#include <sys/shm.h>

void *shmat(int shmid, const void *shmaddr, int shmflg);
/*
 * shmid   – ID returned by shmget()
 * shmaddr – where in your address space to map it:
 *             NULL → let kernel choose (recommended)
 *             non-NULL → request a specific address (use with SHM_RND)
 * shmflg  – SHM_RDONLY, SHM_REMAP, SHM_RND, or 0
 *
 * Returns: pointer to start of attached segment on success
 *          (void *)-1 on error (NOT NULL — check for -1)
 */

Important: shmat() returns (void *)-1 on error, not NULL. Always check if (addr == (void *)-1), not if (addr == NULL).

Example 1: Basic attach and use as a struct

#include <sys/ipc.h>
#include <sys/shm.h>
#include <stdio.h>

/* Define a structure to impose on the shared memory */
typedef struct {
    int   counter;
    float temperature;
    char  status[32];
} sensor_data_t;

int main(void) {
    int shmid = shmget(0x1234, sizeof(sensor_data_t), IPC_CREAT | 0660);
    if (shmid == -1) { perror("shmget"); return 1; }

    /* Attach — cast return value to your struct pointer */
    sensor_data_t *data = (sensor_data_t *)shmat(shmid, NULL, 0);
    if (data == (sensor_data_t *)-1) { perror("shmat"); return 1; }

    /* Use it exactly like a normal struct */
    data->counter = 42;
    data->temperature = 98.6f;
    snprintf(data->status, sizeof(data->status), "OK");

    printf("counter=%d temp=%.1f status=%s\n",
           data->counter, data->temperature, data->status);

    shmdt(data);
    shmctl(shmid, IPC_RMID, NULL);
    return 0;
}

Example 2: Read-only attach (client/reader)

/* Reader process — attaches with SHM_RDONLY */
#include <sys/shm.h>
#include <stdio.h>

typedef struct {
    int   counter;
    float temperature;
    char  status[32];
} sensor_data_t;

int main(void) {
    /* Open existing segment — no IPC_CREAT */
    int shmid = shmget(0x1234, sizeof(sensor_data_t), 0);
    if (shmid == -1) { perror("shmget"); return 1; }

    /* Attach read-only — any write will cause SIGSEGV */
    const sensor_data_t *data =
        (const sensor_data_t *)shmat(shmid, NULL, SHM_RDONLY);
    if (data == (const sensor_data_t *)-1) { perror("shmat"); return 1; }

    printf("counter=%d temp=%.1f status=%s\n",
           data->counter, data->temperature, data->status);

    /* data->counter = 99;  -- This would SIGSEGV */

    shmdt(data);
    return 0;
}

Example 3: Multiple attachments of the same segment

/* A process can attach the same segment multiple times
 * at different addresses — useful for aliasing tricks */
#include <sys/shm.h>
#include <stdio.h>

int main(void) {
    int shmid = shmget(IPC_PRIVATE, 4096, IPC_CREAT | 0600);
    if (shmid == -1) { perror("shmget"); return 1; }

    /* Attach #1 — read-write */
    char *rw = (char *)shmat(shmid, NULL, 0);
    /* Attach #2 — read-only alias of the same segment */
    const char *ro = (const char *)shmat(shmid, NULL, SHM_RDONLY);

    if (rw == (char *)-1 || ro == (const char *)-1) {
        perror("shmat"); return 1;
    }

    /* Write via rw pointer */
    rw[0] = 'H'; rw[1] = 'i'; rw[2] = '\0';

    /* Read via ro pointer — sees same data */
    printf("Via ro alias: %s\n", ro);  /* prints: Hi */

    shmdt(rw);
    shmdt(ro);  /* Must detach each attachment separately */
    shmctl(shmid, IPC_RMID, NULL);
    return 0;
}

#include <sys/shm.h>

int shmdt(const void *shmaddr);
/*
 * shmaddr – the pointer returned by shmat()
 *           (must be the exact pointer, not an offset into it)
 *
 * Returns: 0 on success, -1 on error (EINVAL if invalid address)
 */

Rules for shmdt():

• You must pass the exact pointer that shmat() returned — not a pointer into the middle of the segment.
• If you attached the same segment multiple times, you must call shmdt() once for each attachment.
• After shmdt(), accessing the old pointer causes a SIGSEGV. Set it to NULL after detaching.
• Detaching does not delete the segment. Other processes remain attached.

