blob: dbef95b1594122c2a6276d504d206805d39879f7 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * linux/ipc/sem.c
3 * Copyright (C) 1992 Krishna Balasubramanian
4 * Copyright (C) 1995 Eric Schenk, Bruno Haible
5 *
6 * IMPLEMENTATION NOTES ON CODE REWRITE (Eric Schenk, January 1995):
7 * This code underwent a massive rewrite in order to solve some problems
8 * with the original code. In particular the original code failed to
9 * wake up processes that were waiting for semval to go to 0 if the
10 * value went to 0 and was then incremented rapidly enough. In solving
11 * this problem I have also modified the implementation so that it
12 * processes pending operations in a FIFO manner, thus give a guarantee
13 * that processes waiting for a lock on the semaphore won't starve
14 * unless another locking process fails to unlock.
15 * In addition the following two changes in behavior have been introduced:
16 * - The original implementation of semop returned the value
17 * last semaphore element examined on success. This does not
18 * match the manual page specifications, and effectively
19 * allows the user to read the semaphore even if they do not
20 * have read permissions. The implementation now returns 0
21 * on success as stated in the manual page.
22 * - There is some confusion over whether the set of undo adjustments
23 * to be performed at exit should be done in an atomic manner.
24 * That is, if we are attempting to decrement the semval should we queue
25 * up and wait until we can do so legally?
26 * The original implementation attempted to do this.
27 * The current implementation does not do so. This is because I don't
28 * think it is the right thing (TM) to do, and because I couldn't
29 * see a clean way to get the old behavior with the new design.
30 * The POSIX standard and SVID should be consulted to determine
31 * what behavior is mandated.
32 *
33 * Further notes on refinement (Christoph Rohland, December 1998):
34 * - The POSIX standard says, that the undo adjustments simply should
35 * redo. So the current implementation is o.K.
36 * - The previous code had two flaws:
37 * 1) It actively gave the semaphore to the next waiting process
38 * sleeping on the semaphore. Since this process did not have the
39 * cpu this led to many unnecessary context switches and bad
40 * performance. Now we only check which process should be able to
41 * get the semaphore and if this process wants to reduce some
42 * semaphore value we simply wake it up without doing the
43 * operation. So it has to try to get it later. Thus e.g. the
44 * running process may reacquire the semaphore during the current
45 * time slice. If it only waits for zero or increases the semaphore,
46 * we do the operation in advance and wake it up.
47 * 2) It did not wake up all zero waiting processes. We try to do
48 * better but only get the semops right which only wait for zero or
49 * increase. If there are decrement operations in the operations
50 * array we do the same as before.
51 *
52 * With the incarnation of O(1) scheduler, it becomes unnecessary to perform
53 * check/retry algorithm for waking up blocked processes as the new scheduler
54 * is better at handling thread switch than the old one.
55 *
56 * /proc/sysvipc/sem support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
57 *
58 * SMP-threaded, sysctl's added
Christian Kujau624dffc2006-01-15 02:43:54 +010059 * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070060 * Enforced range limit on SEM_UNDO
Alan Cox046c6882009-01-05 14:06:29 +000061 * (c) 2001 Red Hat Inc
Linus Torvalds1da177e2005-04-16 15:20:36 -070062 * Lockless wakeup
63 * (c) 2003 Manfred Spraul <manfred@colorfullife.com>
Steve Grubb073115d2006-04-02 17:07:33 -040064 *
65 * support for audit of ipc object properties and permission changes
66 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
Kirill Korotaeve3893532006-10-02 02:18:22 -070067 *
68 * namespaces support
69 * OpenVZ, SWsoft Inc.
70 * Pavel Emelianov <xemul@openvz.org>
Linus Torvalds1da177e2005-04-16 15:20:36 -070071 */
72
Linus Torvalds1da177e2005-04-16 15:20:36 -070073#include <linux/slab.h>
74#include <linux/spinlock.h>
75#include <linux/init.h>
76#include <linux/proc_fs.h>
77#include <linux/time.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070078#include <linux/security.h>
79#include <linux/syscalls.h>
80#include <linux/audit.h>
Randy.Dunlapc59ede72006-01-11 12:17:46 -080081#include <linux/capability.h>
Mike Waychison19b49462005-09-06 15:17:10 -070082#include <linux/seq_file.h>
Nadia Derbey3e148c72007-10-18 23:40:54 -070083#include <linux/rwsem.h>
Kirill Korotaeve3893532006-10-02 02:18:22 -070084#include <linux/nsproxy.h>
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080085#include <linux/ipc_namespace.h>
Ingo Molnar5f921ae2006-03-26 01:37:17 -080086
Linus Torvalds1da177e2005-04-16 15:20:36 -070087#include <asm/uaccess.h>
88#include "util.h"
89
Pierre Peiffered2ddbf2008-02-08 04:18:57 -080090#define sem_ids(ns) ((ns)->ids[IPC_SEM_IDS])
Linus Torvalds1da177e2005-04-16 15:20:36 -070091
Kirill Korotaeve3893532006-10-02 02:18:22 -070092#define sem_unlock(sma) ipc_unlock(&(sma)->sem_perm)
Nadia Derbey1b531f22007-10-18 23:40:55 -070093#define sem_checkid(sma, semid) ipc_checkid(&sma->sem_perm, semid)
Linus Torvalds1da177e2005-04-16 15:20:36 -070094
Nadia Derbey7748dbf2007-10-18 23:40:49 -070095static int newary(struct ipc_namespace *, struct ipc_params *);
Pierre Peiffer01b8b072008-02-08 04:18:57 -080096static void freeary(struct ipc_namespace *, struct kern_ipc_perm *);
Linus Torvalds1da177e2005-04-16 15:20:36 -070097#ifdef CONFIG_PROC_FS
Mike Waychison19b49462005-09-06 15:17:10 -070098static int sysvipc_sem_proc_show(struct seq_file *s, void *it);
Linus Torvalds1da177e2005-04-16 15:20:36 -070099#endif
100
101#define SEMMSL_FAST 256 /* 512 bytes on stack */
102#define SEMOPM_FAST 64 /* ~ 372 bytes on stack */
103
104/*
105 * linked list protection:
106 * sem_undo.id_next,
107 * sem_array.sem_pending{,last},
108 * sem_array.sem_undo: sem_lock() for read/write
109 * sem_undo.proc_next: only "current" is allowed to read/write that field.
110 *
111 */
112
Kirill Korotaeve3893532006-10-02 02:18:22 -0700113#define sc_semmsl sem_ctls[0]
114#define sc_semmns sem_ctls[1]
115#define sc_semopm sem_ctls[2]
116#define sc_semmni sem_ctls[3]
Linus Torvalds1da177e2005-04-16 15:20:36 -0700117
Pierre Peiffered2ddbf2008-02-08 04:18:57 -0800118void sem_init_ns(struct ipc_namespace *ns)
Kirill Korotaeve3893532006-10-02 02:18:22 -0700119{
Kirill Korotaeve3893532006-10-02 02:18:22 -0700120 ns->sc_semmsl = SEMMSL;
121 ns->sc_semmns = SEMMNS;
122 ns->sc_semopm = SEMOPM;
123 ns->sc_semmni = SEMMNI;
124 ns->used_sems = 0;
Pierre Peiffered2ddbf2008-02-08 04:18:57 -0800125 ipc_init_ids(&ns->ids[IPC_SEM_IDS]);
Kirill Korotaeve3893532006-10-02 02:18:22 -0700126}
127
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -0800128#ifdef CONFIG_IPC_NS
Kirill Korotaeve3893532006-10-02 02:18:22 -0700129void sem_exit_ns(struct ipc_namespace *ns)
130{
Pierre Peiffer01b8b072008-02-08 04:18:57 -0800131 free_ipcs(ns, &sem_ids(ns), freeary);
Serge E. Hallyn7d6feeb2009-12-15 16:47:27 -0800132 idr_destroy(&ns->ids[IPC_SEM_IDS].ipcs_idr);
Kirill Korotaeve3893532006-10-02 02:18:22 -0700133}
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -0800134#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -0700135
136void __init sem_init (void)
137{
Pierre Peiffered2ddbf2008-02-08 04:18:57 -0800138 sem_init_ns(&init_ipc_ns);
Mike Waychison19b49462005-09-06 15:17:10 -0700139 ipc_init_proc_interface("sysvipc/sem",
140 " key semid perms nsems uid gid cuid cgid otime ctime\n",
Kirill Korotaeve3893532006-10-02 02:18:22 -0700141 IPC_SEM_IDS, sysvipc_sem_proc_show);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700142}
143
Nadia Derbey3e148c72007-10-18 23:40:54 -0700144/*
Nadia Derbey3e148c72007-10-18 23:40:54 -0700145 * sem_lock_(check_) routines are called in the paths where the rw_mutex
146 * is not held.
