1 /*
2 * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1990, 1996-1998 Apple Computer, Inc.
30 * All Rights Reserved.
31 */
32 /*
33 * posix_shm.c : Support for POSIX shared memory APIs
34 *
35 * File: posix_shm.c
36 * Author: Ananthakrishna Ramesh
37 *
38 * HISTORY
39 * 2-Sep-1999 A.Ramesh
40 * Created for MacOSX
41 *
42 */
43 /*
44 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
45 * support for mandatory and extensible security protections. This notice
46 * is included in support of clause 2.2 (b) of the Apple Public License,
47 * Version 2.0.
48 */
49
50 #include <sys/cdefs.h>
51 #include <sys/param.h>
52 #include <sys/systm.h>
53 #include <sys/kernel.h>
54 #include <sys/file_internal.h>
55 #include <sys/filedesc.h>
56 #include <sys/stat.h>
57 #include <sys/proc_internal.h>
58 #include <sys/kauth.h>
59 #include <sys/mount.h>
60 #include <sys/namei.h>
61 #include <sys/vnode.h>
62 #include <sys/vnode_internal.h>
63 #include <sys/ioctl.h>
64 #include <sys/tty.h>
65 #include <sys/malloc.h>
66 #include <sys/mman.h>
67 #include <sys/stat.h>
68 #include <sys/sysproto.h>
69 #include <sys/proc_info.h>
70 #include <sys/posix_shm.h>
71 #include <security/audit/audit.h>
72 #include <stdbool.h>
73
74 #if CONFIG_MACF
75 #include <security/mac_framework.h>
76 #endif
77
78 #include <mach/mach_types.h>
79 #include <mach/mach_vm.h>
80 #include <mach/vm_map.h>
81 #include <mach/vm_prot.h>
82 #include <mach/vm_inherit.h>
83 #include <mach/kern_return.h>
84
85 #include <vm/vm_map.h>
86 #include <vm/vm_protos.h>
87
88 #define f_flag fp_glob->fg_flag
89 #define f_ops fp_glob->fg_ops
90
91 /*
92 * Used to construct the list of memory objects
93 * assigned to a populated shared memory segment.
94 */
95 typedef struct pshm_mobj {
96 void *pshmo_memobject;
97 memory_object_size_t pshmo_size;
98 SLIST_ENTRY(pshm_mobj) pshmo_next;
99 } pshm_mobj_t;
100
101 /*
102 * This represents an existing Posix shared memory object.
103 *
104 * It comes into existence with a shm_open(...O_CREAT...)
105 * call and goes away only after it has been shm_unlink()ed
106 * and the last remaining shm_open() file reference is closed.
107 *
108 * To keep track of that lifetime, pshm_usecount is used as a reference
109 * counter. It's incremented for every successful shm_open() and
110 * one extra time for the shm_unlink() to release. Internally
111 * you can temporarily use an additional reference whenever the
112 * subsystem lock has to be dropped for other reasons.
113 */
114 typedef struct internal_pshminfo {
115 struct pshminfo pshm_hdr;
116 SLIST_HEAD(pshm_mobjhead, pshm_mobj) pshm_mobjs;
117 RB_ENTRY(internal_pshminfo) pshm_links; /* links for red/black tree */
118 } pshm_info_t;
119 #define pshm_flags pshm_hdr.pshm_flags
120 #define pshm_usecount pshm_hdr.pshm_usecount
121 #define pshm_length pshm_hdr.pshm_length
122 #define pshm_mode pshm_hdr.pshm_mode
123 #define pshm_uid pshm_hdr.pshm_uid
124 #define pshm_gid pshm_hdr.pshm_gid
125 #define pshm_label pshm_hdr.pshm_label
126
127 /* Values for pshm_flags that are still used */
128 #define PSHM_ALLOCATED 0x004 /* backing storage is allocated */
129 #define PSHM_MAPPED 0x008 /* mapped at least once */
130 #define PSHM_INUSE 0x010 /* mapped at least once */
131 #define PSHM_REMOVED 0x020 /* no longer in the name cache due to shm_unlink() */
132 #define PSHM_ALLOCATING 0x100 /* storage is being allocated */
133
134 /*
135 * These handle reference counting pshm_info_t structs using pshm_usecount.
136 */
137 static int pshm_ref(pshm_info_t *pinfo);
138 static void pshm_deref(pshm_info_t *pinfo);
139 #define PSHM_MAXCOUNT UINT_MAX
140
141 /*
142 * For every shm_open, we get a new one of these.
143 * The only reason we don't just use pshm_info directly is that
144 * you can query the mapped memory objects via proc_pidinfo to
145 * query the mapped address. Note that even this is a hack. If
146 * you mmap() the same fd multiple times, we only save/report
147 * one address.
