1 /*
2 * Copyright (c) 2000-2019 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* $NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $ */
29
30 /*
31 * Copyright (c) 1994 Adam Glass and Charles Hannum. All rights reserved.
32 *
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
35 * are met:
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 3. All advertising materials mentioning features or use of this software
42 * must display the following acknowledgement:
43 * This product includes software developed by Adam Glass and Charles
44 * Hannum.
45 * 4. The names of the authors may not be used to endorse or promote products
46 * derived from this software without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
49 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
50 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
51 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
52 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
53 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
54 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
55 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
56 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
57 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
58 */
59 /*
60 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
61 * support for mandatory and extensible security protections. This notice
62 * is included in support of clause 2.2 (b) of the Apple Public License,
63 * Version 2.0.
64 * Copyright (c) 2005-2006 SPARTA, Inc.
65 */
66
67
68 #include <sys/appleapiopts.h>
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/shm_internal.h>
73 #include <sys/proc_internal.h>
74 #include <sys/kauth.h>
75 #include <sys/malloc.h>
76 #include <sys/mman.h>
77 #include <sys/stat.h>
78 #include <sys/sysctl.h>
79 #include <sys/ipcs.h>
80 #include <sys/sysent.h>
81 #include <sys/sysproto.h>
82 #if CONFIG_MACF
83 #include <security/mac_framework.h>
84 #endif
85
86 #include <security/audit/audit.h>
87
88 #include <mach/mach_types.h>
89 #include <mach/vm_inherit.h>
90 #include <mach/vm_map.h>
91
92 #include <mach/mach_vm.h>
93
94 #include <vm/vm_map_xnu.h>
95 #include <vm/vm_protos.h>
96 #include <vm/vm_memory_entry_xnu.h>
97 #include <vm/vm_kern_xnu.h>
98
99 #include <kern/locks.h>
100 #include <os/overflow.h>
101
102 /* Uncomment this line to see MAC debugging output. */
103 /* #define MAC_DEBUG */
104 #if CONFIG_MACF_DEBUG
105 #define MPRINTF(a) printf a
106 #else
107 #define MPRINTF(a)
108 #endif
109
110 #if SYSV_SHM
111 static int shminit(void);
112
113 static LCK_GRP_DECLARE(sysv_shm_subsys_lck_grp, "sysv_shm_subsys_lock");
114 static LCK_MTX_DECLARE(sysv_shm_subsys_mutex, &sysv_shm_subsys_lck_grp);
115
116 #define SYSV_SHM_SUBSYS_LOCK() lck_mtx_lock(&sysv_shm_subsys_mutex)
117 #define SYSV_SHM_SUBSYS_UNLOCK() lck_mtx_unlock(&sysv_shm_subsys_mutex)
118
119 static int oshmctl(void *p, void *uap, void *retval);
120 static int shmget_allocate_segment(struct proc *p, struct shmget_args *uap, int mode, int * retval);
121 static int shmget_existing(struct shmget_args *uap, int mode, int segnum, int * retval);
122 static void shmid_ds_64to32(struct user_shmid_ds *in, struct user32_shmid_ds *out);
123 static void shmid_ds_32to64(struct user32_shmid_ds *in, struct user_shmid_ds *out);
124
125 /* XXX casting to (sy_call_t *) is bogus, as usual. */
126 static sy_call_t* const shmcalls[] = {
127 (sy_call_t *)shmat, (sy_call_t *)oshmctl,
128 (sy_call_t *)shmdt, (sy_call_t *)shmget,
129 (sy_call_t *)shmctl
130 };
131
132 #define SHMSEG_FREE 0x0200
133 #define SHMSEG_REMOVED 0x0400
134 #define SHMSEG_ALLOCATED 0x0800
135 #define SHMSEG_WANTED 0x1000
136
137 static int shm_last_free, shm_nused, shm_committed;
138 struct shmid_kernel *shmsegs; /* 64 bit version */
139 static int shm_inited = 0;
140
141 /*
142 * Since anonymous memory chunks are limited to ANON_MAX_SIZE bytes,
143 * we have to keep a list of chunks when we want to handle a shared memory
144 * segment bigger than ANON_MAX_SIZE.
145 * Each chunk points to a VM named entry of up to ANON_MAX_SIZE bytes
146 * of anonymous memory.
147 */
148 struct shm_handle {
149 void * shm_object; /* named entry for this chunk*/
150 memory_object_size_t shm_handle_size; /* size of this chunk */
151 struct shm_handle *shm_handle_next; /* next chunk */
152 };
153
154 struct shmmap_state {
155 mach_vm_address_t va; /* user address */
156 int shmid; /* segment id */
157 };
158
159 static void shm_deallocate_segment(struct shmid_kernel *);
160 static int shm_find_segment_by_key(key_t);
161 static struct shmid_kernel *shm_find_segment_by_shmid(int);
162 static int shm_delete_mapping(struct proc *, struct shmmap_state *, int);
163
164 #ifdef __APPLE_API_PRIVATE
165 #define DEFAULT_SHMMAX (4 * 1024 * 1024)
166 #define DEFAULT_SHMMIN 1
167 #define DEFAULT_SHMMNI 32
168 #define DEFAULT_SHMSEG 8
169 #define DEFAULT_SHMALL 1024
170
171 struct shminfo shminfo = {
172 .shmmax = DEFAULT_SHMMAX,
173 .shmmin = DEFAULT_SHMMIN,
174 .shmmni = DEFAULT_SHMMNI,
175 .shmseg = DEFAULT_SHMSEG,
176 .shmall = DEFAULT_SHMALL
177 };
178
179 #define SHMID_IS_VALID(x) ((x) >= 0)
180 #define SHMID_UNALLOCATED (-1)
181 #define SHMID_SENTINEL (-2)
182
183 #endif /* __APPLE_API_PRIVATE */
184
185 static __inline__ time_t
sysv_shmtime(void)186 sysv_shmtime(void)
187 {
188 struct timeval tv;
189 microtime(&tv);
190 return tv.tv_sec;
191 }
192
193 /*
194 * This conversion is safe, since if we are converting for a 32 bit process,
195 * then it's value of (struct shmid_ds)->shm_segsz will never exceed 4G.
