Linux Audio

Check our new training course

Loading...
v3.1
 
  1/*
  2 * linux/ipc/msg.c
  3 * Copyright (C) 1992 Krishna Balasubramanian
  4 *
  5 * Removed all the remaining kerneld mess
  6 * Catch the -EFAULT stuff properly
  7 * Use GFP_KERNEL for messages as in 1.2
  8 * Fixed up the unchecked user space derefs
  9 * Copyright (C) 1998 Alan Cox & Andi Kleen
 10 *
 11 * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
 12 *
 13 * mostly rewritten, threaded and wake-one semantics added
 14 * MSGMAX limit removed, sysctl's added
 15 * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
 16 *
 17 * support for audit of ipc object properties and permission changes
 18 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
 19 *
 20 * namespaces support
 21 * OpenVZ, SWsoft Inc.
 22 * Pavel Emelianov <xemul@openvz.org>
 23 */
 24
 25#include <linux/capability.h>
 26#include <linux/msg.h>
 27#include <linux/spinlock.h>
 28#include <linux/init.h>
 29#include <linux/mm.h>
 30#include <linux/proc_fs.h>
 31#include <linux/list.h>
 32#include <linux/security.h>
 33#include <linux/sched.h>
 34#include <linux/syscalls.h>
 35#include <linux/audit.h>
 36#include <linux/seq_file.h>
 37#include <linux/rwsem.h>
 38#include <linux/nsproxy.h>
 39#include <linux/ipc_namespace.h>
 
 40
 41#include <asm/current.h>
 42#include <asm/uaccess.h>
 43#include "util.h"
 44
 45/*
 46 * one msg_receiver structure for each sleeping receiver:
 47 */
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 48struct msg_receiver {
 49	struct list_head	r_list;
 50	struct task_struct	*r_tsk;
 51
 52	int			r_mode;
 53	long			r_msgtype;
 54	long			r_maxsize;
 55
 56	struct msg_msg		*volatile r_msg;
 57};
 58
 59/* one msg_sender for each sleeping sender */
 60struct msg_sender {
 61	struct list_head	list;
 62	struct task_struct	*tsk;
 
 63};
 64
 65#define SEARCH_ANY		1
 66#define SEARCH_EQUAL		2
 67#define SEARCH_NOTEQUAL		3
 68#define SEARCH_LESSEQUAL	4
 
 69
 70#define msg_ids(ns)	((ns)->ids[IPC_MSG_IDS])
 71
 72#define msg_unlock(msq)		ipc_unlock(&(msq)->q_perm)
 73
 74static void freeque(struct ipc_namespace *, struct kern_ipc_perm *);
 75static int newque(struct ipc_namespace *, struct ipc_params *);
 76#ifdef CONFIG_PROC_FS
 77static int sysvipc_msg_proc_show(struct seq_file *s, void *it);
 78#endif
 79
 80/*
 81 * Scale msgmni with the available lowmem size: the memory dedicated to msg
 82 * queues should occupy at most 1/MSG_MEM_SCALE of lowmem.
 83 * Also take into account the number of nsproxies created so far.
 84 * This should be done staying within the (MSGMNI , IPCMNI/nr_ipc_ns) range.
 85 */
 86void recompute_msgmni(struct ipc_namespace *ns)
 87{
 88	struct sysinfo i;
 89	unsigned long allowed;
 90	int nb_ns;
 91
 92	si_meminfo(&i);
 93	allowed = (((i.totalram - i.totalhigh) / MSG_MEM_SCALE) * i.mem_unit)
 94		/ MSGMNB;
 95	nb_ns = atomic_read(&nr_ipc_ns);
 96	allowed /= nb_ns;
 97
 98	if (allowed < MSGMNI) {
 99		ns->msg_ctlmni = MSGMNI;
100		return;
101	}
102
103	if (allowed > IPCMNI / nb_ns) {
104		ns->msg_ctlmni = IPCMNI / nb_ns;
105		return;
106	}
107
108	ns->msg_ctlmni = allowed;
109}
110
111void msg_init_ns(struct ipc_namespace *ns)
112{
113	ns->msg_ctlmax = MSGMAX;
114	ns->msg_ctlmnb = MSGMNB;
115
116	recompute_msgmni(ns);
117
118	atomic_set(&ns->msg_bytes, 0);
119	atomic_set(&ns->msg_hdrs, 0);
120	ipc_init_ids(&ns->ids[IPC_MSG_IDS]);
121}
122
123#ifdef CONFIG_IPC_NS
124void msg_exit_ns(struct ipc_namespace *ns)
125{
126	free_ipcs(ns, &msg_ids(ns), freeque);
127	idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
128}
129#endif
130
131void __init msg_init(void)
132{
133	msg_init_ns(&init_ipc_ns);
134
135	printk(KERN_INFO "msgmni has been set to %d\n",
136		init_ipc_ns.msg_ctlmni);
137
138	ipc_init_proc_interface("sysvipc/msg",
139				"       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
140				IPC_MSG_IDS, sysvipc_msg_proc_show);
141}
142
143/*
144 * msg_lock_(check_) routines are called in the paths where the rw_mutex
145 * is not held.
146 */
147static inline struct msg_queue *msg_lock(struct ipc_namespace *ns, int id)
148{
149	struct kern_ipc_perm *ipcp = ipc_lock(&msg_ids(ns), id);
150
151	if (IS_ERR(ipcp))
152		return (struct msg_queue *)ipcp;
153
154	return container_of(ipcp, struct msg_queue, q_perm);
155}
156
157static inline struct msg_queue *msg_lock_check(struct ipc_namespace *ns,
158						int id)
159{
160	struct kern_ipc_perm *ipcp = ipc_lock_check(&msg_ids(ns), id);
161
162	if (IS_ERR(ipcp))
163		return (struct msg_queue *)ipcp;
164
165	return container_of(ipcp, struct msg_queue, q_perm);
166}
167
168static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
169{
170	ipc_rmid(&msg_ids(ns), &s->q_perm);
171}
172
 