148 */
149 typedef struct pshmnode {
150 off_t mapp_addr;
151 pshm_info_t *pinfo;
152 } pshmnode_t;
153
154
155 /* compare function for the red black tree */
156 static int
pshm_compare(pshm_info_t * a,pshm_info_t * b)157 pshm_compare(pshm_info_t *a, pshm_info_t *b)
158 {
159 int cmp = strncmp(a->pshm_hdr.pshm_name, b->pshm_hdr.pshm_name, PSHMNAMLEN + 1);
160
161 if (cmp < 0) {
162 return -1;
163 }
164 if (cmp > 0) {
165 return 1;
166 }
167 return 0;
168 }
169
170
171 /*
172 * shared memory "paths" are stored in a red black tree for lookup
173 */
174 u_long pshmnument; /* count of entries allocated in the red black tree */
175 RB_HEAD(pshmhead, internal_pshminfo) pshm_head;
176 RB_PROTOTYPE(pshmhead, internal_pshminfo, pshm_links, pshm_compare)
177 RB_GENERATE(pshmhead, internal_pshminfo, pshm_links, pshm_compare)
178
179 /* lookup, add, remove functions */
180 static pshm_info_t *pshm_cache_search(pshm_info_t * look);
181 static void pshm_cache_add(pshm_info_t *entry);
182 static void pshm_cache_delete(pshm_info_t *entry);
183
184 static int pshm_closefile(struct fileglob *fg, vfs_context_t ctx);
185
186 static int pshm_access(pshm_info_t *pinfo, int mode, kauth_cred_t cred, proc_t p);
187 int pshm_cache_purge_all(void);
188 int pshm_cache_purge_uid(uid_t uid);
189
190 static void pshm_unlink_internal(pshm_info_t *pinfo);
191
192 static const struct fileops pshmops = {
193 .fo_type = DTYPE_PSXSHM,
194 .fo_read = fo_no_read,
195 .fo_write = fo_no_write,
196 .fo_ioctl = fo_no_ioctl,
197 .fo_select = fo_no_select,
198 .fo_close = pshm_closefile,
199 .fo_drain = fo_no_drain,
200 .fo_kqfilter = fo_no_kqfilter,
201 };
202
203 /*
204 * Everything here is protected by a single mutex.
205 */
206 static LCK_GRP_DECLARE(psx_shm_subsys_lck_grp, "posix shared memory");
207 static LCK_MTX_DECLARE(psx_shm_subsys_mutex, &psx_shm_subsys_lck_grp);
208
209 #define PSHM_SUBSYS_LOCK() lck_mtx_lock(& psx_shm_subsys_mutex)
210 #define PSHM_SUBSYS_UNLOCK() lck_mtx_unlock(& psx_shm_subsys_mutex)
211 #define PSHM_SUBSYS_ASSERT_HELD() LCK_MTX_ASSERT(&psx_shm_subsys_mutex, LCK_MTX_ASSERT_OWNED)
212
213 /*
214 * Lookup an entry in the cache. Only the name is used from "look".
215 */
216 static pshm_info_t *
pshm_cache_search(pshm_info_t * look)217 pshm_cache_search(pshm_info_t *look)
218 {
219 PSHM_SUBSYS_ASSERT_HELD();
220 return RB_FIND(pshmhead, &pshm_head, look);
221 }
222
223 /*
224 * Add a new entry to the cache.
225 */
226 static void
pshm_cache_add(pshm_info_t * entry)227 pshm_cache_add(pshm_info_t *entry)
228 {
229 pshm_info_t *conflict;
230
231 PSHM_SUBSYS_ASSERT_HELD();
232 conflict = RB_INSERT(pshmhead, &pshm_head, entry);
233 if (conflict != NULL) {
234 panic("pshm_cache_add() found %p", conflict);
235 }
236 pshmnument++;
237 }
238
239 /*
240 * Remove the given entry from the red black tree.
241 */
242 static void
pshm_cache_delete(pshm_info_t * entry)243 pshm_cache_delete(pshm_info_t *entry)
244 {
245 PSHM_SUBSYS_ASSERT_HELD();
246 assert(!(entry->pshm_flags & PSHM_REMOVED));
247 RB_REMOVE(pshmhead, &pshm_head, entry);
248 pshmnument--;
249 }
250
251 /*
252 * Initialize the red black tree.
253 */
254 void
pshm_cache_init(void)255 pshm_cache_init(void)
256 {
257 RB_INIT(&pshm_head);
258 }
259
260 /*
261 * Invalidate all entries and delete all objects associated with them
262 * XXX - due to the reference counting, this only works if all userland
263 * references to it via file descriptors are also closed already. Is this
264 * known to be called after all user processes are killed?
265 */
266 int
pshm_cache_purge_all(void)267 pshm_cache_purge_all(void)
268 {
269 pshm_info_t *p;
270 pshm_info_t *tmp;
271
272 if (kauth_cred_issuser(kauth_cred_get()) == 0) {
273 return EPERM;
274 }
275
276 PSHM_SUBSYS_LOCK();
277 RB_FOREACH_SAFE(p, pshmhead, &pshm_head, tmp) {
278 pshm_unlink_internal(p);
279 }
280 assert(pshmnument == 0);
281 PSHM_SUBSYS_UNLOCK();
282
283 return 0;
284 }
285
286 int
pshm_cache_purge_uid(uid_t uid)287 pshm_cache_purge_uid(uid_t uid)
288 {
289 pshm_info_t *p;
290 pshm_info_t *tmp;
291
292 if (kauth_cred_issuser(kauth_cred_get()) == 0) {
293 return EPERM;
294 }
295
296 PSHM_SUBSYS_LOCK();
297 RB_FOREACH_SAFE(p, pshmhead, &pshm_head, tmp) {
298 if (p->pshm_uid == uid) {
299 pshm_unlink_internal(p);
300 }
301 }
302 PSHM_SUBSYS_UNLOCK();
303
304 return 0;
305 }
306
307 /*
308 * Utility to get the shared memory name from userspace and
309 * populate a pshm_info_t with it. If there's a problem
310 * reading the name or it's malformed, will return an error code.
