {
588 struct shmid_ds out; 600 struct shmid_ds out;
589 601
590 memset(&out, 0, sizeof(out)); 602 memset(&out, 0, sizeof(out));
591 ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm); 603 ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
592 out.shm_segsz = in->shm_segsz; 604 out.shm_segsz = in->shm_segsz;
593 out.shm_atime = in->shm_atime; 605 out.shm_atime = in->shm_atime;
594 out.shm_dtime = in->shm_dtime; 606 out.shm_dtime = in->shm_dtime;
595 out.shm_ctime = in->shm_ctime; 607 out.shm_ctime = in->shm_ctime;
596 out.shm_cpid = in->shm_cpid; 608 out.shm_cpid = in->shm_cpid;
597 out.shm_lpid = in->shm_lpid; 609 out.shm_lpid = in->shm_lpid;
598 out.shm_nattch = in->shm_nattch; 610 out.shm_nattch = in->shm_nattch;
599 611
600 return copy_to_user(buf, &out, sizeof(out)); 612 return copy_to_user(buf, &out, sizeof(out));
601 } 613 }
602 default: 614 default:
603 return -EINVAL; 615 return -EINVAL;
604 } 616 }
605 } 617 }
606 618
607 static inline unsigned long 619 static inline unsigned long
608 copy_shmid_from_user(struct shmid64_ds *out, void __user *buf, int version) 620 copy_shmid_from_user(struct shmid64_ds *out, void __user *buf, int version)
609 { 621 {
610 switch(version) { 622 switch(version) {
611 case IPC_64: 623 case IPC_64:
612 if (copy_from_user(out, buf, sizeof(*out))) 624 if (copy_from_user(out, buf, sizeof(*out)))
613 return -EFAULT; 625 return -EFAULT;
614 return 0; 626 return 0;
615 case IPC_OLD: 627 case IPC_OLD:
616 { 628 {
617 struct shmid_ds tbuf_old; 629 struct shmid_ds tbuf_old;
618 630
619 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old))) 631 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
620 return -EFAULT; 632 return -EFAULT;
621 633
622 out->shm_perm.uid = tbuf_old.shm_perm.uid; 634 out->shm_perm.uid = tbuf_old.shm_perm.uid;
623 out->shm_perm.gid = tbuf_old.shm_perm.gid; 635 out->shm_perm.gid = tbuf_old.shm_perm.gid;
624 out->shm_perm.mode = tbuf_old.shm_perm.mode; 636 out->shm_perm.mode = tbuf_old.shm_perm.mode;
625 637
626 return 0; 638 return 0;
627 } 639 }
628 default: 640 default:
629 return -EINVAL; 641 return -EINVAL;
630 } 642 }
631 } 643 }
632 644
633 static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version) 645 static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
634 { 646 {
635 switch(version) { 647 switch(version) {
636 case IPC_64: 648 case IPC_64:
637 return copy_to_user(buf, in, sizeof(*in)); 649 return copy_to_user(buf, in, sizeof(*in));
638 case IPC_OLD: 650 case IPC_OLD:
639 { 651 {
640 struct shminfo out; 652 struct shminfo out;
641 653
642 if(in->shmmax > INT_MAX) 654 if(in->shmmax > INT_MAX)
643 out.shmmax = INT_MAX; 655 out.shmmax = INT_MAX;
644 else 656 else
645 out.shmmax = (int)in->shmmax; 657 out.shmmax = (int)in->shmmax;
646 658
647 out.shmmin = in->shmmin; 659 out.shmmin = in->shmmin;
648 out.shmmni = in->shmmni; 660 out.shmmni = in->shmmni;
649 out.shmseg = in->shmseg; 661 out.shmseg = in->shmseg;
650 out.shmall = in->shmall; 662 out.shmall = in->shmall;
651 663
652 return copy_to_user(buf, &out, sizeof(out)); 664 return copy_to_user(buf, &out, sizeof(out));
653 } 665 }
654 default: 666 default:
655 return -EINVAL; 667 return -EINVAL;
656 } 668 }
657 } 669 }
658 670
659 /* 671 /*
660 * Calculate and add used RSS and swap pages of a shm. 672 * Calculate and add used RSS and swap pages of a shm.
