When no fixed address is given in a shmat() request, pass a hint address

to vm_map_find() that is less likely to be outside of addressable memory
for 32-bit processes: just past the end of the largest possible heap.
This is the same hint that mmap() uses.

1 files changed, 5 insertions, 2 deletions

diff --git a/sys/kern/sysv_shm.c b/sys/kern/sysv_shm.c
index 6a57f4eaa448..64867812744a 100644
--- a/sys/kern/sysv_shm.c
+++ b/sys/kern/sysv_shm.c
@@ -46,6 +46,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mman.h>
 #include <sys/module.h>
 #include <sys/mutex.h>
+#include <sys/resourcevar.h>
 #include <sys/stat.h>
 #include <sys/syscall.h>
 #include <sys/syscallsubr.h>
@@ -370,8 +371,10 @@ kern_shmat(td, shmid, shmaddr, shmflg)
 		 * This is just a hint to vm_map_find() about where to
 		 * put it.
 		 */
-		attach_va = round_page((vm_offset_t)p->p_vmspace->vm_taddr
-		    + maxtsiz + maxdsiz);
+		PROC_LOCK(p);
+		attach_va = round_page((vm_offset_t)p->p_vmspace->vm_daddr +
+		    lim_max(p, RLIMIT_DATA));
+		PROC_UNLOCK(p);
 	}
 
 	shm_handle = shmseg->shm_internal;