311 */
312 static int
pshm_get_name(pshm_info_t * pinfo,const user_addr_t user_addr)313 pshm_get_name(pshm_info_t *pinfo, const user_addr_t user_addr)
314 {
315 size_t bytes_copied = 0;
316 int error;
317
318
319 error = copyinstr(user_addr, &pinfo->pshm_hdr.pshm_name[0], PSHMNAMLEN + 1, &bytes_copied);
320 if (error != 0) {
321 return error;
322 }
323 assert(bytes_copied <= PSHMNAMLEN + 1);
324 assert(pinfo->pshm_hdr.pshm_name[bytes_copied - 1] == 0);
325 if (bytes_copied < 2) { /* 2: expect at least one character and terminating zero */
326 return EINVAL;
327 }
328 AUDIT_ARG(text, &pinfo->pshm_hdr.pshm_name[0]);
329 return 0;
330 }
331
332 /*
333 * Process a shm_open() system call.
334 */
335 int
shm_open(proc_t p,struct shm_open_args * uap,int32_t * retval)336 shm_open(proc_t p, struct shm_open_args *uap, int32_t *retval)
337 {
338 int indx;
339 int error = 0;
340 pshm_info_t *pinfo = NULL;
341 pshm_info_t *new_pinfo = NULL;
342 pshmnode_t *new_pnode = NULL;
343 struct fileproc *fp = NULL;
344 int fmode;
345 mode_t cmode = (mode_t)uap->mode;
346 bool incache = false;
347 bool have_label = false;
348
349 AUDIT_ARG(fflags, uap->oflag);
350 AUDIT_ARG(mode, cmode);
351
352 /*
353 * Allocate data structures we need. We parse the userspace name into
354 * a pshm_info_t, even when we don't need to O_CREAT.
355 */
356 new_pinfo = kalloc_type(pshm_info_t, Z_WAITOK | Z_ZERO | Z_NOFAIL);
357
358 /*
359 * Get and check the name.
360 */
361 error = pshm_get_name(new_pinfo, uap->name);
362 if (error != 0) {
363 goto bad;
364 }
365
366 /*
367 * Attempt to allocate a new fp. If unsuccessful, the fp will be
368 * left unmodified (NULL).
369 */
370 error = falloc(p, &fp, &indx, vfs_context_current());
371 if (error) {
372 goto bad;
373 }
374
375 cmode &= ALLPERMS;
376
377 fmode = FFLAGS(uap->oflag);
378 if ((fmode & (FREAD | FWRITE)) == 0) {
379 error = EINVAL;
380 goto bad;
381 }
382
383 /*
384 * Will need a new pnode for the file pointer
385 */
386 new_pnode = kalloc_type(pshmnode_t, Z_WAITOK | Z_ZERO);
387 if (new_pnode == NULL) {
388 error = ENOSPC;
389 goto bad;
390 }
391
392 /*
393 * If creating a new segment, fill in its information.
394 * If we find a pre-exisitng one in cache lookup we'll just toss this one later.
395 */
396 if (fmode & O_CREAT) {
397 new_pinfo->pshm_usecount = 2; /* one each for: file pointer, shm_unlink */
398 new_pinfo->pshm_length = 0;
399 new_pinfo->pshm_mode = cmode;
400 new_pinfo->pshm_uid = kauth_getuid();
401 new_pinfo->pshm_gid = kauth_getgid();
402 SLIST_INIT(&new_pinfo->pshm_mobjs);
403 #if CONFIG_MACF
404 mac_posixshm_label_init(&new_pinfo->pshm_hdr);
405 have_label = true;
406 error = mac_posixshm_check_create(kauth_cred_get(), new_pinfo->pshm_hdr.pshm_name);
407 if (error) {
408 goto bad;
409 }
410 #endif
411 }
412
413 /*
414 * Look up the named shared memory segment in the cache, possibly adding
415 * it for O_CREAT.