661 * Called with shm_ids.rw_mutex held as a reader 673 * Called with shm_ids.rw_mutex held as a reader
662 */ 674 */
663 static void shm_add_rss_swap(struct shmid_kernel *shp, 675 static void shm_add_rss_swap(struct shmid_kernel *shp,
664 unsigned long *rss_add, unsigned long *swp_add) 676 unsigned long *rss_add, unsigned long *swp_add)
665 { 677 {
666 struct inode *inode; 678 struct inode *inode;
667 679
668 inode = shp->shm_file->f_path.dentry->d_inode; 680 inode = shp->shm_file->f_path.dentry->d_inode;
669 681
670 if (is_file_hugepages(shp->shm_file)) { 682 if (is_file_hugepages(shp->shm_file)) {
671 struct address_space *mapping = inode->i_mapping; 683 struct address_space *mapping = inode->i_mapping;
672 struct hstate *h = hstate_file(shp->shm_file); 684 struct hstate *h = hstate_file(shp->shm_file);
673 *rss_add += pages_per_huge_page(h) * mapping->nrpages; 685 *rss_add += pages_per_huge_page(h) * mapping->nrpages;
674 } else { 686 } else {
675 #ifdef CONFIG_SHMEM 687 #ifdef CONFIG_SHMEM
676 struct shmem_inode_info *info = SHMEM_I(inode); 688 struct shmem_inode_info *info = SHMEM_I(inode);
677 spin_lock(&info->lock); 689 spin_lock(&info->lock);
678 *rss_add += inode->i_mapping->nrpages; 690 *rss_add += inode->i_mapping->nrpages;
679 *swp_add += info->swapped; 691 *swp_add += info->swapped;
680 spin_unlock(&info->lock); 692 spin_unlock(&info->lock);
681 #else 693 #else
682 *rss_add += inode->i_mapping->nrpages; 694 *rss_add += inode->i_mapping->nrpages;
683 #endif 695 #endif
684 } 696 }
685 } 697 }
686 698
687 /* 699 /*
688 * Called with shm_ids.rw_mutex held as a reader 700 * Called with shm_ids.rw_mutex held as a reader
689 */ 701 */
690 static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss, 702 static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
691 unsigned long *swp) 703 unsigned long *swp)
692 { 704 {
693 int next_id; 705 int next_id;
694 int total, in_use; 706 int total, in_use;
695 707
696 *rss = 0; 708 *rss = 0;
697 *swp = 0; 709 *swp = 0;
698 710
699 in_use = shm_ids(ns).in_use; 711 in_use = shm_ids(ns).in_use;
700 712
701 for (total = 0, next_id = 0; total < in_use; next_id++) { 713 for (total = 0, next_id = 0; total < in_use; next_id++) {
702 struct kern_ipc_perm *ipc; 714 struct kern_ipc_perm *ipc;
703 struct shmid_kernel *shp; 715 struct shmid_kernel *shp;
704 716
705 ipc = idr_find(&shm_ids(ns).ipcs_idr, next_id); 717 ipc = idr_find(&shm_ids(ns).ipcs_idr, next_id);
706 if (ipc == NULL) 718 if (ipc == NULL)
707 continue; 719 continue;
708 shp = container_of(ipc, struct shmid_kernel, shm_perm); 720 shp = container_of(ipc, struct shmid_kernel, shm_perm);
709 721
710 shm_add_rss_swap(shp, rss, swp); 722 shm_add_rss_swap(shp, rss, swp);
711 723
712 total++; 724 total++;
713 } 725 }
714 } 726 }
715 727
716 /* 728 /*
717 * This function handles some shmctl commands which require the rw_mutex 729 * This function handles some shmctl commands which require the rw_mutex
718 * to be held in write mode. 730 * to be held in write mode.
719 * NOTE: no locks must be held, the rw_mutex is taken inside this function. 731 * NOTE: no locks must be held, the rw_mutex is taken inside this function.
720 */ 732 */
721 static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd, 733 static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
722 struct shmid_ds __user *buf, int version) 734 struct shmid_ds __user *buf, int version)
723 { 735 {
724 struct kern_ipc_perm *ipcp; 736 struct kern_ipc_perm *ipcp;
725 struct shmid64_ds shmid64; 737 struct shmid64_ds shmid64;
726 struct shmid_kernel *shp; 738 struct shmid_kernel *shp;
727 int err; 739 int err;
728 740
729 if (cmd == IPC_SET) { 741 if (cmd == IPC_SET) {
730 if (copy_shmid_from_user(&shmid64, buf, version)) 742 if (copy_shmid_from_user(&shmid64, buf, version))
731 return -EFAULT; 743 return -EFAULT;
732 } 744 }
733 745
734 ipcp = ipcctl_pre_down(ns, &shm_ids(ns), shmid, cmd, 746 ipcp = ipcctl_pre_down(ns, &shm_ids(ns), shmid, cmd,
735 &shmid64.shm_perm, 0); 747 &shmid64.shm_perm, 0);
736 if (IS_ERR(ipcp)) 748 if (IS_ERR(ipcp))
737 return PTR_ERR(ipcp); 749 return PTR_ERR(ipcp);
738 750
739 shp = container_of(ipcp, struct shmid_kernel, shm_perm); 751 shp = container_of(ipcp, struct shmid_kernel, shm_perm);
740 752
741 err = security_shm_shmctl(shp, cmd); 753 err = security_shm_shmctl(shp, cmd);
742 if (err) 754 if (err)
743 goto out_unlock; 755 goto out_unlock;
744 switch (cmd) { 756 switch (cmd) {
745 case IPC_RMID: 757 case IPC_RMID:
746 do_shm_rmid(ns, ipcp); 758 do_shm_rmid(ns, ipcp);
747 goto out_up; 759 goto out_up;
748 case IPC_SET: 760 case IPC_SET:
