+ /* shmmni can not be changed after SysV SHM has been initialized */
+ if (shm_inited && arg1 == &shminfo.shmmni) {
+ sysctl_shminfo_ret = EPERM;
+ goto sysctl_shminfo_out;
+ }
+ saved_shmmax = shminfo.shmmax;
+ saved_shmmin = shminfo.shmmin;
+ saved_shmseg = shminfo.shmseg;
+ saved_shmmni = shminfo.shmmni;
+ saved_shmall = shminfo.shmall;
+
+ if ((error = SYSCTL_IN(req, arg1, sizeof(int64_t))) != 0) {
+ sysctl_shminfo_ret = error;
+ goto sysctl_shminfo_out;
+ }
+
+ if (arg1 == &shminfo.shmmax) {
+ /* shmmax needs to be page-aligned */
+ if (shminfo.shmmax & PAGE_MASK_64 || shminfo.shmmax < 0) {
+ shminfo.shmmax = saved_shmmax;
+ sysctl_shminfo_ret = EINVAL;
+ goto sysctl_shminfo_out;
+ }
+ } else if (arg1 == &shminfo.shmmin) {
+ if (shminfo.shmmin < 0) {
+ shminfo.shmmin = saved_shmmin;
+ sysctl_shminfo_ret = EINVAL;
+ goto sysctl_shminfo_out;
+ }
+ } else if (arg1 == &shminfo.shmseg) {
+ /* add a sanity check - 20847256 */
+ if (shminfo.shmseg > INT32_MAX || shminfo.shmseg < 0) {
+ shminfo.shmseg = saved_shmseg;
+ sysctl_shminfo_ret = EINVAL;
+ goto sysctl_shminfo_out;
+ }
+ } else if (arg1 == &shminfo.shmmni) {
+ /* add a sanity check - 20847256 */
+ if (shminfo.shmmni > INT32_MAX || shminfo.shmmni < 0) {
+ shminfo.shmmni = saved_shmmni;
+ sysctl_shminfo_ret = EINVAL;
+ goto sysctl_shminfo_out;
+ }
+ } else if (arg1 == &shminfo.shmall) {
+ /* add a sanity check - 20847256 */
+ if (shminfo.shmall > INT32_MAX || shminfo.shmall < 0) {
+ shminfo.shmall = saved_shmall;
+ sysctl_shminfo_ret = EINVAL;
+ goto sysctl_shminfo_out;
+ }
+ }
+ sysctl_shminfo_ret = 0;
+sysctl_shminfo_out:
+ SYSV_SHM_SUBSYS_UNLOCK();
+ return sysctl_shminfo_ret;
+}
+
+static int
+IPCS_shm_sysctl(__unused struct sysctl_oid *oidp, __unused void *arg1,
+ __unused int arg2, struct sysctl_req *req)
+{
+ int error;
+ int cursor;
+ union {
+ struct user32_IPCS_command u32;
+ struct user_IPCS_command u64;
+ } ipcs = { };
+ struct user32_shmid_ds shmid_ds32 = { }; /* post conversion, 32 bit version */
+ struct user_shmid_ds shmid_ds = { }; /* 64 bit version */
+ void *shmid_dsp;
+ size_t ipcs_sz = sizeof(struct user_IPCS_command);
+ size_t shmid_ds_sz = sizeof(struct user_shmid_ds);
+ struct proc *p = current_proc();
+
+ SYSV_SHM_SUBSYS_LOCK();
+
+ if ((error = shminit())) {
+ goto ipcs_shm_sysctl_out;
+ }
+
+ if (!IS_64BIT_PROCESS(p)) {
+ ipcs_sz = sizeof(struct user32_IPCS_command);
+ shmid_ds_sz = sizeof(struct user32_shmid_ds);
+ }
+
+ /* Copy in the command structure */
+ if ((error = SYSCTL_IN(req, &ipcs, ipcs_sz)) != 0) {
+ goto ipcs_shm_sysctl_out;
+ }
+
+ if (!IS_64BIT_PROCESS(p)) { /* convert in place */
+ ipcs.u64.ipcs_data = CAST_USER_ADDR_T(ipcs.u32.ipcs_data);
+ }
+
+ /* Let us version this interface... */
+ if (ipcs.u64.ipcs_magic != IPCS_MAGIC) {
+ error = EINVAL;
+ goto ipcs_shm_sysctl_out;
+ }
+
+ switch (ipcs.u64.ipcs_op) {
+ case IPCS_SHM_CONF: /* Obtain global configuration data */
+ if (ipcs.u64.ipcs_datalen != sizeof(struct shminfo)) {
+ if (ipcs.u64.ipcs_cursor != 0) { /* fwd. compat. */
+ error = ENOMEM;
+ break;
+ }
+ error = ERANGE;
+ break;
+ }
+ error = copyout(&shminfo, ipcs.u64.ipcs_data, ipcs.u64.ipcs_datalen);
+ break;
+
+ case IPCS_SHM_ITER: /* Iterate over existing segments */
+ cursor = ipcs.u64.ipcs_cursor;
+ if (cursor < 0 || cursor >= shminfo.shmmni) {
+ error = ERANGE;
+ break;
+ }
+ if (ipcs.u64.ipcs_datalen != (int)shmid_ds_sz) {
+ error = EINVAL;
+ break;
+ }
+ for (; cursor < shminfo.shmmni; cursor++) {
+ if (shmsegs[cursor].u.shm_perm.mode & SHMSEG_ALLOCATED) {
+ break;