 
 
 
 
 
 
 
 
173/**
174 * newque - Create a new msg queue
175 * @ns: namespace
176 * @params: ptr to the structure that contains the key and msgflg
177 *
178 * Called with msg_ids.rw_mutex held (writer)
179 */
180static int newque(struct ipc_namespace *ns, struct ipc_params *params)
181{
182	struct msg_queue *msq;
183	int id, retval;
184	key_t key = params->key;
185	int msgflg = params->flg;
186
187	msq = ipc_rcu_alloc(sizeof(*msq));
188	if (!msq)
189		return -ENOMEM;
190
191	msq->q_perm.mode = msgflg & S_IRWXUGO;
192	msq->q_perm.key = key;
193
194	msq->q_perm.security = NULL;
195	retval = security_msg_queue_alloc(msq);
196	if (retval) {
197		ipc_rcu_putref(msq);
198		return retval;
199	}
200
201	/*
202	 * ipc_addid() locks msq
203	 */
204	id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
205	if (id < 0) {
206		security_msg_queue_free(msq);
207		ipc_rcu_putref(msq);
208		return id;
209	}
210
211	msq->q_stime = msq->q_rtime = 0;
212	msq->q_ctime = get_seconds();
213	msq->q_cbytes = msq->q_qnum = 0;
214	msq->q_qbytes = ns->msg_ctlmnb;
215	msq->q_lspid = msq->q_lrpid = 0;
216	INIT_LIST_HEAD(&msq->q_messages);
217	INIT_LIST_HEAD(&msq->q_receivers);
218	INIT_LIST_HEAD(&msq->q_senders);
219
220	msg_unlock(msq);
 
 
 
 
 
 
 
 
221
222	return msq->q_perm.id;
223}
224
225static inline void ss_add(struct msg_queue *msq, struct msg_sender *mss)
 
 
 
 
 
 
 
226{
227	mss->tsk = current;
228	current->state = TASK_INTERRUPTIBLE;
 
229	list_add_tail(&mss->list, &msq->q_senders);
230}
231
232static inline void ss_del(struct msg_sender *mss)
233{
234	if (mss->list.next != NULL)
235		list_del(&mss->list);
236}
237
238static void ss_wakeup(struct list_head *h, int kill)
 
239{
240	struct list_head *tmp;
241
242	tmp = h->next;
243	while (tmp != h) {
244		struct msg_sender *mss;
245
246		mss = list_entry(tmp, struct msg_sender, list);
247		tmp = tmp->next;
248		if (kill)
249			mss->list.next = NULL;
250		wake_up_process(mss->tsk);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
251	}
252}
253
254static void expunge_all(struct msg_queue *msq, int res)
 
