X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=ipc%2Fshm.c;h=c47e87278a92d87acf6bdfefbb16ab73186c24b2;hb=a2e9c384ce76993cd68d6de57eaa81985b4618e3;hp=e2de16efe10ddaa45c1667874c64cb3dc6410860;hpb=03f02c7657f7948ab980280c54c9366f962b1474;p=linux-2.6 diff --git a/ipc/shm.c b/ipc/shm.c index e2de16efe1..c47e87278a 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -35,9 +35,10 @@ #include #include #include -#include +#include #include #include +#include #include @@ -55,14 +56,11 @@ struct shm_file_data { static const struct file_operations shm_file_operations; static struct vm_operations_struct shm_vm_ops; -static struct ipc_ids init_shm_ids; - -#define shm_ids(ns) (*((ns)->ids[IPC_SHM_IDS])) +#define shm_ids(ns) ((ns)->ids[IPC_SHM_IDS]) #define shm_unlock(shp) \ ipc_unlock(&(shp)->shm_perm) -#define shm_buildid(ns, id, seq) \ - ipc_buildid(&shm_ids(ns), id, seq) +#define shm_buildid(id, seq) ipc_buildid(id, seq) static int newseg(struct ipc_namespace *, struct ipc_params *); static void shm_open(struct vm_area_struct *vma); @@ -72,18 +70,24 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp); static int sysvipc_shm_proc_show(struct seq_file *s, void *it); #endif -static void __shm_init_ns(struct ipc_namespace *ns, struct ipc_ids *ids) +void shm_init_ns(struct ipc_namespace *ns) { - ns->ids[IPC_SHM_IDS] = ids; ns->shm_ctlmax = SHMMAX; ns->shm_ctlall = SHMALL; ns->shm_ctlmni = SHMMNI; ns->shm_tot = 0; - ipc_init_ids(ids); + ipc_init_ids(&ns->ids[IPC_SHM_IDS]); } -static void do_shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *shp) +/* + * Called with shm_ids.rw_mutex (writer) and the shp structure locked. + * Only shm_ids.rw_mutex remains locked on exit. + */ +static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp) { + struct shmid_kernel *shp; + shp = container_of(ipcp, struct shmid_kernel, shm_perm); + if (shp->shm_nattch){ shp->shm_perm.mode |= SHM_DEST; /* Do not find it any more */ @@ -93,54 +97,59 @@ static void do_shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *shp) shm_destroy(ns, shp); } -int shm_init_ns(struct ipc_namespace *ns) +#ifdef CONFIG_IPC_NS +void shm_exit_ns(struct ipc_namespace *ns) { - struct ipc_ids *ids; - - ids = kmalloc(sizeof(struct ipc_ids), GFP_KERNEL); - if (ids == NULL) - return -ENOMEM; - - __shm_init_ns(ns, ids); - return 0; + free_ipcs(ns, &shm_ids(ns), do_shm_rmid); } +#endif -void shm_exit_ns(struct ipc_namespace *ns) +void __init shm_init (void) { - struct shmid_kernel *shp; - int next_id; - int total, in_use; + shm_init_ns(&init_ipc_ns); + ipc_init_proc_interface("sysvipc/shm", + " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime\n", + IPC_SHM_IDS, sysvipc_shm_proc_show); +} - mutex_lock(&shm_ids(ns).mutex); +/* + * shm_lock_(check_)down routines are called in the paths where the rw_mutex + * is held to protect access to the idr tree. + */ +static inline struct shmid_kernel *shm_lock_down(struct ipc_namespace *ns, + int id) +{ + struct kern_ipc_perm *ipcp = ipc_lock_down(&shm_ids(ns), id); - in_use = shm_ids(ns).in_use; + if (IS_ERR(ipcp)) + return (struct shmid_kernel *)ipcp; - for (total = 0, next_id = 0; total < in_use; next_id++) { - shp = idr_find(&shm_ids(ns).ipcs_idr, next_id); - if (shp == NULL) - continue; - ipc_lock_by_ptr(&shp->shm_perm); - do_shm_rmid(ns, shp); - total++; - } - mutex_unlock(&shm_ids(ns).mutex); - - kfree(ns->ids[IPC_SHM_IDS]); - ns->ids[IPC_SHM_IDS] = NULL; + return container_of(ipcp, struct shmid_kernel, shm_perm); } -void __init shm_init (void) +static