196 *
197 * NOTE: Source and target may *NOT* overlap! (target is smaller)
198 */
199 static void
shmid_ds_64to32(struct user_shmid_ds * in,struct user32_shmid_ds * out)200 shmid_ds_64to32(struct user_shmid_ds *in, struct user32_shmid_ds *out)
201 {
202 out->shm_perm = in->shm_perm;
203 out->shm_segsz = in->shm_segsz;
204 out->shm_lpid = in->shm_lpid;
205 out->shm_cpid = in->shm_cpid;
206 out->shm_nattch = in->shm_nattch;
207 out->shm_atime = in->shm_atime;
208 out->shm_dtime = in->shm_dtime;
209 out->shm_ctime = in->shm_ctime;
210 out->shm_internal = CAST_DOWN_EXPLICIT(int, in->shm_internal);
211 }
212
213 /*
214 * NOTE: Source and target may are permitted to overlap! (source is smaller);
215 * this works because we copy fields in order from the end of the struct to
216 * the beginning.
217 */
218 static void
shmid_ds_32to64(struct user32_shmid_ds * in,struct user_shmid_ds * out)219 shmid_ds_32to64(struct user32_shmid_ds *in, struct user_shmid_ds *out)
220 {
221 out->shm_internal = in->shm_internal;
222 out->shm_ctime = in->shm_ctime;
223 out->shm_dtime = in->shm_dtime;
224 out->shm_atime = in->shm_atime;
225 out->shm_nattch = in->shm_nattch;
226 out->shm_cpid = in->shm_cpid;
227 out->shm_lpid = in->shm_lpid;
228 out->shm_segsz = in->shm_segsz;
229 out->shm_perm = in->shm_perm;
230 }
231
232
233 static int
shm_find_segment_by_key(key_t key)234 shm_find_segment_by_key(key_t key)
235 {
236 int i;
237
238 for (i = 0; i < shminfo.shmmni; i++) {
239 if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) &&
240 shmsegs[i].u.shm_perm._key == key) {
241 return i;
242 }
243 }
244 return -1;
245 }
246
247 static struct shmid_kernel *
shm_find_segment_by_shmid(int shmid)248 shm_find_segment_by_shmid(int shmid)
249 {
250 int segnum;
251 struct shmid_kernel *shmseg;
252
253 segnum = IPCID_TO_IX(shmid);
254 if (segnum < 0 || segnum >= shminfo.shmmni) {
255 return NULL;
256 }
257 shmseg = &shmsegs[segnum];
258 if ((shmseg->u.shm_perm.mode & (SHMSEG_ALLOCATED | SHMSEG_REMOVED))
259 != SHMSEG_ALLOCATED ||
260 shmseg->u.shm_perm._seq != IPCID_TO_SEQ(shmid)) {
261 return NULL;
262 }
263 return shmseg;
264 }
265
266 static void
shm_deallocate_segment(struct shmid_kernel * shmseg)267 shm_deallocate_segment(struct shmid_kernel *shmseg)
268 {
269 struct shm_handle *shm_handle, *shm_handle_next;
270 mach_vm_size_t size;
271
272 for (shm_handle = CAST_DOWN(void *, shmseg->u.shm_internal); /* tunnel */
273 shm_handle != NULL;
274 shm_handle = shm_handle_next) {
275 shm_handle_next = shm_handle->shm_handle_next;
276 mach_memory_entry_port_release(shm_handle->shm_object);
277 kfree_type(struct shm_handle, shm_handle);
278 }
279 shmseg->u.shm_internal = USER_ADDR_NULL; /* tunnel */
280 size = vm_map_round_page(shmseg->u.shm_segsz,
281 vm_map_page_mask(current_map()));
282 shm_committed -= btoc(size);
283 shm_nused--;
284 shmseg->u.shm_perm.mode = SHMSEG_FREE;
285 #if CONFIG_MACF
286 /* Reset the MAC label */
287 mac_sysvshm_label_recycle(shmseg);
288 #endif
289 }
290
291 static int
shm_delete_mapping(__unused struct proc * p,struct shmmap_state * shmmap_s,int deallocate)292 shm_delete_mapping(__unused struct proc *p, struct shmmap_state *shmmap_s,
293 int deallocate)
294 {
295 struct shmid_kernel *shmseg;
296 int segnum, result;
297 mach_vm_size_t size;
298
299 segnum = IPCID_TO_IX(shmmap_s->shmid);
300 shmseg = &shmsegs[segnum];
301 size = vm_map_round_page(shmseg->u.shm_segsz,
302 vm_map_page_mask(current_map())); /* XXX done for us? */
303 if (deallocate) {
304 result = mach_vm_deallocate(current_map(), shmmap_s->va, size);
305 if (result != KERN_SUCCESS) {
306 return EINVAL;
307 }
308 }
309 shmmap_s->shmid = SHMID_UNALLOCATED;
310 shmseg->u.shm_dtime = sysv_shmtime();
311 if ((--shmseg->u.shm_nattch <= 0) &&
312 (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) {
313 shm_deallocate_segment(shmseg);
314 shm_last_free = segnum;
315 }
316 return 0;
317 }
318
319 int
shmdt(struct proc * p,struct shmdt_args * uap,int32_t * retval)320 shmdt(struct proc *p, struct shmdt_args *uap, int32_t *retval)
321 {
322 #if CONFIG_MACF
323 struct shmid_kernel *shmsegptr;
324 #endif
325 struct shmmap_state *shmmap_s;
326 int i;
327 int shmdtret = 0;
328
329 AUDIT_ARG(svipc_addr, uap->shmaddr);
330
331 SYSV_SHM_SUBSYS_LOCK();
332
333 if ((shmdtret = shminit())) {
334 goto shmdt_out;
335 }
336
337 shmmap_s = (struct shmmap_state *)p->vm_shm;
338 if (shmmap_s == NULL) {
339 shmdtret = EINVAL;
340 goto shmdt_out;
