X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=ipc%2Fshm.c;h=c47e87278a92d87acf6bdfefbb16ab73186c24b2;hb=09da5916baf6d3fb9ac16c125c801ae6ea151f97;hp=8cf1cf3d5becc6180f32ae7a8d0ea41f2878bb10;hpb=637c36634029e4e7c81112796dafc32d56355b4a;p=pandora-kernel.git diff --git a/ipc/shm.c b/ipc/shm.c index 8cf1cf3d5bec..c47e87278a92 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -35,9 +35,10 @@ #include #include #include -#include +#include #include #include +#include #include @@ -55,16 +56,11 @@ struct shm_file_data { static const struct file_operations shm_file_operations; static struct vm_operations_struct shm_vm_ops; -static struct ipc_ids init_shm_ids; +#define shm_ids(ns) ((ns)->ids[IPC_SHM_IDS]) -#define shm_ids(ns) (*((ns)->ids[IPC_SHM_IDS])) - -#define shm_lock(ns, id) \ - ((struct shmid_kernel*)ipc_lock(&shm_ids(ns),id)) #define shm_unlock(shp) \ ipc_unlock(&(shp)->shm_perm) -#define shm_buildid(ns, id, seq) \ - ipc_buildid(&shm_ids(ns), id, seq) +#define shm_buildid(id, seq) ipc_buildid(id, seq) static int newseg(struct ipc_namespace *, struct ipc_params *); static void shm_open(struct vm_area_struct *vma); @@ -74,18 +70,24 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp); static int sysvipc_shm_proc_show(struct seq_file *s, void *it); #endif -static void __shm_init_ns(struct ipc_namespace *ns, struct ipc_ids *ids) +void shm_init_ns(struct ipc_namespace *ns) { - ns->ids[IPC_SHM_IDS] = ids; ns->shm_ctlmax = SHMMAX; ns->shm_ctlall = SHMALL; ns->shm_ctlmni = SHMMNI; ns->shm_tot = 0; - ipc_init_ids(ids); + ipc_init_ids(&ns->ids[IPC_SHM_IDS]); } -static void do_shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *shp) +/* + * Called with shm_ids.rw_mutex (writer) and the shp structure locked. + * Only shm_ids.rw_mutex remains locked on exit. + */ +static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp) { + struct shmid_kernel *shp; + shp = container_of(ipcp, struct shmid_kernel, shm_perm); + if (shp->shm_nattch){ shp->shm_perm.mode |= SHM_DEST; /* Do not find it any more */ @@ -95,56 +97,71 @@ static void do_shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *shp) shm_destroy(ns, shp); } -int shm_init_ns(struct ipc_namespace *ns) +#ifdef CONFIG_IPC_NS +void shm_exit_ns(struct ipc_namespace *ns) { - struct ipc_ids *ids; - - ids = kmalloc(sizeof(struct ipc_ids), GFP_KERNEL); - if (ids == NULL) - return -ENOMEM; + free_ipcs(ns, &shm_ids(ns), do_shm_rmid); +} +#endif - __shm_init_ns(ns, ids); - return 0; +void __init shm_init (void) +{ + shm_init_ns(&init_ipc_ns); + ipc_init_proc_interface("sysvipc/shm", + " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime\n", + IPC_SHM_IDS, sysvipc_shm_proc_show); } -void shm_exit_ns(struct ipc_namespace *ns) +/* + * shm_lock_(check_)down routines are called in the paths where the rw_mutex + * is held to protect access to the idr tree. + */ +static inline struct shmid_kernel *shm_lock_down(struct ipc_namespace *ns, + int id) { - struct shmid_kernel *shp; - int next_id; - int total, in_use; + struct kern_ipc_perm *ipcp = ipc_lock_down(&shm_ids(ns), id); - mutex_lock(&shm_ids(ns).mutex); + if (IS_ERR(ipcp)) + return (struct shmid_kernel *)ipcp; - in_use = shm_ids(ns).in_use; + return container_of(ipcp, struct shmid_kernel, shm_perm); +} - for (total = 0, next_id = 0; total < in_use; next_id++) { - shp = idr_find(&shm_ids(ns).ipcs_idr, next_id); - if (shp == NULL) - continue; - ipc_lock_by_ptr(&shp->shm_perm); - do_shm_rmid(ns, shp); - total++; - } - mutex_unlock(&shm_ids(ns).mutex); +static inline struct shmid_kernel *shm_lock_check_down( + struct ipc_namespace *ns, + int id) +{ + struct kern_ipc_perm *ipcp = ipc_lock_check_down(&shm_ids(ns), id); - kfree(ns->ids[IPC_SHM_IDS]); - ns->ids[IPC_SHM_IDS] = NULL; + if (IS_ERR(ipcp)) + return (struct shmid_kernel *)ipcp; + + return container_of(ipcp, struct shmid_kernel, shm_perm); } -void __init shm_init (void) +/* + * shm_lock_(check_) routines are called in the paths where the rw_mutex + * is not held. + */ +static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id) { - __shm_init_ns(&init_ipc_ns, &init_shm_ids); - ipc_init_proc_interface("sysvipc/shm", - " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime\n", - IPC_SHM_IDS, sysvipc_shm_proc_show); + struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id); + + if (IS_ERR(ipcp)) + return (struct shmid_kernel *)ipcp; + + return container_of(ipcp, struct shmid_kernel, shm_perm); } -static inline int shm_checkid(struct ipc_namespace *ns, - struct shmid_kernel *s, int id) +static inline struct shmid_kernel *shm_lock_check(struct ipc_namespace *ns, + int id) { - if (ipc_checkid(&shm_ids(ns), &s->shm_perm, id)) - return -EIDRM; - return 0; + struct kern_ipc_perm *ipcp = ipc_lock_check(&shm_ids(ns), id); + + if (IS_ERR(ipcp)) + return (struct shmid_kernel *)ipcp; + + return container_of(ipcp, struct shmid_kernel, shm_perm); } static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s) @@ -167,7 +184,7 @@ static void shm_open(struct vm_area_struct *vma) struct shmid_kernel *shp; shp = shm_lock(sfd->ns, sfd->id); - BUG_ON(!shp); + BUG_ON(IS_ERR(shp)); shp->shm_atim = get_seconds(); shp->shm_lprid = task_tgid_vnr(current); shp->shm_nattch++; @@ -177,9 +194,10 @@ static void shm_open(struct vm_area_struct *vma) /* * shm_destroy - free the struct shmid_kernel * + * @ns: namespace * @shp: struct to free * - * It has to be called with shp and shm_ids.mutex locked, + * It has to be called with shp and shm_ids.rw_mutex (writer) locked, * but returns with shp unlocked and freed. */ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) @@ -210,10 +228,10 @@ static void shm_close(struct vm_area_struct *vma) struct shmid_kernel *shp; struct ipc_namespace *ns = sfd->ns; - mutex_lock(&shm_ids(ns).mutex); + down_write(&shm_ids(ns).rw_mutex); /* remove from the list of attaches of the shm segment */ - shp = shm_lock(ns, sfd->id); - BUG_ON(!shp); + shp = shm_lock_down(ns, sfd->id); + BUG_ON(IS_ERR(shp)); shp->shm_lprid = task_tgid_vnr(current); shp->shm_dtim = get_seconds(); shp->shm_nattch--; @@ -222,7 +240,7 @@ static void shm_close(struct vm_area_struct *vma) shm_destroy(ns, shp); else shm_unlock(shp); - mutex_unlock(&shm_ids(ns).mutex); + up_write(&shm_ids(ns).rw_mutex); } static int shm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) @@ -338,6 +356,14 @@ static struct vm_operations_struct shm_vm_ops = { #endif }; +/** + * newseg - Create a new shared memory segment + * @ns: namespace + * @params: ptr to the structure that contains key, size and shmflg + * + * Called with shm_ids.rw_mutex held as a writer. + */ + static int newseg(struct ipc_namespace *ns, struct ipc_params *params) { key_t key = params->key; @@ -391,10 +417,11 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) if (IS_ERR(file)) goto no_file; - error = -ENOSPC; id = shm_addid(ns, shp); - if(id == -1) + if (id < 0) { + error = id; goto no_id; + } shp->shm_cprid = task_tgid_vnr(current); shp->shm_lprid = 0; @@ -402,7 +429,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) shp->shm_ctim = get_seconds(); shp->shm_segsz = size; shp->shm_nattch = 0; - shp->shm_perm.id = shm_buildid(ns, id, shp->shm_perm.seq); + shp->shm_perm.id = shm_buildid(id, shp->shm_perm.seq); shp->shm_file = file; /* * shmid gets reported as "inode#" in /proc/pid/maps. @@ -423,14 +450,27 @@ no_file: return error; } -static inline int shm_security(void *shp, int shmflg) +/* + * Called with shm_ids.rw_mutex and ipcp locked. + */ +static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg) { - return security_shm_associate((struct shmid_kernel *) shp, shmflg); + struct shmid_kernel *shp; + + shp = container_of(ipcp, struct shmid_kernel, shm_perm); + return security_shm_associate(shp, shmflg); } -static inline int shm_more_checks(void *shp, struct ipc_params *params) +/* + * Called with shm_ids.rw_mutex and ipcp locked. + */ +static inline int shm_more_checks(struct kern_ipc_perm *ipcp, + struct ipc_params *params) { - if (((struct shmid_kernel *)shp)->shm_segsz < params->u.size) + struct shmid_kernel *shp; + + shp = container_of(ipcp, struct shmid_kernel, shm_perm); + if (shp->shm_segsz < params->u.size) return -EINVAL; return 0; @@ -546,6 +586,9 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf } } +/* + * Called with shm_ids.rw_mutex held as a reader + */ static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss, unsigned long *swp) { @@ -561,18 +604,6 @@ static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss, struct shmid_kernel *shp; struct inode *inode; - /* - * idr_find() is called via shm_get(), so with shm_ids.mutex - * locked. Since ipc_addid() is also called with - * shm_ids.mutex down, there is no need to add read barriers - * here to gurantee the writes in ipc_addid() are seen in - * order here (for Alpha). - * However idr_find() itself does not necessary require - * ipc_ids.mutex down. So if idr_find() is used by other - * places without ipc_ids.mutex down, then it needs read - * read memory barriers as ipc_lock() does. - */ - shp = idr_find(&shm_ids(ns).ipcs_idr, next_id); if (shp == NULL) continue; @@ -626,8 +657,11 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) shminfo.shmmin = SHMMIN; if(copy_shminfo_to_user (buf, &shminfo, version)) return -EFAULT; - /* reading a integer is always atomic */ + + down_read(&shm_ids(ns).rw_mutex); err = ipc_get_maxid(&shm_ids(ns)); + up_read(&shm_ids(ns).rw_mutex); + if(err<0) err = 0; goto out; @@ -641,14 +675,14 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) return err; memset(&shm_info,0,sizeof(shm_info)); - mutex_lock(&shm_ids(ns).mutex); + down_read(&shm_ids(ns).rw_mutex); shm_info.used_ids = shm_ids(ns).in_use; shm_get_stat (ns, &shm_info.shm_rss, &shm_info.shm_swp); shm_info.shm_tot = ns->shm_tot; shm_info.swap_attempts = 0; shm_info.swap_successes = 0; err = ipc_get_maxid(&shm_ids(ns)); - mutex_unlock(&shm_ids(ns).mutex); + up_read(&shm_ids(ns).rw_mutex); if(copy_to_user (buf, &shm_info, sizeof(shm_info))) { err = -EFAULT; goto out; @@ -662,17 +696,25 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) { struct shmid64_ds tbuf; int result; - memset(&tbuf, 0, sizeof(tbuf)); - shp = shm_lock(ns, shmid); - if(shp==NULL) { - err = -EINVAL; + + if (!buf) { + err = -EFAULT; goto out; - } else if (cmd == SHM_STAT) { + } + + if (cmd == SHM_STAT) { + shp = shm_lock(ns, shmid); + if (IS_ERR(shp)) { + err = PTR_ERR(shp); + goto out; + } result = shp->shm_perm.id; } else { - err = shm_checkid(ns, shp,shmid); - if(err) - goto out_unlock; + shp = shm_lock_check(ns, shmid); + if (IS_ERR(shp)) { + err = PTR_ERR(shp); + goto out; + } result = 0; } err=-EACCES; @@ -681,6 +723,7 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) err = security_shm_shmctl(shp, cmd); if (err) goto out_unlock; + memset(&tbuf, 0, sizeof(tbuf)); kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm); tbuf.shm_segsz = shp->shm_segsz; tbuf.shm_atime = shp->shm_atim; @@ -699,14 +742,11 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) case SHM_LOCK: case SHM_UNLOCK: { - shp = shm_lock(ns, shmid); - if(shp==NULL) { - err = -EINVAL; + shp = shm_lock_check(ns, shmid); + if (IS_ERR(shp)) { + err = PTR_ERR(shp); goto out; } - err = shm_checkid(ns, shp,shmid); - if(err) - goto out_unlock; err = audit_ipc_obj(&(shp->shm_perm)); if (err) @@ -755,14 +795,12 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) * Instead we set a destroyed flag, and then blow * the name away when the usage hits zero. */ - mutex_lock(&shm_ids(ns).mutex); - shp = shm_lock(ns, shmid); - err = -EINVAL; - if (shp == NULL) + down_write(&shm_ids(ns).rw_mutex); + shp = shm_lock_check_down(ns, shmid); + if (IS_ERR(shp)) { + err = PTR_ERR(shp); goto out_up; - err = shm_checkid(ns, shp, shmid); - if(err) - goto out_unlock_up; + } err = audit_ipc_obj(&(shp->shm_perm)); if (err) @@ -779,25 +817,28 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) if (err) goto out_unlock_up; - do_shm_rmid(ns, shp); - mutex_unlock(&shm_ids(ns).mutex); + do_shm_rmid(ns, &shp->shm_perm); + up_write(&shm_ids(ns).rw_mutex); goto out; } case IPC_SET: { + if (!buf) { + err = -EFAULT; + goto out; + } + if (copy_shmid_from_user (&setbuf, buf, version)) { err = -EFAULT; goto out; } - mutex_lock(&shm_ids(ns).mutex); - shp = shm_lock(ns, shmid); - err=-EINVAL; - if(shp==NULL) + down_write(&shm_ids(ns).rw_mutex); + shp = shm_lock_check_down(ns, shmid); + if (IS_ERR(shp)) { + err = PTR_ERR(shp); goto out_up; - err = shm_checkid(ns, shp,shmid); - if(err) - goto out_unlock_up; + } err = audit_ipc_obj(&(shp->shm_perm)); if (err) goto out_unlock_up; @@ -832,7 +873,7 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) out_unlock_up: shm_unlock(shp); out_up: - mutex_unlock(&shm_ids(ns).mutex); + up_write(&shm_ids(ns).rw_mutex); goto out; out_unlock: shm_unlock(shp); @@ -903,13 +944,11 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr) * additional creator id... */ ns = current->nsproxy->ipc_ns; - shp = shm_lock(ns, shmid); - if(shp == NULL) + shp = shm_lock_check(ns, shmid); + if (IS_ERR(shp)) { + err = PTR_ERR(shp); goto out; - - err = shm_checkid(ns, shp,shmid); - if (err) - goto out_unlock; + } err = -EACCES; if (ipcperms(&shp->shm_perm, acc_mode)) @@ -968,16 +1007,16 @@ invalid: fput(file); out_nattch: - mutex_lock(&shm_ids(ns).mutex); - shp = shm_lock(ns, shmid); - BUG_ON(!shp); + down_write(&shm_ids(ns).rw_mutex); + shp = shm_lock_down(ns, shmid); + BUG_ON(IS_ERR(shp)); shp->shm_nattch--; if(shp->shm_nattch == 0 && shp->shm_perm.mode & SHM_DEST) shm_destroy(ns, shp); else shm_unlock(shp); - mutex_unlock(&shm_ids(ns).mutex); + up_write(&shm_ids(ns).rw_mutex); out: return err;