X-Git-Url: http://git.lttng.org/?a=blobdiff_plain;f=libringbuffer%2Fshm.h;h=5785b71d8483d26c3684bdd8875c70aa13f00ca2;hb=381c0f1ef474e0ae8a96b3753470ca4bda45c764;hp=d370375b6929cf913ed568e3e665ead996f515ec;hpb=1d4981969313da002983ca979bd85c95493f7316;p=lttng-ust.git

diff --git a/libringbuffer/shm.h b/libringbuffer/shm.h
index d370375b..5785b71d 100644
--- a/libringbuffer/shm.h
+++ b/libringbuffer/shm.h
@@ -14,37 +14,43 @@
 #include "ust/core.h"
 #include "shm_types.h"
 
-#define SHM_MAGIC	0x54335433
-#define SHM_MAJOR	0
-#define SHM_MINOR	1
-
 /*
  * Pointer dereferencing. We don't trust the shm_ref, so we validate
  * both the index and offset with known boundaries.
+ *
+ * "shmp" and "shmp_index" guarantee that it's safe to use the pointer
+ * target type, even in the occurrence of shm_ref modification by an
+ * untrusted process having write access to the shm_ref. We return a
+ * NULL pointer if the ranges are invalid.
  */
 static inline
-char *_shmp(struct shm_object_table *table, struct shm_ref *ref)
+char *_shmp_offset(struct shm_object_table *table, struct shm_ref *ref,
+		   size_t idx, size_t elem_size)
 {
 	struct shm_object *obj;
-	size_t index, offset;
+	size_t objindex, ref_offset;
 
-	index = (size_t) ref->index;
-	if (unlikely(index >= table->allocated_len))
+	objindex = (size_t) ref->index;
+	if (unlikely(objindex >= table->allocated_len))
 		return NULL;
-	obj = &table->objects[index];
-	offset = (size_t) ref->offset;
-	if (unlikely(offset >= obj->memory_map_size))
+	obj = &table->objects[objindex];
+	ref_offset = (size_t) ref->offset;
+	ref_offset += idx * elem_size;
+	/* Check if part of the element returned would exceed the limits. */
+	if (unlikely(ref_offset + elem_size > obj->memory_map_size))
 		return NULL;
-	return &obj->memory_map[offset];
+	return &obj->memory_map[ref_offset];
 }
 
-#define shmp(handle, ref)						\
+#define shmp_index(handle, ref, index)					\
 	({								\
 		__typeof__((ref)._type) ____ptr_ret;			\
-		____ptr_ret = (__typeof__(____ptr_ret)) _shmp((handle)->table, &(ref)._ref);	\
+		____ptr_ret = (__typeof__(____ptr_ret)) _shmp_offset((handle)->table, &(ref)._ref, index, sizeof(*____ptr_ret));	\
 		____ptr_ret;						\
 	})
 
+#define shmp(handle, ref)	shmp_index(handle, ref, 0)
+
 static inline
 void _set_shmp(struct shm_ref *ref, struct shm_ref src)
 {
@@ -68,4 +74,51 @@ struct shm_object *shm_object_table_append(struct shm_object_table *table,
 struct shm_ref zalloc_shm(struct shm_object *obj, size_t len);
 void align_shm(struct shm_object *obj, size_t align);
 
+static inline
+int shm_get_wakeup_fd(struct shm_handle *handle, struct shm_ref *ref)
+{
+	struct shm_object_table *table = handle->table;
+	struct shm_object *obj;
+	size_t index;
+
+	index = (size_t) ref->index;
+	if (unlikely(index >= table->allocated_len))
+		return -EPERM;
+	obj = &table->objects[index];
+	return obj->wait_fd[1];
+
+}
+
+static inline
+int shm_get_wait_fd(struct shm_handle *handle, struct shm_ref *ref)
+{
+	struct shm_object_table *table = handle->table;
+	struct shm_object *obj;
+	size_t index;
+
+	index = (size_t) ref->index;
+	if (unlikely(index >= table->allocated_len))
+		return -EPERM;
+	obj = &table->objects[index];
+	return obj->wait_fd[0];
+}
+
+static inline
+int shm_get_object_data(struct shm_handle *handle, struct shm_ref *ref,
+		int *shm_fd, int *wait_fd, uint64_t *memory_map_size)
+{
+	struct shm_object_table *table = handle->table;
+	struct shm_object *obj;
+	size_t index;
+
+	index = (size_t) ref->index;
+	if (unlikely(index >= table->allocated_len))
+		return -EPERM;
+	obj = &table->objects[index];
+	*shm_fd = obj->shm_fd;
+	*wait_fd = obj->wait_fd[0];
+	*memory_map_size = obj->memory_map_size;
+	return 0;
+}
+
 #endif /* _LIBRINGBUFFER_SHM_H */