416 */
417 PSHM_SUBSYS_LOCK();
418
419 pinfo = pshm_cache_search(new_pinfo);
420 if (pinfo != NULL) {
421 incache = true;
422
423 /* Get a new reference to go with the file pointer.*/
424 error = pshm_ref(pinfo);
425 if (error) {
426 pinfo = NULL; /* so cleanup code doesn't deref */
427 goto bad_locked;
428 }
429
430 /* can't have pre-existing if O_EXCL */
431 if ((fmode & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) {
432 error = EEXIST;
433 goto bad_locked;
434 }
435
436 /* O_TRUNC is only valid while length is not yet set */
437 if ((fmode & O_TRUNC) &&
438 (pinfo->pshm_flags & (PSHM_ALLOCATING | PSHM_ALLOCATED))) {
439 error = EINVAL;
440 goto bad_locked;
441 }
442 } else {
443 incache = false;
444
445 /* if it wasn't found, must have O_CREAT */
446 if (!(fmode & O_CREAT)) {
447 error = ENOENT;
448 goto bad_locked;
449 }
450
451 /* Add the new region to the cache. */
452 pinfo = new_pinfo;
453 pshm_cache_add(pinfo);
454 new_pinfo = NULL; /* so that it doesn't get free'd */
455 }
456
457 PSHM_SUBSYS_UNLOCK();
458
459 /*
460 * Check we have permission to access any pre-existing segment
461 */
462 if (incache) {
463 if (fmode & O_CREAT) {
464 AUDIT_ARG(posix_ipc_perm, pinfo->pshm_uid,
465 pinfo->pshm_gid, pinfo->pshm_mode);
466 }
467 #if CONFIG_MACF
468 if ((error = mac_posixshm_check_open(kauth_cred_get(), &pinfo->pshm_hdr, fmode))) {
469 goto bad;
470 }
471 #endif
472 if ((error = pshm_access(pinfo, fmode, kauth_cred_get(), p))) {
473 goto bad;
474 }
475 } else {
476 #if CONFIG_MACF
477 mac_posixshm_label_associate(kauth_cred_get(), &pinfo->pshm_hdr, pinfo->pshm_hdr.pshm_name);
478 #endif
479 }
480
481 fp->fp_flags |= FP_CLOEXEC;
482 fp->f_flag = fmode & FMASK;
483 fp->f_ops = &pshmops;
484 new_pnode->pinfo = pinfo;
485 fp_set_data(fp, new_pnode);
486
487 proc_fdlock(p);
488 procfdtbl_releasefd(p, indx, NULL);
489 fp_drop(p, indx, fp, 1);
490 proc_fdunlock(p);
491
492 *retval = indx;
493 error = 0;
494 goto done;
495
496 bad_locked:
497 PSHM_SUBSYS_UNLOCK();
498 bad:
499 /*
500 * Drop any new reference to a pre-existing shared memory region.
501 */
502 if (incache && pinfo != NULL) {
503 PSHM_SUBSYS_LOCK();
504 pshm_deref(pinfo);
505 PSHM_SUBSYS_UNLOCK();
506 }
507
508 /*
509 * Delete any allocated unused data structures.
510 */
511 kfree_type(pshmnode_t, new_pnode);
512
513 if (fp != NULL) {
514 fp_free(p, indx, fp);
515 }
516
517 done:
518 if (new_pinfo != NULL) {
519 #if CONFIG_MACF
520 if (have_label) {
521 mac_posixshm_label_destroy(&new_pinfo->pshm_hdr);
522 }
523 #endif
524 kfree_type(pshm_info_t, new_pinfo);
525 }
526 return error;
527 }
528
529
530 /*
531 * The truncate call associates memory with shared memory region. It can
532 * only be succesfully done with a non-zero length once per shared memory region.
533 */
534 int
pshm_truncate(__unused proc_t p,struct fileproc * fp,__unused int fd,off_t length,__unused int32_t * retval)535 pshm_truncate(
536 __unused proc_t p,
537 struct fileproc *fp,
538 __unused int fd,
539 off_t length,
540 __unused int32_t *retval)
541 {
542 pshm_info_t *pinfo;
543 pshmnode_t *pnode;
544 kern_return_t kret;
545 mem_entry_name_port_t mem_object;
546 mach_vm_size_t total_size, alloc_size;
547 memory_object_size_t mosize;
548 pshm_mobj_t *pshmobj, *pshmobj_last;
549 vm_map_t user_map;
550 int error;
551
552 user_map = current_map();
553
554 if (FILEGLOB_DTYPE(fp->fp_glob) != DTYPE_PSXSHM) {
555 return EINVAL;
556 }
557
558 #if 0
559 /*
560 * Can't enforce this yet, some third party tools don't
561 * specify O_RDWR like they ought to. See radar 48692182
562 */
563 /* ftruncate() requires write permission */
564 if (!(fp->f_flag & FWRITE)) {
565 return EINVAL;
566 }
567 #endif
568
569 PSHM_SUBSYS_LOCK();
570 if (((pnode = (pshmnode_t *)fp_get_data(fp))) == NULL) {
571 PSHM_SUBSYS_UNLOCK();
572 return EINVAL;
573 }
574
575 if ((pinfo = pnode->pinfo) == NULL) {
576 PSHM_SUBSYS_UNLOCK();
577 return EINVAL;
578 }
579
580 /* We only allow one ftruncate() per lifetime of the shm object. */
581 if (pinfo->pshm_flags & (PSHM_ALLOCATING | PSHM_ALLOCATED)) {
582 PSHM_SUBSYS_UNLOCK();
583 return EINVAL;
584 }
585
586 #if CONFIG_MACF
587 error = mac_posixshm_check_truncate(kauth_cred_get(), &pinfo->pshm_hdr, length);
588 if (error) {
589 PSHM_SUBSYS_UNLOCK();
590 return error;
591 }
592 #endif
593 /*
594 * Grab an extra reference, so we can drop the lock while allocating and
595 * ensure the objects don't disappear.
