sem.c 35 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418
  1. /*
  2. * linux/ipc/sem.c
  3. * Copyright (C) 1992 Krishna Balasubramanian
  4. * Copyright (C) 1995 Eric Schenk, Bruno Haible
  5. *
  6. * IMPLEMENTATION NOTES ON CODE REWRITE (Eric Schenk, January 1995):
  7. * This code underwent a massive rewrite in order to solve some problems
  8. * with the original code. In particular the original code failed to
  9. * wake up processes that were waiting for semval to go to 0 if the
  10. * value went to 0 and was then incremented rapidly enough. In solving
  11. * this problem I have also modified the implementation so that it
  12. * processes pending operations in a FIFO manner, thus give a guarantee
  13. * that processes waiting for a lock on the semaphore won't starve
  14. * unless another locking process fails to unlock.
  15. * In addition the following two changes in behavior have been introduced:
  16. * - The original implementation of semop returned the value
  17. * last semaphore element examined on success. This does not
  18. * match the manual page specifications, and effectively
  19. * allows the user to read the semaphore even if they do not
  20. * have read permissions. The implementation now returns 0
  21. * on success as stated in the manual page.
  22. * - There is some confusion over whether the set of undo adjustments
  23. * to be performed at exit should be done in an atomic manner.
  24. * That is, if we are attempting to decrement the semval should we queue
  25. * up and wait until we can do so legally?
  26. * The original implementation attempted to do this.
  27. * The current implementation does not do so. This is because I don't
  28. * think it is the right thing (TM) to do, and because I couldn't
  29. * see a clean way to get the old behavior with the new design.
  30. * The POSIX standard and SVID should be consulted to determine
  31. * what behavior is mandated.
  32. *
  33. * Further notes on refinement (Christoph Rohland, December 1998):
  34. * - The POSIX standard says, that the undo adjustments simply should
  35. * redo. So the current implementation is o.K.
  36. * - The previous code had two flaws:
  37. * 1) It actively gave the semaphore to the next waiting process
  38. * sleeping on the semaphore. Since this process did not have the
  39. * cpu this led to many unnecessary context switches and bad
  40. * performance. Now we only check which process should be able to
  41. * get the semaphore and if this process wants to reduce some
  42. * semaphore value we simply wake it up without doing the
  43. * operation. So it has to try to get it later. Thus e.g. the
  44. * running process may reacquire the semaphore during the current
  45. * time slice. If it only waits for zero or increases the semaphore,
  46. * we do the operation in advance and wake it up.
  47. * 2) It did not wake up all zero waiting processes. We try to do
  48. * better but only get the semops right which only wait for zero or
  49. * increase. If there are decrement operations in the operations
  50. * array we do the same as before.
  51. *
  52. * With the incarnation of O(1) scheduler, it becomes unnecessary to perform
  53. * check/retry algorithm for waking up blocked processes as the new scheduler
  54. * is better at handling thread switch than the old one.
  55. *
  56. * /proc/sysvipc/sem support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
  57. *
  58. * SMP-threaded, sysctl's added
  59. * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
  60. * Enforced range limit on SEM_UNDO
  61. * (c) 2001 Red Hat Inc <alan@redhat.com>
  62. * Lockless wakeup
  63. * (c) 2003 Manfred Spraul <manfred@colorfullife.com>
  64. *
  65. * support for audit of ipc object properties and permission changes
  66. * Dustin Kirkland <dustin.kirkland@us.ibm.com>
  67. *
  68. * namespaces support
  69. * OpenVZ, SWsoft Inc.
  70. * Pavel Emelianov <xemul@openvz.org>
  71. */
  72. #include <linux/slab.h>
  73. #include <linux/spinlock.h>
  74. #include <linux/init.h>
  75. #include <linux/proc_fs.h>
  76. #include <linux/time.h>
  77. #include <linux/smp_lock.h>
  78. #include <linux/security.h>
  79. #include <linux/syscalls.h>
  80. #include <linux/audit.h>
  81. #include <linux/capability.h>
  82. #include <linux/seq_file.h>
  83. #include <linux/mutex.h>
  84. #include <linux/nsproxy.h>
  85. #include <asm/uaccess.h>
  86. #include "util.h"
  87. #define sem_ids(ns) (*((ns)->ids[IPC_SEM_IDS]))
  88. #define sem_lock(ns, id) ((struct sem_array*)ipc_lock(&sem_ids(ns), id))
  89. #define sem_unlock(sma) ipc_unlock(&(sma)->sem_perm)
  90. #define sem_rmid(ns, id) ((struct sem_array*)ipc_rmid(&sem_ids(ns), id))
  91. #define sem_checkid(ns, sma, semid) \
  92. ipc_checkid(&sem_ids(ns),&sma->sem_perm,semid)
  93. #define sem_buildid(ns, id, seq) \
  94. ipc_buildid(&sem_ids(ns), id, seq)
  95. static struct ipc_ids init_sem_ids;
  96. static int newary(struct ipc_namespace *, key_t, int, int);
  97. static void freeary(struct ipc_namespace *ns, struct sem_array *sma, int id);
  98. #ifdef CONFIG_PROC_FS
  99. static int sysvipc_sem_proc_show(struct seq_file *s, void *it);
  100. #endif
  101. #define SEMMSL_FAST 256 /* 512 bytes on stack */
  102. #define SEMOPM_FAST 64 /* ~ 372 bytes on stack */
  103. /*
  104. * linked list protection:
  105. * sem_undo.id_next,
  106. * sem_array.sem_pending{,last},
  107. * sem_array.sem_undo: sem_lock() for read/write
  108. * sem_undo.proc_next: only "current" is allowed to read/write that field.
