1 /*
2 * Copyright (c) 2000-2019 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* $NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $ */
29
30 /*
31 * Copyright (c) 1994 Adam Glass and Charles Hannum. All rights reserved.
32 *
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
35 * are met:
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 3. All advertising materials mentioning features or use of this software
42 * must display the following acknowledgement:
43 * This product includes software developed by Adam Glass and Charles
44 * Hannum.
45 * 4. The names of the authors may not be used to endorse or promote products
46 * derived from this software without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
49 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
50 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
51 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
52 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
53 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
54 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
55 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
56 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
57 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
58 */
59 /*
60 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
61 * support for mandatory and extensible security protections. This notice
62 * is included in support of clause 2.2 (b) of the Apple Public License,
63 * Version 2.0.
64 * Copyright (c) 2005-2006 SPARTA, Inc.
65 */
66
67
68 #include <sys/appleapiopts.h>
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/shm_internal.h>
73 #include <sys/proc_internal.h>
74 #include <sys/kauth.h>
75 #include <sys/malloc.h>
76 #include <sys/mman.h>
77 #include <sys/stat.h>
78 #include <sys/sysctl.h>
79 #include <sys/ipcs.h>
80 #include <sys/sysent.h>
81 #include <sys/sysproto.h>
82 #if CONFIG_MACF
83 #include <security/mac_framework.h>
84 #endif
85
86 #include <security/audit/audit.h>
87
88 #include <mach/mach_types.h>
89 #include <mach/vm_inherit.h>
90 #include <mach/vm_map.h>
91
92 #include <mach/mach_vm.h>
93
94 #include <vm/vm_map.h>
95 #include <vm/vm_protos.h>
96 #include <vm/vm_kern.h>
97
98 #include <kern/locks.h>
99 #include <os/overflow.h>
100
101 /* Uncomment this line to see MAC debugging output. */
102 /* #define MAC_DEBUG */
103 #if CONFIG_MACF_DEBUG
104 #define MPRINTF(a) printf a
105 #else
106 #define MPRINTF(a)
107 #endif
108
109 #if SYSV_SHM
110 static int shminit(void);
111
112 static LCK_GRP_DECLARE(sysv_shm_subsys_lck_grp, "sysv_shm_subsys_lock");
113 static LCK_MTX_DECLARE(sysv_shm_subsys_mutex, &sysv_shm_subsys_lck_grp);
114
115 #define SYSV_SHM_SUBSYS_LOCK() lck_mtx_lock(&sysv_shm_subsys_mutex)
116 #define SYSV_SHM_SUBSYS_UNLOCK() lck_mtx_unlock(&sysv_shm_subsys_mutex)
117
118 static int oshmctl(void *p, void *uap, void *retval);
119 static int shmget_allocate_segment(struct proc *p, struct shmget_args *uap, int mode, int * retval);
120 static int shmget_existing(struct shmget_args *uap, int mode, int segnum, int * retval);
121 static void shmid_ds_64to32(struct user_shmid_ds *in, struct user32_shmid_ds *out);
122 static void shmid_ds_32to64(struct user32_shmid_ds *in, struct user_shmid_ds *out);
123
124 /* XXX casting to (sy_call_t *) is bogus, as usual. */
125 static sy_call_t* const shmcalls[] = {
126 (sy_call_t *)shmat, (sy_call_t *)oshmctl,
127 (sy_call_t *)shmdt, (sy_call_t *)shmget,
128 (sy_call_t *)shmctl
129 };
130
131 #define SHMSEG_FREE 0x0200
132 #define SHMSEG_REMOVED 0x0400
133 #define SHMSEG_ALLOCATED 0x0800
134 #define SHMSEG_WANTED 0x1000
135
136 static int shm_last_free, shm_nused, shm_committed;
137 struct shmid_kernel *shmsegs; /* 64 bit version */
138 static int shm_inited = 0;
139
140 /*
141 * Since anonymous memory chunks are limited to ANON_MAX_SIZE bytes,
142 * we have to keep a list of chunks when we want to handle a shared memory
143 * segment bigger than ANON_MAX_SIZE.
144 * Each chunk points to a VM named entry of up to ANON_MAX_SIZE bytes
145 * of anonymous memory.
146 */
147 struct shm_handle {
148 void * shm_object; /* named entry for this chunk*/
149 memory_object_size_t shm_handle_size; /* size of this chunk */
150 struct shm_handle *shm_handle_next; /* next chunk */
151 };
152
153 struct shmmap_state {
154 mach_vm_address_t va; /* user address */
155 int shmid; /* segment id */
156 };
157
158 static void shm_deallocate_segment(struct shmid_kernel *);
159 static int shm_find_segment_by_key(key_t);
160 static struct shmid_kernel *shm_find_segment_by_shmid(int);
161 static int shm_delete_mapping(struct proc *, struct shmmap_state *, int);
162
163 #ifdef __APPLE_API_PRIVATE
164 #define DEFAULT_SHMMAX (4 * 1024 * 1024)
165 #define DEFAULT_SHMMIN 1
166 #define DEFAULT_SHMMNI 32
167 #define DEFAULT_SHMSEG 8
168 #define DEFAULT_SHMALL 1024
169
170 struct shminfo shminfo = {
171 .shmmax = DEFAULT_SHMMAX,
172 .shmmin = DEFAULT_SHMMIN,
173 .shmmni = DEFAULT_SHMMNI,
174 .shmseg = DEFAULT_SHMSEG,
175 .shmall = DEFAULT_SHMALL
176 };
177
178 #define SHMID_IS_VALID(x) ((x) >= 0)
179 #define SHMID_UNALLOCATED (-1)
180 #define SHMID_SENTINEL (-2)
181
182 #endif /* __APPLE_API_PRIVATE */
183
184 static __inline__ time_t
sysv_shmtime(void)185 sysv_shmtime(void)
186 {
187 struct timeval tv;
188 microtime(&tv);
189 return tv.tv_sec;
190 }
191
192 /*
193 * This conversion is safe, since if we are converting for a 32 bit process,
194 * then it's value of (struct shmid_ds)->shm_segsz will never exceed 4G.