749 ipc_update_perm(&shmid64.shm_perm, ipcp); 761 ipc_update_perm(&shmid64.shm_perm, ipcp);
750 shp->shm_ctim = get_seconds(); 762 shp->shm_ctim = get_seconds();
751 break; 763 break;
752 default: 764 default:
753 err = -EINVAL; 765 err = -EINVAL;
754 } 766 }
755 out_unlock: 767 out_unlock:
756 shm_unlock(shp); 768 shm_unlock(shp);
757 out_up: 769 out_up:
758 up_write(&shm_ids(ns).rw_mutex); 770 up_write(&shm_ids(ns).rw_mutex);
759 return err; 771 return err;
760 } 772 }
761 773
762 SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf) 774 SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
763 { 775 {
764 struct shmid_kernel *shp; 776 struct shmid_kernel *shp;
765 int err, version; 777 int err, version;
766 struct ipc_namespace *ns; 778 struct ipc_namespace *ns;
767 779
768 if (cmd < 0 || shmid < 0) { 780 if (cmd < 0 || shmid < 0) {
769 err = -EINVAL; 781 err = -EINVAL;
770 goto out; 782 goto out;
771 } 783 }
772 784
773 version = ipc_parse_version(&cmd); 785 version = ipc_parse_version(&cmd);
774 ns = current->nsproxy->ipc_ns; 786 ns = current->nsproxy->ipc_ns;
775 787
776 switch (cmd) { /* replace with proc interface ? */ 788 switch (cmd) { /* replace with proc interface ? */
777 case IPC_INFO: 789 case IPC_INFO:
778 { 790 {
779 struct shminfo64 shminfo; 791 struct shminfo64 shminfo;
780 792
781 err = security_shm_shmctl(NULL, cmd); 793 err = security_shm_shmctl(NULL, cmd);
782 if (err) 794 if (err)
783 return err; 795 return err;
784 796
785 memset(&shminfo, 0, sizeof(shminfo)); 797 memset(&shminfo, 0, sizeof(shminfo));
786 shminfo.shmmni = shminfo.shmseg = ns->shm_ctlmni; 798 shminfo.shmmni = shminfo.shmseg = ns->shm_ctlmni;
787 shminfo.shmmax = ns->shm_ctlmax; 799 shminfo.shmmax = ns->shm_ctlmax;
788 shminfo.shmall = ns->shm_ctlall; 800 shminfo.shmall = ns->shm_ctlall;
789 801
790 shminfo.shmmin = SHMMIN; 802 shminfo.shmmin = SHMMIN;
791 if(copy_shminfo_to_user (buf, &shminfo, version)) 803 if(copy_shminfo_to_user (buf, &shminfo, version))
792 return -EFAULT; 804 return -EFAULT;
793 805
794 down_read(&shm_ids(ns).rw_mutex); 806 down_read(&shm_ids(ns).rw_mutex);
795 err = ipc_get_maxid(&shm_ids(ns)); 807 err = ipc_get_maxid(&shm_ids(ns));
796 up_read(&shm_ids(ns).rw_mutex); 808 up_read(&shm_ids(ns).rw_mutex);
797 809
798 if(err<0) 810 if(err<0)
799 err = 0; 811 err = 0;
800 goto out; 812 goto out;
801 } 813 }
802 case SHM_INFO: 814 case SHM_INFO:
803 { 815 {
804 struct shm_info shm_info; 816 struct shm_info shm_info;
805 817
806 err = security_shm_shmctl(NULL, cmd); 818 err = security_shm_shmctl(NULL, cmd);
807 if (err) 819 if (err)
808 return err; 820 return err;
809 821
810 memset(&shm_info, 0, sizeof(shm_info)); 822 memset(&shm_info, 0, sizeof(shm_info));
811 down_read(&shm_ids(ns).rw_mutex); 823 down_read(&shm_ids(ns).rw_mutex);
812 shm_info.used_ids = shm_ids(ns).in_use; 824 shm_info.used_ids = shm_ids(ns).in_use;
813 shm_get_stat (ns, &shm_info.shm_rss, &shm_info.shm_swp); 825 shm_get_stat (ns, &shm_info.shm_rss, &shm_info.shm_swp);
814 shm_info.shm_tot = ns->shm_tot; 826 shm_info.shm_tot = ns->shm_tot;
815 shm_info.swap_attempts = 0; 827 shm_info.swap_attempts = 0;
816 shm_info.swap_successes = 0; 828 shm_info.swap_successes = 0;
817 err = ipc_get_maxid(&shm_ids(ns)); 829 err = ipc_get_maxid(&shm_ids(ns));
818 up_read(&shm_ids(ns).rw_mutex); 830 up_read(&shm_ids(ns).rw_mutex);
819 if (copy_to_user(buf, &shm_info, sizeof(shm_info))) { 831 if (copy_to_user(buf, &shm_info, sizeof(shm_info))) {
820 err = -EFAULT; 832 err = -EFAULT;
821 goto out; 833 goto out;
822 } 834 }
823 835
824 err = err < 0 ? 0 : err; 836 err = err < 0 ? 0 : err;
825 goto out; 837 goto out;
826 } 838 }
827 case SHM_STAT: 839 case SHM_STAT:
828 case IPC_STAT: 840 case IPC_STAT:
829 { 841 {
830 struct shmid64_ds tbuf; 842 struct shmid64_ds tbuf;
831 int result; 843 int result;
832 844
833 if (cmd == SHM_STAT) { 845 if (cmd == SHM_STAT) {
834 shp = shm_lock(ns, shmid); 846 shp = shm_lock(ns, shmid);
835 if (IS_ERR(shp)) { 847 if (IS_ERR(shp)) {
836 err = PTR_ERR(shp); 848 err = PTR_ERR(shp);
837 goto out; 849 goto out;
838 } 850 }
839 result = shp->shm_perm.id; 851 result = shp->shm_perm.id;
840 } else { 852 } else {
841 shp = shm_lock_check(ns, shmid); 853 shp = shm_lock_check(ns, shmid);
842 if (IS_ERR(shp)) { 854 if (IS_ERR(shp)) {
843 err = PTR_ERR(shp); 855 err = PTR_ERR(shp);
844 goto out; 856 goto out;
845 } 857 }
846 result = 0; 858 result = 0;
847 } 859 }
848 err = -EACCES; 860 err = -EACCES;
849 if (ipcperms(ns, &shp->shm_perm, S_IRUGO)) 861 if (ipcperms(ns, &shp->shm_perm, S_IRUGO))
850 goto out_unlock; 862 goto out_unlock;