147 */
Nadia Derbey023a5352007-10-18 23:40:51 -0700148static inline struct sem_array *sem_lock(struct ipc_namespace *ns, int id)
149{
Nadia Derbey03f02c72007-10-18 23:40:51 -0700150 struct kern_ipc_perm *ipcp = ipc_lock(&sem_ids(ns), id);
151
Pierre Peifferb1ed88b2008-02-06 01:36:23 -0800152 if (IS_ERR(ipcp))
153 return (struct sem_array *)ipcp;
154
Nadia Derbey03f02c72007-10-18 23:40:51 -0700155 return container_of(ipcp, struct sem_array, sem_perm);
Nadia Derbey023a5352007-10-18 23:40:51 -0700156}
157
158static inline struct sem_array *sem_lock_check(struct ipc_namespace *ns,
159 int id)
160{
Nadia Derbey03f02c72007-10-18 23:40:51 -0700161 struct kern_ipc_perm *ipcp = ipc_lock_check(&sem_ids(ns), id);
162
Pierre Peifferb1ed88b2008-02-06 01:36:23 -0800163 if (IS_ERR(ipcp))
164 return (struct sem_array *)ipcp;
165
Nadia Derbey03f02c72007-10-18 23:40:51 -0700166 return container_of(ipcp, struct sem_array, sem_perm);
Nadia Derbey023a5352007-10-18 23:40:51 -0700167}
168
Pierre Peiffer6ff37972008-04-29 01:00:46 -0700169static inline void sem_lock_and_putref(struct sem_array *sma)
170{
171 ipc_lock_by_ptr(&sma->sem_perm);
172 ipc_rcu_putref(sma);
173}
174
175static inline void sem_getref_and_unlock(struct sem_array *sma)
176{
177 ipc_rcu_getref(sma);
178 ipc_unlock(&(sma)->sem_perm);
179}
180
181static inline void sem_putref(struct sem_array *sma)
182{
183 ipc_lock_by_ptr(&sma->sem_perm);
184 ipc_rcu_putref(sma);
185 ipc_unlock(&(sma)->sem_perm);
186}
187
Nadia Derbey7ca7e562007-10-18 23:40:48 -0700188static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s)
189{
190 ipc_rmid(&sem_ids(ns), &s->sem_perm);
191}
192
Linus Torvalds1da177e2005-04-16 15:20:36 -0700193/*
194 * Lockless wakeup algorithm:
195 * Without the check/retry algorithm a lockless wakeup is possible:
196 * - queue.status is initialized to -EINTR before blocking.
197 * - wakeup is performed by
198 * * unlinking the queue entry from sma->sem_pending
199 * * setting queue.status to IN_WAKEUP
200 * This is the notification for the blocked thread that a
201 * result value is imminent.
202 * * call wake_up_process
203 * * set queue.status to the final value.
204 * - the previously blocked thread checks queue.status:
205 * * if it's IN_WAKEUP, then it must wait until the value changes
206 * * if it's not -EINTR, then the operation was completed by
207 * update_queue. semtimedop can return queue.status without
Ingo Molnar5f921ae2006-03-26 01:37:17 -0800208 * performing any operation on the sem array.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700209 * * otherwise it must acquire the spinlock and check what's up.
210 *
211 * The two-stage algorithm is necessary to protect against the following
212 * races:
213 * - if queue.status is set after wake_up_process, then the woken up idle
214 * thread could race forward and try (and fail) to acquire sma->lock
215 * before update_queue had a chance to set queue.status
216 * - if queue.status is written before wake_up_process and if the
217 * blocked process is woken up by a signal between writing
218 * queue.status and the wake_up_process, then the woken up
219 * process could return from semtimedop and die by calling
220 * sys_exit before wake_up_process is called. Then wake_up_process
221 * will oops, because the task structure is already invalid.
222 * (yes, this happened on s390 with sysv msg).
223 *
224 */
225#define IN_WAKEUP 1
226
Nadia Derbeyf4566f02007-10-18 23:40:53 -0700227/**
228 * newary - Create a new semaphore set
229 * @ns: namespace
230 * @params: ptr to the structure that contains key, semflg and nsems
231 *
Nadia Derbey3e148c72007-10-18 23:40:54 -0700232 * Called with sem_ids.rw_mutex held (as a writer)
Nadia Derbeyf4566f02007-10-18 23:40:53 -0700233 */
234
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700235static int newary(struct ipc_namespace *ns, struct ipc_params *params)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700236{
237 int id;
238 int retval;
239 struct sem_array *sma;
240 int size;
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700241 key_t key = params->key;
242 int nsems = params->u.nsems;
243 int semflg = params->flg;
Manfred Spraulb97e8202009-12-15 16:47:32 -0800244 int i;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700245
246 if (!nsems)
247 return -EINVAL;
Kirill Korotaeve3893532006-10-02 02:18:22 -0700248 if (ns->used_sems + nsems > ns->sc_semmns)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700249 return -ENOSPC;
250
251 size = sizeof (*sma) + nsems * sizeof (struct sem);
252 sma = ipc_rcu_alloc(size);
253 if (!sma) {
254 return -ENOMEM;
255 }
256 memset (sma, 0, size);
257
258 sma->sem_perm.mode = (semflg & S_IRWXUGO);
259 sma->sem_perm.key = key;
260
261 sma->sem_perm.security = NULL;
262 retval = security_sem_alloc(sma);
263 if (retval) {
264 ipc_rcu_putref(sma);
265 return retval;
266 }
267
Kirill Korotaeve3893532006-10-02 02:18:22 -0700268 id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
Pierre Peiffer283bb7f2007-10-18 23:40:57 -0700269 if (id < 0) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700270 security_sem_free(sma);
271 ipc_rcu_putref(sma);
Pierre Peiffer283bb7f2007-10-18 23:40:57 -0700272 return id;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700273 }
Kirill Korotaeve3893532006-10-02 02:18:22 -0700274 ns->used_sems += nsems;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700275
276 sma->sem_base = (struct sem *) &sma[1];
Manfred Spraulb97e8202009-12-15 16:47:32 -0800277
278 for (i = 0; i < nsems; i++)
279 INIT_LIST_HEAD(&sma->sem_base[i].sem_pending);
280
281 sma->complex_count = 0;
Manfred Spraula1193f82008-07-25 01:48:06 -0700282 INIT_LIST_HEAD(&sma->sem_pending);
Manfred Spraul4daa28f2008-07-25 01:48:04 -0700283 INIT_LIST_HEAD(&sma->list_id);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700284 sma->sem_nsems = nsems;
285 sma->sem_ctime = get_seconds();
286 sem_unlock(sma);
287
Nadia Derbey7ca7e562007-10-18 23:40:48 -0700288 return sma->sem_perm.id;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700289}
290
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700291
Nadia Derbeyf4566f02007-10-18 23:40:53 -0700292/*
Nadia Derbey3e148c72007-10-18 23:40:54 -0700293 * Called with sem_ids.rw_mutex and ipcp locked.
Nadia Derbeyf4566f02007-10-18 23:40:53 -0700294 */
Nadia Derbey03f02c72007-10-18 23:40:51 -0700295static inline int sem_security(struct kern_ipc_perm *ipcp, int semflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700296{
Nadia Derbey03f02c72007-10-18 23:40:51 -0700297 struct sem_array *sma;
298
299 sma = container_of(ipcp, struct sem_array, sem_perm);
300 return security_sem_associate(sma, semflg);
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700301}
302
Nadia Derbeyf4566f02007-10-18 23:40:53 -0700303/*
Nadia Derbey3e148c72007-10-18 23:40:54 -0700304 * Called with sem_ids.rw_mutex and ipcp locked.