195 *
196 * NOTE: Source and target may *NOT* overlap! (target is smaller)
197 */
198 static void
shmid_ds_64to32(struct user_shmid_ds * in,struct user32_shmid_ds * out)199 shmid_ds_64to32(struct user_shmid_ds *in, struct user32_shmid_ds *out)
200 {
201 out->shm_perm = in->shm_perm;
202 out->shm_segsz = in->shm_segsz;
203 out->shm_lpid = in->shm_lpid;
204 out->shm_cpid = in->shm_cpid;
205 out->shm_nattch = in->shm_nattch;
206 out->shm_atime = in->shm_atime;
207 out->shm_dtime = in->shm_dtime;
208 out->shm_ctime = in->shm_ctime;
209 out->shm_internal = CAST_DOWN_EXPLICIT(int, in->shm_internal);
210 }
211
212 /*
213 * NOTE: Source and target may are permitted to overlap! (source is smaller);
214 * this works because we copy fields in order from the end of the struct to
215 * the beginning.
216 */
217 static void
shmid_ds_32to64(struct user32_shmid_ds * in,struct user_shmid_ds * out)218 shmid_ds_32to64(struct user32_shmid_ds *in, struct user_shmid_ds *out)
219 {
220 out->shm_internal = in->shm_internal;
221 out->shm_ctime = in->shm_ctime;
222 out->shm_dtime = in->shm_dtime;
223 out->shm_atime = in->shm_atime;
224 out->shm_nattch = in->shm_nattch;
225 out->shm_cpid = in->shm_cpid;
226 out->shm_lpid = in->shm_lpid;
227 out->shm_segsz = in->shm_segsz;
228 out->shm_perm = in->shm_perm;
229 }
230
231
232 static int
shm_find_segment_by_key(key_t key)233 shm_find_segment_by_key(key_t key)
234 {
235 int i;
236
237 for (i = 0; i < shminfo.shmmni; i++) {
238 if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) &&
239 shmsegs[i].u.shm_perm._key == key) {
240 return i;
241 }
242 }
243 return -1;
244 }
245
246 static struct shmid_kernel *
shm_find_segment_by_shmid(int shmid)247 shm_find_segment_by_shmid(int shmid)
248 {
249 int segnum;
250 struct shmid_kernel *shmseg;
251
252 segnum = IPCID_TO_IX(shmid);
253 if (segnum < 0 || segnum >= shminfo.shmmni) {
254 return NULL;
255 }
256 shmseg = &shmsegs[segnum];
257 if ((shmseg->u.shm_perm.mode & (SHMSEG_ALLOCATED | SHMSEG_REMOVED))
258 != SHMSEG_ALLOCATED ||
259 shmseg->u.shm_perm._seq != IPCID_TO_SEQ(shmid)) {
260 return NULL;
261 }
262 return shmseg;
263 }
264
265 static void
shm_deallocate_segment(struct shmid_kernel * shmseg)266 shm_deallocate_segment(struct shmid_kernel *shmseg)
267 {
268 struct shm_handle *shm_handle, *shm_handle_next;
269 mach_vm_size_t size;
270
271 for (shm_handle = CAST_DOWN(void *, shmseg->u.shm_internal); /* tunnel */
272 shm_handle != NULL;
273 shm_handle = shm_handle_next) {
274 shm_handle_next = shm_handle->shm_handle_next;
275 mach_memory_entry_port_release(shm_handle->shm_object);
276 kfree_type(struct shm_handle, shm_handle);
277 }
278 shmseg->u.shm_internal = USER_ADDR_NULL; /* tunnel */
279 size = vm_map_round_page(shmseg->u.shm_segsz,
280 vm_map_page_mask(current_map()));
281 shm_committed -= btoc(size);
282 shm_nused--;
283 shmseg->u.shm_perm.mode = SHMSEG_FREE;
284 #if CONFIG_MACF
285 /* Reset the MAC label */
286 mac_sysvshm_label_recycle(shmseg);
287 #endif
288 }
289
290 static int
shm_delete_mapping(__unused struct proc * p,struct shmmap_state * shmmap_s,int deallocate)291 shm_delete_mapping(__unused struct proc *p, struct shmmap_state *shmmap_s,
292 int deallocate)
293 {
294 struct shmid_kernel *shmseg;
295 int segnum, result;
296 mach_vm_size_t size;
297
298 segnum = IPCID_TO_IX(shmmap_s->shmid);
299 shmseg = &shmsegs[segnum];
300 size = vm_map_round_page(shmseg->u.shm_segsz,
301 vm_map_page_mask(current_map())); /* XXX done for us? */
302 if (deallocate) {
303 result = mach_vm_deallocate(current_map(), shmmap_s->va, size);
304 if (result != KERN_SUCCESS) {
305 return EINVAL;
306 }
307 }
308 shmmap_s->shmid = SHMID_UNALLOCATED;
309 shmseg->u.shm_dtime = sysv_shmtime();
310 if ((--shmseg->u.shm_nattch <= 0) &&
311 (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) {
312 shm_deallocate_segment(shmseg);
313 shm_last_free = segnum;
314 }
315 return 0;
316 }
317
318 int
shmdt(struct proc * p,struct shmdt_args * uap,int32_t * retval)319 shmdt(struct proc *p, struct shmdt_args *uap, int32_t *retval)
320 {
321 #if CONFIG_MACF
322 struct shmid_kernel *shmsegptr;
323 #endif
324 struct shmmap_state *shmmap_s;
325 int i;
326 int shmdtret = 0;
327
328 AUDIT_ARG(svipc_addr, uap->shmaddr);
329
330 SYSV_SHM_SUBSYS_LOCK();
331
332 if ((shmdtret = shminit())) {
333 goto shmdt_out;
334 }
335
336 shmmap_s = (struct shmmap_state *)p->vm_shm;
337 if (shmmap_s == NULL) {
338 shmdtret = EINVAL;
339 goto shmdt_out;