341 }
342
343 for (; shmmap_s->shmid != SHMID_SENTINEL; shmmap_s++) {
344 if (SHMID_IS_VALID(shmmap_s->shmid) &&
345 shmmap_s->va == (mach_vm_offset_t)uap->shmaddr) {
346 break;
347 }
348 }
349
350 if (!SHMID_IS_VALID(shmmap_s->shmid)) {
351 shmdtret = EINVAL;
352 goto shmdt_out;
353 }
354
355 #if CONFIG_MACF
356 /*
357 * XXX: It might be useful to move this into the shm_delete_mapping
358 * function
359 */
360 shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)];
361 shmdtret = mac_sysvshm_check_shmdt(kauth_cred_get(), shmsegptr);
362 if (shmdtret) {
363 goto shmdt_out;
364 }
365 #endif
366 i = shm_delete_mapping(p, shmmap_s, 1);
367
368 if (i == 0) {
369 *retval = 0;
370 }
371 shmdtret = i;
372 shmdt_out:
373 SYSV_SHM_SUBSYS_UNLOCK();
374 return shmdtret;
375 }
376
377 int
shmat(struct proc * p,struct shmat_args * uap,user_addr_t * retval)378 shmat(struct proc *p, struct shmat_args *uap, user_addr_t *retval)
379 {
380 int error, flags;
381 struct shmid_kernel *shmseg;
382 struct shmmap_state *shmmap_s = NULL;
383 struct shm_handle *shm_handle;
384 mach_vm_address_t attach_va; /* attach address in/out */
385 mach_vm_address_t shmlba;
386 mach_vm_size_t map_size; /* size of map entry */
387 mach_vm_size_t mapped_size;
388 vm_prot_t prot;
389 kern_return_t rv;
390 int shmat_ret;
391 vm_map_kernel_flags_t vmk_flags;
392
393 shmat_ret = 0;
394
395 AUDIT_ARG(svipc_id, uap->shmid);
396 AUDIT_ARG(svipc_addr, uap->shmaddr);
397
398 SYSV_SHM_SUBSYS_LOCK();
399
400 if ((shmat_ret = shminit())) {
401 goto shmat_out;
402 }
403
404 shmmap_s = (struct shmmap_state *)p->vm_shm;
405 if (shmmap_s == NULL) {
406 /* lazily allocate the shm map */
407
408 int nsegs = shminfo.shmseg;
409 if (nsegs <= 0) {
410 shmat_ret = EMFILE;
411 goto shmat_out;
412 }
413
414 /* +1 for the sentinel */
415 shmmap_s = kalloc_type(struct shmmap_state, nsegs + 1, Z_WAITOK);
416 if (shmmap_s == NULL) {
417 shmat_ret = ENOMEM;
418 goto shmat_out;
419 }
420
421 /* initialize the entries */
422 for (int i = 0; i < nsegs; i++) {
423 shmmap_s[i].shmid = SHMID_UNALLOCATED;
424 }
425 shmmap_s[nsegs].shmid = SHMID_SENTINEL;
426
427 p->vm_shm = (caddr_t)shmmap_s;
428 }
429
430 shmseg = shm_find_segment_by_shmid(uap->shmid);
431 if (shmseg == NULL) {
432 shmat_ret = EINVAL;
433 goto shmat_out;
434 }
435
436 AUDIT_ARG(svipc_perm, &shmseg->u.shm_perm);
437 error = ipcperm(kauth_cred_get(), &shmseg->u.shm_perm,
438 (uap->shmflg & SHM_RDONLY) ? IPC_R : IPC_R | IPC_W);
439 if (error) {
440 shmat_ret = error;
441 goto shmat_out;
442 }
443
444 #if CONFIG_MACF
445 error = mac_sysvshm_check_shmat(kauth_cred_get(), shmseg, uap->shmflg);
446 if (error) {
447 shmat_ret = error;
448 goto shmat_out;
449 }
450 #endif
451
452 /* find a free shmid */
453 while (SHMID_IS_VALID(shmmap_s->shmid)) {
454 shmmap_s++;
455 }
456 if (shmmap_s->shmid != SHMID_UNALLOCATED) {
457 /* no free shmids */
458 shmat_ret = EMFILE;
459 goto shmat_out;
460 }
461
462 map_size = vm_map_round_page(shmseg->u.shm_segsz,
463 vm_map_page_mask(current_map()));
464 prot = VM_PROT_READ;
465 if ((uap->shmflg & SHM_RDONLY) == 0) {
466 prot |= VM_PROT_WRITE;
467 }
468 flags = MAP_ANON | MAP_SHARED;
469 if (uap->shmaddr) {
470 flags |= MAP_FIXED;
471 }
472
473 attach_va = (mach_vm_address_t)uap->shmaddr;
474 shmlba = vm_map_page_size(current_map()); /* XXX instead of SHMLBA */
475 if (uap->shmflg & SHM_RND) {
476 attach_va &= ~(shmlba - 1);
477 } else if ((attach_va & (shmlba - 1)) != 0) {
478 shmat_ret = EINVAL;
479 goto shmat_out;
480 }
481
482 if (flags & MAP_FIXED) {
483 vmk_flags = VM_MAP_KERNEL_FLAGS_FIXED();
484 } else {
485 vmk_flags = VM_MAP_KERNEL_FLAGS_ANYWHERE();
486 }
487
488 mapped_size = 0;
489
490 /* first reserve enough space... */
491 rv = mach_vm_map_kernel(current_map(),
492 &attach_va,
493 map_size,
494 0,
495 vmk_flags,
496 IPC_PORT_NULL,
497 0,
498 FALSE,
499 VM_PROT_NONE,
500 VM_PROT_NONE,
501 VM_INHERIT_NONE);
502 if (rv != KERN_SUCCESS) {
503 goto out;
504 }
505
506 shmmap_s->va = attach_va;
507
508 /* ... then map the shared memory over the reserved space */
509 for (shm_handle = CAST_DOWN(void *, shmseg->u.shm_internal);/* tunnel */
510 shm_handle != NULL;
511 shm_handle = shm_handle->shm_handle_next) {
512 vm_map_size_t chunk_size;
513
514 assert(mapped_size < map_size);
515 chunk_size = shm_handle->shm_handle_size;
516 if (chunk_size > map_size - mapped_size) {
517 /*
518 * Partial mapping of last chunk due to
519 * page size mismatch.