255{
256	struct list_head *tmp;
257
258	tmp = msq->q_receivers.next;
259	while (tmp != &msq->q_receivers) {
260		struct msg_receiver *msr;
261
262		msr = list_entry(tmp, struct msg_receiver, r_list);
263		tmp = tmp->next;
264		msr->r_msg = NULL;
265		wake_up_process(msr->r_tsk);
266		smp_mb();
267		msr->r_msg = ERR_PTR(res);
268	}
269}
270
271/*
272 * freeque() wakes up waiters on the sender and receiver waiting queue,
273 * removes the message queue from message queue ID IDR, and cleans up all the
274 * messages associated with this queue.
275 *
276 * msg_ids.rw_mutex (writer) and the spinlock for this message queue are held
277 * before freeque() is called. msg_ids.rw_mutex remains locked on exit.
278 */
279static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
280{
281	struct list_head *tmp;
282	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
 
283
284	expunge_all(msq, -EIDRM);
285	ss_wakeup(&msq->q_senders, 1);
286	msg_rmid(ns, msq);
287	msg_unlock(msq);
288
289	tmp = msq->q_messages.next;
290	while (tmp != &msq->q_messages) {
291		struct msg_msg *msg = list_entry(tmp, struct msg_msg, m_list);
292
293		tmp = tmp->next;
294		atomic_dec(&ns->msg_hdrs);
295		free_msg(msg);
296	}
297	atomic_sub(msq->q_cbytes, &ns->msg_bytes);
298	security_msg_queue_free(msq);
299	ipc_rcu_putref(msq);
 
300}
301
302/*
303 * Called with msg_ids.rw_mutex and ipcp locked.
304 */
305static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
306{
307	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
308
309	return security_msg_queue_associate(msq, msgflg);
310}
311
312SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
313{
314	struct ipc_namespace *ns;
315	struct ipc_ops msg_ops;
 
 
 
316	struct ipc_params msg_params;
317
318	ns = current->nsproxy->ipc_ns;
319
320	msg_ops.getnew = newque;
321	msg_ops.associate = msg_security;
322	msg_ops.more_checks = NULL;
323
324	msg_params.key = key;
325	msg_params.flg = msgflg;
326
327	return ipcget(ns, &msg_ids(ns), &msg_ops, &msg_params);
328}
329
 
 
 
 
 
330static inline unsigned long
331copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
332{
333	switch(version) {
334	case IPC_64:
335		return copy_to_user(buf, in, sizeof(*in));
336	case IPC_OLD:
337	{
338		struct msqid_ds out;
339
340		memset(&out, 0, sizeof(out));
341
342		ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
343
344		out.msg_stime		= in->msg_stime;
345		out.msg_rtime		= in->msg_rtime;
346		out.msg_ctime		= in->msg_ctime;
347
348		if (in->msg_cbytes > USHRT_MAX)
349			out.msg_cbytes	= USHRT_MAX;
350		else
351			out.msg_cbytes	= in->msg_cbytes;
352		out.msg_lcbytes		= in->msg_cbytes;
353
354		if (in->msg_qnum > USHRT_MAX)
355			out.msg_qnum	= USHRT_MAX;
356		else
357			out.msg_qnum	= in->msg_qnum;
358
359		if (in->msg_qbytes > USHRT_MAX)
360			out.msg_qbytes	= USHRT_MAX;
361		else
362			out.msg_qbytes	= in->msg_qbytes;
363		out.msg_lqbytes		= in->msg_qbytes;
364
365		out.msg_lspid		= in->msg_lspid;
366		out.msg_lrpid		= in->msg_lrpid;
367
368		return copy_to_user(buf, &out, sizeof(out));
369	}
370	default:
371		return -EINVAL;
372	}
373}
374
375static inline unsigned long
376copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
377{
378	switch(version) {
379	case IPC_64:
380		if (copy_from_user(out, buf, sizeof(*out)))
381			return -EFAULT;
382		return 0;
383	case IPC_OLD:
384	{
385		struct msqid_ds tbuf_old;
386
387		if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
388			return -EFAULT;
389
390		out->msg_perm.uid      	= tbuf_old.msg_perm.uid;
391		out->msg_perm.gid      	= tbuf_old.msg_perm.gid;
392		out->msg_perm.mode     	= tbuf_old.msg_perm.mode;
393
394		if (tbuf_old.msg_qbytes == 0)
395			out->msg_qbytes	= tbuf_old.msg_lqbytes;
396		else
397			out->msg_qbytes	= tbuf_old.msg_qbytes;
398
399		return 0;
400	}
401	default:
402		return -EINVAL;
403	}
404}
405
406/*
407 * This function handles some msgctl commands which require the rw_mutex
408 * to be held in write mode.
409 * NOTE: no locks must be held, the rw_mutex is taken inside this function.
410 */
411static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
412		       struct msqid_ds __user *buf, int version)
413{
414	struct kern_ipc_perm *ipcp;
415	struct msqid64_ds uninitialized_var(msqid64);
416	struct msg_queue *msq;
417	int err;
418
419	if (cmd == IPC_SET) {
420		if (copy_msqid_from_user(&msqid64, buf, version))
421			return -EFAULT;
422	}
423
424	ipcp = ipcctl_pre_down(ns, &msg_ids(ns), msqid, cmd,
425			       &msqid64.msg_perm, msqid64.msg_qbytes);
426	if (IS_ERR(ipcp))
427		return PTR_ERR(ipcp);
 