Nadia Derbeyf4566f02007-10-18 23:40:53 -0700305 */
Nadia Derbey03f02c72007-10-18 23:40:51 -0700306static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
307 struct ipc_params *params)
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700308{
Nadia Derbey03f02c72007-10-18 23:40:51 -0700309 struct sem_array *sma;
310
311 sma = container_of(ipcp, struct sem_array, sem_perm);
312 if (params->u.nsems > sma->sem_nsems)
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700313 return -EINVAL;
314
315 return 0;
316}
317
Heiko Carstensd5460c92009-01-14 14:14:27 +0100318SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700319{
Kirill Korotaeve3893532006-10-02 02:18:22 -0700320 struct ipc_namespace *ns;
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700321 struct ipc_ops sem_ops;
322 struct ipc_params sem_params;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700323
Kirill Korotaeve3893532006-10-02 02:18:22 -0700324 ns = current->nsproxy->ipc_ns;
325
326 if (nsems < 0 || nsems > ns->sc_semmsl)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700327 return -EINVAL;
Nadia Derbey7ca7e562007-10-18 23:40:48 -0700328
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700329 sem_ops.getnew = newary;
330 sem_ops.associate = sem_security;
331 sem_ops.more_checks = sem_more_checks;
Nadia Derbey7ca7e562007-10-18 23:40:48 -0700332
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700333 sem_params.key = key;
334 sem_params.flg = semflg;
335 sem_params.u.nsems = nsems;
Nadia Derbey7ca7e562007-10-18 23:40:48 -0700336
Nadia Derbey7748dbf2007-10-18 23:40:49 -0700337 return ipcget(ns, &sem_ids(ns), &sem_ops, &sem_params);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700338}
339
Linus Torvalds1da177e2005-04-16 15:20:36 -0700340/*
341 * Determine whether a sequence of semaphore operations would succeed
342 * all at once. Return 0 if yes, 1 if need to sleep, else return error code.
343 */
344
345static int try_atomic_semop (struct sem_array * sma, struct sembuf * sops,
346 int nsops, struct sem_undo *un, int pid)
347{
348 int result, sem_op;
349 struct sembuf *sop;
350 struct sem * curr;
351
352 for (sop = sops; sop < sops + nsops; sop++) {
353 curr = sma->sem_base + sop->sem_num;
354 sem_op = sop->sem_op;
355 result = curr->semval;
356
357 if (!sem_op && result)
358 goto would_block;
359
360 result += sem_op;
361 if (result < 0)
362 goto would_block;
363 if (result > SEMVMX)
364 goto out_of_range;
365 if (sop->sem_flg & SEM_UNDO) {
366 int undo = un->semadj[sop->sem_num] - sem_op;
367 /*
368 * Exceeding the undo range is an error.
369 */
370 if (undo < (-SEMAEM - 1) || undo > SEMAEM)
371 goto out_of_range;
372 }
373 curr->semval = result;
374 }
375
376 sop--;
377 while (sop >= sops) {
378 sma->sem_base[sop->sem_num].sempid = pid;
379 if (sop->sem_flg & SEM_UNDO)
380 un->semadj[sop->sem_num] -= sop->sem_op;
381 sop--;
382 }
383
384 sma->sem_otime = get_seconds();
385 return 0;
386
387out_of_range:
388 result = -ERANGE;
389 goto undo;
390
391would_block:
392 if (sop->sem_flg & IPC_NOWAIT)
393 result = -EAGAIN;
394 else
395 result = 1;
396
397undo:
398 sop--;
399 while (sop >= sops) {
400 sma->sem_base[sop->sem_num].semval -= sop->sem_op;
401 sop--;
402 }
403
404 return result;
405}
406
Nick Piggind4212092009-12-15 16:47:30 -0800407/*
408 * Wake up a process waiting on the sem queue with a given error.
409 * The queue is invalid (may not be accessed) after the function returns.
410 */
411static void wake_up_sem_queue(struct sem_queue *q, int error)
412{
413 /*
414 * Hold preempt off so that we don't get preempted and have the
415 * wakee busy-wait until we're scheduled back on. We're holding
416 * locks here so it may not strictly be needed, however if the
417 * locks become preemptible then this prevents such a problem.
418 */
419 preempt_disable();
420 q->status = IN_WAKEUP;
421 wake_up_process(q->sleeper);
422 /* hands-off: q can disappear immediately after writing q->status. */
423 smp_wmb();
424 q->status = error;
425 preempt_enable();
426}
427
Manfred Spraulb97e8202009-12-15 16:47:32 -0800428static void unlink_queue(struct sem_array *sma, struct sem_queue *q)
429{
430 list_del(&q->list);
431 if (q->nsops == 1)
432 list_del(&q->simple_list);
433 else
434 sma->complex_count--;
435}
436
Manfred Spraul636c6be2009-12-15 16:47:33 -0800437
438/**
439 * update_queue(sma, semnum): Look for tasks that can be completed.
440 * @sma: semaphore array.
441 * @semnum: semaphore that was modified.
442 *
443 * update_queue must be called after a semaphore in a semaphore array
444 * was modified. If multiple semaphore were modified, then @semnum
445 * must be set to -1.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700446 */
Manfred Spraul636c6be2009-12-15 16:47:33 -0800447static void update_queue(struct sem_array *sma, int semnum)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700448{
Manfred Spraul636c6be2009-12-15 16:47:33 -0800449 struct sem_queue *q;
450 struct list_head *walk;
451 struct list_head *pending_list;
452 int offset;
453
454 /* if there are complex operations around, then knowing the semaphore
455 * that was modified doesn't help us. Assume that multiple semaphores
456 * were modified.
457 */
458 if (sma->complex_count)
459 semnum = -1;
460
461 if (semnum == -1) {
462 pending_list = &sma->sem_pending;
463 offset = offsetof(struct sem_queue, list);
464 } else {
465 pending_list = &sma->sem_base[semnum].sem_pending;
466 offset = offsetof(struct sem_queue, simple_list);
467 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700468
Nick Piggin9cad2002009-12-15 16:47:29 -0800469again:
Manfred Spraul636c6be2009-12-15 16:47:33 -0800470 walk = pending_list->next;
471 while (walk != pending_list) {
472 int error, alter;
473
474 q = (struct sem_queue *)((char *)walk - offset);
475 walk = walk->next;
Nick Piggin9cad2002009-12-15 16:47:29 -0800476
Manfred Sprauld987f8b22009-12-15 16:47:34 -0800477 /* If we are scanning the single sop, per-semaphore list of
478 * one semaphore and that semaphore is 0, then it is not
479 * necessary to scan the "alter" entries: simple increments
480 * that affect only one entry succeed immediately and cannot
481 * be in the per semaphore pending queue, and decrements
482 * cannot be successful if the value is already 0.
483 */
484 if (semnum != -1 && sma->sem_base[semnum].semval == 0 &&
485 q->alter)
486 break;
487
Linus Torvalds1da177e2005-04-16 15:20:36 -0700488 error = try_atomic_semop(sma, q->sops, q->nsops,
489 q->undo, q->pid);
490
491 /* Does q->sleeper still need to sleep? */
Nick Piggin9cad2002009-12-15 16:47:29 -0800492 if (error > 0)
493 continue;
Manfred Spraula1193f82008-07-25 01:48:06 -0700494
Manfred Spraulb97e8202009-12-15 16:47:32 -0800495 unlink_queue(sma, q);
Manfred Spraula1193f82008-07-25 01:48:06 -0700496
Nick Piggin9cad2002009-12-15 16:47:29 -0800497 /*
498 * The next operation that must be checked depends on the type
499 * of the completed operation:
500 * - if the operation modified the array, then restart from the
501 * head of the queue and check for threads that might be
Manfred Spraulb6e90822009-12-15 16:47:31 -0800502 * waiting for the new semaphore values.
Nick Piggin9cad2002009-12-15 16:47:29 -0800503 * - if the operation didn't modify the array, then just
504 * continue.
505 */
506 alter = q->alter;
Nick Piggind4212092009-12-15 16:47:30 -0800507 wake_up_sem_queue(q, error);
Manfred Spraulb6e90822009-12-15 16:47:31 -0800508 if (alter && !error)
Nick Piggin9cad2002009-12-15 16:47:29 -0800509 goto again;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700510 }
511}
512
513/* The following counts are associated to each semaphore:
514 * semncnt number of tasks waiting on semval being nonzero
515 * semzcnt number of tasks waiting on semval being zero
516 * This model assumes that a task waits on exactly one semaphore.
