shmat, shmdt — System V shared memory operations


#include <sys/types.h>
#include <sys/shm.h>
void *shmat( int shmid,
  const void *shmaddr,
  int shmflg);
int shmdt( const void *shmaddr);


shmat() attaches the System V shared memory segment identified by shmid to the address space of the calling process. The attaching address is specified by shmaddr with one of the following criteria:

If shmaddr is NULL, the system chooses a suitable (unused) address at which to attach the segment.

If shmaddr isn't NULL and SHM_RND is specified in shmflg, the attach occurs at the address equal to shmaddr rounded down to the nearest multiple of SHMLBA. Otherwise shmaddr must be a page-aligned address at which the attach occurs.

If SHM_RDONLY is specified in shmflg, the segment is attached for reading and the process must have read permission for the segment. Otherwise the segment is attached for read and write and the process must have read and write permission for the segment. There is no notion of a write-only shared memory segment.

The (Linux-specific) SHM_REMAP flag may be specified in shmflg to indicate that the mapping of the segment should replace any existing mapping in the range starting at shmaddr and continuing for the size of the segment. (Normally an EINVAL error would result if a mapping already exists in this address range.) In this case, shmaddr must not be NULL.

The brk(2) value of the calling process is not altered by the attach. The segment will automatically be detached at process exit. The same segment may be attached as a read and as a read-write one, and more than once, in the process's address space.

A successful shmat() call updates the members of the shmid_ds structure (see shmctl(2)) associated with the shared memory segment as follows:

  • shm_atime is set to the current time.

  • shm_lpid is set to the process-ID of the calling process.

  • shm_nattch is incremented by one.

shmdt() detaches the shared memory segment located at the address specified by shmaddr from the address space of the calling process. The to-be-detached segment must be currently attached with shmaddr equal to the value returned by the attaching shmat() call.

On a successful shmdt() call the system updates the members of the shmid_ds structure associated with the shared memory segment as follows:

  • shm_dtime is set to the current time.

  • shm_lpid is set to the process-ID of the calling process.

  • shm_nattch is decremented by one. If it becomes 0 and the segment is marked for deletion, the segment is deleted.

After a fork(2) the child inherits the attached shared memory segments.

After an execve(2) all attached shared memory segments are detached from the process.

Upon _exit(2) all attached shared memory segments are detached from the process.


On success shmat() returns the address of the attached shared memory segment; on error (void *) −1 is returned, and errno is set to indicate the cause of the error.

On success shmdt() returns 0; on error −1 is returned, and errno is set to indicate the cause of the error.


When shmat() fails, errno is set to one of the following:


The calling process does not have the required permissions for the requested attach type, and does not have the CAP_IPC_OWNER capability.


shmid points to a removed identifier.


Invalid shmid value, unaligned (i.e., not page-aligned and SHM_RND was not specified) or invalid shmaddr value, or can't attach segment at shmaddr, or SHM_REMAP was specified and shmaddr was NULL.


Could not allocate memory for the descriptor or for the page tables.

When shmdt() fails, errno is set as follows:


There is no shared memory segment attached at shmaddr; or, shmaddr is not aligned on a page boundary.


SVr4, POSIX.1-2001.

In SVID 3 (or perhaps earlier) the type of the shmaddr argument was changed from char * into const void *, and the returned type of shmat() from char * into void *. (Linux libc4 and libc5 have the char * prototypes; glibc2 has void *.)


Using shmat() with shmaddr equal to NULL is the preferred, portable way of attaching a shared memory segment. Be aware that the shared memory segment attached in this way may be attached at different addresses in different processes. Therefore, any pointers maintained within the shared memory must be made relative (typically to the starting address of the segment), rather than absolute.

On Linux, it is possible to attach a shared memory segment even if it is already marked to be deleted. However, POSIX.1-2001 does not specify this behavior and many other implementations do not support it.

The following system parameter affects shmat():


Segment low boundary address multiple. Must be page aligned. For the current implementation the SHMLBA value is PAGE_SIZE.

The implementation places no intrinsic limit on the per-process maximum number of shared memory segments (SHMSEG).


brk(2), mmap(2), shmctl(2), shmget(2), capabilities(7), shm_overview(7), svipc(7)


This page is part of release 3.52 of the Linux man-pages project. A description of the project, and information about reporting bugs, can be found at−pages/.

  Copyright 1993 Giorgio Ciucci (

Permission is granted to make and distribute verbatim copies of this
manual provided the copyright notice and this permission notice are
preserved on all copies.

Permission is granted to copy and distribute modified versions of this
manual under the conditions for verbatim copying, provided that the
entire resulting derived work is distributed under the terms of a
permission notice identical to this one.

Since the Linux kernel and libraries are constantly changing, this
manual page may be incorrect or out-of-date.  The author(s) assume no
responsibility for errors or omissions, or for damages resulting from
the use of the information contained herein.  The author(s) may not
have taken the same level of care in the production of this manual,
which is licensed free of charge, as they might when working

Formatted or processed versions of this manual, if unaccompanied by
the source, must acknowledge the copyright and authors of this work.

Modified Sun Nov 28 17:06:19 1993, Rik Faith (
         with material from Luigi P. Bai (
Portions Copyright 1993 Luigi P. Bai
Modified Tue Oct 22 22:04:23 1996 by Eric S. Raymond <>
Modified, 5 Jan 2002, Michael Kerrisk <>
Modified, 19 Sep 2002, Michael Kerrisk <>
Added SHM_REMAP flag description
Modified, 27 May 2004, Michael Kerrisk <>
    Added notes on capability requirements
Modified, 11 Nov 2004, Michael Kerrisk <>
Language and formatting clean-ups
Changed wording and placement of sentence regarding attachment
of segments marked for destruction

FIXME . Add an example program to this page.
FIXME Linux 2.6.9 added SHM_EXEC, which should be documented