520 */
521 assert(vm_map_page_shift(current_map()) < PAGE_SHIFT);
522 assert(shm_handle->shm_handle_next == NULL);
523 chunk_size = map_size - mapped_size;
524 }
525 rv = mach_vm_map_kernel(
526 current_map(), /* process map */
527 &attach_va, /* attach address */
528 chunk_size, /* size to map */
529 (mach_vm_offset_t)0, /* alignment mask */
530 VM_MAP_KERNEL_FLAGS_FIXED(.vmf_overwrite = true),
531 shm_handle->shm_object,
532 (mach_vm_offset_t)0,
533 FALSE,
534 prot,
535 prot,
536 VM_INHERIT_SHARE);
537 if (rv != KERN_SUCCESS) {
538 goto out;
539 }
540
541 mapped_size += chunk_size;
542 attach_va = attach_va + chunk_size;
543 }
544
545 shmmap_s->shmid = uap->shmid;
546 shmseg->u.shm_lpid = proc_getpid(p);
547 shmseg->u.shm_atime = sysv_shmtime();
548 shmseg->u.shm_nattch++;
549 *retval = shmmap_s->va; /* XXX return -1 on error */
550 shmat_ret = 0;
551 goto shmat_out;
552 out:
553 if (mapped_size > 0) {
554 (void) mach_vm_deallocate(current_map(),
555 shmmap_s->va,
556 mapped_size);
557 }
558 switch (rv) {
559 case KERN_INVALID_ADDRESS:
560 case KERN_NO_SPACE:
561 shmat_ret = ENOMEM;
562 break;
563 case KERN_PROTECTION_FAILURE:
564 shmat_ret = EACCES;
565 break;
566 default:
567 shmat_ret = EINVAL;
568 break;
569 }
570 shmat_out:
571 SYSV_SHM_SUBSYS_UNLOCK();
572 return shmat_ret;
573 }
574
575 static int
oshmctl(__unused void * p,__unused void * uap,__unused void * retval)576 oshmctl(__unused void *p, __unused void *uap, __unused void *retval)
577 {
578 return EINVAL;
579 }
580
581 /*
582 * Returns: 0 Success
583 * EINVAL
584 * copyout:EFAULT
585 * copyin:EFAULT
586 * ipcperm:EPERM
587 * ipcperm:EACCES
588 */
589 int
shmctl(__unused struct proc * p,struct shmctl_args * uap,int32_t * retval)590 shmctl(__unused struct proc *p, struct shmctl_args *uap, int32_t *retval)
591 {
592 int error;
593 kauth_cred_t cred = kauth_cred_get();
594 struct user_shmid_ds inbuf;
595 struct shmid_kernel *shmseg;
596
597 int shmctl_ret = 0;
598
599 AUDIT_ARG(svipc_cmd, uap->cmd);
600 AUDIT_ARG(svipc_id, uap->shmid);
601
602 SYSV_SHM_SUBSYS_LOCK();
603
604 if ((shmctl_ret = shminit())) {
605 goto shmctl_out;
606 }
607
608 shmseg = shm_find_segment_by_shmid(uap->shmid);
609 if (shmseg == NULL) {
610 shmctl_ret = EINVAL;
611 goto shmctl_out;
612 }
613
614 /* XXAUDIT: This is the perms BEFORE any change by this call. This
615 * may not be what is desired.
616 */
617 AUDIT_ARG(svipc_perm, &shmseg->u.shm_perm);
618
619 #if CONFIG_MACF
620 error = mac_sysvshm_check_shmctl(cred, shmseg, uap->cmd);
621 if (error) {
622 shmctl_ret = error;
623 goto shmctl_out;
624 }
625 #endif
626 switch (uap->cmd) {
627 case IPC_STAT:
628 error = ipcperm(cred, &shmseg->u.shm_perm, IPC_R);
629 if (error) {
630 shmctl_ret = error;
631 goto shmctl_out;
632 }
633
634 if (IS_64BIT_PROCESS(p)) {
635 struct user_shmid_ds shmid_ds = {};
636 memcpy(&shmid_ds, &shmseg->u, sizeof(struct user_shmid_ds));
637
638 /* Clear kernel reserved pointer before copying to user space */
639 shmid_ds.shm_internal = USER_ADDR_NULL;
640
641 error = copyout(&shmid_ds, uap->buf, sizeof(shmid_ds));
642 } else {
643 struct user32_shmid_ds shmid_ds32 = {};
644 shmid_ds_64to32(&shmseg->u, &shmid_ds32);
645
646 /* Clear kernel reserved pointer before copying to user space */
647 shmid_ds32.shm_internal = (user32_addr_t)0;
648
649 error = copyout(&shmid_ds32, uap->buf, sizeof(shmid_ds32));
650 }
651 if (error) {
652 shmctl_ret = error;
653 goto shmctl_out;
654 }
655 break;
656 case IPC_SET:
657 error = ipcperm(cred, &shmseg->u.shm_perm, IPC_M);
658 if (error) {
659 shmctl_ret = error;
660 goto shmctl_out;
661 }
662 if (IS_64BIT_PROCESS(p)) {
663 error = copyin(uap->buf, &inbuf, sizeof(struct user_shmid_ds));
664 } else {
665 struct user32_shmid_ds shmid_ds32;
666 error = copyin(uap->buf, &shmid_ds32, sizeof(shmid_ds32));
667 /* convert in place; ugly, but safe */
668 shmid_ds_32to64(&shmid_ds32, &inbuf);
669 }
670 if (error) {
671 shmctl_ret = error;
672 goto shmctl_out;
673 }
674 shmseg->u.shm_perm.uid = inbuf.shm_perm.uid;
675 shmseg->u.shm_perm.gid = inbuf.shm_perm.gid;
676 shmseg->u.shm_perm.mode =
677 (shmseg->u.shm_perm.mode & ~ACCESSPERMS) |
678 (inbuf.shm_perm.mode & ACCESSPERMS);
679 shmseg->u.shm_ctime = sysv_shmtime();
680 break;
681 case IPC_RMID:
682 error = ipcperm(cred, &shmseg->u.shm_perm, IPC_M);
683 if (error) {
684 shmctl_ret = error;
685 goto shmctl_out;
686 }
687 shmseg->u.shm_perm._key = IPC_PRIVATE;
688 shmseg->u.shm_perm.mode |= SHMSEG_REMOVED;
689 if (shmseg->u.shm_nattch <= 0) {
690 shm_deallocate_segment(shmseg);
691 shm_last_free = IPCID_TO_IX(uap->shmid);
692 }
693 break;
694 #if 0
695 case SHM_LOCK:
696 case SHM_UNLOCK:
697 #endif
698 default:
699 shmctl_ret = EINVAL;
700 goto shmctl_out;
701 }
702 *retval = 0;
703 shmctl_ret = 0;
704 shmctl_out:
705 SYSV_SHM_SUBSYS_UNLOCK();
706 return shmctl_ret;
707 }
708
709 static int
shmget_existing(struct shmget_args * uap,int mode,int segnum,int * retval)710 shmget_existing(struct shmget_args *uap, int mode, int segnum, int *retval)
711 {
712 struct shmid_kernel *shmseg;
713 int error = 0;
714
715 shmseg = &shmsegs[segnum];
716 if (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) {
717 /*
718 * This segment is in the process of being allocated. Wait
719 * until it's done, and look the key up again (in case the
720 * allocation failed or it was freed).