517 * Since semaphore operations are to be performed atomically, tasks actually
518 * wait on a whole sequence of semaphores simultaneously.
519 * The counts we return here are a rough approximation, but still
520 * warrant that semncnt+semzcnt>0 if the task is on the pending queue.
521 */
522static int count_semncnt (struct sem_array * sma, ushort semnum)
523{
524 int semncnt;
525 struct sem_queue * q;
526
527 semncnt = 0;
Manfred Spraula1193f82008-07-25 01:48:06 -0700528 list_for_each_entry(q, &sma->sem_pending, list) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700529 struct sembuf * sops = q->sops;
530 int nsops = q->nsops;
531 int i;
532 for (i = 0; i < nsops; i++)
533 if (sops[i].sem_num == semnum
534 && (sops[i].sem_op < 0)
535 && !(sops[i].sem_flg & IPC_NOWAIT))
536 semncnt++;
537 }
538 return semncnt;
539}
Manfred Spraula1193f82008-07-25 01:48:06 -0700540
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541static int count_semzcnt (struct sem_array * sma, ushort semnum)
542{
543 int semzcnt;
544 struct sem_queue * q;
545
546 semzcnt = 0;
Manfred Spraula1193f82008-07-25 01:48:06 -0700547 list_for_each_entry(q, &sma->sem_pending, list) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700548 struct sembuf * sops = q->sops;
549 int nsops = q->nsops;
550 int i;
551 for (i = 0; i < nsops; i++)
552 if (sops[i].sem_num == semnum
553 && (sops[i].sem_op == 0)
554 && !(sops[i].sem_flg & IPC_NOWAIT))
555 semzcnt++;
556 }
557 return semzcnt;
558}
559
Adrian Bunk6d97e2342008-10-15 22:05:16 -0700560static void free_un(struct rcu_head *head)
Manfred Spraul380af1b2008-07-25 01:48:06 -0700561{
562 struct sem_undo *un = container_of(head, struct sem_undo, rcu);
563 kfree(un);
564}
565
Nadia Derbey3e148c72007-10-18 23:40:54 -0700566/* Free a semaphore set. freeary() is called with sem_ids.rw_mutex locked
567 * as a writer and the spinlock for this semaphore set hold. sem_ids.rw_mutex
568 * remains locked on exit.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700569 */
Pierre Peiffer01b8b072008-02-08 04:18:57 -0800570static void freeary(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700571{
Manfred Spraul380af1b2008-07-25 01:48:06 -0700572 struct sem_undo *un, *tu;
573 struct sem_queue *q, *tq;
Pierre Peiffer01b8b072008-02-08 04:18:57 -0800574 struct sem_array *sma = container_of(ipcp, struct sem_array, sem_perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700575
Manfred Spraul380af1b2008-07-25 01:48:06 -0700576 /* Free the existing undo structures for this semaphore set. */
Manfred Spraul4daa28f2008-07-25 01:48:04 -0700577 assert_spin_locked(&sma->sem_perm.lock);
Manfred Spraul380af1b2008-07-25 01:48:06 -0700578 list_for_each_entry_safe(un, tu, &sma->list_id, list_id) {
579 list_del(&un->list_id);
580 spin_lock(&un->ulp->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700581 un->semid = -1;
Manfred Spraul380af1b2008-07-25 01:48:06 -0700582 list_del_rcu(&un->list_proc);
583 spin_unlock(&un->ulp->lock);
584 call_rcu(&un->rcu, free_un);
585 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700586
587 /* Wake up all pending processes and let them fail with EIDRM. */
Manfred Spraul380af1b2008-07-25 01:48:06 -0700588 list_for_each_entry_safe(q, tq, &sma->sem_pending, list) {
Manfred Spraulb97e8202009-12-15 16:47:32 -0800589 unlink_queue(sma, q);
Nick Piggind4212092009-12-15 16:47:30 -0800590 wake_up_sem_queue(q, -EIDRM);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700591 }
592
Nadia Derbey7ca7e562007-10-18 23:40:48 -0700593 /* Remove the semaphore set from the IDR */
594 sem_rmid(ns, sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700595 sem_unlock(sma);
596
Kirill Korotaeve3893532006-10-02 02:18:22 -0700597 ns->used_sems -= sma->sem_nsems;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700598 security_sem_free(sma);
599 ipc_rcu_putref(sma);
600}
601
602static unsigned long copy_semid_to_user(void __user *buf, struct semid64_ds *in, int version)
603{
604 switch(version) {
605 case IPC_64:
606 return copy_to_user(buf, in, sizeof(*in));
607 case IPC_OLD:
608 {
609 struct semid_ds out;
610
611 ipc64_perm_to_ipc_perm(&in->sem_perm, &out.sem_perm);
612
613 out.sem_otime = in->sem_otime;
614 out.sem_ctime = in->sem_ctime;
615 out.sem_nsems = in->sem_nsems;
616
617 return copy_to_user(buf, &out, sizeof(out));
618 }
619 default:
620 return -EINVAL;
621 }
622}
623
Pierre Peiffer4b9fcb02008-02-08 04:18:56 -0800624static int semctl_nolock(struct ipc_namespace *ns, int semid,
625 int cmd, int version, union semun arg)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700626{
Amerigo Wange5cc9c72009-12-15 16:47:35 -0800627 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700628 struct sem_array *sma;
629
630 switch(cmd) {
631 case IPC_INFO:
632 case SEM_INFO:
633 {
634 struct seminfo seminfo;
635 int max_id;
636
637 err = security_sem_semctl(NULL, cmd);
638 if (err)
639 return err;
640
641 memset(&seminfo,0,sizeof(seminfo));
Kirill Korotaeve3893532006-10-02 02:18:22 -0700642 seminfo.semmni = ns->sc_semmni;
643 seminfo.semmns = ns->sc_semmns;
644 seminfo.semmsl = ns->sc_semmsl;
645 seminfo.semopm = ns->sc_semopm;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700646 seminfo.semvmx = SEMVMX;
647 seminfo.semmnu = SEMMNU;
648 seminfo.semmap = SEMMAP;
649 seminfo.semume = SEMUME;
Nadia Derbey3e148c72007-10-18 23:40:54 -0700650 down_read(&sem_ids(ns).rw_mutex);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700651 if (cmd == SEM_INFO) {
Kirill Korotaeve3893532006-10-02 02:18:22 -0700652 seminfo.semusz = sem_ids(ns).in_use;
653 seminfo.semaem = ns->used_sems;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700654 } else {
655 seminfo.semusz = SEMUSZ;
656 seminfo.semaem = SEMAEM;
657 }
Nadia Derbey7ca7e562007-10-18 23:40:48 -0700658 max_id = ipc_get_maxid(&sem_ids(ns));
Nadia Derbey3e148c72007-10-18 23:40:54 -0700659 up_read(&sem_ids(ns).rw_mutex);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700660 if (copy_to_user (arg.__buf, &seminfo, sizeof(struct seminfo)))
661 return -EFAULT;
662 return (max_id < 0) ? 0: max_id;
663 }
Pierre Peiffer4b9fcb02008-02-08 04:18:56 -0800664 case IPC_STAT:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700665 case SEM_STAT:
666 {
667 struct semid64_ds tbuf;
668 int id;
669
Pierre Peiffer4b9fcb02008-02-08 04:18:56 -0800670 if (cmd == SEM_STAT) {
671 sma = sem_lock(ns, semid);
672 if (IS_ERR(sma))
673 return PTR_ERR(sma);
674 id = sma->sem_perm.id;
675 } else {
676 sma = sem_lock_check(ns, semid);
677 if (IS_ERR(sma))
678 return PTR_ERR(sma);
679 id = 0;
680 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700681
682 err = -EACCES;
683 if (ipcperms (&sma->sem_perm, S_IRUGO))
684 goto out_unlock;
685
686 err = security_sem_semctl(sma, cmd);
687 if (err)
688 goto out_unlock;
689
Nadia Derbey023a5352007-10-18 23:40:51 -0700690 memset(&tbuf, 0, sizeof(tbuf));
691
Linus Torvalds1da177e2005-04-16 15:20:36 -0700692 kernel_to_ipc64_perm(&sma->sem_perm, &tbuf.sem_perm);