596 */
597 error = pshm_ref(pinfo);
598 if (error) {
599 PSHM_SUBSYS_UNLOCK();
600 return error;
601 }
602
603 /* set ALLOCATING, so another truncate can't start */
604 pinfo->pshm_flags |= PSHM_ALLOCATING;
605 total_size = vm_map_round_page(length, vm_map_page_mask(user_map));
606
607 pshmobj_last = NULL;
608 for (alloc_size = 0; alloc_size < total_size; alloc_size += mosize) {
609 PSHM_SUBSYS_UNLOCK();
610
611 /* get a memory object back some of the shared memory */
612 mosize = MIN(total_size - alloc_size, ANON_MAX_SIZE);
613 kret = mach_make_memory_entry_64(VM_MAP_NULL, &mosize, 0,
614 MAP_MEM_NAMED_CREATE | VM_PROT_DEFAULT, &mem_object, 0);
615
616 if (kret != KERN_SUCCESS) {
617 goto out;
618 }
619
620 /* get a list entry to track the memory object */
621 pshmobj = kalloc_type(pshm_mobj_t, Z_WAITOK | Z_NOFAIL);
622
623 PSHM_SUBSYS_LOCK();
624
625 /* link in the new entry */
626 pshmobj->pshmo_memobject = (void *)mem_object;
627 pshmobj->pshmo_size = mosize;
628 SLIST_NEXT(pshmobj, pshmo_next) = NULL;
629
630 if (pshmobj_last == NULL) {
631 SLIST_FIRST(&pinfo->pshm_mobjs) = pshmobj;
632 } else {
633 SLIST_INSERT_AFTER(pshmobj_last, pshmobj, pshmo_next);
634 }
635 pshmobj_last = pshmobj;
636 }
637
638 /* all done, change flags to ALLOCATED and return success */
639 pinfo->pshm_flags |= PSHM_ALLOCATED;
640 pinfo->pshm_flags &= ~(PSHM_ALLOCATING);
641 pinfo->pshm_length = total_size;
642 pshm_deref(pinfo); /* drop the "allocating" reference */
643 PSHM_SUBSYS_UNLOCK();
644 return 0;
645
646 out:
647 /* clean up any partially allocated objects */
648 PSHM_SUBSYS_LOCK();
649 while ((pshmobj = SLIST_FIRST(&pinfo->pshm_mobjs)) != NULL) {
650 SLIST_REMOVE_HEAD(&pinfo->pshm_mobjs, pshmo_next);
651 PSHM_SUBSYS_UNLOCK();
652 mach_memory_entry_port_release(pshmobj->pshmo_memobject);
653 kfree_type(pshm_mobj_t, pshmobj);
654 PSHM_SUBSYS_LOCK();
655 }
656 pinfo->pshm_flags &= ~PSHM_ALLOCATING;
657 pshm_deref(pinfo); /* drop the "allocating" reference */
658 PSHM_SUBSYS_UNLOCK();
659
660 switch (kret) {
661 case KERN_INVALID_ADDRESS:
662 case KERN_NO_SPACE:
663 return ENOMEM;
664 case KERN_PROTECTION_FAILURE:
665 return EACCES;
666 default:
667 return EINVAL;
668 }
669 }
670
671 int
pshm_stat(pshmnode_t * pnode,void * ub,int isstat64)672 pshm_stat(pshmnode_t *pnode, void *ub, int isstat64)
673 {
674 struct stat *sb = (struct stat *)0; /* warning avoidance ; protected by isstat64 */
675 struct stat64 * sb64 = (struct stat64 *)0; /* warning avoidance ; protected by isstat64 */
676 pshm_info_t *pinfo;
677 #if CONFIG_MACF
678 int error;
679 #endif
680
681 PSHM_SUBSYS_LOCK();
682 if ((pinfo = pnode->pinfo) == NULL) {
683 PSHM_SUBSYS_UNLOCK();
684 return EINVAL;
685 }
686
687 #if CONFIG_MACF
688 error = mac_posixshm_check_stat(kauth_cred_get(), &pinfo->pshm_hdr);
689 if (error) {
690 PSHM_SUBSYS_UNLOCK();
691 return error;
692 }
693 #endif
694
695 if (isstat64 != 0) {
696 sb64 = (struct stat64 *)ub;
697 bzero(sb64, sizeof(struct stat64));
698 sb64->st_mode = pinfo->pshm_mode;
699 sb64->st_uid = pinfo->pshm_uid;
700 sb64->st_gid = pinfo->pshm_gid;
701 sb64->st_size = pinfo->pshm_length;
702 } else {
703 sb = (struct stat *)ub;
704 bzero(sb, sizeof(struct stat));
705 sb->st_mode = pinfo->pshm_mode;
706 sb->st_uid = pinfo->pshm_uid;
707 sb->st_gid = pinfo->pshm_gid;
708 sb->st_size = pinfo->pshm_length;
709 }
710 PSHM_SUBSYS_UNLOCK();
711
712 return 0;
713 }
714
715 /*
716 * Verify access to a shared memory region.