 
428
429	msq = container_of(ipcp, struct msg_queue, q_perm);
430
431	err = security_msg_queue_msgctl(msq, cmd);
432	if (err)
433		goto out_unlock;
434
435	switch (cmd) {
436	case IPC_RMID:
 
 
437		freeque(ns, ipcp);
438		goto out_up;
439	case IPC_SET:
440		if (msqid64.msg_qbytes > ns->msg_ctlmnb &&
 
 
 
441		    !capable(CAP_SYS_RESOURCE)) {
442			err = -EPERM;
443			goto out_unlock;
444		}
445
446		msq->q_qbytes = msqid64.msg_qbytes;
 
 
 
 
 
447
448		ipc_update_perm(&msqid64.msg_perm, ipcp);
449		msq->q_ctime = get_seconds();
450		/* sleeping receivers might be excluded by
451		 * stricter permissions.
452		 */
453		expunge_all(msq, -EAGAIN);
454		/* sleeping senders might be able to send
 
455		 * due to a larger queue size.
456		 */
457		ss_wakeup(&msq->q_senders, 0);
458		break;
 
 
 
 
459	default:
460		err = -EINVAL;
 
461	}
462out_unlock:
463	msg_unlock(msq);
 
 
 
464out_up:
465	up_write(&msg_ids(ns).rw_mutex);
466	return err;
467}
468
469SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
470{
471	struct msg_queue *msq;
472	int err, version;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
473	struct ipc_namespace *ns;
 
 
474
475	if (msqid < 0 || cmd < 0)
476		return -EINVAL;
477
478	version = ipc_parse_version(&cmd);
479	ns = current->nsproxy->ipc_ns;
480
481	switch (cmd) {
482	case IPC_INFO:
483	case MSG_INFO:
484	{
485		struct msginfo msginfo;
486		int max_id;
487
488		if (!buf)
489			return -EFAULT;
490		/*
491		 * We must not return kernel stack data.
492		 * due to padding, it's not enough
493		 * to set all member fields.
494		 */
495		err = security_msg_queue_msgctl(NULL, cmd);
496		if (err)
497			return err;
498
499		memset(&msginfo, 0, sizeof(msginfo));
500		msginfo.msgmni = ns->msg_ctlmni;
501		msginfo.msgmax = ns->msg_ctlmax;
502		msginfo.msgmnb = ns->msg_ctlmnb;
503		msginfo.msgssz = MSGSSZ;
504		msginfo.msgseg = MSGSEG;
505		down_read(&msg_ids(ns).rw_mutex);
506		if (cmd == MSG_INFO) {
507			msginfo.msgpool = msg_ids(ns).in_use;
508			msginfo.msgmap = atomic_read(&ns->msg_hdrs);
509			msginfo.msgtql = atomic_read(&ns->msg_bytes);
510		} else {
511			msginfo.msgmap = MSGMAP;
512			msginfo.msgpool = MSGPOOL;
513			msginfo.msgtql = MSGTQL;
514		}
515		max_id = ipc_get_maxid(&msg_ids(ns));
516		up_read(&msg_ids(ns).rw_mutex);
517		if (copy_to_user(buf, &msginfo, sizeof(struct msginfo)))
518			return -EFAULT;
519		return (max_id < 0) ? 0 : max_id;
520	}
521	case MSG_STAT:	/* msqid is an index rather than a msg queue id */
 