693 tbuf.sem_otime = sma->sem_otime;
694 tbuf.sem_ctime = sma->sem_ctime;
695 tbuf.sem_nsems = sma->sem_nsems;
696 sem_unlock(sma);
697 if (copy_semid_to_user (arg.buf, &tbuf, version))
698 return -EFAULT;
699 return id;
700 }
701 default:
702 return -EINVAL;
703 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700704out_unlock:
705 sem_unlock(sma);
706 return err;
707}
708
Kirill Korotaeve3893532006-10-02 02:18:22 -0700709static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
710 int cmd, int version, union semun arg)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700711{
712 struct sem_array *sma;
713 struct sem* curr;
714 int err;
715 ushort fast_sem_io[SEMMSL_FAST];
716 ushort* sem_io = fast_sem_io;
717 int nsems;
718
Nadia Derbey023a5352007-10-18 23:40:51 -0700719 sma = sem_lock_check(ns, semid);
720 if (IS_ERR(sma))
721 return PTR_ERR(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700722
723 nsems = sma->sem_nsems;
724
Linus Torvalds1da177e2005-04-16 15:20:36 -0700725 err = -EACCES;
726 if (ipcperms (&sma->sem_perm, (cmd==SETVAL||cmd==SETALL)?S_IWUGO:S_IRUGO))
727 goto out_unlock;
728
729 err = security_sem_semctl(sma, cmd);
730 if (err)
731 goto out_unlock;
732
733 err = -EACCES;
734 switch (cmd) {
735 case GETALL:
736 {
737 ushort __user *array = arg.array;
738 int i;
739
740 if(nsems > SEMMSL_FAST) {
Pierre Peiffer6ff37972008-04-29 01:00:46 -0700741 sem_getref_and_unlock(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700742
743 sem_io = ipc_alloc(sizeof(ushort)*nsems);
744 if(sem_io == NULL) {
Pierre Peiffer6ff37972008-04-29 01:00:46 -0700745 sem_putref(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700746 return -ENOMEM;
747 }
748
Pierre Peiffer6ff37972008-04-29 01:00:46 -0700749 sem_lock_and_putref(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700750 if (sma->sem_perm.deleted) {
751 sem_unlock(sma);
752 err = -EIDRM;
753 goto out_free;
754 }
755 }
756
757 for (i = 0; i < sma->sem_nsems; i++)
758 sem_io[i] = sma->sem_base[i].semval;
759 sem_unlock(sma);
760 err = 0;
761 if(copy_to_user(array, sem_io, nsems*sizeof(ushort)))
762 err = -EFAULT;
763 goto out_free;
764 }
765 case SETALL:
766 {
767 int i;
768 struct sem_undo *un;
769
Pierre Peiffer6ff37972008-04-29 01:00:46 -0700770 sem_getref_and_unlock(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700771
772 if(nsems > SEMMSL_FAST) {
773 sem_io = ipc_alloc(sizeof(ushort)*nsems);
774 if(sem_io == NULL) {
Pierre Peiffer6ff37972008-04-29 01:00:46 -0700775 sem_putref(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700776 return -ENOMEM;
777 }
778 }
779
780 if (copy_from_user (sem_io, arg.array, nsems*sizeof(ushort))) {
Pierre Peiffer6ff37972008-04-29 01:00:46 -0700781 sem_putref(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700782 err = -EFAULT;
783 goto out_free;
784 }
785
786 for (i = 0; i < nsems; i++) {
787 if (sem_io[i] > SEMVMX) {
Pierre Peiffer6ff37972008-04-29 01:00:46 -0700788 sem_putref(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700789 err = -ERANGE;
790 goto out_free;
791 }
792 }
Pierre Peiffer6ff37972008-04-29 01:00:46 -0700793 sem_lock_and_putref(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700794 if (sma->sem_perm.deleted) {
795 sem_unlock(sma);
796 err = -EIDRM;
797 goto out_free;
798 }
799
800 for (i = 0; i < nsems; i++)
801 sma->sem_base[i].semval = sem_io[i];
Manfred Spraul4daa28f2008-07-25 01:48:04 -0700802
803 assert_spin_locked(&sma->sem_perm.lock);
804 list_for_each_entry(un, &sma->list_id, list_id) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700805 for (i = 0; i < nsems; i++)
806 un->semadj[i] = 0;
Manfred Spraul4daa28f2008-07-25 01:48:04 -0700807 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700808 sma->sem_ctime = get_seconds();
809 /* maybe some queued-up processes were waiting for this */
Manfred Spraul636c6be2009-12-15 16:47:33 -0800810 update_queue(sma, -1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700811 err = 0;
812 goto out_unlock;
813 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700814 /* GETVAL, GETPID, GETNCTN, GETZCNT, SETVAL: fall-through */
815 }
816 err = -EINVAL;
817 if(semnum < 0 || semnum >= nsems)
818 goto out_unlock;
819
820 curr = &sma->sem_base[semnum];
821
822 switch (cmd) {
823 case GETVAL:
824 err = curr->semval;
825 goto out_unlock;
826 case GETPID:
827 err = curr->sempid;
828 goto out_unlock;
829 case GETNCNT:
830 err = count_semncnt(sma,semnum);
831 goto out_unlock;
832 case GETZCNT:
833 err = count_semzcnt(sma,semnum);
834 goto out_unlock;
835 case SETVAL:
836 {
837 int val = arg.val;
838 struct sem_undo *un;
Manfred Spraul4daa28f2008-07-25 01:48:04 -0700839
Linus Torvalds1da177e2005-04-16 15:20:36 -0700840 err = -ERANGE;
841 if (val > SEMVMX || val < 0)
842 goto out_unlock;
843
Manfred Spraul4daa28f2008-07-25 01:48:04 -0700844 assert_spin_locked(&sma->sem_perm.lock);
845 list_for_each_entry(un, &sma->list_id, list_id)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700846 un->semadj[semnum] = 0;
Manfred Spraul4daa28f2008-07-25 01:48:04 -0700847
Linus Torvalds1da177e2005-04-16 15:20:36 -0700848 curr->semval = val;
Pavel Emelyanovb4888932007-10-18 23:40:14 -0700849 curr->sempid = task_tgid_vnr(current);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700850 sma->sem_ctime = get_seconds();
851 /* maybe some queued-up processes were waiting for this */
Manfred Spraul636c6be2009-12-15 16:47:33 -0800852 update_queue(sma, semnum);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700853 err = 0;
854 goto out_unlock;
855 }
856 }
857out_unlock:
858 sem_unlock(sma);
859out_free:
860 if(sem_io != fast_sem_io)
861 ipc_free(sem_io, sizeof(ushort)*nsems);
862 return err;
863}
864
Pierre Peiffer016d7132008-04-29 01:00:50 -0700865static inline unsigned long
866copy_semid_from_user(struct semid64_ds *out, void __user *buf, int version)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700867{
868 switch(version) {
869 case IPC_64:
Pierre Peiffer016d7132008-04-29 01:00:50 -0700870 if (copy_from_user(out, buf, sizeof(*out)))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700871 return -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700872 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700873 case IPC_OLD:
874 {
875 struct semid_ds tbuf_old;
876
877 if(copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
878 return -EFAULT;
879
Pierre Peiffer016d7132008-04-29 01:00:50 -0700880 out->sem_perm.uid = tbuf_old.sem_perm.uid;
881 out->sem_perm.gid = tbuf_old.sem_perm.gid;
882 out->sem_perm.mode = tbuf_old.sem_perm.mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700883
884 return 0;
885 }
886 default:
887 return -EINVAL;
888 }
889}
890
Pierre Peiffer522bb2a2008-04-29 01:00:49 -0700891/*
892 * This function handles some semctl commands which require the rw_mutex
893 * to be held in write mode.
894 * NOTE: no locks must be held, the rw_mutex is taken inside this function.