851 err = security_shm_shmctl(shp, cmd); 863 err = security_shm_shmctl(shp, cmd);
852 if (err) 864 if (err)
853 goto out_unlock; 865 goto out_unlock;
854 memset(&tbuf, 0, sizeof(tbuf)); 866 memset(&tbuf, 0, sizeof(tbuf));
855 kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm); 867 kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm);
856 tbuf.shm_segsz = shp->shm_segsz; 868 tbuf.shm_segsz = shp->shm_segsz;
857 tbuf.shm_atime = shp->shm_atim; 869 tbuf.shm_atime = shp->shm_atim;
858 tbuf.shm_dtime = shp->shm_dtim; 870 tbuf.shm_dtime = shp->shm_dtim;
859 tbuf.shm_ctime = shp->shm_ctim; 871 tbuf.shm_ctime = shp->shm_ctim;
860 tbuf.shm_cpid = shp->shm_cprid; 872 tbuf.shm_cpid = shp->shm_cprid;
861 tbuf.shm_lpid = shp->shm_lprid; 873 tbuf.shm_lpid = shp->shm_lprid;
862 tbuf.shm_nattch = shp->shm_nattch; 874 tbuf.shm_nattch = shp->shm_nattch;
863 shm_unlock(shp); 875 shm_unlock(shp);
864 if(copy_shmid_to_user (buf, &tbuf, version)) 876 if(copy_shmid_to_user (buf, &tbuf, version))
865 err = -EFAULT; 877 err = -EFAULT;
866 else 878 else
867 err = result; 879 err = result;
868 goto out; 880 goto out;
869 } 881 }
870 case SHM_LOCK: 882 case SHM_LOCK:
871 case SHM_UNLOCK: 883 case SHM_UNLOCK:
872 { 884 {
873 struct file *shm_file; 885 struct file *shm_file;
874 886
875 shp = shm_lock_check(ns, shmid); 887 shp = shm_lock_check(ns, shmid);
876 if (IS_ERR(shp)) { 888 if (IS_ERR(shp)) {
877 err = PTR_ERR(shp); 889 err = PTR_ERR(shp);
878 goto out; 890 goto out;
879 } 891 }
880 892
881 audit_ipc_obj(&(shp->shm_perm)); 893 audit_ipc_obj(&(shp->shm_perm));
882 894
883 if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) { 895 if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
884 uid_t euid = current_euid(); 896 uid_t euid = current_euid();
885 err = -EPERM; 897 err = -EPERM;
886 if (euid != shp->shm_perm.uid && 898 if (euid != shp->shm_perm.uid &&
887 euid != shp->shm_perm.cuid) 899 euid != shp->shm_perm.cuid)
888 goto out_unlock; 900 goto out_unlock;
889 if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) 901 if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))
890 goto out_unlock; 902 goto out_unlock;
891 } 903 }
892 904
893 err = security_shm_shmctl(shp, cmd); 905 err = security_shm_shmctl(shp, cmd);
894 if (err) 906 if (err)
895 goto out_unlock; 907 goto out_unlock;
896 908
897 shm_file = shp->shm_file; 909 shm_file = shp->shm_file;
898 if (is_file_hugepages(shm_file)) 910 if (is_file_hugepages(shm_file))
899 goto out_unlock; 911 goto out_unlock;
900 912
901 if (cmd == SHM_LOCK) { 913 if (cmd == SHM_LOCK) {
902 struct user_struct *user = current_user(); 914 struct user_struct *user = current_user();
903 err = shmem_lock(shm_file, 1, user); 915 err = shmem_lock(shm_file, 1, user);
904 if (!err && !(shp->shm_perm.mode & SHM_LOCKED)) { 916 if (!err && !(shp->shm_perm.mode & SHM_LOCKED)) {
905 shp->shm_perm.mode |= SHM_LOCKED; 917 shp->shm_perm.mode |= SHM_LOCKED;
906 shp->mlock_user = user; 918 shp->mlock_user = user;
907 } 919 }
908 goto out_unlock; 920 goto out_unlock;
909 } 921 }
910 922
911 /* SHM_UNLOCK */ 923 /* SHM_UNLOCK */
912 if (!(shp->shm_perm.mode & SHM_LOCKED)) 924 if (!(shp->shm_perm.mode & SHM_LOCKED))
913 goto out_unlock; 925 goto out_unlock;
914 shmem_lock(shm_file, 0, shp->mlock_user); 926 shmem_lock(shm_file, 0, shp->mlock_user);
915 shp->shm_perm.mode &= ~SHM_LOCKED; 927 shp->shm_perm.mode &= ~SHM_LOCKED;
916 shp->mlock_user = NULL; 928 shp->mlock_user = NULL;
917 get_file(shm_file); 929 get_file(shm_file);
918 shm_unlock(shp); 930 shm_unlock(shp);
919 shmem_unlock_mapping(shm_file->f_mapping); 931 shmem_unlock_mapping(shm_file->f_mapping);
920 fput(shm_file); 932 fput(shm_file);
921 goto out; 933 goto out;
922 } 934 }
923 case IPC_RMID: 935 case IPC_RMID:
924 case IPC_SET: 936 case IPC_SET:
925 err = shmctl_down(ns, shmid, cmd, buf, version); 937 err = shmctl_down(ns, shmid, cmd, buf, version);
926 return err; 938 return err;
927 default: 939 default:
928 return -EINVAL; 940 return -EINVAL;
929 } 941 }
930 942
931 out_unlock: 943 out_unlock:
932 shm_unlock(shp); 944 shm_unlock(shp);
933 out: 945 out:
934 return err; 946 return err;
935 } 947 }
936 948
937 /* 949 /*
938 * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists. 950 * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
939 * 951 *
940 * NOTE! Despite the name, this is NOT a direct system call entrypoint. The 952 * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
941 * "raddr" thing points to kernel space, and there has to be a wrapper around 953 * "raddr" thing points to kernel space, and there has to be a wrapper around
942 * this. 954 * this.