721 */
722 shmseg->u.shm_perm.mode |= SHMSEG_WANTED;
723 error = tsleep((caddr_t)shmseg, PLOCK | PCATCH, "shmget", 0);
724 if (error) {
725 return error;
726 }
727 return EAGAIN;
728 }
729
730 /*
731 * The low 9 bits of shmflag are the mode bits being requested, which
732 * are the actual mode bits desired on the segment, and not in IPC_R
733 * form; therefore it would be incorrect to call ipcperm() to validate
734 * them; instead, we AND the existing mode with the requested mode, and
735 * verify that it matches the requested mode; otherwise, we fail with
736 * EACCES (access denied).
737 */
738 if ((shmseg->u.shm_perm.mode & mode) != mode) {
739 return EACCES;
740 }
741
742 #if CONFIG_MACF
743 error = mac_sysvshm_check_shmget(kauth_cred_get(), shmseg, uap->shmflg);
744 if (error) {
745 return error;
746 }
747 #endif
748
749 if (uap->size && uap->size > shmseg->u.shm_segsz) {
750 return EINVAL;
751 }
752
753 if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL)) {
754 return EEXIST;
755 }
756
757 *retval = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
758 return 0;
759 }
760
761 static int
shmget_allocate_segment(struct proc * p,struct shmget_args * uap,int mode,int * retval)762 shmget_allocate_segment(struct proc *p, struct shmget_args *uap, int mode,
763 int *retval)
764 {
765 int i, segnum, shmid;
766 kauth_cred_t cred = kauth_cred_get();
767 struct shmid_kernel *shmseg;
768 struct shm_handle *shm_handle;
769 kern_return_t kret;
770 mach_vm_size_t total_size, size = 0, alloc_size;
771 void * mem_object;
772 struct shm_handle *shm_handle_next, **shm_handle_next_p;
773
774 if (uap->size <= 0 ||
775 uap->size < (user_size_t)shminfo.shmmin ||
776 uap->size > (user_size_t)shminfo.shmmax) {
777 return EINVAL;
778 }
779 if (shm_nused >= shminfo.shmmni) { /* any shmids left? */
780 return ENOSPC;
781 }
782 if (mach_vm_round_page_overflow(uap->size, &total_size)) {
783 return EINVAL;
784 }
785 if ((user_ssize_t)(shm_committed + btoc(total_size)) > shminfo.shmall) {
786 return ENOMEM;
787 }
788 if (shm_last_free < 0) {
789 for (i = 0; i < shminfo.shmmni; i++) {
790 if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE) {
791 break;
792 }
793 }
794 if (i == shminfo.shmmni) {
795 panic("shmseg free count inconsistent");
796 }
797 segnum = i;
798 } else {
799 segnum = shm_last_free;
800 shm_last_free = -1;
801 }
802 shmseg = &shmsegs[segnum];
803
804 /*
805 * In case we sleep in malloc(), mark the segment present but deleted
806 * so that noone else tries to create the same key.
807 * XXX but we don't release the global lock !?
808 */
809 shmseg->u.shm_perm.mode = SHMSEG_ALLOCATED | SHMSEG_REMOVED;
810 shmseg->u.shm_perm._key = uap->key;
811 shmseg->u.shm_perm._seq = (shmseg->u.shm_perm._seq + 1) & 0x7fff;
812
813 shm_handle_next_p = NULL;
814 for (alloc_size = 0;
815 alloc_size < total_size;
816 alloc_size += size) {
817 size = MIN(total_size - alloc_size, ANON_MAX_SIZE);
818 kret = mach_make_memory_entry_64(
819 VM_MAP_NULL,
820 (memory_object_size_t *) &size,
821 (memory_object_offset_t) 0,
822 MAP_MEM_NAMED_CREATE | VM_PROT_DEFAULT,
823 (ipc_port_t *) &mem_object, 0);
824 if (kret != KERN_SUCCESS) {
825 goto out;
826 }
827
828 shm_handle = kalloc_type(struct shm_handle, Z_WAITOK | Z_NOFAIL);
829 shm_handle->shm_object = mem_object;
830 shm_handle->shm_handle_size = size;
831 shm_handle->shm_handle_next = NULL;
832 if (shm_handle_next_p == NULL) {
833 shmseg->u.shm_internal = CAST_USER_ADDR_T(shm_handle);/* tunnel */
834 } else {
835 *shm_handle_next_p = shm_handle;
836 }
837 shm_handle_next_p = &shm_handle->shm_handle_next;
838 }
839
840 shmid = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
841
842 shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = kauth_cred_getuid(cred);
843 shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = kauth_cred_getgid(cred);
844 shmseg->u.shm_perm.mode = (shmseg->u.shm_perm.mode & SHMSEG_WANTED) |
845 (mode & ACCESSPERMS) | SHMSEG_ALLOCATED;
846 shmseg->u.shm_segsz = uap->size;
847 shmseg->u.shm_cpid = proc_getpid(p);
848 shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0;
849 shmseg->u.shm_atime = shmseg->u.shm_dtime = 0;
850 #if CONFIG_MACF
851 mac_sysvshm_label_associate(cred, shmseg);
852 #endif
853 shmseg->u.shm_ctime = sysv_shmtime();
854 shm_committed += btoc(size);
855 shm_nused++;
856 AUDIT_ARG(svipc_perm, &shmseg->u.shm_perm);
857 if (shmseg->u.shm_perm.mode & SHMSEG_WANTED) {
858 /*
859 * Somebody else wanted this key while we were asleep. Wake
860 * them up now.