inline struct shmid_kernel *shm_lock_check_down( + struct ipc_namespace *ns, + int id) { - __shm_init_ns(&init_ipc_ns, &init_shm_ids); - ipc_init_proc_interface("sysvipc/shm", - " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime\n", - IPC_SHM_IDS, sysvipc_shm_proc_show); + struct kern_ipc_perm *ipcp = ipc_lock_check_down(&shm_ids(ns), id); + + if (IS_ERR(ipcp)) + return (struct shmid_kernel *)ipcp; + + return container_of(ipcp, struct shmid_kernel, shm_perm); } +/* + * shm_lock_(check_) routines are called in the paths where the rw_mutex + * is not held. + */ static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id) { struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id); + if (IS_ERR(ipcp)) + return (struct shmid_kernel *)ipcp; + return container_of(ipcp, struct shmid_kernel, shm_perm); } @@ -149,6 +158,9 @@ static inline struct shmid_kernel *shm_lock_check(struct ipc_namespace *ns, { struct kern_ipc_perm *ipcp = ipc_lock_check(&shm_ids(ns), id); + if (IS_ERR(ipcp)) + return (struct shmid_kernel *)ipcp; + return container_of(ipcp, struct shmid_kernel, shm_perm); } @@ -182,9 +194,10 @@ static void shm_open(struct vm_area_struct *vma) /* * shm_destroy - free the struct shmid_kernel * + * @ns: namespace * @shp: struct to free * - * It has to be called with shp and shm_ids.mutex locked, + * It has to be called with shp and shm_ids.rw_mutex (writer) locked, * but returns with shp unlocked and freed. */ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) @@ -215,9 +228,9 @@ static void shm_close(struct vm_area_struct *vma) struct shmid_kernel *shp; struct ipc_namespace *ns = sfd->ns; - mutex_lock(&shm_ids(ns).mutex); + down_write(&shm_ids(ns).rw_mutex); /* remove from the list of attaches of the shm segment */ - shp = shm_lock(ns, sfd->id); + shp = shm_lock_down(ns, sfd->id); BUG_ON(IS_ERR(shp)); shp->shm_lprid = task_tgid_vnr(current); shp->shm_dtim = get_seconds(); @@ -227,7 +240,7 @@ static void shm_close(struct vm_area_struct *vma) shm_destroy(ns, shp); else shm_unlock(shp); - mutex_unlock(&shm_ids(ns).mutex); + up_write(&shm_ids(ns).rw_mutex); } static int shm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) @@ -343,6 +356,14 @@ static struct vm_operations_struct shm_vm_ops = { #endif }; +/** + * newseg - Create a new shared memory segment + * @ns: namespace + * @params: ptr to the structure that contains key, size and shmflg + * + * Called with shm_ids.rw_mutex held as a writer. + */ + static int newseg(struct ipc_namespace *ns, struct ipc_params *params) { key_t key = params->key; @@ -396,10 +417,11 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) if (IS_ERR(file)) goto no_file; - error = -ENOSPC; id = shm_addid(ns, shp); - if(id == -1) + if (id < 0) { + error = id; goto no_id; + } shp->shm_cprid = task_tgid_vnr(current); shp->shm_lprid = 0; @@ -407,7 +429,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) shp->shm_ctim = get_seconds(); shp->shm_segsz = size; shp->shm_nattch = 0; - shp->shm_perm.id = shm_buildid(ns, id, shp->shm_perm.seq); + shp->shm_perm.id = shm_buildid(id, shp->shm_perm.seq); shp->shm_file = file; /* * shmid gets reported as "inode#" in /proc/pid/maps. @@ -428,6 +450,9 @@ no_file: return error; } +/* + * Called with shm_ids.rw_mutex and ipcp locked. + */ static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg) { struct shmid_kernel *shp; @@ -436,6 +461,9 @@ static inline int shm_security(struct kern_ipc_perm *ipcp, int shmflg) return security_shm_associate(shp, shmflg); } +/* + * Called