943 */ 955 */
944 long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr) 956 long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
945 { 957 {
946 struct shmid_kernel *shp; 958 struct shmid_kernel *shp;
947 unsigned long addr; 959 unsigned long addr;
948 unsigned long size; 960 unsigned long size;
949 struct file * file; 961 struct file * file;
950 int err; 962 int err;
951 unsigned long flags; 963 unsigned long flags;
952 unsigned long prot; 964 unsigned long prot;
953 int acc_mode; 965 int acc_mode;
954 unsigned long user_addr; 966 unsigned long user_addr;
955 struct ipc_namespace *ns; 967 struct ipc_namespace *ns;
956 struct shm_file_data *sfd; 968 struct shm_file_data *sfd;
957 struct path path; 969 struct path path;
958 fmode_t f_mode; 970 fmode_t f_mode;
959 971
960 err = -EINVAL; 972 err = -EINVAL;
961 if (shmid < 0) 973 if (shmid < 0)
962 goto out; 974 goto out;
963 else if ((addr = (ulong)shmaddr)) { 975 else if ((addr = (ulong)shmaddr)) {
964 if (addr & (SHMLBA-1)) { 976 if (addr & (SHMLBA-1)) {
965 if (shmflg & SHM_RND) 977 if (shmflg & SHM_RND)
966 addr &= ~(SHMLBA-1); /* round down */ 978 addr &= ~(SHMLBA-1); /* round down */
967 else 979 else
968 #ifndef __ARCH_FORCE_SHMLBA 980 #ifndef __ARCH_FORCE_SHMLBA
969 if (addr & ~PAGE_MASK) 981 if (addr & ~PAGE_MASK)
970 #endif 982 #endif
971 goto out; 983 goto out;
972 } 984 }
973 flags = MAP_SHARED | MAP_FIXED; 985 flags = MAP_SHARED | MAP_FIXED;
974 } else { 986 } else {
975 if ((shmflg & SHM_REMAP)) 987 if ((shmflg & SHM_REMAP))
976 goto out; 988 goto out;
977 989
978 flags = MAP_SHARED; 990 flags = MAP_SHARED;
979 } 991 }
980 992
981 if (shmflg & SHM_RDONLY) { 993 if (shmflg & SHM_RDONLY) {
982 prot = PROT_READ; 994 prot = PROT_READ;
983 acc_mode = S_IRUGO; 995 acc_mode = S_IRUGO;
984 f_mode = FMODE_READ; 996 f_mode = FMODE_READ;
985 } else { 997 } else {
986 prot = PROT_READ | PROT_WRITE; 998 prot = PROT_READ | PROT_WRITE;
987 acc_mode = S_IRUGO | S_IWUGO; 999 acc_mode = S_IRUGO | S_IWUGO;
988 f_mode = FMODE_READ | FMODE_WRITE; 1000 f_mode = FMODE_READ | FMODE_WRITE;
989 } 1001 }
990 if (shmflg & SHM_EXEC) { 1002 if (shmflg & SHM_EXEC) {
991 prot |= PROT_EXEC; 1003 prot |= PROT_EXEC;
992 acc_mode |= S_IXUGO; 1004 acc_mode |= S_IXUGO;
993 } 1005 }
994 1006
995 /* 1007 /*
996 * We cannot rely on the fs check since SYSV IPC does have an 1008 * We cannot rely on the fs check since SYSV IPC does have an
997 * additional creator id... 1009 * additional creator id...