861 */
862 shmseg->u.shm_perm.mode &= ~SHMSEG_WANTED;
863 wakeup((caddr_t)shmseg);
864 }
865 *retval = shmid;
866 AUDIT_ARG(svipc_id, shmid);
867 return 0;
868 out:
869 if (kret != KERN_SUCCESS) {
870 for (shm_handle = CAST_DOWN(void *, shmseg->u.shm_internal); /* tunnel */
871 shm_handle != NULL;
872 shm_handle = shm_handle_next) {
873 shm_handle_next = shm_handle->shm_handle_next;
874 mach_memory_entry_port_release(shm_handle->shm_object);
875 kfree_type(struct shm_handle, shm_handle);
876 }
877 shmseg->u.shm_internal = USER_ADDR_NULL; /* tunnel */
878 }
879
880 switch (kret) {
881 case KERN_INVALID_ADDRESS:
882 case KERN_NO_SPACE:
883 return ENOMEM;
884 case KERN_PROTECTION_FAILURE:
885 return EACCES;
886 default:
887 return EINVAL;
888 }
889 }
890
891 int
shmget(struct proc * p,struct shmget_args * uap,int32_t * retval)892 shmget(struct proc *p, struct shmget_args *uap, int32_t *retval)
893 {
894 int segnum, mode, error;
895 int shmget_ret = 0;
896
897 /* Auditing is actually done in shmget_allocate_segment() */
898
899 SYSV_SHM_SUBSYS_LOCK();
900
901 if ((shmget_ret = shminit())) {
902 goto shmget_out;
903 }
904
905 mode = uap->shmflg & ACCESSPERMS;
906 if (uap->key != IPC_PRIVATE) {
907 again:
908 segnum = shm_find_segment_by_key(uap->key);
909 if (segnum >= 0) {
910 error = shmget_existing(uap, mode, segnum, retval);
911 if (error == EAGAIN) {
912 goto again;
913 }
914 shmget_ret = error;
915 goto shmget_out;
916 }
917 if ((uap->shmflg & IPC_CREAT) == 0) {
918 shmget_ret = ENOENT;
919 goto shmget_out;
920 }
921 }
922 shmget_ret = shmget_allocate_segment(p, uap, mode, retval);
923 shmget_out:
924 SYSV_SHM_SUBSYS_UNLOCK();
925 return shmget_ret;
926 }
927
928 /*
929 * shmsys
930 *
931 * Entry point for all SHM calls: shmat, oshmctl, shmdt, shmget, shmctl
932 *
933 * Parameters: p Process requesting the call
934 * uap User argument descriptor (see below)
935 * retval Return value of the selected shm call
936 *
937 * Indirect parameters: uap->which msg call to invoke (index in array of shm calls)
938 * uap->a2 User argument descriptor
939 *
940 * Returns: 0 Success
941 * !0 Not success
942 *
943 * Implicit returns: retval Return value of the selected shm call
944 *
945 * DEPRECATED: This interface should not be used to call the other SHM
946 * functions (shmat, oshmctl, shmdt, shmget, shmctl). The correct
947 * usage is to call the other SHM functions directly.
948 */
949 int
shmsys(struct proc * p,struct shmsys_args * uap,int32_t * retval)950 shmsys(struct proc *p, struct shmsys_args *uap, int32_t *retval)
951 {
952 /* The routine that we are dispatching already does this */
953
954 if (uap->which >= sizeof(shmcalls) / sizeof(shmcalls[0])) {
955 return EINVAL;
956 }
957 return (*shmcalls[uap->which])(p, &uap->a2, retval);
958 }
959
960 /*
961 * Return 0 on success, 1 on failure.
962 */
963 int
shmfork(struct proc * p1,struct proc * p2)964 shmfork(struct proc *p1, struct proc *p2)
965 {
966 struct shmmap_state *shmmap_s;
967 int nsegs = 0;
968 int ret = 0;
969
970 SYSV_SHM_SUBSYS_LOCK();
971
972 if (shminit()) {
973 ret = 1;
974 goto shmfork_out;
975 }
976
977 struct shmmap_state *src = (struct shmmap_state *)p1->vm_shm;
978 assert(src);
979
980 /* count number of shmid entries in src */
981 for (struct shmmap_state *s = src; s->shmid != SHMID_SENTINEL; s++) {
982 nsegs++;
983 }
984
985 shmmap_s = kalloc_type(struct shmmap_state, nsegs + 1, Z_WAITOK);
986 if (shmmap_s == NULL) {
987 ret = 1;
988 goto shmfork_out;
989 }
990
991 bcopy(src, (caddr_t)shmmap_s, (nsegs + 1) * sizeof(struct shmmap_state));
992 p2->vm_shm = (caddr_t)shmmap_s;
993 for (; shmmap_s->shmid != SHMID_SENTINEL; shmmap_s++) {
994 if (SHMID_IS_VALID(shmmap_s->shmid)) {
995 shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++;
996 }
997 }
998
999 shmfork_out:
1000 SYSV_SHM_SUBSYS_UNLOCK();
1001 return ret;
1002 }
1003
1004 static void
shmcleanup(struct proc * p,int deallocate)1005 shmcleanup(struct proc *p, int deallocate)
1006 {
1007 struct shmmap_state *shmmap_s;
1008 int nsegs = 0;
1009
1010 SYSV_SHM_SUBSYS_LOCK();
1011
1012 shmmap_s = (struct shmmap_state *)p->vm_shm;
1013 for (; shmmap_s->shmid != SHMID_SENTINEL; shmmap_s++) {
1014 nsegs++;
1015 if (SHMID_IS_VALID(shmmap_s->shmid)) {
1016 /*
1017 * XXX: Should the MAC framework enforce
1018 * check here as well.