895 */
Pierre Peiffer21a48262008-04-29 01:00:49 -0700896static int semctl_down(struct ipc_namespace *ns, int semid,
897 int cmd, int version, union semun arg)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700898{
899 struct sem_array *sma;
900 int err;
Pierre Peiffer016d7132008-04-29 01:00:50 -0700901 struct semid64_ds semid64;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700902 struct kern_ipc_perm *ipcp;
903
904 if(cmd == IPC_SET) {
Pierre Peiffer016d7132008-04-29 01:00:50 -0700905 if (copy_semid_from_user(&semid64, arg.buf, version))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700906 return -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700907 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700908
Pierre Peiffera5f75e72008-04-29 01:00:54 -0700909 ipcp = ipcctl_pre_down(&sem_ids(ns), semid, cmd, &semid64.sem_perm, 0);
910 if (IS_ERR(ipcp))
911 return PTR_ERR(ipcp);
Steve Grubb073115d2006-04-02 17:07:33 -0400912
Pierre Peiffera5f75e72008-04-29 01:00:54 -0700913 sma = container_of(ipcp, struct sem_array, sem_perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700914
915 err = security_sem_semctl(sma, cmd);
916 if (err)
917 goto out_unlock;
918
919 switch(cmd){
920 case IPC_RMID:
Pierre Peiffer01b8b072008-02-08 04:18:57 -0800921 freeary(ns, ipcp);
Pierre Peiffer522bb2a2008-04-29 01:00:49 -0700922 goto out_up;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700923 case IPC_SET:
Pierre Peiffer8f4a3802008-04-29 01:00:51 -0700924 ipc_update_perm(&semid64.sem_perm, ipcp);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700925 sma->sem_ctime = get_seconds();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700926 break;
927 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700928 err = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700929 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700930
931out_unlock:
932 sem_unlock(sma);
Pierre Peiffer522bb2a2008-04-29 01:00:49 -0700933out_up:
934 up_write(&sem_ids(ns).rw_mutex);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700935 return err;
936}
937
Heiko Carstens6673e0c2009-01-14 14:14:02 +0100938SYSCALL_DEFINE(semctl)(int semid, int semnum, int cmd, union semun arg)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700939{
940 int err = -EINVAL;
941 int version;
Kirill Korotaeve3893532006-10-02 02:18:22 -0700942 struct ipc_namespace *ns;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700943
944 if (semid < 0)
945 return -EINVAL;
946
947 version = ipc_parse_version(&cmd);
Kirill Korotaeve3893532006-10-02 02:18:22 -0700948 ns = current->nsproxy->ipc_ns;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700949
950 switch(cmd) {
951 case IPC_INFO:
952 case SEM_INFO:
Pierre Peiffer4b9fcb02008-02-08 04:18:56 -0800953 case IPC_STAT:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700954 case SEM_STAT:
Pierre Peiffer4b9fcb02008-02-08 04:18:56 -0800955 err = semctl_nolock(ns, semid, cmd, version, arg);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700956 return err;
957 case GETALL:
958 case GETVAL:
959 case GETPID:
960 case GETNCNT:
961 case GETZCNT:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700962 case SETVAL:
963 case SETALL:
Kirill Korotaeve3893532006-10-02 02:18:22 -0700964 err = semctl_main(ns,semid,semnum,cmd,version,arg);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700965 return err;
966 case IPC_RMID:
967 case IPC_SET:
Pierre Peiffer21a48262008-04-29 01:00:49 -0700968 err = semctl_down(ns, semid, cmd, version, arg);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700969 return err;
970 default:
971 return -EINVAL;
972 }
973}
Heiko Carstens6673e0c2009-01-14 14:14:02 +0100974#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
975asmlinkage long SyS_semctl(int semid, int semnum, int cmd, union semun arg)
976{
977 return SYSC_semctl((int) semid, (int) semnum, (int) cmd, arg);
978}
979SYSCALL_ALIAS(sys_semctl, SyS_semctl);
980#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -0700981
Linus Torvalds1da177e2005-04-16 15:20:36 -0700982/* If the task doesn't already have a undo_list, then allocate one
983 * here. We guarantee there is only one thread using this undo list,
984 * and current is THE ONE
985 *
986 * If this allocation and assignment succeeds, but later
987 * portions of this code fail, there is no need to free the sem_undo_list.
988 * Just let it stay associated with the task, and it'll be freed later
989 * at exit time.
990 *
991 * This can block, so callers must hold no locks.
992 */
993static inline int get_undo_list(struct sem_undo_list **undo_listp)
994{
995 struct sem_undo_list *undo_list;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700996
997 undo_list = current->sysvsem.undo_list;
998 if (!undo_list) {
Matt Helsley2453a302006-10-02 02:18:25 -0700999 undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001000 if (undo_list == NULL)
1001 return -ENOMEM;
Ingo Molnar00a5dfd2005-08-05 23:05:27 +02001002 spin_lock_init(&undo_list->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001003 atomic_set(&undo_list->refcnt, 1);
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001004 INIT_LIST_HEAD(&undo_list->list_proc);
1005
Linus Torvalds1da177e2005-04-16 15:20:36 -07001006 current->sysvsem.undo_list = undo_list;
1007 }
1008 *undo_listp = undo_list;
1009 return 0;
1010}
1011
Nick Pigginbf17bb72009-12-15 16:47:28 -08001012static struct sem_undo *__lookup_undo(struct sem_undo_list *ulp, int semid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001013{
Nick Pigginbf17bb72009-12-15 16:47:28 -08001014 struct sem_undo *un;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001015
Nick Pigginbf17bb72009-12-15 16:47:28 -08001016 list_for_each_entry_rcu(un, &ulp->list_proc, list_proc) {
1017 if (un->semid == semid)
1018 return un;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001019 }
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001020 return NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001021}
1022
Nick Pigginbf17bb72009-12-15 16:47:28 -08001023static struct sem_undo *lookup_undo(struct sem_undo_list *ulp, int semid)
1024{
1025 struct sem_undo *un;
1026
1027 assert_spin_locked(&ulp->lock);
1028
1029 un = __lookup_undo(ulp, semid);
1030 if (un) {
1031 list_del_rcu(&un->list_proc);
1032 list_add_rcu(&un->list_proc, &ulp->list_proc);
1033 }
1034 return un;
1035}
1036
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001037/**
1038 * find_alloc_undo - Lookup (and if not present create) undo array
1039 * @ns: namespace
1040 * @semid: semaphore array id
1041 *
1042 * The function looks up (and if not present creates) the undo structure.
1043 * The size of the undo structure depends on the size of the semaphore
1044 * array, thus the alloc path is not that straightforward.
Manfred Spraul380af1b2008-07-25 01:48:06 -07001045 * Lifetime-rules: sem_undo is rcu-protected, on success, the function
1046 * performs a rcu_read_lock().
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001047 */
1048static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001049{
1050 struct sem_array *sma;
1051 struct sem_undo_list *ulp;
1052 struct sem_undo *un, *new;
1053 int nsems;
1054 int error;
1055
1056 error = get_undo_list(&ulp);
1057 if (error)
1058 return ERR_PTR(error);
1059
Manfred Spraul380af1b2008-07-25 01:48:06 -07001060 rcu_read_lock();
Pierre Peifferc530c6a2007-10-18 23:40:55 -07001061 spin_lock(&ulp->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001062 un = lookup_undo(ulp, semid);
Pierre Peifferc530c6a2007-10-18 23:40:55 -07001063 spin_unlock(&ulp->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001064 if (likely(un!=NULL))
1065 goto out;
Manfred Spraul380af1b2008-07-25 01:48:06 -07001066 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001067
1068 /* no undo structure around - allocate one. */
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001069 /* step 1: figure out the size of the semaphore array */
Nadia Derbey023a5352007-10-18 23:40:51 -07001070 sma = sem_lock_check(ns, semid);
1071 if (IS_ERR(sma))
1072 return ERR_PTR(PTR_ERR(sma));
1073
Linus Torvalds1da177e2005-04-16 15:20:36 -07001074 nsems = sma->sem_nsems;
Pierre Peiffer6ff37972008-04-29 01:00:46 -07001075 sem_getref_and_unlock(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001076
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001077 /* step 2: allocate new undo structure */
Burman Yan4668edc2006-12-06 20:38:51 -08001078 new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001079 if (!new) {
Pierre Peiffer6ff37972008-04-29 01:00:46 -07001080 sem_putref(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001081 return ERR_PTR(-ENOMEM);
1082 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001083
Manfred Spraul380af1b2008-07-25 01:48:06 -07001084 /* step 3: Acquire the lock on semaphore array */
Pierre Peiffer6ff37972008-04-29 01:00:46 -07001085 sem_lock_and_putref(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001086 if (sma->sem_perm.deleted) {
1087 sem_unlock(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001088 kfree(new);
1089 un = ERR_PTR(-EIDRM);
1090 goto out;
1091 }
Manfred Spraul380af1b2008-07-25 01:48:06 -07001092 spin_lock(&ulp->lock);
1093
1094 /*
1095 * step 4: check for races: did someone else allocate the undo struct?