717 */
718 static int
pshm_access(pshm_info_t * pinfo,int mode,kauth_cred_t cred,__unused proc_t p)719 pshm_access(pshm_info_t *pinfo, int mode, kauth_cred_t cred, __unused proc_t p)
720 {
721 mode_t mode_req = ((mode & FREAD) ? S_IRUSR : 0) |
722 ((mode & FWRITE) ? S_IWUSR : 0);
723
724 /* Otherwise, user id 0 always gets access. */
725 if (!suser(cred, NULL)) {
726 return 0;
727 }
728
729 return posix_cred_access(cred, pinfo->pshm_uid, pinfo->pshm_gid, pinfo->pshm_mode, mode_req);
730 }
731
732 int
pshm_mmap(__unused proc_t p,struct mmap_args * uap,user_addr_t * retval,struct fileproc * fp,off_t pageoff)733 pshm_mmap(
734 __unused proc_t p,
735 struct mmap_args *uap,
736 user_addr_t *retval,
737 struct fileproc *fp,
738 off_t pageoff)
739 {
740 vm_map_offset_t user_addr = (vm_map_offset_t)uap->addr;
741 vm_map_size_t user_size = (vm_map_size_t)uap->len;
742 vm_map_offset_t user_start_addr = 0;
743 vm_map_size_t map_size, mapped_size, pshm_size;
744 int prot = uap->prot;
745 int max_prot = VM_PROT_DEFAULT;
746 int flags = uap->flags;
747 vm_object_offset_t file_pos = (vm_object_offset_t)uap->pos;
748 vm_object_offset_t map_pos;
749 vm_map_t user_map;
750 int alloc_flags;
751 vm_map_kernel_flags_t vmk_flags;
752 bool docow;
753 kern_return_t kret = KERN_SUCCESS;
754 pshm_info_t *pinfo;
755 pshmnode_t *pnode;
756 pshm_mobj_t *pshmobj;
757 int error;
758
759 if (user_size == 0) {
760 return 0;
761 }
762
763 if (!(flags & MAP_SHARED)) {
764 return EINVAL;
765 }
766
767 /* Can't allow write permission if the shm_open() didn't allow them. */
768 if (!(fp->f_flag & FWRITE)) {
769 if (prot & VM_PROT_WRITE) {
770 return EPERM;
771 }
772 max_prot &= ~VM_PROT_WRITE;
773 }
774
775 user_map = current_map();
776
777 PSHM_SUBSYS_LOCK();
778 pnode = (pshmnode_t *)fp_get_data(fp);
779 if (pnode == NULL) {
780 PSHM_SUBSYS_UNLOCK();
781 return EINVAL;
782 }
783
784 pinfo = pnode->pinfo;
785 if (pinfo == NULL) {
786 PSHM_SUBSYS_UNLOCK();
787 return EINVAL;
788 }
789
790 if (!(pinfo->pshm_flags & PSHM_ALLOCATED)) {
791 PSHM_SUBSYS_UNLOCK();
792 return EINVAL;
793 }
794
795 pshm_size = vm_map_round_page((vm_map_size_t)pinfo->pshm_length, vm_map_page_mask(user_map));
796
797 if (user_size > pshm_size) {
798 PSHM_SUBSYS_UNLOCK();
799 return EINVAL;
800 }
801
802 vm_map_size_t end_pos = 0;
803 if (os_add_overflow(user_size, file_pos, &end_pos)) {
804 PSHM_SUBSYS_UNLOCK();
805 return EINVAL;
806 }
807 if (end_pos > pshm_size) {
808 PSHM_SUBSYS_UNLOCK();
809 return EINVAL;
810 }
811
812 pshmobj = SLIST_FIRST(&pinfo->pshm_mobjs);
813 if (pshmobj == NULL) {
814 PSHM_SUBSYS_UNLOCK();
815 return EINVAL;
816 }
817
818 #if CONFIG_MACF
819 error = mac_posixshm_check_mmap(kauth_cred_get(), &pinfo->pshm_hdr, prot, flags);
820 if (error) {
821 PSHM_SUBSYS_UNLOCK();
822 return error;
823 }
824 #endif
825 /* Grab an extra reference, so we can drop the lock while mapping. */
826 error = pshm_ref(pinfo);
827 if (error) {
828 PSHM_SUBSYS_UNLOCK();
829 return error;
830 }
831
832 PSHM_SUBSYS_UNLOCK();
833
834 if (!(flags & MAP_FIXED)) {
835 alloc_flags = VM_FLAGS_ANYWHERE;
836 user_addr = vm_map_round_page(user_addr,
837 vm_map_page_mask(user_map));
838 } else {
839 if (user_addr != vm_map_round_page(user_addr,
840 vm_map_page_mask(user_map))) {
841 error = EINVAL;
842 goto out_deref;
843 }
844
845 /*
846 * We do not get rid of the existing mappings here because
847 * it wouldn't be atomic (see comment in mmap()). We let
848 * Mach VM know that we want it to replace any existing
849 * mapping with the new one.