  109. *
  110. */
  111. #define sc_semmsl sem_ctls[0]
  112. #define sc_semmns sem_ctls[1]
  113. #define sc_semopm sem_ctls[2]
  114. #define sc_semmni sem_ctls[3]
  115. static void __ipc_init __sem_init_ns(struct ipc_namespace *ns, struct ipc_ids *ids)
  116. {
  117. ns->ids[IPC_SEM_IDS] = ids;
  118. ns->sc_semmsl = SEMMSL;
  119. ns->sc_semmns = SEMMNS;
  120. ns->sc_semopm = SEMOPM;
  121. ns->sc_semmni = SEMMNI;
  122. ns->used_sems = 0;
  123. ipc_init_ids(ids, ns->sc_semmni);
  124. }
  125. #ifdef CONFIG_IPC_NS
  126. int sem_init_ns(struct ipc_namespace *ns)
  127. {
  128. struct ipc_ids *ids;
  129. ids = kmalloc(sizeof(struct ipc_ids), GFP_KERNEL);
  130. if (ids == NULL)
  131. return -ENOMEM;
  132. __sem_init_ns(ns, ids);
  133. return 0;
  134. }
  135. void sem_exit_ns(struct ipc_namespace *ns)
  136. {
  137. int i;
  138. struct sem_array *sma;
  139. mutex_lock(&sem_ids(ns).mutex);
  140. for (i = 0; i <= sem_ids(ns).max_id; i++) {
  141. sma = sem_lock(ns, i);
  142. if (sma == NULL)
  143. continue;
  144. freeary(ns, sma, i);
  145. }
  146. mutex_unlock(&sem_ids(ns).mutex);
  147. ipc_fini_ids(ns->ids[IPC_SEM_IDS]);
  148. kfree(ns->ids[IPC_SEM_IDS]);
  149. ns->ids[IPC_SEM_IDS] = NULL;
  150. }
  151. #endif
  152. void __init sem_init (void)
  153. {
  154. __sem_init_ns(&init_ipc_ns, &init_sem_ids);
  155. ipc_init_proc_interface("sysvipc/sem",
  156. " key semid perms nsems uid gid cuid cgid otime ctime\n",
  157. IPC_SEM_IDS, sysvipc_sem_proc_show);
  158. }
  159. /*
  160. * Lockless wakeup algorithm:
  161. * Without the check/retry algorithm a lockless wakeup is possible:
  162. * - queue.status is initialized to -EINTR before blocking.
  163. * - wakeup is performed by
  164. * * unlinking the queue entry from sma->sem_pending
  165. * * setting queue.status to IN_WAKEUP
  166. * This is the notification for the blocked thread that a
  167. * result value is imminent.
  168. * * call wake_up_process
  169. * * set queue.status to the final value.
  170. * - the previously blocked thread checks queue.status:
  171. * * if it's IN_WAKEUP, then it must wait until the value changes
  172. * * if it's not -EINTR, then the operation was completed by
  173. * update_queue. semtimedop can return queue.status without
  174. * performing any operation on the sem array.
  175. * * otherwise it must acquire the spinlock and check what's up.
  176. *
  177. * The two-stage algorithm is necessary to protect against the following
  178. * races:
  179. * - if queue.status is set after wake_up_process, then the woken up idle
  180. * thread could race forward and try (and fail) to acquire sma->lock
  181. * before update_queue had a chance to set queue.status
  182. * - if queue.status is written before wake_up_process and if the
  183. * blocked process is woken up by a signal between writing
  184. * queue.status and the wake_up_process, then the woken up
  185. * process could return from semtimedop and die by calling
  186. * sys_exit before wake_up_process is called. Then wake_up_process
  187. * will oops, because the task structure is already invalid.
  188. * (yes, this happened on s390 with sysv msg).
  189. *
  190. */
  191. #define IN_WAKEUP 1
  192. static int newary (struct ipc_namespace *ns, key_t key, int nsems, int semflg)
  193. {
  194. int id;
  195. int retval;
  196. struct sem_array *sma;
  197. int size;
  198. if (!nsems)
  199. return -EINVAL;
  200. if (ns->used_sems + nsems > ns->sc_semmns)
  201. return -ENOSPC;
  202. size = sizeof (*sma) + nsems * sizeof (struct sem);
  203. sma = ipc_rcu_alloc(size);
  204. if (!sma) {
  205. return -ENOMEM;
  206. }
  207. memset (sma, 0, size);
  208. sma->sem_perm.mode = (semflg & S_IRWXUGO);
  209. sma->sem_perm.key = key;
  210. sma->sem_perm.security = NULL;
  211. retval = security_sem_alloc(sma);
  212. if (retval) {
  213. ipc_rcu_putref(sma);
  214. return retval;
  215. }
  216. id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
  217. if(id == -1) {
  218. security_sem_free(sma);
  219. ipc_rcu_putref(sma);
  220. return -ENOSPC;
  221. }
  222. ns->used_sems += nsems;
  223. sma->sem_id = sem_buildid(ns, id, sma->sem_perm.seq);
  224. sma->sem_base = (struct sem *) &sma[1];
  225. /* sma->sem_pending = NULL; */
  226. sma->sem_pending_last = &sma->sem_pending;
  227. /* sma->undo = NULL; */
  228. sma->sem_nsems = nsems;
  229. sma->sem_ctime = get_seconds();
  230. sem_unlock(sma);
  231. return sma->sem_id;
  232. }
  233. asmlinkage long sys_semget (key_t key, int nsems, int semflg)
  234. {
  235. int id, err = -EINVAL;
  236. struct sem_array *sma;
  237. struct ipc_namespace *ns;
  238. ns = current->nsproxy->ipc_ns;
  239. if (nsems < 0 || nsems > ns->sc_semmsl)
  240. return -EINVAL;
  241. mutex_lock(&sem_ids(ns).mutex);
  242. if (key == IPC_PRIVATE) {
  243. err = newary(ns, key, nsems, semflg);
  244. } else if ((id = ipc_findkey(&sem_ids(ns), key)) == -1) { /* key not used */
  245. if (!(semflg & IPC_CREAT))
  246. err = -ENOENT;
  247. else
  248. err = newary(ns, key, nsems, semflg);
  249. } else if (semflg & IPC_CREAT && semflg & IPC_EXCL) {
  250. err = -EEXIST;
  251. } else {
  252. sma = sem_lock(ns, id);
  253. BUG_ON(sma==NULL);
  254. if (nsems > sma->sem_nsems)
  255. err = -EINVAL;
  256. else if (ipcperms(&sma->sem_perm, semflg))
  257. err = -EACCES;
  258. else {
  259. int semid = sem_buildid(ns, id, sma->sem_perm.seq);
  260. err = security_sem_associate(sma, semflg);
  261. if (!err)
  262. err = semid;
  263. }
  264. sem_unlock(sma);
  265. }
  266. mutex_unlock(&sem_ids(ns).mutex);
  267. return err;
  268. }
  269. /* Manage the doubly linked list sma->sem_pending as a FIFO:
  270. * insert new queue elements at the tail sma->sem_pending_last.