340 }
341
342 for (; shmmap_s->shmid != SHMID_SENTINEL; shmmap_s++) {
343 if (SHMID_IS_VALID(shmmap_s->shmid) &&
344 shmmap_s->va == (mach_vm_offset_t)uap->shmaddr) {
345 break;
346 }
347 }
348
349 if (!SHMID_IS_VALID(shmmap_s->shmid)) {
350 shmdtret = EINVAL;
351 goto shmdt_out;
352 }
353
354 #if CONFIG_MACF
355 /*
356 * XXX: It might be useful to move this into the shm_delete_mapping
357 * function
358 */
359 shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)];
360 shmdtret = mac_sysvshm_check_shmdt(kauth_cred_get(), shmsegptr);
361 if (shmdtret) {
362 goto shmdt_out;
363 }
364 #endif
365 i = shm_delete_mapping(p, shmmap_s, 1);
366
367 if (i == 0) {
368 *retval = 0;
369 }
370 shmdtret = i;
371 shmdt_out:
372 SYSV_SHM_SUBSYS_UNLOCK();
373 return shmdtret;
374 }
375
376 int
shmat(struct proc * p,struct shmat_args * uap,user_addr_t * retval)377 shmat(struct proc *p, struct shmat_args *uap, user_addr_t *retval)
378 {
379 int error, flags;
380 struct shmid_kernel *shmseg;
381 struct shmmap_state *shmmap_s = NULL;
382 struct shm_handle *shm_handle;
383 mach_vm_address_t attach_va; /* attach address in/out */
384 mach_vm_address_t shmlba;
385 mach_vm_size_t map_size; /* size of map entry */
386 mach_vm_size_t mapped_size;
387 vm_prot_t prot;
388 kern_return_t rv;
389 int shmat_ret;
390 int vm_flags;
391
392 shmat_ret = 0;
393
394 AUDIT_ARG(svipc_id, uap->shmid);
395 AUDIT_ARG(svipc_addr, uap->shmaddr);
396
397 SYSV_SHM_SUBSYS_LOCK();
398
399 if ((shmat_ret = shminit())) {
400 goto shmat_out;
401 }
402
403 shmmap_s = (struct shmmap_state *)p->vm_shm;
404 if (shmmap_s == NULL) {
405 /* lazily allocate the shm map */
406
407 int nsegs = shminfo.shmseg;
408 if (nsegs <= 0) {
409 shmat_ret = EMFILE;
410 goto shmat_out;
411 }
412
413 /* +1 for the sentinel */
414 shmmap_s = kalloc_type(struct shmmap_state, nsegs + 1, Z_WAITOK);
415 if (shmmap_s == NULL) {
416 shmat_ret = ENOMEM;
417 goto shmat_out;
418 }
419
420 /* initialize the entries */
421 for (int i = 0; i < nsegs; i++) {
422 shmmap_s[i].shmid = SHMID_UNALLOCATED;
423 }
424 shmmap_s[nsegs].shmid = SHMID_SENTINEL;
425
426 p->vm_shm = (caddr_t)shmmap_s;
427 }
428
429 shmseg = shm_find_segment_by_shmid(uap->shmid);
430 if (shmseg == NULL) {
431 shmat_ret = EINVAL;
432 goto shmat_out;
433 }
434
435 AUDIT_ARG(svipc_perm, &shmseg->u.shm_perm);
436 error = ipcperm(kauth_cred_get(), &shmseg->u.shm_perm,
437 (uap->shmflg & SHM_RDONLY) ? IPC_R : IPC_R | IPC_W);
438 if (error) {
439 shmat_ret = error;
440 goto shmat_out;
441 }
442
443 #if CONFIG_MACF
444 error = mac_sysvshm_check_shmat(kauth_cred_get(), shmseg, uap->shmflg);
445 if (error) {
446 shmat_ret = error;
447 goto shmat_out;
448 }
449 #endif
450
451 /* find a free shmid */
452 while (SHMID_IS_VALID(shmmap_s->shmid)) {
453 shmmap_s++;
454 }
455 if (shmmap_s->shmid != SHMID_UNALLOCATED) {
456 /* no free shmids */
457 shmat_ret = EMFILE;
458 goto shmat_out;
459 }
460
461 map_size = vm_map_round_page(shmseg->u.shm_segsz,
462 vm_map_page_mask(current_map()));
463 prot = VM_PROT_READ;
464 if ((uap->shmflg & SHM_RDONLY) == 0) {
465 prot |= VM_PROT_WRITE;
466 }
467 flags = MAP_ANON | MAP_SHARED;
468 if (uap->shmaddr) {
469 flags |= MAP_FIXED;
470 }
471
472 attach_va = (mach_vm_address_t)uap->shmaddr;
473 shmlba = vm_map_page_size(current_map()); /* XXX instead of SHMLBA */
474 if (uap->shmflg & SHM_RND) {
475 attach_va &= ~(shmlba - 1);
476 } else if ((attach_va & (shmlba - 1)) != 0) {
477 shmat_ret = EINVAL;
478 goto shmat_out;
479 }
480
481 if (flags & MAP_FIXED) {
482 vm_flags = VM_FLAGS_FIXED;
483 } else {
484 vm_flags = VM_FLAGS_ANYWHERE;
485 }
486
487 mapped_size = 0;
488
489 /* first reserve enough space... */
490 rv = mach_vm_map_kernel(current_map(),
491 &attach_va,
492 map_size,
493 0,
494 vm_flags,
495 VM_MAP_KERNEL_FLAGS_NONE,
496 VM_KERN_MEMORY_NONE,
497 IPC_PORT_NULL,
498 0,
499 FALSE,
500 VM_PROT_NONE,
501 VM_PROT_NONE,
502 VM_INHERIT_NONE);
503 if (rv != KERN_SUCCESS) {
504 goto out;
505 }
506
507 shmmap_s->va = attach_va;
508
509 /* ... then map the shared memory over the reserved space */
510 for (shm_handle = CAST_DOWN(void *, shmseg->u.shm_internal);/* tunnel */
511 shm_handle != NULL;
512 shm_handle = shm_handle->shm_handle_next) {
513 vm_map_size_t chunk_size;
514
515 assert(mapped_size < map_size);
516 chunk_size = shm_handle->shm_handle_size;
517 if (chunk_size > map_size - mapped_size) {
518 /*
519 * Partial mapping of last chunk due to
520 * page size mismatch.