1096 */
1097 un = lookup_undo(ulp, semid);
1098 if (un) {
1099 kfree(new);
1100 goto success;
1101 }
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001102 /* step 5: initialize & link new undo structure */
1103 new->semadj = (short *) &new[1];
Manfred Spraul380af1b2008-07-25 01:48:06 -07001104 new->ulp = ulp;
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001105 new->semid = semid;
1106 assert_spin_locked(&ulp->lock);
Manfred Spraul380af1b2008-07-25 01:48:06 -07001107 list_add_rcu(&new->list_proc, &ulp->list_proc);
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001108 assert_spin_locked(&sma->sem_perm.lock);
1109 list_add(&new->list_id, &sma->list_id);
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001110 un = new;
Manfred Spraul380af1b2008-07-25 01:48:06 -07001111
1112success:
1113 spin_unlock(&ulp->lock);
1114 rcu_read_lock();
1115 sem_unlock(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001116out:
1117 return un;
1118}
1119
Heiko Carstensd5460c92009-01-14 14:14:27 +01001120SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
1121 unsigned, nsops, const struct timespec __user *, timeout)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001122{
1123 int error = -EINVAL;
1124 struct sem_array *sma;
1125 struct sembuf fast_sops[SEMOPM_FAST];
1126 struct sembuf* sops = fast_sops, *sop;
1127 struct sem_undo *un;
Manfred Spraulb78755a2005-06-23 00:10:06 -07001128 int undos = 0, alter = 0, max;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001129 struct sem_queue queue;
1130 unsigned long jiffies_left = 0;
Kirill Korotaeve3893532006-10-02 02:18:22 -07001131 struct ipc_namespace *ns;
1132
1133 ns = current->nsproxy->ipc_ns;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001134
1135 if (nsops < 1 || semid < 0)
1136 return -EINVAL;
Kirill Korotaeve3893532006-10-02 02:18:22 -07001137 if (nsops > ns->sc_semopm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001138 return -E2BIG;
1139 if(nsops > SEMOPM_FAST) {
1140 sops = kmalloc(sizeof(*sops)*nsops,GFP_KERNEL);
1141 if(sops==NULL)
1142 return -ENOMEM;
1143 }
1144 if (copy_from_user (sops, tsops, nsops * sizeof(*tsops))) {
1145 error=-EFAULT;
1146 goto out_free;
1147 }
1148 if (timeout) {
1149 struct timespec _timeout;
1150 if (copy_from_user(&_timeout, timeout, sizeof(*timeout))) {
1151 error = -EFAULT;
1152 goto out_free;
1153 }
1154 if (_timeout.tv_sec < 0 || _timeout.tv_nsec < 0 ||
1155 _timeout.tv_nsec >= 1000000000L) {
1156 error = -EINVAL;
1157 goto out_free;
1158 }
1159 jiffies_left = timespec_to_jiffies(&_timeout);
1160 }
1161 max = 0;
1162 for (sop = sops; sop < sops + nsops; sop++) {
1163 if (sop->sem_num >= max)
1164 max = sop->sem_num;
1165 if (sop->sem_flg & SEM_UNDO)
Manfred Spraulb78755a2005-06-23 00:10:06 -07001166 undos = 1;
1167 if (sop->sem_op != 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001168 alter = 1;
1169 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001170
Linus Torvalds1da177e2005-04-16 15:20:36 -07001171 if (undos) {
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001172 un = find_alloc_undo(ns, semid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001173 if (IS_ERR(un)) {
1174 error = PTR_ERR(un);
1175 goto out_free;
1176 }
1177 } else
1178 un = NULL;
1179
Nadia Derbey023a5352007-10-18 23:40:51 -07001180 sma = sem_lock_check(ns, semid);
1181 if (IS_ERR(sma)) {
Manfred Spraul380af1b2008-07-25 01:48:06 -07001182 if (un)
1183 rcu_read_unlock();
Nadia Derbey023a5352007-10-18 23:40:51 -07001184 error = PTR_ERR(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001185 goto out_free;
Nadia Derbey023a5352007-10-18 23:40:51 -07001186 }
1187
Linus Torvalds1da177e2005-04-16 15:20:36 -07001188 /*
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001189 * semid identifiers are not unique - find_alloc_undo may have
Linus Torvalds1da177e2005-04-16 15:20:36 -07001190 * allocated an undo structure, it was invalidated by an RMID
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001191 * and now a new array with received the same id. Check and fail.
Manfred Spraul380af1b2008-07-25 01:48:06 -07001192 * This case can be detected checking un->semid. The existance of
1193 * "un" itself is guaranteed by rcu.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001194 */
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001195 error = -EIDRM;
Manfred Spraul380af1b2008-07-25 01:48:06 -07001196 if (un) {
1197 if (un->semid == -1) {
1198 rcu_read_unlock();
1199 goto out_unlock_free;
1200 } else {
1201 /*
1202 * rcu lock can be released, "un" cannot disappear:
1203 * - sem_lock is acquired, thus IPC_RMID is
1204 * impossible.
1205 * - exit_sem is impossible, it always operates on
1206 * current (or a dead task).
1207 */
1208
1209 rcu_read_unlock();
1210 }
1211 }
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001212
Linus Torvalds1da177e2005-04-16 15:20:36 -07001213 error = -EFBIG;
1214 if (max >= sma->sem_nsems)
1215 goto out_unlock_free;
1216
1217 error = -EACCES;
1218 if (ipcperms(&sma->sem_perm, alter ? S_IWUGO : S_IRUGO))
1219 goto out_unlock_free;
1220
1221 error = security_sem_semop(sma, sops, nsops, alter);
1222 if (error)
1223 goto out_unlock_free;
1224
Pavel Emelyanovb4888932007-10-18 23:40:14 -07001225 error = try_atomic_semop (sma, sops, nsops, un, task_tgid_vnr(current));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001226 if (error <= 0) {
1227 if (alter && error == 0)
Manfred Spraul636c6be2009-12-15 16:47:33 -08001228 update_queue(sma, (nsops == 1) ? sops[0].sem_num : -1);
1229
Linus Torvalds1da177e2005-04-16 15:20:36 -07001230 goto out_unlock_free;
1231 }
1232
1233 /* We need to sleep on this operation, so we put the current
1234 * task into the pending queue and go to sleep.