522	case IPC_STAT:
523	{
524		struct msqid64_ds tbuf;
525		int success_return;
526
527		if (!buf)
 
 
 
528			return -EFAULT;
 
 
 
 
 
 
 
529
530		if (cmd == MSG_STAT) {
531			msq = msg_lock(ns, msqid);
532			if (IS_ERR(msq))
533				return PTR_ERR(msq);
534			success_return = msq->q_perm.id;
535		} else {
536			msq = msg_lock_check(ns, msqid);
537			if (IS_ERR(msq))
538				return PTR_ERR(msq);
539			success_return = 0;
540		}
541		err = -EACCES;
542		if (ipcperms(ns, &msq->q_perm, S_IRUGO))
543			goto out_unlock;
544
545		err = security_msg_queue_msgctl(msq, cmd);
546		if (err)
547			goto out_unlock;
 
548
549		memset(&tbuf, 0, sizeof(tbuf));
 
550
551		kernel_to_ipc64_perm(&msq->q_perm, &tbuf.msg_perm);
552		tbuf.msg_stime  = msq->q_stime;
553		tbuf.msg_rtime  = msq->q_rtime;
554		tbuf.msg_ctime  = msq->q_ctime;
555		tbuf.msg_cbytes = msq->q_cbytes;
556		tbuf.msg_qnum   = msq->q_qnum;
557		tbuf.msg_qbytes = msq->q_qbytes;
558		tbuf.msg_lspid  = msq->q_lspid;
559		tbuf.msg_lrpid  = msq->q_lrpid;
560		msg_unlock(msq);
561		if (copy_msqid_to_user(buf, &tbuf, version))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
562			return -EFAULT;
563		return success_return;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
564	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
565	case IPC_SET:
 
 
 
566	case IPC_RMID:
567		err = msgctl_down(ns, msqid, cmd, buf, version);
568		return err;
569	default:
570		return  -EINVAL;
571	}
 
572
573out_unlock:
574	msg_unlock(msq);
575	return err;
 
 
 
 
 
 
 
 
576}
577
 
 
 
 
 
 
 
578static int testmsg(struct msg_msg *msg, long type, int mode)
579{
580	switch(mode)
581	{
582		case SEARCH_ANY:
 
 
 
583			return 1;
584		case SEARCH_LESSEQUAL:
585			if (msg->m_type <=type)
586				return 1;
587			break;
588		case SEARCH_EQUAL:
589			if (msg->m_type == type)
590				return 1;
591			break;
592		case SEARCH_NOTEQUAL:
593			if (msg->m_type != type)
594				return 1;
595			break;
596	}
597	return 0;
598}
599
600static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg)
 
601{
602	struct list_head *tmp;
603
604	tmp = msq->q_receivers.next;
605	while (tmp != &msq->q_receivers) {
606		struct msg_receiver *msr;
607
608		msr = list_entry(tmp, struct msg_receiver, r_list);
609		tmp = tmp->next;
610		if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
611		    !security_msg_queue_msgrcv(msq, msg, msr->r_tsk,
612					       msr->r_msgtype, msr->r_mode)) {
613
614			list_del(&msr->r_list);
615			if (msr->r_maxsize < msg->m_ts) {
616				msr->r_msg = NULL;
617				wake_up_process(msr->r_tsk);
618				smp_mb();
619				msr->r_msg = ERR_PTR(-E2BIG);
620			} else {
621				msr->r_msg = NULL;
622				msq->q_lrpid = task_pid_vnr(msr->r_tsk);
623				msq->q_rtime = get_seconds();
624				wake_up_process(msr->r_tsk);
625				smp_mb();
626				msr->r_msg = msg;
627
 
 
628				return 1;
629			}
630		}
631	}
 
632	return 0;
633}
634
635long do_msgsnd(int msqid, long mtype, void __user *mtext,
636		size_t msgsz, int msgflg)
637{
638	struct msg_queue *msq;
639	struct msg_msg *msg;
640	int err;
641	struct ipc_namespace *ns;
 