/* Correct pattern: detach then nullify */
shmdt(ptr);
ptr = NULL;  /* Prevent accidental use after detach */

/* Wrong: passing offset */
char *base = (char *)shmat(shmid, NULL, 0);
base += 100;
shmdt(base);  /* WRONG — must pass original pointer */

/* fork() example — child inherits parent's shm attachment */
#include <sys/shm.h>
#include <sys/wait.h>
#include <stdio.h>
#include <unistd.h>

int main(void) {
    int shmid = shmget(IPC_PRIVATE, 4096, IPC_CREAT | 0600);
    int *shared = (int *)shmat(shmid, NULL, 0);
    *shared = 0;

    pid_t pid = fork();
    if (pid == 0) {
        /* Child: increment the counter */
        (*shared)++;
        printf("Child wrote: %d\n", *shared);
        shmdt(shared);
        return 0;
    }

    /* Parent: wait for child then read */
    wait(NULL);
    printf("Parent reads: %d\n", *shared);  /* sees 1 */

    shmdt(shared);
    shmctl(shmid, IPC_RMID, NULL);
    return 0;
}

You can check how many processes are currently attached using shmctl(IPC_STAT). This is useful in server shutdown logic — wait until all clients have detached before deleting.

#include <sys/shm.h>
#include <stdio.h>

void print_shm_info(int shmid) {
    struct shmid_ds ds;

    if (shmctl(shmid, IPC_STAT, &ds) == -1) {
        perror("shmctl IPC_STAT");
        return;
    }

    printf("Segment size   : %lu bytes\n", (unsigned long)ds.shm_segsz);
    printf("Attached count : %lu\n",       (unsigned long)ds.shm_nattch);
    printf("Last attach PID: %d\n",        (int)ds.shm_lpid);
    printf("Creator PID    : %d\n",        (int)ds.shm_cpid);
}

/* Usage */
int shmid = shmget(0x1234, 4096, IPC_CREAT | 0660);
void *p   = shmat(shmid, NULL, 0);
print_shm_info(shmid);  /* nattch = 1 */
shmdt(p);
print_shm_info(shmid);  /* nattch = 0 */

Since different processes attach the segment at different virtual addresses, never store raw pointers inside the segment. Use offsets from the segment base address instead.

/* WRONG — stores a virtual pointer; breaks in other process */
typedef struct {
    char *name;       /* BAD: pointer only valid in this process */
    int   value;
} bad_t;

/* CORRECT — stores an offset; valid in all processes */
typedef struct {
    size_t name_offset;  /* offset from start of segment */
    int    value;
    char   name_buf[64]; /* actual string stored in-segment */
} good_t;

/* Access pattern using offset */
char *base   = (char *)shmat(shmid, NULL, 0);
good_t *hdr  = (good_t *)base;

/* Write */
hdr->name_offset = sizeof(good_t);  /* name_buf starts after header */
snprintf(base + hdr->name_offset, 64, "sensor_A");
hdr->value = 100;

/* Read in another process (different base address but same offset) */
char *base2   = (char *)shmat(shmid, NULL, 0);
good_t *hdr2  = (good_t *)base2;
char *name    = base2 + hdr2->name_offset;
printf("Name: %s, Value: %d\n", name, hdr2->value);

It returns (void *)-1 (which equals 0xFFFFFFFF...FF), not NULL. This is unusual because most functions return NULL on failure. The reason is that NULL (address 0) is a valid return value if the kernel happens to map the segment there (though this is rare). The only unambiguous error indicator is (void *)-1. Always check if (addr == (void *)-1).

SHM_RDONLY maps the segment as read-only in the calling process’s page table. Any write attempt causes a SIGSEGV. Use it in reader/client processes that should consume data but must not modify it — similar to opening a file with O_RDONLY. It provides both protection (prevents accidental writes) and a documentation hint about the process’s role.

shm_nattch is a field in struct shmid_ds that the kernel maintains automatically. It counts how many processes currently have the segment attached. It increments on each shmat() and decrements on each shmdt(). A server can poll this field to wait until all clients detach before destroying the segment, or check that no orphaned processes are still using a segment before restarting.

shmdt() requires the exact pointer returned by shmat() — the start of the mapping. If you pass a pointer that is offset from the start (e.g. you incremented the pointer), shmdt() returns -1 with errno = EINVAL. Always save the original pointer from shmat() separately for use in shmdt().

Yes. Each call to shmat() creates a new mapping at a new virtual address. The segment’s attach count (shm_nattch) increments for each attachment. You get two different virtual addresses pointing to the same physical memory. You must call shmdt() separately for each attachment to fully detach. This is sometimes used deliberately to create read-only and read-write aliases simultaneously.

Because shmat() maps the segment at different virtual addresses in different processes (unless you force a fixed address). A pointer value stored by Process A (e.g. 0x7f001234) has no meaning in Process B where the segment might be at 0x7e001234. The solution is to store byte offsets from the start of the segment, which are consistent across all processes regardless of their individual attachment addresses.