#include <sys/types.h>   /* For portability */
#include <sys/shm.h>

void *shmat(int shmid, const void *shmaddr, int shmflg);

/* Returns: address at which segment is attached on success,
            or (void *) -1 on error */

#include <sys/types.h>
#include <sys/shm.h>

int shmdt(const void *shmaddr);

/* Returns: 0 on success, or -1 on error */

shmaddr must be the value previously returned by shmat(). Passing any other address causes EINVAL. After this call the pointer is invalid — any further dereference causes a segfault.

When you call shmat(), the kernel adds new entries to the calling process’s page table. These entries map some range of virtual addresses to the physical frames of the shared segment. Two processes can map the same physical frames at different virtual addresses — the pointer values will differ but they point to the same RAM.

Pass SHM_RDONLY in shmflg to attach the segment for reading only. Attempting to write to a read-only attachment causes a SIGSEGV (segmentation fault), the same signal you get from writing to a const pointer or a write-protected page.

To attach read-only, the process needs only read permission on the segment. Without SHM_RDONLY, both read and write permissions are required.

/* Read-only attach */
const char *shm_ro = shmat(shmid, NULL, SHM_RDONLY);
if (shm_ro == (void *)-1) { perror("shmat rdonly"); exit(1); }

printf("Data: %s\n", shm_ro);   /* OK — reading */

/* shm_ro[0] = 'X';  — WRONG! This would cause SIGSEGV */

shmdt(shm_ro);

/* Practical: producer attaches read-write, consumer read-only */
/* Producer (writer): */
char *buf = shmat(shmid, NULL, 0);            /* read-write */

/* Consumer (reader): */
const char *buf = shmat(shmid, NULL, SHM_RDONLY);  /* read-only */

A single process can call shmat() on the same segment multiple times. Each call creates an independent mapping at a different virtual address. All mappings point to the same physical RAM.

You can mix read-write and read-only attachments in the same process. This is unusual but valid — you might attach read-only for most code and keep one read-write pointer for a privileged update function.

/* Multiple attaches — same segment, different virtual addresses */
char *rw_ptr = shmat(shmid, NULL, 0);          /* read-write */
char *ro_ptr = shmat(shmid, NULL, SHM_RDONLY); /* read-only */

/* Both point to the same physical memory */
printf("rw_ptr = %p\n", (void *)rw_ptr);
printf("ro_ptr = %p\n", (void *)ro_ptr);
/* These addresses will differ, but *rw_ptr == *ro_ptr */

strcpy(rw_ptr, "hello");
printf("via ro: %s\n", ro_ptr);   /* prints: hello */

/* Must detach both independently */
shmdt(rw_ptr);
shmdt(ro_ptr);

Normally, attaching at an address range already occupied by another mapping fails with EINVAL. The Linux-specific SHM_REMAP flag overrides this: it replaces any existing mapping in the target range with the new shared memory segment.

SHM_REMAP requires shmaddr to be non-NULL. It is a non-standard Linux extension — do not use it in portable code.

/* SHM_REMAP: replace whatever is at 'addr' with this segment */
void *addr = (void *)0x60000000;

/* First attach something at that address */
void *old = shmat(other_shmid, addr, 0);

/* Now replace it — without SHM_REMAP this would fail with EINVAL */
void *new = shmat(shmid, addr, SHM_REMAP);
if (new == (void *)-1) {
    perror("shmat SHM_REMAP");
}
/* old mapping is gone, 'addr' now maps to shmid */

shmdt() is straightforward but has important rules:

/* CORRECT: save original pointer */
char *shm_base = shmat(shmid, NULL, 0);   /* original */
char *p        = shm_base;                /* working pointer */

while (*p) p++;   /* advance p */

/* ... */

shmdt(shm_base);   /* pass original — correct */
/* shmdt(p);       would be WRONG if p != shm_base */

/* WRONG pattern — don't do this */
char *shm = shmat(shmid, NULL, 0);
shm += 100;   /* moved shm away from base */
shmdt(shm);   /* EINVAL — wrong address! */

Because two processes attach the same segment at different virtual addresses, a pointer that is valid in Process A (pointing into the shared segment) will point to the wrong place in Process B — or crash it outright.

Use offsets from the base address instead of absolute pointers:

/* WRONG: storing absolute pointer in shared memory */
struct bad_shm {
    char  data[512];
    char *next;        /* absolute pointer — process-specific! */
};

/* CORRECT: use offset from base */
struct good_shm {
    char   data[512];
    size_t next_offset;   /* offset within the segment */
};

/* Writer (Process A): */
struct good_shm *shm = shmat(shmid, NULL, 0);
shm->next_offset = sizeof(struct good_shm);  /* offset, not pointer */

/* Reader (Process B): */
struct good_shm *shm = shmat(shmid, NULL, 0);  /* different virtual addr */
struct good_shm *next = (struct good_shm *)((char *)shm + shm->next_offset);
/* This works regardless of attach address */

This example puts a struct directly in shared memory along with a POSIX mutex (configured for process sharing) to prevent race conditions.