850 */
851 alloc_flags = VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE;
852 }
853 docow = false;
854
855 mapped_size = 0;
856 vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
857 /* reserve the entire space first... */
858 kret = vm_map_enter_mem_object(user_map,
859 &user_addr,
860 user_size,
861 0,
862 alloc_flags,
863 vmk_flags,
864 VM_KERN_MEMORY_NONE,
865 IPC_PORT_NULL,
866 0,
867 false,
868 VM_PROT_NONE,
869 VM_PROT_NONE,
870 VM_INHERIT_NONE);
871 user_start_addr = user_addr;
872 if (kret != KERN_SUCCESS) {
873 goto out_deref;
874 }
875
876 /* Now overwrite with the real mappings. */
877 for (map_pos = 0, pshmobj = SLIST_FIRST(&pinfo->pshm_mobjs);
878 user_size != 0;
879 map_pos += pshmobj->pshmo_size, pshmobj = SLIST_NEXT(pshmobj, pshmo_next)) {
880 if (pshmobj == NULL) {
881 /* nothing there to map !? */
882 goto out_deref;
883 }
884 if (file_pos >= map_pos + pshmobj->pshmo_size) {
885 continue;
886 }
887 map_size = (vm_map_size_t)(pshmobj->pshmo_size - (file_pos - map_pos));
888 if (map_size > user_size) {
889 map_size = user_size;
890 }
891 vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
892 kret = vm_map_enter_mem_object(
893 user_map,
894 &user_addr,
895 map_size,
896 0,
897 VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
898 vmk_flags,
899 VM_KERN_MEMORY_NONE,
900 pshmobj->pshmo_memobject,
901 file_pos - map_pos,
902 docow,
903 prot,
904 max_prot,
905 VM_INHERIT_SHARE);
906 if (kret != KERN_SUCCESS) {
907 goto out_deref;
908 }
909
910 user_addr += map_size;
911 user_size -= map_size;
912 mapped_size += map_size;
913 file_pos += map_size;
914 }
915
916 PSHM_SUBSYS_LOCK();
917 pnode->mapp_addr = user_start_addr;
918 pinfo->pshm_flags |= (PSHM_MAPPED | PSHM_INUSE);
919 PSHM_SUBSYS_UNLOCK();
920 out_deref:
921 PSHM_SUBSYS_LOCK();
922 pshm_deref(pinfo); /* drop the extra reference we had while mapping. */
923 PSHM_SUBSYS_UNLOCK();
924 if (kret != KERN_SUCCESS) {
925 if (mapped_size != 0) {
926 (void) mach_vm_deallocate(current_map(),
927 user_start_addr,
928 mapped_size);
929 }
930 }
931
932 switch (kret) {
933 case KERN_SUCCESS:
934 *retval = (user_addr_t)(user_start_addr + pageoff);
935 return 0;
936 case KERN_INVALID_ADDRESS:
937 case KERN_NO_SPACE:
938 return ENOMEM;
939 case KERN_PROTECTION_FAILURE:
940 return EACCES;
941 default:
942 return EINVAL;
943 }
944 }
945
946 /*
947 * Remove a shared memory region name from the name lookup cache.
948 */
949 static void
pshm_unlink_internal(pshm_info_t * pinfo)950 pshm_unlink_internal(pshm_info_t *pinfo)
951 {
952 PSHM_SUBSYS_ASSERT_HELD();
953
954 pshm_cache_delete(pinfo);
955 pinfo->pshm_flags |= PSHM_REMOVED;
956
957 /* release the "unlink" reference */
958 pshm_deref(pinfo);
959 }
960
961 int
shm_unlink(proc_t p,struct shm_unlink_args * uap,__unused int32_t * retval)962 shm_unlink(proc_t p, struct shm_unlink_args *uap, __unused int32_t *retval)
963 {
964 int error = 0;
965 pshm_info_t *pinfo = NULL;
966 pshm_info_t *name_pinfo = NULL;
967
968 /*
969 * Get the name from user args.
970 */
971 name_pinfo = kalloc_type(pshm_info_t,
972 Z_WAITOK | Z_ZERO | Z_NOFAIL);
973 error = pshm_get_name(name_pinfo, uap->name);
974 if (error != 0) {
975 error = EINVAL;
976 goto bad;
977 }
978
979 PSHM_SUBSYS_LOCK();
980 pinfo = pshm_cache_search(name_pinfo);
981
982 if (pinfo == NULL) {
983 error = ENOENT;
984 goto bad_unlock;
985 }
986
987 #if CONFIG_MACF
988 error = mac_posixshm_check_unlink(kauth_cred_get(), &pinfo->pshm_hdr, name_pinfo->pshm_hdr.pshm_name);
989 if (error) {
990 goto bad_unlock;
991 }
992 #endif
993
994 AUDIT_ARG(posix_ipc_perm, pinfo->pshm_uid, pinfo->pshm_gid, pinfo->pshm_mode);
995
996 /*
997 * Following file semantics, unlink should normally be allowed
998 * for users with write permission only. We also allow the creator
999 * of a segment to be able to delete, even w/o write permission.
1000 * That's because there's no equivalent of write permission for the
1001 * directory containing a file.
1002 */
1003 error = pshm_access(pinfo, FWRITE, kauth_cred_get(), p);
1004 if (error != 0 && pinfo->pshm_uid != kauth_getuid()) {
1005 goto bad_unlock;
1006 }
1007
1008 pshm_unlink_internal(pinfo);
1009 error = 0;
1010 bad_unlock:
1011 PSHM_SUBSYS_UNLOCK();
1012 bad:
1013 kfree_type(pshm_info_t, name_pinfo);
1014 return error;
1015 }
1016
1017 /*
1018 * Add a new reference to a shared memory region.