with shm_ids.rw_mutex and ipcp locked. + */ static inline int shm_more_checks(struct kern_ipc_perm *ipcp, struct ipc_params *params) { @@ -558,6 +586,9 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf } } +/* + * Called with shm_ids.rw_mutex held as a reader + */ static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss, unsigned long *swp) { @@ -573,18 +604,6 @@ static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss, struct shmid_kernel *shp; struct inode *inode; - /* - * idr_find() is called via shm_get(), so with shm_ids.mutex - * locked. Since ipc_addid() is also called with - * shm_ids.mutex down, there is no need to add read barriers - * here to gurantee the writes in ipc_addid() are seen in - * order here (for Alpha). - * However idr_find() itself does not necessary require - * ipc_ids.mutex down. So if idr_find() is used by other - * places without ipc_ids.mutex down, then it needs read - * read memory barriers as ipc_lock() does. - */ - shp = idr_find(&shm_ids(ns).ipcs_idr, next_id); if (shp == NULL) continue; @@ -638,8 +657,11 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) shminfo.shmmin = SHMMIN; if(copy_shminfo_to_user (buf, &shminfo, version)) return -EFAULT; - /* reading a integer is always atomic */ + + down_read(&shm_ids(ns).rw_mutex); err = ipc_get_maxid(&shm_ids(ns)); + up_read(&shm_ids(ns).rw_mutex); + if(err<0) err = 0; goto out; @@ -653,14 +675,14 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) return err; memset(&shm_info,0,sizeof(shm_info)); - mutex_lock(&shm_ids(ns).mutex); + down_read(&shm_ids(ns).rw_mutex); shm_info.used_ids = shm_ids(ns).in_use; shm_get_stat (ns, &shm_info.shm_rss, &shm_info.shm_swp); shm_info.shm_tot = ns->shm_tot; shm_info.swap_attempts = 0; shm_info.swap_successes = 0; err = ipc_get_maxid(&shm_ids(ns)); - mutex_unlock(&shm_ids(ns).mutex); + up_read(&shm_ids(ns).rw_mutex); if(copy_to_user (buf, &shm_info, sizeof(shm_info))) { err = -EFAULT; goto out; @@ -773,8 +795,8 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) * Instead we set a destroyed flag, and then blow * the name away when the usage hits zero. */ - mutex_lock(&shm_ids(ns).mutex); - shp = shm_lock_check(ns, shmid); + down_write(&shm_ids(ns).rw_mutex); + shp = shm_lock_check_down(ns, shmid); if (IS_ERR(shp)) { err = PTR_ERR(shp); goto out_up; @@ -795,8 +817,8 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) if (err) goto out_unlock_up; - do_shm_rmid(ns, shp); - mutex_unlock(&shm_ids(ns).mutex); + do_shm_rmid(ns, &shp->shm_perm); + up_write(&shm_ids(ns).rw_mutex); goto out; } @@ -811,8 +833,8 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) err = -EFAULT; goto out; } - mutex_lock(&shm_ids(ns).mutex); - shp = shm_lock_check(ns, shmid); + down_write(&shm_ids(ns).rw_mutex); + shp = shm_lock_check_down(ns, shmid); if (IS_ERR(shp)) { err = PTR_ERR(shp); goto out_up; @@ -851,7 +873,7 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf) out_unlock_up: shm_unlock(shp); out_up: - mutex_unlock(&shm_ids(ns).mutex); + up_write(&shm_ids(ns).rw_mutex); goto out; out_unlock: shm_unlock(shp); @@ -985,8 +1007,8 @@ invalid: fput(file); out_nattch: - mutex_lock(&shm_ids(ns).mutex); - shp = shm_lock(ns, shmid); + down_write(&shm_ids(ns).rw_mutex); + shp = shm_lock_down(ns, shmid); BUG_ON(IS_ERR(shp)); shp->shm_nattch--; if(shp->shm_nattch == 0 && @@ -994,7 +1016,7 @@ out_nattch: shm_destroy(ns, shp); else shm_unlock(shp); - mutex_unlock(&shm_ids(ns).mutex); + up_write(&shm_ids(ns).rw_mutex); out: return err;