  271. */
  272. static inline void append_to_queue (struct sem_array * sma,
  273. struct sem_queue * q)
  274. {
  275. *(q->prev = sma->sem_pending_last) = q;
  276. *(sma->sem_pending_last = &q->next) = NULL;
  277. }
  278. static inline void prepend_to_queue (struct sem_array * sma,
  279. struct sem_queue * q)
  280. {
  281. q->next = sma->sem_pending;
  282. *(q->prev = &sma->sem_pending) = q;
  283. if (q->next)
  284. q->next->prev = &q->next;
  285. else /* sma->sem_pending_last == &sma->sem_pending */
  286. sma->sem_pending_last = &q->next;
  287. }
  288. static inline void remove_from_queue (struct sem_array * sma,
  289. struct sem_queue * q)
  290. {
  291. *(q->prev) = q->next;
  292. if (q->next)
  293. q->next->prev = q->prev;
  294. else /* sma->sem_pending_last == &q->next */
  295. sma->sem_pending_last = q->prev;
  296. q->prev = NULL; /* mark as removed */
  297. }
  298. /*
  299. * Determine whether a sequence of semaphore operations would succeed
  300. * all at once. Return 0 if yes, 1 if need to sleep, else return error code.
  301. */
  302. static int try_atomic_semop (struct sem_array * sma, struct sembuf * sops,
  303. int nsops, struct sem_undo *un, int pid)
  304. {
  305. int result, sem_op;
  306. struct sembuf *sop;
  307. struct sem * curr;
  308. for (sop = sops; sop < sops + nsops; sop++) {
  309. curr = sma->sem_base + sop->sem_num;
  310. sem_op = sop->sem_op;
  311. result = curr->semval;
  312. if (!sem_op && result)
  313. goto would_block;
  314. result += sem_op;
  315. if (result < 0)
  316. goto would_block;
  317. if (result > SEMVMX)
  318. goto out_of_range;
  319. if (sop->sem_flg & SEM_UNDO) {
  320. int undo = un->semadj[sop->sem_num] - sem_op;
  321. /*
  322. * Exceeding the undo range is an error.
  323. */
  324. if (undo < (-SEMAEM - 1) || undo > SEMAEM)
  325. goto out_of_range;
  326. }
  327. curr->semval = result;
  328. }
  329. sop--;
  330. while (sop >= sops) {
  331. sma->sem_base[sop->sem_num].sempid = pid;
  332. if (sop->sem_flg & SEM_UNDO)
  333. un->semadj[sop->sem_num] -= sop->sem_op;
  334. sop--;
  335. }
  336. sma->sem_otime = get_seconds();
  337. return 0;
  338. out_of_range:
  339. result = -ERANGE;
  340. goto undo;
  341. would_block:
  342. if (sop->sem_flg & IPC_NOWAIT)
  343. result = -EAGAIN;
  344. else
  345. result = 1;
  346. undo:
  347. sop--;
  348. while (sop >= sops) {
  349. sma->sem_base[sop->sem_num].semval -= sop->sem_op;
  350. sop--;
  351. }
  352. return result;
  353. }
  354. /* Go through the pending queue for the indicated semaphore
  355. * looking for tasks that can be completed.
  356. */
  357. static void update_queue (struct sem_array * sma)
  358. {
  359. int error;
  360. struct sem_queue * q;
  361. q = sma->sem_pending;
  362. while(q) {
  363. error = try_atomic_semop(sma, q->sops, q->nsops,
  364. q->undo, q->pid);
  365. /* Does q->sleeper still need to sleep? */
  366. if (error <= 0) {
  367. struct sem_queue *n;
  368. remove_from_queue(sma,q);
  369. q->status = IN_WAKEUP;
  370. /*
  371. * Continue scanning. The next operation
  372. * that must be checked depends on the type of the
  373. * completed operation:
  374. * - if the operation modified the array, then
  375. * restart from the head of the queue and
  376. * check for threads that might be waiting
  377. * for semaphore values to become 0.
  378. * - if the operation didn't modify the array,
  379. * then just continue.
  380. */
  381. if (q->alter)
  382. n = sma->sem_pending;
  383. else
  384. n = q->next;
  385. wake_up_process(q->sleeper);
  386. /* hands-off: q will disappear immediately after
  387. * writing q->status.
  388. */
  389. smp_wmb();
  390. q->status = error;
  391. q = n;
  392. } else {
  393. q = q->next;
  394. }
  395. }
  396. }
  397. /* The following counts are associated to each semaphore:
  398. * semncnt number of tasks waiting on semval being nonzero
  399. * semzcnt number of tasks waiting on semval being zero
  400. * This model assumes that a task waits on exactly one semaphore.
  401. * Since semaphore operations are to be performed atomically, tasks actually
  402. * wait on a whole sequence of semaphores simultaneously.
  403. * The counts we return here are a rough approximation, but still
  404. * warrant that semncnt+semzcnt>0 if the task is on the pending queue.
  405. */
  406. static int count_semncnt (struct sem_array * sma, ushort semnum)
  407. {
  408. int semncnt;
  409. struct sem_queue * q;
  410. semncnt = 0;
  411. for (q = sma->sem_pending; q; q = q->next) {
  412. struct sembuf * sops = q->sops;
  413. int nsops = q->nsops;
  414. int i;
  415. for (i = 0; i < nsops; i++)
  416. if (sops[i].sem_num == semnum
  417. && (sops[i].sem_op < 0)
  418. && !(sops[i].sem_flg & IPC_NOWAIT))
  419. semncnt++;
  420. }
  421. return semncnt;
  422. }
  423. static int count_semzcnt (struct sem_array * sma, ushort semnum)
  424. {
  425. int semzcnt;
  426. struct sem_queue * q;
  427. semzcnt = 0;
  428. for (q = sma->sem_pending; q; q = q->next) {
  429. struct sembuf * sops = q->sops;
  430. int nsops = q->nsops;
  431. int i;
  432. for (i = 0; i < nsops; i++)
  433. if (sops[i].sem_num == semnum
  434. && (sops[i].sem_op == 0)
  435. && !(sops[i].sem_flg & IPC_NOWAIT))
  436. semzcnt++;
  437. }
  438. return semzcnt;
  439. }
  440. /* Free a semaphore set. freeary() is called with sem_ids.mutex locked and
  441. * the spinlock for this semaphore set hold. sem_ids.mutex remains locked
  442. * on exit.