521 */
522 assert(vm_map_page_shift(current_map()) < PAGE_SHIFT);
523 assert(shm_handle->shm_handle_next == NULL);
524 chunk_size = map_size - mapped_size;
525 }
526 rv = vm_map_enter_mem_object(
527 current_map(), /* process map */
528 &attach_va, /* attach address */
529 chunk_size, /* size to map */
530 (mach_vm_offset_t)0, /* alignment mask */
531 VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
532 VM_MAP_KERNEL_FLAGS_NONE,
533 VM_KERN_MEMORY_NONE,
534 shm_handle->shm_object,
535 (mach_vm_offset_t)0,
536 FALSE,
537 prot,
538 prot,
539 VM_INHERIT_SHARE);
540 if (rv != KERN_SUCCESS) {
541 goto out;
542 }
543
544 mapped_size += chunk_size;
545 attach_va = attach_va + chunk_size;
546 }
547
548 shmmap_s->shmid = uap->shmid;
549 shmseg->u.shm_lpid = proc_getpid(p);
550 shmseg->u.shm_atime = sysv_shmtime();
551 shmseg->u.shm_nattch++;
552 *retval = shmmap_s->va; /* XXX return -1 on error */
553 shmat_ret = 0;
554 goto shmat_out;
555 out:
556 if (mapped_size > 0) {
557 (void) mach_vm_deallocate(current_map(),
558 shmmap_s->va,
559 mapped_size);
560 }
561 switch (rv) {
562 case KERN_INVALID_ADDRESS:
563 case KERN_NO_SPACE:
564 shmat_ret = ENOMEM;
565 break;
566 case KERN_PROTECTION_FAILURE:
567 shmat_ret = EACCES;
568 break;
569 default:
570 shmat_ret = EINVAL;
571 break;
572 }
573 shmat_out:
574 SYSV_SHM_SUBSYS_UNLOCK();
575 return shmat_ret;
576 }
577
578 static int
oshmctl(__unused void * p,__unused void * uap,__unused void * retval)579 oshmctl(__unused void *p, __unused void *uap, __unused void *retval)
580 {
581 return EINVAL;
582 }
583
584 /*
585 * Returns: 0 Success
586 * EINVAL
587 * copyout:EFAULT
588 * copyin:EFAULT
589 * ipcperm:EPERM
590 * ipcperm:EACCES
591 */
592 int
shmctl(__unused struct proc * p,struct shmctl_args * uap,int32_t * retval)593 shmctl(__unused struct proc *p, struct shmctl_args *uap, int32_t *retval)
594 {
595 int error;
596 kauth_cred_t cred = kauth_cred_get();
597 struct user_shmid_ds inbuf;
598 struct shmid_kernel *shmseg;
599
600 int shmctl_ret = 0;
601
602 AUDIT_ARG(svipc_cmd, uap->cmd);
603 AUDIT_ARG(svipc_id, uap->shmid);
604
605 SYSV_SHM_SUBSYS_LOCK();
606
607 if ((shmctl_ret = shminit())) {
608 goto shmctl_out;
609 }
610
611 shmseg = shm_find_segment_by_shmid(uap->shmid);
612 if (shmseg == NULL) {
613 shmctl_ret = EINVAL;
614 goto shmctl_out;
615 }
616
617 /* XXAUDIT: This is the perms BEFORE any change by this call. This
618 * may not be what is desired.
619 */
620 AUDIT_ARG(svipc_perm, &shmseg->u.shm_perm);
621
622 #if CONFIG_MACF
623 error = mac_sysvshm_check_shmctl(cred, shmseg, uap->cmd);
624 if (error) {
625 shmctl_ret = error;
626 goto shmctl_out;
627 }
628 #endif
629 switch (uap->cmd) {
630 case IPC_STAT:
631 error = ipcperm(cred, &shmseg->u.shm_perm, IPC_R);
632 if (error) {
633 shmctl_ret = error;
634 goto shmctl_out;
635 }
636
637 if (IS_64BIT_PROCESS(p)) {
638 struct user_shmid_ds shmid_ds = {};
639 memcpy(&shmid_ds, &shmseg->u, sizeof(struct user_shmid_ds));
640
641 /* Clear kernel reserved pointer before copying to user space */
642 shmid_ds.shm_internal = USER_ADDR_NULL;
643
644 error = copyout(&shmid_ds, uap->buf, sizeof(shmid_ds));
645 } else {
646 struct user32_shmid_ds shmid_ds32 = {};
647 shmid_ds_64to32(&shmseg->u, &shmid_ds32);
648
649 /* Clear kernel reserved pointer before copying to user space */
650 shmid_ds32.shm_internal = (user32_addr_t)0;
651
652 error = copyout(&shmid_ds32, uap->buf, sizeof(shmid_ds32));
653 }
654 if (error) {
655 shmctl_ret = error;
656 goto shmctl_out;
657 }
658 break;
659 case IPC_SET:
660 error = ipcperm(cred, &shmseg->u.shm_perm, IPC_M);
661 if (error) {
662 shmctl_ret = error;
663 goto shmctl_out;
664 }
665 if (IS_64BIT_PROCESS(p)) {
666 error = copyin(uap->buf, &inbuf, sizeof(struct user_shmid_ds));
667 } else {
668 struct user32_shmid_ds shmid_ds32;
669 error = copyin(uap->buf, &shmid_ds32, sizeof(shmid_ds32));
670 /* convert in place; ugly, but safe */
671 shmid_ds_32to64(&shmid_ds32, &inbuf);
672 }
673 if (error) {
674 shmctl_ret = error;
675 goto shmctl_out;
676 }
677 shmseg->u.shm_perm.uid = inbuf.shm_perm.uid;
678 shmseg->u.shm_perm.gid = inbuf.shm_perm.gid;
679 shmseg->u.shm_perm.mode =
680 (shmseg->u.shm_perm.mode & ~ACCESSPERMS) |
681 (inbuf.shm_perm.mode & ACCESSPERMS);
682 shmseg->u.shm_ctime = sysv_shmtime();
683 break;
684 case IPC_RMID:
685 error = ipcperm(cred, &shmseg->u.shm_perm, IPC_M);
686 if (error) {
687 shmctl_ret = error;
688 goto shmctl_out;
689 }
690 shmseg->u.shm_perm._key = IPC_PRIVATE;
691 shmseg->u.shm_perm.mode |= SHMSEG_REMOVED;
692 if (shmseg->u.shm_nattch <= 0) {
693 shm_deallocate_segment(shmseg);
694 shm_last_free = IPCID_TO_IX(uap->shmid);
695 }
696 break;
697 #if 0
698 case SHM_LOCK:
699 case SHM_UNLOCK:
700 #endif
701 default:
702 shmctl_ret = EINVAL;
703 goto shmctl_out;
704 }
705 *retval = 0;
706 shmctl_ret = 0;
707 shmctl_out:
708 SYSV_SHM_SUBSYS_UNLOCK();
709 return shmctl_ret;
710 }
711
712 static int
shmget_existing(struct shmget_args * uap,int mode,int segnum,int * retval)713 shmget_existing(struct shmget_args *uap, int mode, int segnum, int *retval)
714 {
715 struct shmid_kernel *shmseg;
716 int error = 0;
717
718 shmseg = &shmsegs[segnum];
719 if (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) {
720 /*
721 * This segment is in the process of being allocated. Wait
722 * until it's done, and look the key up again (in case the
723 * allocation failed or it was freed).