642
643	ns = current->nsproxy->ipc_ns;
644
645	if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0)
646		return -EINVAL;
647	if (mtype < 1)
648		return -EINVAL;
649
650	msg = load_msg(mtext, msgsz);
651	if (IS_ERR(msg))
652		return PTR_ERR(msg);
653
654	msg->m_type = mtype;
655	msg->m_ts = msgsz;
656
657	msq = msg_lock_check(ns, msqid);
 
658	if (IS_ERR(msq)) {
659		err = PTR_ERR(msq);
660		goto out_free;
661	}
662
 
 
663	for (;;) {
664		struct msg_sender s;
665
666		err = -EACCES;
667		if (ipcperms(ns, &msq->q_perm, S_IWUGO))
668			goto out_unlock_free;
 
 
 
 
 
 
669
670		err = security_msg_queue_msgsnd(msq, msg, msgflg);
671		if (err)
672			goto out_unlock_free;
673
674		if (msgsz + msq->q_cbytes <= msq->q_qbytes &&
675				1 + msq->q_qnum <= msq->q_qbytes) {
676			break;
677		}
678
679		/* queue full, wait: */
680		if (msgflg & IPC_NOWAIT) {
681			err = -EAGAIN;
682			goto out_unlock_free;
 
 
 
 
 
 
 
 
683		}
684		ss_add(msq, &s);
685		ipc_rcu_getref(msq);
686		msg_unlock(msq);
687		schedule();
688
689		ipc_lock_by_ptr(&msq->q_perm);
690		ipc_rcu_putref(msq);
691		if (msq->q_perm.deleted) {
 
 
 
692			err = -EIDRM;
693			goto out_unlock_free;
694		}
695		ss_del(&s);
696
697		if (signal_pending(current)) {
698			err = -ERESTARTNOHAND;
699			goto out_unlock_free;
700		}
 
701	}
702
703	msq->q_lspid = task_tgid_vnr(current);
704	msq->q_stime = get_seconds();
705
706	if (!pipelined_send(msq, msg)) {
707		/* no one is waiting for this message, enqueue it */
708		list_add_tail(&msg->m_list, &msq->q_messages);
709		msq->q_cbytes += msgsz;
710		msq->q_qnum++;
711		atomic_add(msgsz, &ns->msg_bytes);
712		atomic_inc(&ns->msg_hdrs);
713	}
714
715	err = 0;
716	msg = NULL;
717
718out_unlock_free:
719	msg_unlock(msq);
720out_free:
 
 
721	if (msg != NULL)
722		free_msg(msg);
723	return err;
724}
725
726SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
727		int, msgflg)
728{
729	long mtype;
730
731	if (get_user(mtype, &msgp->mtype))
732		return -EFAULT;
733	return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
734}
735
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
736static inline int convert_mode(long *msgtyp, int msgflg)
737{
 
 
738	/*
739	 *  find message of correct type.
740	 *  msgtyp = 0 => get first.
741	 *  msgtyp > 0 => get first message of matching type.
742	 *  msgtyp < 0 => get message with least type must be < abs(msgtype).
743	 */
744	if (*msgtyp == 0)
745		return SEARCH_ANY;
746	if (*msgtyp < 0) {
747		*msgtyp = -*msgtyp;
 
 
 
748		return SEARCH_LESSEQUAL;
749	}
750	if (msgflg & MSG_EXCEPT)
751		return SEARCH_NOTEQUAL;
752	return SEARCH_EQUAL;
753}
754
755long do_msgrcv(int msqid, long *pmtype, void __user *mtext,
756		size_t msgsz, long msgtyp, int msgflg)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
757{
758	struct msg_queue *msq;
759	struct msg_msg *msg;
760	int mode;
 
761	struct ipc_namespace *ns;
 
 
 
 
762
763	if (msqid < 0 || (long) msgsz < 0)
764		return -EINVAL;
 
 
 
 
 
 
 
 
765	mode = convert_mode(&msgtyp, msgflg);
766	ns = current->nsproxy->ipc_ns;
767
768	msq = msg_lock_check(ns, msqid);
769	if (IS_ERR(msq))
 
 
 
770		return PTR_ERR(msq);
 