  443. */
  444. static void freeary (struct ipc_namespace *ns, struct sem_array *sma, int id)
  445. {
  446. struct sem_undo *un;
  447. struct sem_queue *q;
  448. int size;
  449. /* Invalidate the existing undo structures for this semaphore set.
  450. * (They will be freed without any further action in exit_sem()
  451. * or during the next semop.)
  452. */
  453. for (un = sma->undo; un; un = un->id_next)
  454. un->semid = -1;
  455. /* Wake up all pending processes and let them fail with EIDRM. */
  456. q = sma->sem_pending;
  457. while(q) {
  458. struct sem_queue *n;
  459. /* lazy remove_from_queue: we are killing the whole queue */
  460. q->prev = NULL;
  461. n = q->next;
  462. q->status = IN_WAKEUP;
  463. wake_up_process(q->sleeper); /* doesn't sleep */
  464. smp_wmb();
  465. q->status = -EIDRM; /* hands-off q */
  466. q = n;
  467. }
  468. /* Remove the semaphore set from the ID array*/
  469. sma = sem_rmid(ns, id);
  470. sem_unlock(sma);
  471. ns->used_sems -= sma->sem_nsems;
  472. size = sizeof (*sma) + sma->sem_nsems * sizeof (struct sem);
  473. security_sem_free(sma);
  474. ipc_rcu_putref(sma);
  475. }
  476. static unsigned long copy_semid_to_user(void __user *buf, struct semid64_ds *in, int version)
  477. {
  478. switch(version) {
  479. case IPC_64:
  480. return copy_to_user(buf, in, sizeof(*in));
  481. case IPC_OLD:
  482. {
  483. struct semid_ds out;
  484. ipc64_perm_to_ipc_perm(&in->sem_perm, &out.sem_perm);
  485. out.sem_otime = in->sem_otime;
  486. out.sem_ctime = in->sem_ctime;
  487. out.sem_nsems = in->sem_nsems;
  488. return copy_to_user(buf, &out, sizeof(out));
  489. }
  490. default:
  491. return -EINVAL;
  492. }
  493. }
  494. static int semctl_nolock(struct ipc_namespace *ns, int semid, int semnum,
  495. int cmd, int version, union semun arg)
  496. {
  497. int err = -EINVAL;
  498. struct sem_array *sma;
  499. switch(cmd) {
  500. case IPC_INFO:
  501. case SEM_INFO:
  502. {
  503. struct seminfo seminfo;
  504. int max_id;
  505. err = security_sem_semctl(NULL, cmd);
  506. if (err)
  507. return err;
  508. memset(&seminfo,0,sizeof(seminfo));
  509. seminfo.semmni = ns->sc_semmni;
  510. seminfo.semmns = ns->sc_semmns;
  511. seminfo.semmsl = ns->sc_semmsl;
  512. seminfo.semopm = ns->sc_semopm;
  513. seminfo.semvmx = SEMVMX;
  514. seminfo.semmnu = SEMMNU;
  515. seminfo.semmap = SEMMAP;
  516. seminfo.semume = SEMUME;
  517. mutex_lock(&sem_ids(ns).mutex);
  518. if (cmd == SEM_INFO) {
  519. seminfo.semusz = sem_ids(ns).in_use;
  520. seminfo.semaem = ns->used_sems;
  521. } else {
  522. seminfo.semusz = SEMUSZ;
  523. seminfo.semaem = SEMAEM;
  524. }
  525. max_id = sem_ids(ns).max_id;
  526. mutex_unlock(&sem_ids(ns).mutex);
  527. if (copy_to_user (arg.__buf, &seminfo, sizeof(struct seminfo)))
  528. return -EFAULT;
  529. return (max_id < 0) ? 0: max_id;
  530. }
  531. case SEM_STAT:
  532. {
  533. struct semid64_ds tbuf;
  534. int id;
  535. if(semid >= sem_ids(ns).entries->size)
  536. return -EINVAL;
  537. memset(&tbuf,0,sizeof(tbuf));
  538. sma = sem_lock(ns, semid);
  539. if(sma == NULL)
  540. return -EINVAL;
  541. err = -EACCES;
  542. if (ipcperms (&sma->sem_perm, S_IRUGO))
  543. goto out_unlock;
  544. err = security_sem_semctl(sma, cmd);
  545. if (err)
  546. goto out_unlock;
  547. id = sem_buildid(ns, semid, sma->sem_perm.seq);
  548. kernel_to_ipc64_perm(&sma->sem_perm, &tbuf.sem_perm);
  549. tbuf.sem_otime = sma->sem_otime;
  550. tbuf.sem_ctime = sma->sem_ctime;
  551. tbuf.sem_nsems = sma->sem_nsems;
  552. sem_unlock(sma);
  553. if (copy_semid_to_user (arg.buf, &tbuf, version))
  554. return -EFAULT;
  555. return id;
  556. }
  557. default:
  558. return -EINVAL;
  559. }
  560. return err;
  561. out_unlock:
  562. sem_unlock(sma);
  563. return err;
  564. }
  565. static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
  566. int cmd, int version, union semun arg)
  567. {
  568. struct sem_array *sma;
  569. struct sem* curr;
  570. int err;
  571. ushort fast_sem_io[SEMMSL_FAST];
  572. ushort* sem_io = fast_sem_io;
  573. int nsems;
  574. sma = sem_lock(ns, semid);
  575. if(sma==NULL)
  576. return -EINVAL;
  577. nsems = sma->sem_nsems;
  578. err=-EIDRM;
  579. if (sem_checkid(ns,sma,semid))
  580. goto out_unlock;
  581. err = -EACCES;
  582. if (ipcperms (&sma->sem_perm, (cmd==SETVAL||cmd==SETALL)?S_IWUGO:S_IRUGO))
  583. goto out_unlock;
