Btrfs: fix possible ENOSPC problems with truncate

[safe/jmp/linux-2.6] / ipc / shm.c

diff --git a/ipc/shm.c b/ipc/shm.c
index 05d51d2..1bc4701 100644 (file)
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -39,6 +39,7 @@
 #include <linux/nsproxy.h>
 #include <linux/mount.h>
 #include <linux/ipc_namespace.h>
+#include <linux/ima.h>
 
 #include <asm/uaccess.h>
 
@@ -173,7 +174,7 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
        shm_unlock(shp);
        if (!is_file_hugepages(shp->shm_file))
                shmem_lock(shp->shm_file, 0, shp->mlock_user);
-       else
+       else if (shp->mlock_user)
                user_shm_unlock(shp->shm_file->f_path.dentry->d_inode->i_size,
                                                shp->mlock_user);
        fput (shp->shm_file);
@@ -368,8 +369,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
                /* hugetlb_file_setup applies strict accounting */
                if (shmflg & SHM_NORESERVE)
                        acctflag = VM_NORESERVE;
-               file = hugetlb_file_setup(name, size, acctflag);
-               shp->mlock_user = current_user();
+               file = hugetlb_file_setup(name, size, acctflag,
+                                                       &shp->mlock_user);
        } else {
                /*
                 * Do not allow no accounting for OVERCOMMIT_NEVER, even
@@ -409,6 +410,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
        return error;
 
 no_id:
+       if (shp->mlock_user)    /* shmflg & SHM_HUGETLB case */
+               user_shm_unlock(size, shp->mlock_user);
        fput(file);
 no_file:
        security_shm_free(shp);
@@ -553,12 +556,14 @@ static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
        in_use = shm_ids(ns).in_use;
 
        for (total = 0, next_id = 0; total < in_use; next_id++) {
+               struct kern_ipc_perm *ipc;
                struct shmid_kernel *shp;
                struct inode *inode;
 
-               shp = idr_find(&shm_ids(ns).ipcs_idr, next_id);
-               if (shp == NULL)
+               ipc = idr_find(&shm_ids(ns).ipcs_idr, next_id);
+               if (ipc == NULL)
                        continue;
+               shp = container_of(ipc, struct shmid_kernel, shm_perm);
 
                inode = shp->shm_file->f_path.dentry->d_inode;
 
@@ -887,6 +892,7 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
        file = alloc_file(path.mnt, path.dentry, f_mode, &shm_file_operations);
        if (!file)
                goto out_free;
+       ima_counts_get(file);
 
        file->private_data = sfd;
        file->f_mapping = shp->shm_file->f_mapping;
@@ -964,10 +970,13 @@ SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
 SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
 {
        struct mm_struct *mm = current->mm;
-       struct vm_area_struct *vma, *next;
+       struct vm_area_struct *vma;
        unsigned long addr = (unsigned long)shmaddr;
-       loff_t size = 0;
        int retval = -EINVAL;
+#ifdef CONFIG_MMU
+       loff_t size = 0;
+       struct vm_area_struct *next;
+#endif
 
        if (addr & ~PAGE_MASK)
                return retval;