/* shared_struct.h — put this in shared memory */
#ifndef SHARED_STRUCT_H
#define SHARED_STRUCT_H

#include <pthread.h>

#define MAX_MSG 256

typedef struct {
    pthread_mutex_t mutex;      /* MUST be process-shared */
    int             count;
    char            message[MAX_MSG];
    int             ready;      /* flag: 1 = new data available */
} shared_data_t;

#endif

/* producer.c — creates segment and writes data */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ipc.h>
#include <sys/shm.h>
#include <pthread.h>
#include "shared_struct.h"

#define KEY_PATH "/tmp"
#define KEY_ID   'P'

int main(void)
{
    key_t          key    = ftok(KEY_PATH, KEY_ID);
    int            shmid  = shmget(key, sizeof(shared_data_t),
                                   IPC_CREAT | IPC_EXCL | 0660);
    if (shmid == -1) { perror("shmget"); exit(1); }

    shared_data_t *shm = shmat(shmid, NULL, 0);
    if (shm == (void *)-1) { perror("shmat"); exit(1); }

    /* Initialize mutex for cross-process sharing */
    pthread_mutexattr_t attr;
    pthread_mutexattr_init(&attr);
    pthread_mutexattr_setpshared(&attr, PTHREAD_PROCESS_SHARED);
    pthread_mutex_init(&shm->mutex, &attr);
    pthread_mutexattr_destroy(&attr);

    shm->count = 0;
    shm->ready = 0;

    for (int i = 1; i <= 5; i++) {
        pthread_mutex_lock(&shm->mutex);

        shm->count = i;
        snprintf(shm->message, MAX_MSG, "Message #%d from PID %d", i, getpid());
        shm->ready = 1;

        pthread_mutex_unlock(&shm->mutex);

        printf("[producer] wrote: %s\n", shm->message);
        sleep(1);
    }

    /* Signal done */
    pthread_mutex_lock(&shm->mutex);
    shm->ready = -1;   /* sentinel: done */
    pthread_mutex_unlock(&shm->mutex);

    /* Cleanup after consumer has finished */
    sleep(2);
    pthread_mutex_destroy(&shm->mutex);
    shmdt(shm);
    shmctl(shmid, IPC_RMID, NULL);
    printf("[producer] segment deleted\n");
    return 0;
}

/* consumer.c — reads from existing segment */
#include <stdio.h>
#include <stdlib.h>
#include <sys/ipc.h>
#include <sys/shm.h>
#include <pthread.h>
#include "shared_struct.h"

#define KEY_PATH "/tmp"
#define KEY_ID   'P'

int main(void)
{
    key_t          key   = ftok(KEY_PATH, KEY_ID);
    int            shmid = shmget(key, 0, 0);   /* open existing */
    if (shmid == -1) { perror("shmget"); exit(1); }

    shared_data_t *shm = shmat(shmid, NULL, 0);
    if (shm == (void *)-1) { perror("shmat"); exit(1); }

    int last_count = 0;
    while (1) {
        pthread_mutex_lock(&shm->mutex);
        int done  = (shm->ready == -1);
        int fresh = (shm->ready == 1 && shm->count != last_count);

        if (fresh) {
            printf("[consumer] read: %s\n", shm->message);
            last_count = shm->count;
        }
        pthread_mutex_unlock(&shm->mutex);

        if (done) break;
        usleep(100000);   /* poll every 100ms */
    }

    printf("[consumer] producer finished\n");
    shmdt(shm);
    return 0;
}

gcc -o producer producer.c -lpthread
gcc -o consumer consumer.c -lpthread

# Terminal 1:
./producer

# Terminal 2:
./consumer

The shmid_ds structure maintained by the kernel contains shm_nattch — the number of processes currently attached to the segment. You can query it with shmctl(IPC_STAT).

#include <sys/shm.h>
#include <stdio.h>

void print_shm_info(int shmid)
{
    struct shmid_ds ds;

    if (shmctl(shmid, IPC_STAT, &ds) == -1) {
        perror("shmctl IPC_STAT");
        return;
    }

    printf("Segment size:    %zu bytes\n",  ds.shm_segsz);
    printf("Attach count:    %lu\n",         (unsigned long)ds.shm_nattch);
    printf("Owner UID:       %u\n",           ds.shm_perm.uid);
    printf("Creator PID:     %d\n",           (int)ds.shm_cpid);
    printf("Last attach PID: %d\n",           (int)ds.shm_lpid);
}

int main(void)
{
    int shmid = shmget(IPC_PRIVATE, 4096, IPC_CREAT | 0600);
    if (shmid == -1) { perror("shmget"); return 1; }

    printf("Before attach:\n");
    print_shm_info(shmid);

    void *p = shmat(shmid, NULL, 0);

    printf("\nAfter attach:\n");
    print_shm_info(shmid);    /* nattch = 1 */

    shmdt(p);
    printf("\nAfter detach:\n");
    print_shm_info(shmid);    /* nattch = 0 */

    shmctl(shmid, IPC_RMID, NULL);
    return 0;
}