998 */ 1010 */
999 ns = current->nsproxy->ipc_ns; 1011 ns = current->nsproxy->ipc_ns;
1000 shp = shm_lock_check(ns, shmid); 1012 shp = shm_lock_check(ns, shmid);
1001 if (IS_ERR(shp)) { 1013 if (IS_ERR(shp)) {
1002 err = PTR_ERR(shp); 1014 err = PTR_ERR(shp);
1003 goto out; 1015 goto out;
1004 } 1016 }
1005 1017
1006 err = -EACCES; 1018 err = -EACCES;
1007 if (ipcperms(ns, &shp->shm_perm, acc_mode)) 1019 if (ipcperms(ns, &shp->shm_perm, acc_mode))
1008 goto out_unlock; 1020 goto out_unlock;
1009 1021
1010 err = security_shm_shmat(shp, shmaddr, shmflg); 1022 err = security_shm_shmat(shp, shmaddr, shmflg);
1011 if (err) 1023 if (err)
1012 goto out_unlock; 1024 goto out_unlock;
1013 1025
1014 path = shp->shm_file->f_path; 1026 path = shp->shm_file->f_path;
1015 path_get(&path); 1027 path_get(&path);
1016 shp->shm_nattch++; 1028 shp->shm_nattch++;
1017 size = i_size_read(path.dentry->d_inode); 1029 size = i_size_read(path.dentry->d_inode);
1018 shm_unlock(shp); 1030 shm_unlock(shp);
1019 1031
1020 err = -ENOMEM; 1032 err = -ENOMEM;
1021 sfd = kzalloc(sizeof(*sfd), GFP_KERNEL); 1033 sfd = kzalloc(sizeof(*sfd), GFP_KERNEL);
1022 if (!sfd) 1034 if (!sfd)
1023 goto out_put_dentry; 1035 goto out_put_dentry;
1024 1036
1025 file = alloc_file(&path, f_mode, 1037 file = alloc_file(&path, f_mode,
1026 is_file_hugepages(shp->shm_file) ? 1038 is_file_hugepages(shp->shm_file) ?
1027 &shm_file_operations_huge : 1039 &shm_file_operations_huge :
1028 &shm_file_operations); 1040 &shm_file_operations);
1029 if (!file) 1041 if (!file)
1030 goto out_free; 1042 goto out_free;
1031 1043
1032 file->private_data = sfd; 1044 file->private_data = sfd;
1033 file->f_mapping = shp->shm_file->f_mapping; 1045 file->f_mapping = shp->shm_file->f_mapping;
1034 sfd->id = shp->shm_perm.id; 1046 sfd->id = shp->shm_perm.id;
1035 sfd->ns = get_ipc_ns(ns); 1047 sfd->ns = get_ipc_ns(ns);
1036 sfd->file = shp->shm_file; 1048 sfd->file = shp->shm_file;
1037 sfd->vm_ops = NULL; 1049 sfd->vm_ops = NULL;
1038 1050
1039 err = security_mmap_file(file, prot, flags); 1051 err = security_mmap_file(file, prot, flags);
1040 if (err) 1052 if (err)
1041 goto out_fput; 1053 goto out_fput;
1042 1054
1043 down_write(&current->mm->mmap_sem); 1055 down_write(&current->mm->mmap_sem);
1044 if (addr && !(shmflg & SHM_REMAP)) { 1056 if (addr && !(shmflg & SHM_REMAP)) {
1045 err = -EINVAL; 1057 err = -EINVAL;
1046 if (find_vma_intersection(current->mm, addr, addr + size)) 1058 if (find_vma_intersection(current->mm, addr, addr + size))
1047 goto invalid; 1059 goto invalid;
1048 /* 1060 /*
1049 * If shm segment goes below stack, make sure there is some 1061 * If shm segment goes below stack, make sure there is some
1050 * space left for the stack to grow (at least 4 pages). 1062 * space left for the stack to grow (at least 4 pages).
1051 */ 1063 */
1052 if (addr < current->mm->start_stack && 1064 if (addr < current->mm->start_stack &&
1053 addr > current->mm->start_stack - size - PAGE_SIZE * 5) 1065 addr > current->mm->start_stack - size - PAGE_SIZE * 5)
1054 goto invalid; 1066 goto invalid;
1055 } 1067 }
1056 1068
1057 user_addr = do_mmap_pgoff(file, addr, size, prot, flags, 0); 1069 user_addr = do_mmap_pgoff(file, addr, size, prot, flags, 0);
1058 *raddr = user_addr; 1070 *raddr = user_addr;
1059 err = 0; 1071 err = 0;
1060 if (IS_ERR_VALUE(user_addr)) 1072 if (IS_ERR_VALUE(user_addr))
1061 err = (long)user_addr; 1073 err = (long)user_addr;
1062 invalid: 1074 invalid:
1063 up_write(&current->mm->mmap_sem); 1075 up_write(&current->mm->mmap_sem);
1064 1076
1065 out_fput: 1077 out_fput:
1066 fput(file); 1078 fput(file);
1067 1079
1068 out_nattch: 1080 out_nattch:
1069 down_write(&shm_ids(ns).rw_mutex); 1081 down_write(&shm_ids(ns).rw_mutex);
1070 shp = shm_lock(ns, shmid); 1082 shp = shm_lock(ns, shmid);
1071 BUG_ON(IS_ERR(shp)); 1083 BUG_ON(IS_ERR(shp));
1072 shp->shm_nattch--; 1084 shp->shm_nattch--;
1073 if (shm_may_destroy(ns, shp)) 1085 if (shm_may_destroy(ns, shp))
1074 shm_destroy(ns, shp); 1086 shm_destroy(ns, shp);
1075 else 1087 else
1076 shm_unlock(shp); 1088 shm_unlock(shp);
1077 up_write(&shm_ids(ns).rw_mutex); 1089 up_write(&shm_ids(ns).rw_mutex);
1078 1090
1079 out: 1091 out:
1080 return err; 1092 return err;
1081 1093
1082 out_unlock: 1094 out_unlock:
1083 shm_unlock(shp); 1095 shm_unlock(shp);
1084 goto out; 1096 goto out;
1085 1097
1086 out_free: 1098 out_free:
1087 kfree(sfd); 1099 kfree(sfd);
1088 out_put_dentry: 1100 out_put_dentry:
1089 path_put(&path); 1101 path_put(&path);
1090 goto out_nattch; 1102 goto out_nattch;
1091 } 1103 }
1092 1104
1093 SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg) 1105 SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
1094 { 1106 {
1095 unsigned long ret; 1107 unsigned long ret;
1096 long err; 1108 long err;
1097 1109
1098 err = do_shmat(shmid, shmaddr, shmflg, &ret); 1110 err = do_shmat(shmid, shmaddr, shmflg, &ret);
1099 if (err) 1111 if (err)
1100 return err; 1112 return err;
1101 force_successful_syscall_return(); 1113 force_successful_syscall_return();
1102 return (long)ret; 1114 return (long)ret;
1103 } 1115 }
1104 1116
1105 /* 1117 /*
1106 * detach and kill segment if marked destroyed. 1118 * detach and kill segment if marked destroyed.