1235 */
1236
Linus Torvalds1da177e2005-04-16 15:20:36 -07001237 queue.sops = sops;
1238 queue.nsops = nsops;
1239 queue.undo = un;
Pavel Emelyanovb4888932007-10-18 23:40:14 -07001240 queue.pid = task_tgid_vnr(current);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001241 queue.alter = alter;
1242 if (alter)
Manfred Spraula1193f82008-07-25 01:48:06 -07001243 list_add_tail(&queue.list, &sma->sem_pending);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001244 else
Manfred Spraula1193f82008-07-25 01:48:06 -07001245 list_add(&queue.list, &sma->sem_pending);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001246
Manfred Spraulb97e8202009-12-15 16:47:32 -08001247 if (nsops == 1) {
1248 struct sem *curr;
1249 curr = &sma->sem_base[sops->sem_num];
1250
1251 if (alter)
1252 list_add_tail(&queue.simple_list, &curr->sem_pending);
1253 else
1254 list_add(&queue.simple_list, &curr->sem_pending);
1255 } else {
1256 INIT_LIST_HEAD(&queue.simple_list);
1257 sma->complex_count++;
1258 }
1259
Linus Torvalds1da177e2005-04-16 15:20:36 -07001260 queue.status = -EINTR;
1261 queue.sleeper = current;
1262 current->state = TASK_INTERRUPTIBLE;
1263 sem_unlock(sma);
1264
1265 if (timeout)
1266 jiffies_left = schedule_timeout(jiffies_left);
1267 else
1268 schedule();
1269
1270 error = queue.status;
1271 while(unlikely(error == IN_WAKEUP)) {
1272 cpu_relax();
1273 error = queue.status;
1274 }
1275
1276 if (error != -EINTR) {
1277 /* fast path: update_queue already obtained all requested
1278 * resources */
1279 goto out_free;
1280 }
1281
Kirill Korotaeve3893532006-10-02 02:18:22 -07001282 sma = sem_lock(ns, semid);
Nadia Derbey023a5352007-10-18 23:40:51 -07001283 if (IS_ERR(sma)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001284 error = -EIDRM;
1285 goto out_free;
1286 }
1287
1288 /*
1289 * If queue.status != -EINTR we are woken up by another process
1290 */
1291 error = queue.status;
1292 if (error != -EINTR) {
1293 goto out_unlock_free;
1294 }
1295
1296 /*
1297 * If an interrupt occurred we have to clean up the queue
1298 */
1299 if (timeout && jiffies_left == 0)
1300 error = -EAGAIN;
Manfred Spraulb97e8202009-12-15 16:47:32 -08001301 unlink_queue(sma, &queue);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001302
1303out_unlock_free:
1304 sem_unlock(sma);
1305out_free:
1306 if(sops != fast_sops)
1307 kfree(sops);
1308 return error;
1309}
1310
Heiko Carstensd5460c92009-01-14 14:14:27 +01001311SYSCALL_DEFINE3(semop, int, semid, struct sembuf __user *, tsops,
1312 unsigned, nsops)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001313{
1314 return sys_semtimedop(semid, tsops, nsops, NULL);
1315}
1316
1317/* If CLONE_SYSVSEM is set, establish sharing of SEM_UNDO state between
1318 * parent and child tasks.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001319 */
1320
1321int copy_semundo(unsigned long clone_flags, struct task_struct *tsk)
1322{
1323 struct sem_undo_list *undo_list;
1324 int error;
1325
1326 if (clone_flags & CLONE_SYSVSEM) {
1327 error = get_undo_list(&undo_list);
1328 if (error)
1329 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001330 atomic_inc(&undo_list->refcnt);
1331 tsk->sysvsem.undo_list = undo_list;
1332 } else
1333 tsk->sysvsem.undo_list = NULL;
1334
1335 return 0;
1336}
1337
1338/*
1339 * add semadj values to semaphores, free undo structures.
1340 * undo structures are not freed when semaphore arrays are destroyed
1341 * so some of them may be out of date.
1342 * IMPLEMENTATION NOTE: There is some confusion over whether the
1343 * set of adjustments that needs to be done should be done in an atomic
1344 * manner or not. That is, if we are attempting to decrement the semval
1345 * should we queue up and wait until we can do so legally?
1346 * The original implementation attempted to do this (queue and wait).
1347 * The current implementation does not do so. The POSIX standard
1348 * and SVID should be consulted to determine what behavior is mandated.
1349 */
1350void exit_sem(struct task_struct *tsk)
1351{
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001352 struct sem_undo_list *ulp;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001353
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001354 ulp = tsk->sysvsem.undo_list;
1355 if (!ulp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001356 return;
Manfred Spraul9edff4a2008-04-29 01:00:57 -07001357 tsk->sysvsem.undo_list = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001358
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001359 if (!atomic_dec_and_test(&ulp->refcnt))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001360 return;
1361
Manfred Spraul380af1b2008-07-25 01:48:06 -07001362 for (;;) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001363 struct sem_array *sma;
Manfred Spraul380af1b2008-07-25 01:48:06 -07001364 struct sem_undo *un;
1365 int semid;
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001366 int i;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001367
Manfred Spraul380af1b2008-07-25 01:48:06 -07001368 rcu_read_lock();
Jiri Pirko05725f72009-04-14 20:17:16 +02001369 un = list_entry_rcu(ulp->list_proc.next,
1370 struct sem_undo, list_proc);
Manfred Spraul380af1b2008-07-25 01:48:06 -07001371 if (&un->list_proc == &ulp->list_proc)
1372 semid = -1;
1373 else
1374 semid = un->semid;
1375 rcu_read_unlock();
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001376
Manfred Spraul380af1b2008-07-25 01:48:06 -07001377 if (semid == -1)
1378 break;
1379
1380 sma = sem_lock_check(tsk->nsproxy->ipc_ns, un->semid);
1381
1382 /* exit_sem raced with IPC_RMID, nothing to do */
Nadia Derbey023a5352007-10-18 23:40:51 -07001383 if (IS_ERR(sma))
Manfred Spraul380af1b2008-07-25 01:48:06 -07001384 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001385
Nick Pigginbf17bb72009-12-15 16:47:28 -08001386 un = __lookup_undo(ulp, semid);
Manfred Spraul380af1b2008-07-25 01:48:06 -07001387 if (un == NULL) {
1388 /* exit_sem raced with IPC_RMID+semget() that created
1389 * exactly the same semid. Nothing to do.
1390 */
1391 sem_unlock(sma);
1392 continue;
1393 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001394
Manfred Spraul380af1b2008-07-25 01:48:06 -07001395 /* remove un from the linked lists */
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001396 assert_spin_locked(&sma->sem_perm.lock);
1397 list_del(&un->list_id);
1398
Manfred Spraul380af1b2008-07-25 01:48:06 -07001399 spin_lock(&ulp->lock);
1400 list_del_rcu(&un->list_proc);
1401 spin_unlock(&ulp->lock);
1402
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001403 /* perform adjustments registered in un */
1404 for (i = 0; i < sma->sem_nsems; i++) {
Ingo Molnar5f921ae2006-03-26 01:37:17 -08001405 struct sem * semaphore = &sma->sem_base[i];
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001406 if (un->semadj[i]) {
1407 semaphore->semval += un->semadj[i];
Linus Torvalds1da177e2005-04-16 15:20:36 -07001408 /*
1409 * Range checks of the new semaphore value,
1410 * not defined by sus:
1411 * - Some unices ignore the undo entirely
1412 * (e.g. HP UX 11i 11.22, Tru64 V5.1)
1413 * - some cap the value (e.g. FreeBSD caps
1414 * at 0, but doesn't enforce SEMVMX)
1415 *
1416 * Linux caps the semaphore value, both at 0
1417 * and at SEMVMX.
1418 *
1419 * Manfred <manfred@colorfullife.com>
1420 */
Ingo Molnar5f921ae2006-03-26 01:37:17 -08001421 if (semaphore->semval < 0)
1422 semaphore->semval = 0;
1423 if (semaphore->semval > SEMVMX)
1424 semaphore->semval = SEMVMX;
Pavel Emelyanovb4888932007-10-18 23:40:14 -07001425 semaphore->sempid = task_tgid_vnr(current);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001426 }
1427 }
1428 sma->sem_otime = get_seconds();
1429 /* maybe some queued-up processes were waiting for this */
Manfred Spraul636c6be2009-12-15 16:47:33 -08001430 update_queue(sma, -1);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001431 sem_unlock(sma);
Manfred Spraul380af1b2008-07-25 01:48:06 -07001432
1433 call_rcu(&un->rcu, free_un);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001434 }
Manfred Spraul4daa28f2008-07-25 01:48:04 -07001435 kfree(ulp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001436}
1437
1438#ifdef CONFIG_PROC_FS
Mike Waychison19b49462005-09-06 15:17:10 -07001439static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001440{
Mike Waychison19b49462005-09-06 15:17:10 -07001441 struct sem_array *sma = it;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001442
Mike Waychison19b49462005-09-06 15:17:10 -07001443 return seq_printf(s,
Manfred Spraulb97e8202009-12-15 16:47:32 -08001444 "%10d %10d %4o %10u %5u %5u %5u %5u %10lu %10lu\n",
Mike Waychison19b49462005-09-06 15:17:10 -07001445 sma->sem_perm.key,
Nadia Derbey7ca7e562007-10-18 23:40:48 -07001446 sma->sem_perm.id,
Mike Waychison19b49462005-09-06 15:17:10 -07001447 sma->sem_perm.mode,
1448 sma->sem_nsems,
1449 sma->sem_perm.uid,
1450 sma->sem_perm.gid,
1451 sma->sem_perm.cuid,
1452 sma->sem_perm.cgid,
1453 sma->sem_otime,
1454 sma->sem_ctime);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001455}
1456#endif