  584. err = security_sem_semctl(sma, cmd);
  585. if (err)
  586. goto out_unlock;
  587. err = -EACCES;
  588. switch (cmd) {
  589. case GETALL:
  590. {
  591. ushort __user *array = arg.array;
  592. int i;
  593. if(nsems > SEMMSL_FAST) {
  594. ipc_rcu_getref(sma);
  595. sem_unlock(sma);
  596. sem_io = ipc_alloc(sizeof(ushort)*nsems);
  597. if(sem_io == NULL) {
  598. ipc_lock_by_ptr(&sma->sem_perm);
  599. ipc_rcu_putref(sma);
  600. sem_unlock(sma);
  601. return -ENOMEM;
  602. }
  603. ipc_lock_by_ptr(&sma->sem_perm);
  604. ipc_rcu_putref(sma);
  605. if (sma->sem_perm.deleted) {
  606. sem_unlock(sma);
  607. err = -EIDRM;
  608. goto out_free;
  609. }
  610. }
  611. for (i = 0; i < sma->sem_nsems; i++)
  612. sem_io[i] = sma->sem_base[i].semval;
  613. sem_unlock(sma);
  614. err = 0;
  615. if(copy_to_user(array, sem_io, nsems*sizeof(ushort)))
  616. err = -EFAULT;
  617. goto out_free;
  618. }
  619. case SETALL:
  620. {
  621. int i;
  622. struct sem_undo *un;
  623. ipc_rcu_getref(sma);
  624. sem_unlock(sma);
  625. if(nsems > SEMMSL_FAST) {
  626. sem_io = ipc_alloc(sizeof(ushort)*nsems);
  627. if(sem_io == NULL) {
  628. ipc_lock_by_ptr(&sma->sem_perm);
  629. ipc_rcu_putref(sma);
  630. sem_unlock(sma);
  631. return -ENOMEM;
  632. }
  633. }
  634. if (copy_from_user (sem_io, arg.array, nsems*sizeof(ushort))) {
  635. ipc_lock_by_ptr(&sma->sem_perm);
  636. ipc_rcu_putref(sma);
  637. sem_unlock(sma);
  638. err = -EFAULT;
  639. goto out_free;
  640. }
  641. for (i = 0; i < nsems; i++) {
  642. if (sem_io[i] > SEMVMX) {
  643. ipc_lock_by_ptr(&sma->sem_perm);
  644. ipc_rcu_putref(sma);
  645. sem_unlock(sma);
  646. err = -ERANGE;
  647. goto out_free;
  648. }
  649. }
  650. ipc_lock_by_ptr(&sma->sem_perm);
  651. ipc_rcu_putref(sma);
  652. if (sma->sem_perm.deleted) {
  653. sem_unlock(sma);
  654. err = -EIDRM;
  655. goto out_free;
  656. }
  657. for (i = 0; i < nsems; i++)
  658. sma->sem_base[i].semval = sem_io[i];
  659. for (un = sma->undo; un; un = un->id_next)
  660. for (i = 0; i < nsems; i++)
  661. un->semadj[i] = 0;
  662. sma->sem_ctime = get_seconds();
  663. /* maybe some queued-up processes were waiting for this */
  664. update_queue(sma);
  665. err = 0;
  666. goto out_unlock;
  667. }
  668. case IPC_STAT:
  669. {
  670. struct semid64_ds tbuf;
  671. memset(&tbuf,0,sizeof(tbuf));
  672. kernel_to_ipc64_perm(&sma->sem_perm, &tbuf.sem_perm);
  673. tbuf.sem_otime = sma->sem_otime;
  674. tbuf.sem_ctime = sma->sem_ctime;
  675. tbuf.sem_nsems = sma->sem_nsems;
  676. sem_unlock(sma);
  677. if (copy_semid_to_user (arg.buf, &tbuf, version))
  678. return -EFAULT;
  679. return 0;
  680. }
  681. /* GETVAL, GETPID, GETNCTN, GETZCNT, SETVAL: fall-through */
  682. }
  683. err = -EINVAL;
  684. if(semnum < 0 || semnum >= nsems)
  685. goto out_unlock;
  686. curr = &sma->sem_base[semnum];
  687. switch (cmd) {
  688. case GETVAL:
  689. err = curr->semval;
  690. goto out_unlock;
  691. case GETPID:
  692. err = curr->sempid;
  693. goto out_unlock;
  694. case GETNCNT:
  695. err = count_semncnt(sma,semnum);
  696. goto out_unlock;
  697. case GETZCNT:
  698. err = count_semzcnt(sma,semnum);
  699. goto out_unlock;
  700. case SETVAL:
  701. {
  702. int val = arg.val;
  703. struct sem_undo *un;
  704. err = -ERANGE;
  705. if (val > SEMVMX || val < 0)
  706. goto out_unlock;
  707. for (un = sma->undo; un; un = un->id_next)
  708. un->semadj[semnum] = 0;
  709. curr->semval = val;
  710. curr->sempid = current->tgid;
  711. sma->sem_ctime = get_seconds();
  712. /* maybe some queued-up processes were waiting for this */
  713. update_queue(sma);
  714. err = 0;
  715. goto out_unlock;
  716. }
  717. }
  718. out_unlock:
  719. sem_unlock(sma);
  720. out_free:
  721. if(sem_io != fast_sem_io)
  722. ipc_free(sem_io, sizeof(ushort)*nsems);
  723. return err;
  724. }
  725. struct sem_setbuf {
  726. uid_t uid;
  727. gid_t gid;
  728. mode_t mode;
  729. };
  730. static inline unsigned long copy_semid_from_user(struct sem_setbuf *out, void __user *buf, int version)
  731. {
  732. switch(version) {
  733. case IPC_64:
  734. {
  735. struct semid64_ds tbuf;
  736. if(copy_from_user(&tbuf, buf, sizeof(tbuf)))
  737. return -EFAULT;
  738. out->uid = tbuf.sem_perm.uid;
  739. out->gid = tbuf.sem_perm.gid;
  740. out->mode = tbuf.sem_perm.mode;
  741. return 0;
  742. }
  743. case IPC_OLD:
  744. {
  745. struct semid_ds tbuf_old;