1019 */
1020 shm_delete_mapping(p, shmmap_s, deallocate);
1021 }
1022 }
1023
1024 kfree_type(struct shmmap_state, nsegs + 1, p->vm_shm);
1025 SYSV_SHM_SUBSYS_UNLOCK();
1026 }
1027
1028 void
shmexit(struct proc * p)1029 shmexit(struct proc *p)
1030 {
1031 shmcleanup(p, 1);
1032 }
1033
1034 /*
1035 * shmexec() is like shmexit(), only it doesn't delete the mappings,
1036 * since the old address space has already been destroyed and the new
1037 * one instantiated. Instead, it just does the housekeeping work we
1038 * need to do to keep the System V shared memory subsystem sane.
1039 */
1040 __private_extern__ void
shmexec(struct proc * p)1041 shmexec(struct proc *p)
1042 {
1043 shmcleanup(p, 0);
1044 }
1045
1046 int
shminit(void)1047 shminit(void)
1048 {
1049 size_t sz;
1050 int i;
1051
1052 if (!shm_inited) {
1053 /*
1054 * we store internally 64 bit, since if we didn't, we would
1055 * be unable to represent a segment size in excess of 32 bits
1056 * with the (struct shmid_ds)->shm_segsz field; also, POSIX
1057 * dictates this filed be a size_t, which is 64 bits when
1058 * running 64 bit binaries.
1059 */
1060 if (os_mul_overflow(shminfo.shmmni, sizeof(struct shmid_kernel), &sz)) {
1061 return ENOMEM;
1062 }
1063
1064 shmsegs = zalloc_permanent(sz, ZALIGN_PTR);
1065 if (shmsegs == NULL) {
1066 return ENOMEM;
1067 }
1068 for (i = 0; i < shminfo.shmmni; i++) {
1069 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
1070 shmsegs[i].u.shm_perm._seq = 0;
1071 #if CONFIG_MACF
1072 mac_sysvshm_label_init(&shmsegs[i]);
1073 #endif
1074 }
1075 shm_last_free = 0;
1076 shm_nused = 0;
1077 shm_committed = 0;
1078 shm_inited = 1;
1079 }
1080
1081 return 0;
1082 }
1083
1084 /* (struct sysctl_oid *oidp, void *arg1, int arg2, \
1085 * struct sysctl_req *req) */
1086 static int
sysctl_shminfo(__unused struct sysctl_oid * oidp,void * arg1,__unused int arg2,struct sysctl_req * req)1087 sysctl_shminfo(__unused struct sysctl_oid *oidp, void *arg1,
1088 __unused int arg2, struct sysctl_req *req)
1089 {
1090 int error = 0;
1091 int sysctl_shminfo_ret = 0;
1092 int64_t saved_shmmax;
1093 int64_t saved_shmmin;
1094 int64_t saved_shmseg;
1095 int64_t saved_shmmni;
1096 int64_t saved_shmall;
1097
1098 error = SYSCTL_OUT(req, arg1, sizeof(int64_t));
1099 if (error || req->newptr == USER_ADDR_NULL) {
1100 return error;
1101 }
1102
1103 SYSV_SHM_SUBSYS_LOCK();
1104
1105 /* shmmni can not be changed after SysV SHM has been initialized */
1106 if (shm_inited && arg1 == &shminfo.shmmni) {
1107 sysctl_shminfo_ret = EPERM;
1108 goto sysctl_shminfo_out;
1109 }
1110 saved_shmmax = shminfo.shmmax;
1111 saved_shmmin = shminfo.shmmin;
1112 saved_shmseg = shminfo.shmseg;
1113 saved_shmmni = shminfo.shmmni;
1114 saved_shmall = shminfo.shmall;
1115
1116 if ((error = SYSCTL_IN(req, arg1, sizeof(int64_t))) != 0) {
1117 sysctl_shminfo_ret = error;
1118 goto sysctl_shminfo_out;
1119 }
1120
1121 if (arg1 == &shminfo.shmmax) {
1122 /* shmmax needs to be page-aligned */
1123 if (shminfo.shmmax & PAGE_MASK_64 || shminfo.shmmax < 0) {
1124 shminfo.shmmax = saved_shmmax;
1125 sysctl_shminfo_ret = EINVAL;
1126 goto sysctl_shminfo_out;
1127 }
1128 } else if (arg1 == &shminfo.shmmin) {
1129 if (shminfo.shmmin < 0) {
1130 shminfo.shmmin = saved_shmmin;
1131 sysctl_shminfo_ret = EINVAL;
1132 goto sysctl_shminfo_out;
1133 }
1134 } else if (arg1 == &shminfo.shmseg) {
1135 /* add a sanity check - 20847256 */
1136 if (shminfo.shmseg > INT32_MAX || shminfo.shmseg < 0) {
1137 shminfo.shmseg = saved_shmseg;
1138 sysctl_shminfo_ret = EINVAL;
1139 goto sysctl_shminfo_out;
1140 }
1141 } else if (arg1 == &shminfo.shmmni) {
1142 /* add a sanity check - 20847256 */
1143 if (shminfo.shmmni > INT32_MAX || shminfo.shmmni < 0) {
1144 shminfo.shmmni = saved_shmmni;
1145 sysctl_shminfo_ret = EINVAL;
1146 goto sysctl_shminfo_out;
1147 }
1148 } else if (arg1 == &shminfo.shmall) {
1149 /* add a sanity check - 20847256 */
1150 if (shminfo.shmall > INT32_MAX || shminfo.shmall < 0) {
1151 shminfo.shmall = saved_shmall;
1152 sysctl_shminfo_ret = EINVAL;
1153 goto sysctl_shminfo_out;
1154 }
1155 }
1156 sysctl_shminfo_ret = 0;
1157 sysctl_shminfo_out:
1158 SYSV_SHM_SUBSYS_UNLOCK();
1159 return sysctl_shminfo_ret;
1160 }
1161
1162 static int
IPCS_shm_sysctl(__unused struct sysctl_oid * oidp,__unused void * arg1,__unused int arg2,struct sysctl_req * req)1163 IPCS_shm_sysctl(__unused struct sysctl_oid *oidp, __unused void *arg1,
1164 __unused int arg2, struct sysctl_req *req)
1165 {
1166 int error;
1167 int cursor;
1168 union {
1169 struct user32_IPCS_command u32;