724 */
725 shmseg->u.shm_perm.mode |= SHMSEG_WANTED;
726 error = tsleep((caddr_t)shmseg, PLOCK | PCATCH, "shmget", 0);
727 if (error) {
728 return error;
729 }
730 return EAGAIN;
731 }
732
733 /*
734 * The low 9 bits of shmflag are the mode bits being requested, which
735 * are the actual mode bits desired on the segment, and not in IPC_R
736 * form; therefore it would be incorrect to call ipcperm() to validate
737 * them; instead, we AND the existing mode with the requested mode, and
738 * verify that it matches the requested mode; otherwise, we fail with
739 * EACCES (access denied).
740 */
741 if ((shmseg->u.shm_perm.mode & mode) != mode) {
742 return EACCES;
743 }
744
745 #if CONFIG_MACF
746 error = mac_sysvshm_check_shmget(kauth_cred_get(), shmseg, uap->shmflg);
747 if (error) {
748 return error;
749 }
750 #endif
751
752 if (uap->size && uap->size > shmseg->u.shm_segsz) {
753 return EINVAL;
754 }
755
756 if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL)) {
757 return EEXIST;
758 }
759
760 *retval = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
761 return 0;
762 }
763
764 static int
shmget_allocate_segment(struct proc * p,struct shmget_args * uap,int mode,int * retval)765 shmget_allocate_segment(struct proc *p, struct shmget_args *uap, int mode,
766 int *retval)
767 {
768 int i, segnum, shmid;
769 kauth_cred_t cred = kauth_cred_get();
770 struct shmid_kernel *shmseg;
771 struct shm_handle *shm_handle;
772 kern_return_t kret;
773 mach_vm_size_t total_size, size = 0, alloc_size;
774 void * mem_object;
775 struct shm_handle *shm_handle_next, **shm_handle_next_p;
776
777 if (uap->size <= 0 ||
778 uap->size < (user_size_t)shminfo.shmmin ||
779 uap->size > (user_size_t)shminfo.shmmax) {
780 return EINVAL;
781 }
782 if (shm_nused >= shminfo.shmmni) { /* any shmids left? */
783 return ENOSPC;
784 }
785 if (mach_vm_round_page_overflow(uap->size, &total_size)) {
786 return EINVAL;
787 }
788 if ((user_ssize_t)(shm_committed + btoc(total_size)) > shminfo.shmall) {
789 return ENOMEM;
790 }
791 if (shm_last_free < 0) {
792 for (i = 0; i < shminfo.shmmni; i++) {
793 if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE) {
794 break;
795 }
796 }
797 if (i == shminfo.shmmni) {
798 panic("shmseg free count inconsistent");
799 }
800 segnum = i;
801 } else {
802 segnum = shm_last_free;
803 shm_last_free = -1;
804 }
805 shmseg = &shmsegs[segnum];
806
807 /*
808 * In case we sleep in malloc(), mark the segment present but deleted
809 * so that noone else tries to create the same key.
810 * XXX but we don't release the global lock !?
811 */
812 shmseg->u.shm_perm.mode = SHMSEG_ALLOCATED | SHMSEG_REMOVED;
813 shmseg->u.shm_perm._key = uap->key;
814 shmseg->u.shm_perm._seq = (shmseg->u.shm_perm._seq + 1) & 0x7fff;
815
816 shm_handle_next_p = NULL;
817 for (alloc_size = 0;
818 alloc_size < total_size;
819 alloc_size += size) {
820 size = MIN(total_size - alloc_size, ANON_MAX_SIZE);
821 kret = mach_make_memory_entry_64(
822 VM_MAP_NULL,
823 (memory_object_size_t *) &size,
824 (memory_object_offset_t) 0,
825 MAP_MEM_NAMED_CREATE | VM_PROT_DEFAULT,
826 (ipc_port_t *) &mem_object, 0);
827 if (kret != KERN_SUCCESS) {
828 goto out;
829 }
830
831 shm_handle = kalloc_type(struct shm_handle, Z_WAITOK | Z_NOFAIL);
832 shm_handle->shm_object = mem_object;
833 shm_handle->shm_handle_size = size;
834 shm_handle->shm_handle_next = NULL;
835 if (shm_handle_next_p == NULL) {
836 shmseg->u.shm_internal = CAST_USER_ADDR_T(shm_handle);/* tunnel */
837 } else {
838 *shm_handle_next_p = shm_handle;
839 }
840 shm_handle_next_p = &shm_handle->shm_handle_next;
841 }
842
843 shmid = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
844
845 shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = kauth_cred_getuid(cred);
846 shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = kauth_cred_getgid(cred);
847 shmseg->u.shm_perm.mode = (shmseg->u.shm_perm.mode & SHMSEG_WANTED) |
848 (mode & ACCESSPERMS) | SHMSEG_ALLOCATED;
849 shmseg->u.shm_segsz = uap->size;
850 shmseg->u.shm_cpid = proc_getpid(p);
851 shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0;
852 shmseg->u.shm_atime = shmseg->u.shm_dtime = 0;
853 #if CONFIG_MACF
854 mac_sysvshm_label_associate(cred, shmseg);
855 #endif
856 shmseg->u.shm_ctime = sysv_shmtime();
857 shm_committed += btoc(size);
858 shm_nused++;
859 AUDIT_ARG(svipc_perm, &shmseg->u.shm_perm);
860 if (shmseg->u.shm_perm.mode & SHMSEG_WANTED) {
861 /*
862 * Somebody else wanted this key while we were asleep. Wake
863 * them up now.