  746. if(copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
  747. return -EFAULT;
  748. out->uid = tbuf_old.sem_perm.uid;
  749. out->gid = tbuf_old.sem_perm.gid;
  750. out->mode = tbuf_old.sem_perm.mode;
  751. return 0;
  752. }
  753. default:
  754. return -EINVAL;
  755. }
  756. }
  757. static int semctl_down(struct ipc_namespace *ns, int semid, int semnum,
  758. int cmd, int version, union semun arg)
  759. {
  760. struct sem_array *sma;
  761. int err;
  762. struct sem_setbuf setbuf={};
  763. struct kern_ipc_perm *ipcp;
  764. if(cmd == IPC_SET) {
  765. if(copy_semid_from_user (&setbuf, arg.buf, version))
  766. return -EFAULT;
  767. }
  768. sma = sem_lock(ns, semid);
  769. if(sma==NULL)
  770. return -EINVAL;
  771. if (sem_checkid(ns,sma,semid)) {
  772. err=-EIDRM;
  773. goto out_unlock;
  774. }
  775. ipcp = &sma->sem_perm;
  776. err = audit_ipc_obj(ipcp);
  777. if (err)
  778. goto out_unlock;
  779. if (cmd == IPC_SET) {
  780. err = audit_ipc_set_perm(0, setbuf.uid, setbuf.gid, setbuf.mode);
  781. if (err)
  782. goto out_unlock;
  783. }
  784. if (current->euid != ipcp->cuid &&
  785. current->euid != ipcp->uid && !capable(CAP_SYS_ADMIN)) {
  786. err=-EPERM;
  787. goto out_unlock;
  788. }
  789. err = security_sem_semctl(sma, cmd);
  790. if (err)
  791. goto out_unlock;
  792. switch(cmd){
  793. case IPC_RMID:
  794. freeary(ns, sma, semid);
  795. err = 0;
  796. break;
  797. case IPC_SET:
  798. ipcp->uid = setbuf.uid;
  799. ipcp->gid = setbuf.gid;
  800. ipcp->mode = (ipcp->mode & ~S_IRWXUGO)
  801. | (setbuf.mode & S_IRWXUGO);
  802. sma->sem_ctime = get_seconds();
  803. sem_unlock(sma);
  804. err = 0;
  805. break;
  806. default:
  807. sem_unlock(sma);
  808. err = -EINVAL;
  809. break;
  810. }
  811. return err;
  812. out_unlock:
  813. sem_unlock(sma);
  814. return err;
  815. }
  816. asmlinkage long sys_semctl (int semid, int semnum, int cmd, union semun arg)
  817. {
  818. int err = -EINVAL;
  819. int version;
  820. struct ipc_namespace *ns;
  821. if (semid < 0)
  822. return -EINVAL;
  823. version = ipc_parse_version(&cmd);
  824. ns = current->nsproxy->ipc_ns;
  825. switch(cmd) {
  826. case IPC_INFO:
  827. case SEM_INFO:
  828. case SEM_STAT:
  829. err = semctl_nolock(ns,semid,semnum,cmd,version,arg);
  830. return err;
  831. case GETALL:
  832. case GETVAL:
  833. case GETPID:
  834. case GETNCNT:
  835. case GETZCNT:
  836. case IPC_STAT:
  837. case SETVAL:
  838. case SETALL:
  839. err = semctl_main(ns,semid,semnum,cmd,version,arg);
  840. return err;
  841. case IPC_RMID:
  842. case IPC_SET:
  843. mutex_lock(&sem_ids(ns).mutex);
  844. err = semctl_down(ns,semid,semnum,cmd,version,arg);
  845. mutex_unlock(&sem_ids(ns).mutex);
  846. return err;
  847. default:
  848. return -EINVAL;
  849. }
  850. }
  851. static inline void lock_semundo(void)
  852. {
  853. struct sem_undo_list *undo_list;
  854. undo_list = current->sysvsem.undo_list;
  855. if (undo_list)
  856. spin_lock(&undo_list->lock);
  857. }
  858. /* This code has an interaction with copy_semundo().
  859. * Consider; two tasks are sharing the undo_list. task1
  860. * acquires the undo_list lock in lock_semundo(). If task2 now
  861. * exits before task1 releases the lock (by calling
  862. * unlock_semundo()), then task1 will never call spin_unlock().
  863. * This leave the sem_undo_list in a locked state. If task1 now creats task3
  864. * and once again shares the sem_undo_list, the sem_undo_list will still be
  865. * locked, and future SEM_UNDO operations will deadlock. This case is
  866. * dealt with in copy_semundo() by having it reinitialize the spin lock when
  867. * the refcnt goes from 1 to 2.
  868. */
  869. static inline void unlock_semundo(void)
  870. {
  871. struct sem_undo_list *undo_list;
  872. undo_list = current->sysvsem.undo_list;
  873. if (undo_list)
  874. spin_unlock(&undo_list->lock);
  875. }
  876. /* If the task doesn't already have a undo_list, then allocate one
  877. * here. We guarantee there is only one thread using this undo list,
  878. * and current is THE ONE
  879. *
  880. * If this allocation and assignment succeeds, but later
  881. * portions of this code fail, there is no need to free the sem_undo_list.
  882. * Just let it stay associated with the task, and it'll be freed later
  883. * at exit time.
  884. *
  885. * This can block, so callers must hold no locks.