1019 * Fails if we will overflow the reference counter.
1020 */
1021 static int
pshm_ref(pshm_info_t * pinfo)1022 pshm_ref(pshm_info_t *pinfo)
1023 {
1024 PSHM_SUBSYS_ASSERT_HELD();
1025
1026 if (pinfo->pshm_usecount == PSHM_MAXCOUNT) {
1027 return EMFILE;
1028 }
1029 pinfo->pshm_usecount++;
1030 return 0;
1031 }
1032
1033 /*
1034 * Dereference a pshm_info_t. Delete the region if
1035 * this was the final reference count.
1036 */
1037 static void
pshm_deref(pshm_info_t * pinfo)1038 pshm_deref(pshm_info_t *pinfo)
1039 {
1040 pshm_mobj_t *pshmobj;
1041
1042 PSHM_SUBSYS_ASSERT_HELD();
1043 if (pinfo->pshm_usecount == 0) {
1044 panic("negative usecount in pshm_close");
1045 }
1046 pinfo->pshm_usecount--; /* release this fd's reference */
1047
1048 if (pinfo->pshm_usecount == 0) {
1049 #if CONFIG_MACF
1050 mac_posixshm_label_destroy(&pinfo->pshm_hdr);
1051 #endif
1052 PSHM_SUBSYS_UNLOCK();
1053
1054 /*
1055 * Release references to any backing objects.
1056 */
1057 while ((pshmobj = SLIST_FIRST(&pinfo->pshm_mobjs)) != NULL) {
1058 SLIST_REMOVE_HEAD(&pinfo->pshm_mobjs, pshmo_next);
1059 mach_memory_entry_port_release(pshmobj->pshmo_memobject);
1060 kfree_type(pshm_mobj_t, pshmobj);
1061 }
1062
1063 /* free the pinfo itself */
1064 kfree_type(pshm_info_t, pinfo);
1065
1066 PSHM_SUBSYS_LOCK();
1067 }
1068 }
1069
1070 /* vfs_context_t passed to match prototype for struct fileops */
1071 static int
pshm_closefile(struct fileglob * fg,__unused vfs_context_t ctx)1072 pshm_closefile(struct fileglob *fg, __unused vfs_context_t ctx)
1073 {
1074 int error = EINVAL;
1075 pshmnode_t *pnode;
1076
1077 PSHM_SUBSYS_LOCK();
1078
1079 pnode = (pshmnode_t *)fg_get_data(fg);
1080 if (pnode != NULL) {
1081 error = 0;
1082 fg_set_data(fg, NULL); /* set fg_data to NULL to avoid racing close()es */
1083 if (pnode->pinfo != NULL) {
1084 pshm_deref(pnode->pinfo);
1085 pnode->pinfo = NULL;
1086 }
1087 }
1088
1089 PSHM_SUBSYS_UNLOCK();
1090 kfree_type(pshmnode_t, pnode);
1091
1092 return error;
1093 }
1094
1095 int
fill_pshminfo(pshmnode_t * pshm,struct pshm_info * info)1096 fill_pshminfo(pshmnode_t * pshm, struct pshm_info * info)
1097 {
1098 pshm_info_t *pinfo;
1099 struct vinfo_stat *sb;
1100
1101 PSHM_SUBSYS_LOCK();
1102 if ((pinfo = pshm->pinfo) == NULL) {
1103 PSHM_SUBSYS_UNLOCK();
1104 return EINVAL;
1105 }
1106
1107 sb = &info->pshm_stat;
1108
1109 bzero(sb, sizeof(struct vinfo_stat));
1110 sb->vst_mode = pinfo->pshm_mode;
1111 sb->vst_uid = pinfo->pshm_uid;
1112 sb->vst_gid = pinfo->pshm_gid;
1113 sb->vst_size = pinfo->pshm_length;
1114
1115 info->pshm_mappaddr = pshm->mapp_addr;
1116 bcopy(&pinfo->pshm_hdr.pshm_name[0], &info->pshm_name[0], PSHMNAMLEN + 1);
1117
1118 PSHM_SUBSYS_UNLOCK();
1119 return 0;
1120 }
1121
1122 #if CONFIG_MACF
1123 void
pshm_label_associate(struct fileproc * fp,struct vnode * vp,vfs_context_t ctx)1124 pshm_label_associate(struct fileproc *fp, struct vnode *vp, vfs_context_t ctx)
1125 {
1126 pshmnode_t *pnode;
1127 pshm_info_t *pshm;
1128
1129 PSHM_SUBSYS_LOCK();
1130 pnode = (pshmnode_t *)fp_get_data(fp);
1131 if (pnode != NULL) {
1132 pshm = pnode->pinfo;
1133 if (pshm != NULL) {
1134 mac_posixshm_vnode_label_associate(
1135 vfs_context_ucred(ctx), &pshm->pshm_hdr,
1136 mac_posixshm_label(&pshm->pshm_hdr), vp, mac_vnode_label(vp));
1137 }
1138 }
1139 PSHM_SUBSYS_UNLOCK();
1140 }
1141 #endif
1142