864 */
865 shmseg->u.shm_perm.mode &= ~SHMSEG_WANTED;
866 wakeup((caddr_t)shmseg);
867 }
868 *retval = shmid;
869 AUDIT_ARG(svipc_id, shmid);
870 return 0;
871 out:
872 if (kret != KERN_SUCCESS) {
873 for (shm_handle = CAST_DOWN(void *, shmseg->u.shm_internal); /* tunnel */
874 shm_handle != NULL;
875 shm_handle = shm_handle_next) {
876 shm_handle_next = shm_handle->shm_handle_next;
877 mach_memory_entry_port_release(shm_handle->shm_object);
878 kfree_type(struct shm_handle, shm_handle);
879 }
880 shmseg->u.shm_internal = USER_ADDR_NULL; /* tunnel */
881 }
882
883 switch (kret) {
884 case KERN_INVALID_ADDRESS:
885 case KERN_NO_SPACE:
886 return ENOMEM;
887 case KERN_PROTECTION_FAILURE:
888 return EACCES;
889 default:
890 return EINVAL;
891 }
892 }
893
894 int
shmget(struct proc * p,struct shmget_args * uap,int32_t * retval)895 shmget(struct proc *p, struct shmget_args *uap, int32_t *retval)
896 {
897 int segnum, mode, error;
898 int shmget_ret = 0;
899
900 /* Auditing is actually done in shmget_allocate_segment() */
901
902 SYSV_SHM_SUBSYS_LOCK();
903
904 if ((shmget_ret = shminit())) {
905 goto shmget_out;
906 }
907
908 mode = uap->shmflg & ACCESSPERMS;
909 if (uap->key != IPC_PRIVATE) {
910 again:
911 segnum = shm_find_segment_by_key(uap->key);
912 if (segnum >= 0) {
913 error = shmget_existing(uap, mode, segnum, retval);
914 if (error == EAGAIN) {
915 goto again;
916 }
917 shmget_ret = error;
918 goto shmget_out;
919 }
920 if ((uap->shmflg & IPC_CREAT) == 0) {
921 shmget_ret = ENOENT;
922 goto shmget_out;
923 }
924 }
925 shmget_ret = shmget_allocate_segment(p, uap, mode, retval);
926 shmget_out:
927 SYSV_SHM_SUBSYS_UNLOCK();
928 return shmget_ret;
929 }
930
931 /*
932 * shmsys
933 *
934 * Entry point for all SHM calls: shmat, oshmctl, shmdt, shmget, shmctl
935 *
936 * Parameters: p Process requesting the call
937 * uap User argument descriptor (see below)
938 * retval Return value of the selected shm call
939 *
940 * Indirect parameters: uap->which msg call to invoke (index in array of shm calls)
941 * uap->a2 User argument descriptor
942 *
943 * Returns: 0 Success
944 * !0 Not success
945 *
946 * Implicit returns: retval Return value of the selected shm call
947 *
948 * DEPRECATED: This interface should not be used to call the other SHM
949 * functions (shmat, oshmctl, shmdt, shmget, shmctl). The correct
950 * usage is to call the other SHM functions directly.
951 */
952 int
shmsys(struct proc * p,struct shmsys_args * uap,int32_t * retval)953 shmsys(struct proc *p, struct shmsys_args *uap, int32_t *retval)
954 {
955 /* The routine that we are dispatching already does this */
956
957 if (uap->which >= sizeof(shmcalls) / sizeof(shmcalls[0])) {
958 return EINVAL;
959 }
960 return (*shmcalls[uap->which])(p, &uap->a2, retval);
961 }
962
963 /*
964 * Return 0 on success, 1 on failure.
965 */
966 int
shmfork(struct proc * p1,struct proc * p2)967 shmfork(struct proc *p1, struct proc *p2)
968 {
969 struct shmmap_state *shmmap_s;
970 int nsegs = 0;
971 int ret = 0;
972
973 SYSV_SHM_SUBSYS_LOCK();
974
975 if (shminit()) {
976 ret = 1;
977 goto shmfork_out;
978 }
979
980 struct shmmap_state *src = (struct shmmap_state *)p1->vm_shm;
981 assert(src);
982
983 /* count number of shmid entries in src */
984 for (struct shmmap_state *s = src; s->shmid != SHMID_SENTINEL; s++) {
985 nsegs++;
986 }
987
988 shmmap_s = kalloc_type(struct shmmap_state, nsegs + 1, Z_WAITOK);
989 if (shmmap_s == NULL) {
990 ret = 1;
991 goto shmfork_out;
992 }
993
994 bcopy(src, (caddr_t)shmmap_s, (nsegs + 1) * sizeof(struct shmmap_state));
995 p2->vm_shm = (caddr_t)shmmap_s;
996 for (; shmmap_s->shmid != SHMID_SENTINEL; shmmap_s++) {
997 if (SHMID_IS_VALID(shmmap_s->shmid)) {
998 shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++;
999 }
1000 }
1001
1002 shmfork_out:
1003 SYSV_SHM_SUBSYS_UNLOCK();
1004 return ret;
1005 }
1006
1007 static void
shmcleanup(struct proc * p,int deallocate)1008 shmcleanup(struct proc *p, int deallocate)
1009 {
1010 struct shmmap_state *shmmap_s;
1011 int nsegs = 0;
1012
1013 SYSV_SHM_SUBSYS_LOCK();
1014
1015 shmmap_s = (struct shmmap_state *)p->vm_shm;
1016 for (; shmmap_s->shmid != SHMID_SENTINEL; shmmap_s++) {
1017 nsegs++;
1018 if (SHMID_IS_VALID(shmmap_s->shmid)) {
1019 /*
1020 * XXX: Should the MAC framework enforce
1021 * check here as well.