  886. */
  887. static inline int get_undo_list(struct sem_undo_list **undo_listp)
  888. {
  889. struct sem_undo_list *undo_list;
  890. undo_list = current->sysvsem.undo_list;
  891. if (!undo_list) {
  892. undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL);
  893. if (undo_list == NULL)
  894. return -ENOMEM;
  895. spin_lock_init(&undo_list->lock);
  896. atomic_set(&undo_list->refcnt, 1);
  897. current->sysvsem.undo_list = undo_list;
  898. }
  899. *undo_listp = undo_list;
  900. return 0;
  901. }
  902. static struct sem_undo *lookup_undo(struct sem_undo_list *ulp, int semid)
  903. {
  904. struct sem_undo **last, *un;
  905. last = &ulp->proc_list;
  906. un = *last;
  907. while(un != NULL) {
  908. if(un->semid==semid)
  909. break;
  910. if(un->semid==-1) {
  911. *last=un->proc_next;
  912. kfree(un);
  913. } else {
  914. last=&un->proc_next;
  915. }
  916. un=*last;
  917. }
  918. return un;
  919. }
  920. static struct sem_undo *find_undo(struct ipc_namespace *ns, int semid)
  921. {
  922. struct sem_array *sma;
  923. struct sem_undo_list *ulp;
  924. struct sem_undo *un, *new;
  925. int nsems;
  926. int error;
  927. error = get_undo_list(&ulp);
  928. if (error)
  929. return ERR_PTR(error);
  930. lock_semundo();
  931. un = lookup_undo(ulp, semid);
  932. unlock_semundo();
  933. if (likely(un!=NULL))
  934. goto out;
  935. /* no undo structure around - allocate one. */
  936. sma = sem_lock(ns, semid);
  937. un = ERR_PTR(-EINVAL);
  938. if(sma==NULL)
  939. goto out;
  940. un = ERR_PTR(-EIDRM);
  941. if (sem_checkid(ns,sma,semid)) {
  942. sem_unlock(sma);
  943. goto out;
  944. }
  945. nsems = sma->sem_nsems;
  946. ipc_rcu_getref(sma);
  947. sem_unlock(sma);
  948. new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
  949. if (!new) {
  950. ipc_lock_by_ptr(&sma->sem_perm);
  951. ipc_rcu_putref(sma);
  952. sem_unlock(sma);
  953. return ERR_PTR(-ENOMEM);
  954. }
  955. new->semadj = (short *) &new[1];
  956. new->semid = semid;
  957. lock_semundo();
  958. un = lookup_undo(ulp, semid);
  959. if (un) {
  960. unlock_semundo();
  961. kfree(new);
  962. ipc_lock_by_ptr(&sma->sem_perm);
  963. ipc_rcu_putref(sma);
  964. sem_unlock(sma);
  965. goto out;
  966. }
  967. ipc_lock_by_ptr(&sma->sem_perm);
  968. ipc_rcu_putref(sma);
  969. if (sma->sem_perm.deleted) {
  970. sem_unlock(sma);
  971. unlock_semundo();
  972. kfree(new);
  973. un = ERR_PTR(-EIDRM);
  974. goto out;
  975. }
  976. new->proc_next = ulp->proc_list;
  977. ulp->proc_list = new;
  978. new->id_next = sma->undo;
  979. sma->undo = new;
  980. sem_unlock(sma);
  981. un = new;
  982. unlock_semundo();
  983. out:
  984. return un;
  985. }
  986. asmlinkage long sys_semtimedop(int semid, struct sembuf __user *tsops,
  987. unsigned nsops, const struct timespec __user *timeout)
  988. {
  989. int error = -EINVAL;
  990. struct sem_array *sma;
  991. struct sembuf fast_sops[SEMOPM_FAST];
  992. struct sembuf* sops = fast_sops, *sop;
  993. struct sem_undo *un;
  994. int undos = 0, alter = 0, max;
  995. struct sem_queue queue;
  996. unsigned long jiffies_left = 0;
  997. struct ipc_namespace *ns;
  998. ns = current->nsproxy->ipc_ns;
  999. if (nsops < 1 || semid < 0)
  1000. return -EINVAL;
  1001. if (nsops > ns->sc_semopm)
  1002. return -E2BIG;
  1003. if(nsops > SEMOPM_FAST) {
  1004. sops = kmalloc(sizeof(*sops)*nsops,GFP_KERNEL);
  1005. if(sops==NULL)
  1006. return -ENOMEM;
  1007. }
  1008. if (copy_from_user (sops, tsops, nsops * sizeof(*tsops))) {
  1009. error=-EFAULT;
  1010. goto out_free;
  1011. }
  1012. if (timeout) {
  1013. struct timespec _timeout;
  1014. if (copy_from_user(&_timeout, timeout, sizeof(*timeout))) {
  1015. error = -EFAULT;
  1016. goto out_free;
  1017. }
  1018. if (_timeout.tv_sec < 0 || _timeout.tv_nsec < 0 ||
  1019. _timeout.tv_nsec >= 1000000000L) {
  1020. error = -EINVAL;
  1021. goto out_free;
  1022. }
  1023. jiffies_left = timespec_to_jiffies(&_timeout);
  1024. }
  1025. max = 0;
  1026. for (sop = sops; sop < sops + nsops; sop++) {
  1027. if (sop->sem_num >= max)
  1028. max = sop->sem_num;
  1029. if (sop->sem_flg & SEM_UNDO)
  1030. undos = 1;
  1031. if (sop->sem_op != 0)
  1032. alter = 1;
  1033. }
  1034. retry_undos:
  1035. if (undos) {
  1036. un = find_undo(ns, semid);
  1037. if (IS_ERR(un)) {
  1038. error = PTR_ERR(un);
  1039. goto out_free;
  1040. }
  1041. } else
  1042. un = NULL;
  1043. sma = sem_lock(ns, semid);
  1044. error=-EINVAL;
  1045. if(sma==NULL)
  1046. goto out_free;
  1047. error = -EIDRM;
  1048. if (sem_checkid(ns,sma,semid))
  1049. goto out_unlock_free;
  1050. /*
  1051. * semid identifies are not unique - find_undo may have
  1052. * allocated an undo structure, it was invalidated by an RMID
  1053. * and now a new array with received the same id. Check and retry.
  1054. */
  1055. if (un && un->semid == -1) {
  1056. sem_unlock(sma);
  1057. goto retry_undos;
  1058. }
  1059. error = -EFBIG;
  1060. if (max >= sma->sem_nsems)
  1061. goto out_unlock_free;
  1062. error = -EACCES;
  1063. if (ipcperms(&sma->sem_perm, alter ? S_IWUGO : S_IRUGO))
  1064. goto out_unlock_free;
  1065. error = security_sem_semop(sma, sops, nsops, alter);
  1066. if (error)
  1067. goto out_unlock_free;
  1068. error = try_atomic_semop (sma, sops, nsops, un, current->tgid);
  1069. if (error <= 0) {
  1070. if (alter && error == 0)
  1071. update_queue (sma);
  1072. goto out_unlock_free;
  1073. }
  1074. /* We need to sleep on this operation, so we put the current
  1075. * task into the pending queue and go to sleep.