771
772	for (;;) {
773		struct msg_receiver msr_d;
774		struct list_head *tmp;
775
776		msg = ERR_PTR(-EACCES);
777		if (ipcperms(ns, &msq->q_perm, S_IRUGO))
778			goto out_unlock;
779
780		msg = ERR_PTR(-EAGAIN);
781		tmp = msq->q_messages.next;
782		while (tmp != &msq->q_messages) {
783			struct msg_msg *walk_msg;
784
785			walk_msg = list_entry(tmp, struct msg_msg, m_list);
786			if (testmsg(walk_msg, msgtyp, mode) &&
787			    !security_msg_queue_msgrcv(msq, walk_msg, current,
788						       msgtyp, mode)) {
789
790				msg = walk_msg;
791				if (mode == SEARCH_LESSEQUAL &&
792						walk_msg->m_type != 1) {
793					msg = walk_msg;
794					msgtyp = walk_msg->m_type - 1;
795				} else {
796					msg = walk_msg;
797					break;
798				}
799			}
800			tmp = tmp->next;
801		}
 
 
802		if (!IS_ERR(msg)) {
803			/*
804			 * Found a suitable message.
805			 * Unlink it from the queue.
806			 */
807			if ((msgsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
808				msg = ERR_PTR(-E2BIG);
809				goto out_unlock;
810			}
 
 
 
 
 
 
 
 
 
811			list_del(&msg->m_list);
812			msq->q_qnum--;
813			msq->q_rtime = get_seconds();
814			msq->q_lrpid = task_tgid_vnr(current);
815			msq->q_cbytes -= msg->m_ts;
816			atomic_sub(msg->m_ts, &ns->msg_bytes);
817			atomic_dec(&ns->msg_hdrs);
818			ss_wakeup(&msq->q_senders, 0);
819			msg_unlock(msq);
820			break;
821		}
 
822		/* No message waiting. Wait for a message */
823		if (msgflg & IPC_NOWAIT) {
824			msg = ERR_PTR(-ENOMSG);
825			goto out_unlock;
826		}
 
827		list_add_tail(&msr_d.r_list, &msq->q_receivers);
828		msr_d.r_tsk = current;
829		msr_d.r_msgtype = msgtyp;
830		msr_d.r_mode = mode;
831		if (msgflg & MSG_NOERROR)
832			msr_d.r_maxsize = INT_MAX;
833		else
834			msr_d.r_maxsize = msgsz;
835		msr_d.r_msg = ERR_PTR(-EAGAIN);
836		current->state = TASK_INTERRUPTIBLE;
837		msg_unlock(msq);
838
 
 
839		schedule();
840
841		/* Lockless receive, part 1:
842		 * Disable preemption.  We don't hold a reference to the queue
843		 * and getting a reference would defeat the idea of a lockless
844		 * operation, thus the code relies on rcu to guarantee the
845		 * existence of msq:
 
846		 * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
847		 * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
848		 * rcu_read_lock() prevents preemption between reading r_msg
849		 * and the spin_lock() inside ipc_lock_by_ptr().
850		 */
851		rcu_read_lock();
852
853		/* Lockless receive, part 2:
854		 * Wait until pipelined_send or expunge_all are outside of
855		 * wake_up_process(). There is a race with exit(), see
856		 * ipc/mqueue.c for the details.
857		 */
858		msg = (struct msg_msg*)msr_d.r_msg;
859		while (msg == NULL) {
860			cpu_relax();
861			msg = (struct msg_msg *)msr_d.r_msg;
862		}
863
864		/* Lockless receive, part 3:
865		 * If there is a message or an error then accept it without
866		 * locking.
867		 */
868		if (msg != ERR_PTR(-EAGAIN)) {
869			rcu_read_unlock();
870			break;
871		}
872
873		/* Lockless receive, part 3:
874		 * Acquire the queue spinlock.
875		 */
876		ipc_lock_by_ptr(&msq->q_perm);
877		rcu_read_unlock();
878
879		/* Lockless receive, part 4:
880		 * Repeat test after acquiring the spinlock.
881		 */
882		msg = (struct msg_msg*)msr_d.r_msg;
883		if (msg != ERR_PTR(-EAGAIN))
884			goto out_unlock;
885
886		list_del(&msr_d.r_list);
887		if (signal_pending(current)) {
888			msg = ERR_PTR(-ERESTARTNOHAND);
889out_unlock:
890			msg_unlock(msq);
891			break;
892		}
 
 
893	}
894	if (IS_ERR(msg))
895		return PTR_ERR(msg);
896
897	msgsz = (msgsz > msg->m_ts) ? msg->m_ts : msgsz;
898	*pmtype = msg->m_type;
899	if (store_msg(mtext, msg, msgsz))
900		msgsz = -EFAULT;
 