1022 */
1023 shm_delete_mapping(p, shmmap_s, deallocate);
1024 }
1025 }
1026
1027 kfree_type(struct shmmap_state, nsegs + 1, p->vm_shm);
1028 SYSV_SHM_SUBSYS_UNLOCK();
1029 }
1030
1031 void
shmexit(struct proc * p)1032 shmexit(struct proc *p)
1033 {
1034 shmcleanup(p, 1);
1035 }
1036
1037 /*
1038 * shmexec() is like shmexit(), only it doesn't delete the mappings,
1039 * since the old address space has already been destroyed and the new
1040 * one instantiated. Instead, it just does the housekeeping work we
1041 * need to do to keep the System V shared memory subsystem sane.
1042 */
1043 __private_extern__ void
shmexec(struct proc * p)1044 shmexec(struct proc *p)
1045 {
1046 shmcleanup(p, 0);
1047 }
1048
1049 int
shminit(void)1050 shminit(void)
1051 {
1052 size_t sz;
1053 int i;
1054
1055 if (!shm_inited) {
1056 /*
1057 * we store internally 64 bit, since if we didn't, we would
1058 * be unable to represent a segment size in excess of 32 bits
1059 * with the (struct shmid_ds)->shm_segsz field; also, POSIX
1060 * dictates this filed be a size_t, which is 64 bits when
1061 * running 64 bit binaries.
1062 */
1063 if (os_mul_overflow(shminfo.shmmni, sizeof(struct shmid_kernel), &sz)) {
1064 return ENOMEM;
1065 }
1066
1067 shmsegs = zalloc_permanent(sz, ZALIGN_PTR);
1068 if (shmsegs == NULL) {
1069 return ENOMEM;
1070 }
1071 for (i = 0; i < shminfo.shmmni; i++) {
1072 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
1073 shmsegs[i].u.shm_perm._seq = 0;
1074 #if CONFIG_MACF
1075 mac_sysvshm_label_init(&shmsegs[i]);
1076 #endif
1077 }
1078 shm_last_free = 0;
1079 shm_nused = 0;
1080 shm_committed = 0;
1081 shm_inited = 1;
1082 }
1083
1084 return 0;
1085 }
1086
1087 /* (struct sysctl_oid *oidp, void *arg1, int arg2, \
1088 * struct sysctl_req *req) */
1089 static int
sysctl_shminfo(__unused struct sysctl_oid * oidp,void * arg1,__unused int arg2,struct sysctl_req * req)1090 sysctl_shminfo(__unused struct sysctl_oid *oidp, void *arg1,
1091 __unused int arg2, struct sysctl_req *req)
1092 {
1093 int error = 0;
1094 int sysctl_shminfo_ret = 0;
1095 int64_t saved_shmmax;
1096 int64_t saved_shmmin;
1097 int64_t saved_shmseg;
1098 int64_t saved_shmmni;
1099 int64_t saved_shmall;
1100
1101 error = SYSCTL_OUT(req, arg1, sizeof(int64_t));
1102 if (error || req->newptr == USER_ADDR_NULL) {
1103 return error;
1104 }
1105
1106 SYSV_SHM_SUBSYS_LOCK();
1107
1108 /* shmmni can not be changed after SysV SHM has been initialized */
1109 if (shm_inited && arg1 == &shminfo.shmmni) {
1110 sysctl_shminfo_ret = EPERM;
1111 goto sysctl_shminfo_out;
1112 }
1113 saved_shmmax = shminfo.shmmax;
1114 saved_shmmin = shminfo.shmmin;
1115 saved_shmseg = shminfo.shmseg;
1116 saved_shmmni = shminfo.shmmni;
1117 saved_shmall = shminfo.shmall;
1118
1119 if ((error = SYSCTL_IN(req, arg1, sizeof(int64_t))) != 0) {
1120 sysctl_shminfo_ret = error;
1121 goto sysctl_shminfo_out;
1122 }
1123
1124 if (arg1 == &shminfo.shmmax) {
1125 /* shmmax needs to be page-aligned */
1126 if (shminfo.shmmax & PAGE_MASK_64 || shminfo.shmmax < 0) {
1127 shminfo.shmmax = saved_shmmax;
1128 sysctl_shminfo_ret = EINVAL;
1129 goto sysctl_shminfo_out;
1130 }
1131 } else if (arg1 == &shminfo.shmmin) {
1132 if (shminfo.shmmin < 0) {
1133 shminfo.shmmin = saved_shmmin;
1134 sysctl_shminfo_ret = EINVAL;
1135 goto sysctl_shminfo_out;
1136 }
1137 } else if (arg1 == &shminfo.shmseg) {
1138 /* add a sanity check - 20847256 */
1139 if (shminfo.shmseg > INT32_MAX || shminfo.shmseg < 0) {
1140 shminfo.shmseg = saved_shmseg;
1141 sysctl_shminfo_ret = EINVAL;
1142 goto sysctl_shminfo_out;
1143 }
1144 } else if (arg1 == &shminfo.shmmni) {
1145 /* add a sanity check - 20847256 */
1146 if (shminfo.shmmni > INT32_MAX || shminfo.shmmni < 0) {
1147 shminfo.shmmni = saved_shmmni;
1148 sysctl_shminfo_ret = EINVAL;
1149 goto sysctl_shminfo_out;
1150 }
1151 } else if (arg1 == &shminfo.shmall) {
1152 /* add a sanity check - 20847256 */
1153 if (shminfo.shmall > INT32_MAX || shminfo.shmall < 0) {
1154 shminfo.shmall = saved_shmall;
1155 sysctl_shminfo_ret = EINVAL;
1156 goto sysctl_shminfo_out;
1157 }
1158 }
1159 sysctl_shminfo_ret = 0;
1160 sysctl_shminfo_out:
1161 SYSV_SHM_SUBSYS_UNLOCK();
1162 return sysctl_shminfo_ret;
1163 }
1164
1165 static int
IPCS_shm_sysctl(__unused struct sysctl_oid * oidp,__unused void * arg1,__unused int arg2,struct sysctl_req * req)1166 IPCS_shm_sysctl(__unused struct sysctl_oid *oidp, __unused void *arg1,
1167 __unused int arg2, struct sysctl_req *req)
1168 {
1169 int error;
1170 int cursor;
1171 union {