  1076. */
  1077. queue.sma = sma;
  1078. queue.sops = sops;
  1079. queue.nsops = nsops;
  1080. queue.undo = un;
  1081. queue.pid = current->tgid;
  1082. queue.id = semid;
  1083. queue.alter = alter;
  1084. if (alter)
  1085. append_to_queue(sma ,&queue);
  1086. else
  1087. prepend_to_queue(sma ,&queue);
  1088. queue.status = -EINTR;
  1089. queue.sleeper = current;
  1090. current->state = TASK_INTERRUPTIBLE;
  1091. sem_unlock(sma);
  1092. if (timeout)
  1093. jiffies_left = schedule_timeout(jiffies_left);
  1094. else
  1095. schedule();
  1096. error = queue.status;
  1097. while(unlikely(error == IN_WAKEUP)) {
  1098. cpu_relax();
  1099. error = queue.status;
  1100. }
  1101. if (error != -EINTR) {
  1102. /* fast path: update_queue already obtained all requested
  1103. * resources */
  1104. goto out_free;
  1105. }
  1106. sma = sem_lock(ns, semid);
  1107. if(sma==NULL) {
  1108. BUG_ON(queue.prev != NULL);
  1109. error = -EIDRM;
  1110. goto out_free;
  1111. }
  1112. /*
  1113. * If queue.status != -EINTR we are woken up by another process
  1114. */
  1115. error = queue.status;
  1116. if (error != -EINTR) {
  1117. goto out_unlock_free;
  1118. }
  1119. /*
  1120. * If an interrupt occurred we have to clean up the queue
  1121. */
  1122. if (timeout && jiffies_left == 0)
  1123. error = -EAGAIN;
  1124. remove_from_queue(sma,&queue);
  1125. goto out_unlock_free;
  1126. out_unlock_free:
  1127. sem_unlock(sma);
  1128. out_free:
  1129. if(sops != fast_sops)
  1130. kfree(sops);
  1131. return error;
  1132. }
  1133. asmlinkage long sys_semop (int semid, struct sembuf __user *tsops, unsigned nsops)
  1134. {
  1135. return sys_semtimedop(semid, tsops, nsops, NULL);
  1136. }
  1137. /* If CLONE_SYSVSEM is set, establish sharing of SEM_UNDO state between
  1138. * parent and child tasks.
  1139. *
  1140. * See the notes above unlock_semundo() regarding the spin_lock_init()
  1141. * in this code. Initialize the undo_list->lock here instead of get_undo_list()
  1142. * because of the reasoning in the comment above unlock_semundo.
  1143. */
  1144. int copy_semundo(unsigned long clone_flags, struct task_struct *tsk)
  1145. {
  1146. struct sem_undo_list *undo_list;
  1147. int error;
  1148. if (clone_flags & CLONE_SYSVSEM) {
  1149. error = get_undo_list(&undo_list);
  1150. if (error)
  1151. return error;
  1152. atomic_inc(&undo_list->refcnt);
  1153. tsk->sysvsem.undo_list = undo_list;
  1154. } else
  1155. tsk->sysvsem.undo_list = NULL;
  1156. return 0;
  1157. }
  1158. /*
  1159. * add semadj values to semaphores, free undo structures.
  1160. * undo structures are not freed when semaphore arrays are destroyed
  1161. * so some of them may be out of date.
  1162. * IMPLEMENTATION NOTE: There is some confusion over whether the
  1163. * set of adjustments that needs to be done should be done in an atomic
  1164. * manner or not. That is, if we are attempting to decrement the semval
  1165. * should we queue up and wait until we can do so legally?
  1166. * The original implementation attempted to do this (queue and wait).
  1167. * The current implementation does not do so. The POSIX standard
  1168. * and SVID should be consulted to determine what behavior is mandated.
  1169. */
  1170. void exit_sem(struct task_struct *tsk)
  1171. {
  1172. struct sem_undo_list *undo_list;
  1173. struct sem_undo *u, **up;
  1174. struct ipc_namespace *ns;
  1175. undo_list = tsk->sysvsem.undo_list;
  1176. if (!undo_list)
  1177. return;
  1178. if (!atomic_dec_and_test(&undo_list->refcnt))
  1179. return;
  1180. ns = tsk->nsproxy->ipc_ns;
  1181. /* There's no need to hold the semundo list lock, as current
  1182. * is the last task exiting for this undo list.
  1183. */
  1184. for (up = &undo_list->proc_list; (u = *up); *up = u->proc_next, kfree(u)) {
  1185. struct sem_array *sma;
  1186. int nsems, i;
  1187. struct sem_undo *un, **unp;
  1188. int semid;
  1189. semid = u->semid;
  1190. if(semid == -1)
  1191. continue;
  1192. sma = sem_lock(ns, semid);
  1193. if (sma == NULL)
  1194. continue;
  1195. if (u->semid == -1)
  1196. goto next_entry;
  1197. BUG_ON(sem_checkid(ns,sma,u->semid));
  1198. /* remove u from the sma->undo list */
  1199. for (unp = &sma->undo; (un = *unp); unp = &un->id_next) {
  1200. if (u == un)
  1201. goto found;
  1202. }
  1203. printk ("exit_sem undo list error id=%d\n", u->semid);
  1204. goto next_entry;
  1205. found:
  1206. *unp = un->id_next;
  1207. /* perform adjustments registered in u */
  1208. nsems = sma->sem_nsems;
  1209. for (i = 0; i < nsems; i++) {
  1210. struct sem * semaphore = &sma->sem_base[i];
  1211. if (u->semadj[i]) {
  1212. semaphore->semval += u->semadj[i];
  1213. /*
  1214. * Range checks of the new semaphore value,
  1215. * not defined by sus:
  1216. * - Some unices ignore the undo entirely
  1217. * (e.g. HP UX 11i 11.22, Tru64 V5.1)
  1218. * - some cap the value (e.g. FreeBSD caps
  1219. * at 0, but doesn't enforce SEMVMX)
  1220. *
  1221. * Linux caps the semaphore value, both at 0
  1222. * and at SEMVMX.
  1223. *
  1224. * Manfred <manfred@colorfullife.com>
  1225. */
  1226. if (semaphore->semval < 0)
  1227. semaphore->semval = 0;
  1228. if (semaphore->semval > SEMVMX)
  1229. semaphore->semval = SEMVMX;
  1230. semaphore->sempid = current->tgid;
  1231. }
  1232. }
  1233. sma->sem_otime = get_seconds();
  1234. /* maybe some queued-up processes were waiting for this */
  1235. update_queue(sma);
  1236. next_entry:
  1237. sem_unlock(sma);
  1238. }
  1239. kfree(undo_list);
  1240. }
  1241. #ifdef CONFIG_PROC_FS
  1242. static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
  1243. {
  1244. struct sem_array *sma = it;
  1245. return seq_printf(s,
  1246. "%10d %10d %4o %10lu %5u %5u %5u %5u %10lu %10lu\n",
  1247. sma->sem_perm.key,
  1248. sma->sem_id,
  1249. sma->sem_perm.mode,
  1250. sma->sem_nsems,
  1251. sma->sem_perm.uid,
  1252. sma->sem_perm.gid,
  1253. sma->sem_perm.cuid,
  1254. sma->sem_perm.cgid,
  1255. sma->sem_otime,
  1256. sma->sem_ctime);
  1257. }
  1258. #endif