1107 * The work is done in shm_close. 1119 * The work is done in shm_close.
1108 */ 1120 */
1109 SYSCALL_DEFINE1(shmdt, char __user *, shmaddr) 1121 SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
1110 { 1122 {
1111 struct mm_struct *mm = current->mm; 1123 struct mm_struct *mm = current->mm;
1112 struct vm_area_struct *vma; 1124 struct vm_area_struct *vma;
1113 unsigned long addr = (unsigned long)shmaddr; 1125 unsigned long addr = (unsigned long)shmaddr;
1114 int retval = -EINVAL; 1126 int retval = -EINVAL;
1115 #ifdef CONFIG_MMU 1127 #ifdef CONFIG_MMU
1116 loff_t size = 0; 1128 loff_t size = 0;
1117 struct vm_area_struct *next; 1129 struct vm_area_struct *next;
1118 #endif 1130 #endif
1119 1131
1120 if (addr & ~PAGE_MASK) 1132 if (addr & ~PAGE_MASK)
1121 return retval; 1133 return retval;
1122 1134
1123 down_write(&mm->mmap_sem); 1135 down_write(&mm->mmap_sem);
1124 1136
1125 /* 1137 /*
1126 * This function tries to be smart and unmap shm segments that 1138 * This function tries to be smart and unmap shm segments that
1127 * were modified by partial mlock or munmap calls: 1139 * were modified by partial mlock or munmap calls:
1128 * - It first determines the size of the shm segment that should be 1140 * - It first determines the size of the shm segment that should be
1129 * unmapped: It searches for a vma that is backed by shm and that 1141 * unmapped: It searches for a vma that is backed by shm and that
1130 * started at address shmaddr. It records it's size and then unmaps 1142 * started at address shmaddr. It records it's size and then unmaps
1131 * it. 1143 * it.
1132 * - Then it unmaps all shm vmas that started at shmaddr and that 1144 * - Then it unmaps all shm vmas that started at shmaddr and that
1133 * are within the initially determined size. 1145 * are within the initially determined size.
1134 * Errors from do_munmap are ignored: the function only fails if 1146 * Errors from do_munmap are ignored: the function only fails if
1135 * it's called with invalid parameters or if it's called to unmap 1147 * it's called with invalid parameters or if it's called to unmap
1136 * a part of a vma. Both calls in this function are for full vmas, 1148 * a part of a vma. Both calls in this function are for full vmas,
1137 * the parameters are directly copied from the vma itself and always 1149 * the parameters are directly copied from the vma itself and always
1138 * valid - therefore do_munmap cannot fail. (famous last words?) 1150 * valid - therefore do_munmap cannot fail. (famous last words?)
1139 */ 1151 */
1140 /* 1152 /*
1141 * If it had been mremap()'d, the starting address would not 1153 * If it had been mremap()'d, the starting address would not
1142 * match the usual checks anyway. So assume all vma's are 1154 * match the usual checks anyway. So assume all vma's are
1143 * above the starting address given. 1155 * above the starting address given.
1144 */ 1156 */
1145 vma = find_vma(mm, addr); 1157 vma = find_vma(mm, addr);
1146 1158
1147 #ifdef CONFIG_MMU 1159 #ifdef CONFIG_MMU
1148 while (vma) { 1160 while (vma) {
1149 next = vma->vm_next; 1161 next = vma->vm_next;
1150 1162
1151 /* 1163 /*
1152 * Check if the starting address would match, i.e. it's 1164 * Check if the starting address would match, i.e. it's
1153 * a fragment created by mprotect() and/or munmap(), or it 1165 * a fragment created by mprotect() and/or munmap(), or it
1154 * otherwise it starts at this address with no hassles. 1166 * otherwise it starts at this address with no hassles.
1155 */ 1167 */
1156 if ((vma->vm_ops == &shm_vm_ops) && 1168 if ((vma->vm_ops == &shm_vm_ops) &&
1157 (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) { 1169 (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) {
1158 1170
1159 1171
1160 size = vma->vm_file->f_path.dentry->d_inode->i_size; 1172 size = vma->vm_file->f_path.dentry->d_inode->i_size;
1161 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start); 1173 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1162 /* 1174 /*
1163 * We discovered the size of the shm segment, so 1175 * We discovered the size of the shm segment, so
1164 * break out of here and fall through to the next 1176 * break out of here and fall through to the next
1165 * loop that uses the size information to stop 1177 * loop that uses the size information to stop
1166 * searching for matching vma's. 1178 * searching for matching vma's.