1172 struct user32_IPCS_command u32;
1173 struct user_IPCS_command u64;
1174 } ipcs = { };
1175 struct user32_shmid_ds shmid_ds32 = { }; /* post conversion, 32 bit version */
1176 struct user_shmid_ds shmid_ds = { }; /* 64 bit version */
1177 void *shmid_dsp;
1178 size_t ipcs_sz = sizeof(struct user_IPCS_command);
1179 size_t shmid_ds_sz = sizeof(struct user_shmid_ds);
1180 struct proc *p = current_proc();
1181
1182 SYSV_SHM_SUBSYS_LOCK();
1183
1184 if ((error = shminit())) {
1185 goto ipcs_shm_sysctl_out;
1186 }
1187
1188 if (!IS_64BIT_PROCESS(p)) {
1189 ipcs_sz = sizeof(struct user32_IPCS_command);
1190 shmid_ds_sz = sizeof(struct user32_shmid_ds);
1191 }
1192
1193 /* Copy in the command structure */
1194 if ((error = SYSCTL_IN(req, &ipcs, ipcs_sz)) != 0) {
1195 goto ipcs_shm_sysctl_out;
1196 }
1197
1198 if (!IS_64BIT_PROCESS(p)) { /* convert in place */
1199 ipcs.u64.ipcs_data = CAST_USER_ADDR_T(ipcs.u32.ipcs_data);
1200 }
1201
1202 /* Let us version this interface... */
1203 if (ipcs.u64.ipcs_magic != IPCS_MAGIC) {
1204 error = EINVAL;
1205 goto ipcs_shm_sysctl_out;
1206 }
1207
1208 switch (ipcs.u64.ipcs_op) {
1209 case IPCS_SHM_CONF: /* Obtain global configuration data */
1210 if (ipcs.u64.ipcs_datalen != sizeof(struct shminfo)) {
1211 if (ipcs.u64.ipcs_cursor != 0) { /* fwd. compat. */
1212 error = ENOMEM;
1213 break;
1214 }
1215 error = ERANGE;
1216 break;
1217 }
1218 error = copyout(&shminfo, ipcs.u64.ipcs_data, ipcs.u64.ipcs_datalen);
1219 break;
1220
1221 case IPCS_SHM_ITER: /* Iterate over existing segments */
1222 cursor = ipcs.u64.ipcs_cursor;
1223 if (cursor < 0 || cursor >= shminfo.shmmni) {
1224 error = ERANGE;
1225 break;
1226 }
1227 if (ipcs.u64.ipcs_datalen != (int)shmid_ds_sz) {
1228 error = EINVAL;
1229 break;
1230 }
1231 for (; cursor < shminfo.shmmni; cursor++) {
1232 if (shmsegs[cursor].u.shm_perm.mode & SHMSEG_ALLOCATED) {
1233 break;
1234 }
1235 continue;
1236 }
1237 if (cursor == shminfo.shmmni) {
1238 error = ENOENT;
1239 break;
1240 }
1241
1242 shmid_dsp = &shmsegs[cursor]; /* default: 64 bit */
1243
1244 /*
1245 * If necessary, convert the 64 bit kernel segment
1246 * descriptor to a 32 bit user one.
1247 */
1248 if (!IS_64BIT_PROCESS(p)) {
1249 shmid_ds_64to32(shmid_dsp, &shmid_ds32);
1250
1251 /* Clear kernel reserved pointer before copying to user space */
1252 shmid_ds32.shm_internal = (user32_addr_t)0;
1253
1254 shmid_dsp = &shmid_ds32;
1255 } else {
1256 memcpy(&shmid_ds, shmid_dsp, sizeof(shmid_ds));
1257
1258 /* Clear kernel reserved pointer before copying to user space */
1259 shmid_ds.shm_internal = USER_ADDR_NULL;
1260
1261 shmid_dsp = &shmid_ds;
1262 }
1263 error = copyout(shmid_dsp, ipcs.u64.ipcs_data, ipcs.u64.ipcs_datalen);
1264 if (!error) {
1265 /* update cursor */
1266 ipcs.u64.ipcs_cursor = cursor + 1;
1267
1268 if (!IS_64BIT_PROCESS(p)) { /* convert in place */
1269 ipcs.u32.ipcs_data = CAST_DOWN_EXPLICIT(user32_addr_t, ipcs.u64.ipcs_data);
1270 }
1271
1272 error = SYSCTL_OUT(req, &ipcs, ipcs_sz);
1273 }
1274 break;
1275
1276 default:
1277 error = EINVAL;
1278 break;
1279 }
1280 ipcs_shm_sysctl_out:
1281 SYSV_SHM_SUBSYS_UNLOCK();
1282 return error;
1283 }
1284
1285 SYSCTL_NODE(_kern, KERN_SYSV, sysv, CTLFLAG_RW | CTLFLAG_LOCKED | CTLFLAG_ANYBODY, 0, "SYSV");
1286
1287 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmmax, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1288 &shminfo.shmmax, 0, &sysctl_shminfo, "Q", "shmmax");
1289
1290 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmmin, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1291 &shminfo.shmmin, 0, &sysctl_shminfo, "Q", "shmmin");
1292
1293 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmmni, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1294 &shminfo.shmmni, 0, &sysctl_shminfo, "Q", "shmmni");
1295
1296 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmseg, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1297 &shminfo.shmseg, 0, &sysctl_shminfo, "Q", "shmseg");
1298
1299 SYSCTL_PROC(_kern_sysv, OID_AUTO, shmall, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
1300 &shminfo.shmall, 0, &sysctl_shminfo, "Q", "shmall");
1301
1302 SYSCTL_NODE(_kern_sysv, OID_AUTO, ipcs, CTLFLAG_RW | CTLFLAG_LOCKED | CTLFLAG_ANYBODY, 0, "SYSVIPCS");
1303
1304 SYSCTL_PROC(_kern_sysv_ipcs, OID_AUTO, shm, CTLFLAG_RW | CTLFLAG_ANYBODY | CTLFLAG_LOCKED,
1305 0, 0, IPCS_shm_sysctl,
1306 "S,IPCS_shm_command",
1307 "ipcs shm command interface");
1308 #endif /* SYSV_SHM */
1309
1310 /* DSEP Review Done pl-20051108-v02 @2743,@2908,@2913,@3009 */
1311