1170 struct user_IPCS_command u64;
1171 } ipcs = { };
1172 struct user32_shmid_ds shmid_ds32 = { }; /* post conversion, 32 bit version */
1173 struct user_shmid_ds shmid_ds = { }; /* 64 bit version */
1174 void *shmid_dsp;
1175 size_t ipcs_sz = sizeof(struct user_IPCS_command);
1176 size_t shmid_ds_sz = sizeof(struct user_shmid_ds);
1177 struct proc *p = current_proc();
1178
1179 SYSV_SHM_SUBSYS_LOCK();
1180
1181 if ((error = shminit())) {
1182 goto ipcs_shm_sysctl_out;
1183 }
1184
1185 if (!IS_64BIT_PROCESS(p)) {
1186 ipcs_sz = sizeof(struct user32_IPCS_command);
1187 shmid_ds_sz = sizeof(struct user32_shmid_ds);
1188 }
1189
1190 /* Copy in the command structure */
1191 if ((error = SYSCTL_IN(req, &ipcs, ipcs_sz)) != 0) {
1192 goto ipcs_shm_sysctl_out;
1193 }
1194
1195 if (!IS_64BIT_PROCESS(p)) { /* convert in place */
1196 ipcs.u64.ipcs_data = CAST_USER_ADDR_T(ipcs.u32.ipcs_data);
1197 }
1198
1199 /* Let us version this interface... */
1200 if (ipcs.u64.ipcs_magic != IPCS_MAGIC) {
1201 error = EINVAL;
1202 goto ipcs_shm_sysctl_out;
1203 }
1204
1205 switch (ipcs.u64.ipcs_op) {
1206 case IPCS_SHM_CONF: /* Obtain global configuration data */
1207 if (ipcs.u64.ipcs_datalen != sizeof(struct shminfo)) {
1208 if (ipcs.u64.ipcs_cursor != 0) { /* fwd. compat. */
1209 error = ENOMEM;
1210 break;
1211 }
1212 error = ERANGE;
1213 break;
1214 }
1215 error = copyout(&shminfo, ipcs.u64.ipcs_data, ipcs.u64.ipcs_datalen);
1216 break;
1217
1218 case IPCS_SHM_ITER: /* Iterate over existing segments */
1219 cursor = ipcs.u64.ipcs_cursor;
1220 if (cursor < 0 || cursor >= shminfo.shmmni) {
1221 error = ERANGE;
1222 break;
1223 }
1224 if (ipcs.u64.ipcs_datalen != (int)shmid_ds_sz) {
1225 error = EINVAL;
1226 break;
1227 }
1228 for (; cursor < shminfo.shmmni; cursor++) {
1229 if (shmsegs[cursor].u.shm_perm.mode & SHMSEG_ALLOCATED) {
1230 break;
1231 }
1232 continue;
1233 }
1234 if (cursor == shminfo.shmmni) {
1235 error = ENOENT;
1236 break;
1237 }
1238
1239 shmid_dsp = &shmsegs[cursor]; /* default: 64 bit */
1240
1241 /*
1242 * If necessary, convert the 64 bit kernel segment
1243 * descriptor to a 32 bit user one.
1244 */
1245 if (!IS_64BIT_PROCESS(p)) {
1246 shmid_ds_64to32(shmid_dsp, &shmid_ds32);
1247
1248 /* Clear kernel reserved pointer before copying to user space */
1249 shmid_ds32.shm_internal = (user32_addr_t)0;
1250
1251 shmid_dsp = &shmid_ds32;
1252 } else {
1253 memcpy(&shmid_ds, shmid_dsp, sizeof(shmid_ds));
1254
1255 /* Clear kernel reserved pointer before copying to user space */
1256 shmid_ds.shm_internal = USER_ADDR_NULL;
1257
1258 shmid_dsp = &shmid_ds;
1259 }
1260 error = copyout(shmid_dsp, ipcs.u64.ipcs_data, ipcs.u64.ipcs_datalen);
1261 if (!error) {
1262 /* update cursor */
1263 ipcs.u64.ipcs_cursor = cursor + 1;
1264
1265 if (!IS_64BIT_PROCESS(p)) { /* convert in place */
1266 ipcs.u32.ipcs_data = CAST_DOWN_EXPLICIT(user32_addr_t, ipcs.u64.ipcs_data);
1267 }
1268
1269 error = SYSCTL_OUT(req, &ipcs, ipcs_sz);
1270 }
1271 break;
1272
1273 default:
1274 error = EINVAL;
1275 break;
1276 }
1277 ipcs_shm_sysctl_out:
1278 SYSV_SHM_SUBSYS_UNLOCK();
1279 return error;
1280 }
1281
1282 SYSCTL_NODE(_kern, KERN_SYSV, sysv, CTLFLAG_RW | CTLFLAG_LOCKED | CTLFLAG_ANYBODY, 0, "SYSV");
1283
1284 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmmax, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1285 &shminfo.shmmax, 0, &sysctl_shminfo, "Q", "shmmax");
1286
1287 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmmin, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1288 &shminfo.shmmin, 0, &sysctl_shminfo, "Q", "shmmin");
1289
1290 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmmni, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1291 &shminfo.shmmni, 0, &sysctl_shminfo, "Q", "shmmni");
1292
1293 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmseg, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1294 &shminfo.shmseg, 0, &sysctl_shminfo, "Q", "shmseg");
1295
1296 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmall, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1297 &shminfo.shmall, 0, &sysctl_shminfo, "Q", "shmall");
1298
1299 SYSCTL_NODE(_kern_sysv, OID_AUTO, ipcs, CTLFLAG_RW | CTLFLAG_LOCKED | CTLFLAG_ANYBODY, 0, "SYSVIPCS");
1300
1301 SYSCTL_PROC(_kern_sysv_ipcs, OID_AUTO, shm, CTLFLAG_RW | CTLFLAG_ANYBODY | CTLFLAG_LOCKED,
1302 0, 0, IPCS_shm_sysctl,
1303 "S,IPCS_shm_command",
1304 "ipcs shm command interface");
1305 #endif /* SYSV_SHM */
1306
1307 /* DSEP Review Done pl-20051108-v02 @2743,@2908,@2913,@3009 */
1308