1167 */ 1179 */
1168 retval = 0; 1180 retval = 0;
1169 vma = next; 1181 vma = next;
1170 break; 1182 break;
1171 } 1183 }
1172 vma = next; 1184 vma = next;
1173 } 1185 }
1174 1186
1175 /* 1187 /*
1176 * We need look no further than the maximum address a fragment 1188 * We need look no further than the maximum address a fragment
1177 * could possibly have landed at. Also cast things to loff_t to 1189 * could possibly have landed at. Also cast things to loff_t to
1178 * prevent overflows and make comparisons vs. equal-width types. 1190 * prevent overflows and make comparisons vs. equal-width types.
1179 */ 1191 */
1180 size = PAGE_ALIGN(size); 1192 size = PAGE_ALIGN(size);
1181 while (vma && (loff_t)(vma->vm_end - addr) <= size) { 1193 while (vma && (loff_t)(vma->vm_end - addr) <= size) {
1182 next = vma->vm_next; 1194 next = vma->vm_next;
1183 1195
1184 /* finding a matching vma now does not alter retval */ 1196 /* finding a matching vma now does not alter retval */
1185 if ((vma->vm_ops == &shm_vm_ops) && 1197 if ((vma->vm_ops == &shm_vm_ops) &&
1186 (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) 1198 (vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff)
1187 1199
1188 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start); 1200 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1189 vma = next; 1201 vma = next;
1190 } 1202 }
1191 1203
1192 #else /* CONFIG_MMU */ 1204 #else /* CONFIG_MMU */
1193 /* under NOMMU conditions, the exact address to be destroyed must be 1205 /* under NOMMU conditions, the exact address to be destroyed must be
1194 * given */ 1206 * given */
1195 retval = -EINVAL; 1207 retval = -EINVAL;
1196 if (vma->vm_start == addr && vma->vm_ops == &shm_vm_ops) { 1208 if (vma->vm_start == addr && vma->vm_ops == &shm_vm_ops) {
1197 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start); 1209 do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start);
1198 retval = 0; 1210 retval = 0;
1199 } 1211 }
1200 1212
1201 #endif 1213 #endif
1202 1214
1203 up_write(&mm->mmap_sem); 1215 up_write(&mm->mmap_sem);
1204 return retval; 1216 return retval;
1205 } 1217 }
1206 1218
1207 #ifdef CONFIG_PROC_FS 1219 #ifdef CONFIG_PROC_FS
1208 static int sysvipc_shm_proc_show(struct seq_file *s, void *it) 1220 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
1209 { 1221 {
1210 struct shmid_kernel *shp = it; 1222 struct shmid_kernel *shp = it;
1211 unsigned long rss = 0, swp = 0; 1223 unsigned long rss = 0, swp = 0;
1212 1224
1213 shm_add_rss_swap(shp, &rss, &swp); 1225 shm_add_rss_swap(shp, &rss, &swp);
1214 1226
1215 #if BITS_PER_LONG <= 32 1227 #if BITS_PER_LONG <= 32
1216 #define SIZE_SPEC "%10lu" 1228 #define SIZE_SPEC "%10lu"
1217 #else 1229 #else
1218 #define SIZE_SPEC "%21lu" 1230 #define SIZE_SPEC "%21lu"
1219 #endif 1231 #endif
1220 1232
1221 return seq_printf(s, 1233 return seq_printf(s,
1222 "%10d %10d %4o " SIZE_SPEC " %5u %5u " 1234 "%10d %10d %4o " SIZE_SPEC " %5u %5u "
1223 "%5lu %5u %5u %5u %5u %10lu %10lu %10lu " 1235 "%5lu %5u %5u %5u %5u %10lu %10lu %10lu "
1224 SIZE_SPEC " " SIZE_SPEC "\n", 1236 SIZE_SPEC " " SIZE_SPEC "\n",
1225 shp->shm_perm.key, 1237 shp->shm_perm.key,
1226 shp->shm_perm.id, 1238 shp->shm_perm.id,
1227 shp->shm_perm.mode, 1239 shp->shm_perm.mode,
1228 shp->shm_segsz, 1240 shp->shm_segsz,
1229 shp->shm_cprid, 1241 shp->shm_cprid,
1230 shp->shm_lprid, 1242 shp->shm_lprid,
1231 shp->shm_nattch, 1243 shp->shm_nattch,
1232 shp->shm_perm.uid, 1244 shp->shm_perm.uid,
1233 shp->shm_perm.gid, 1245 shp->shm_perm.gid,
1234 shp->shm_perm.cuid, 1246 shp->shm_perm.cuid,
1235 shp->shm_perm.cgid, 1247 shp->shm_perm.cgid,
1236 shp->shm_atim, 1248 shp->shm_atim,
1237 shp->shm_dtim, 1249 shp->shm_dtim,
1238 shp->shm_ctim, 1250 shp->shm_ctim,
1239 rss * PAGE_SIZE, 1251 rss * PAGE_SIZE,
1240 swp * PAGE_SIZE); 1252 swp * PAGE_SIZE);
1241 } 1253 }
1242 #endif 1254 #endif
1243 1255