 
 
 
 
901
 
902	free_msg(msg);
903
904	return msgsz;
 
 
 
 
 
 
905}
906
907SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
908		long, msgtyp, int, msgflg)
909{
910	long err, mtype;
 
911
912	err =  do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
913	if (err < 0)
914		goto out;
915
916	if (put_user(mtype, &msgp->mtype))
917		err = -EFAULT;
918out:
919	return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
920}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
921
922#ifdef CONFIG_PROC_FS
923static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
924{
925	struct msg_queue *msq = it;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
926
927	return seq_printf(s,
928			"%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
929			msq->q_perm.key,
930			msq->q_perm.id,
931			msq->q_perm.mode,
932			msq->q_cbytes,
933			msq->q_qnum,
934			msq->q_lspid,
935			msq->q_lrpid,
936			msq->q_perm.uid,
937			msq->q_perm.gid,
938			msq->q_perm.cuid,
939			msq->q_perm.cgid,
940			msq->q_stime,
941			msq->q_rtime,
942			msq->q_ctime);
943}
944#endif
v5.4
   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * linux/ipc/msg.c
   4 * Copyright (C) 1992 Krishna Balasubramanian
   5 *
   6 * Removed all the remaining kerneld mess
   7 * Catch the -EFAULT stuff properly
   8 * Use GFP_KERNEL for messages as in 1.2
   9 * Fixed up the unchecked user space derefs
  10 * Copyright (C) 1998 Alan Cox & Andi Kleen
  11 *
  12 * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
  13 *
  14 * mostly rewritten, threaded and wake-one semantics added
  15 * MSGMAX limit removed, sysctl's added
  16 * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
  17 *
  18 * support for audit of ipc object properties and permission changes
  19 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
  20 *
  21 * namespaces support
  22 * OpenVZ, SWsoft Inc.
  23 * Pavel Emelianov <xemul@openvz.org>
  24 */
  25
  26#include <linux/capability.h>
  27#include <linux/msg.h>
  28#include <linux/spinlock.h>
  29#include <linux/init.h>
  30#include <linux/mm.h>
  31#include <linux/proc_fs.h>
  32#include <linux/list.h>
  33#include <linux/security.h>
  34#include <linux/sched/wake_q.h>
  35#include <linux/syscalls.h>
  36#include <linux/audit.h>
  37#include <linux/seq_file.h>
  38#include <linux/rwsem.h>
  39#include <linux/nsproxy.h>
  40#include <linux/ipc_namespace.h>
  41#include <linux/rhashtable.h>
  42
  43#include <asm/current.h>
  44#include <linux/uaccess.h>
  45#include "util.h"
  46
  47/* one msq_queue structure for each present queue on the system */
  48struct msg_queue {
  49	struct kern_ipc_perm q_perm;
  50	time64_t q_stime;		/* last msgsnd time */
  51	time64_t q_rtime;		/* last msgrcv time */
  52	time64_t q_ctime;		/* last change time */
  53	unsigned long q_cbytes;		/* current number of bytes on queue */
  54	unsigned long q_qnum;		/* number of messages in queue */
  55	unsigned long q_qbytes;		/* max number of bytes on queue */
  56	struct pid *q_lspid;		/* pid of last msgsnd */
  57	struct pid *q_lrpid;		/* last receive pid */
  58
  59	struct list_head q_messages;
  60	struct list_head q_receivers;
  61	struct list_head q_senders;
  62} __randomize_layout;
  63
  64/* one msg_receiver structure for each sleeping receiver */
  65struct msg_receiver {
  66	struct list_head	r_list;
  67	struct task_struct	*r_tsk;
  68
  69	int			r_mode;
  70	long			r_msgtype;
  71	long			r_maxsize;
  72
  73	struct msg_msg		*r_msg;
  74};
  75
  76/* one msg_sender for each sleeping sender */
  77struct msg_sender {
  78	struct list_head	list;
  79	struct task_struct	*tsk;
  80	size_t                  msgsz;
  81};
  82
  83#define SEARCH_ANY		1
  84#define SEARCH_EQUAL		2
  85#define SEARCH_NOTEQUAL		3
  86#define SEARCH_LESSEQUAL	4
  87#define SEARCH_NUMBER		5
  88
  89#define msg_ids(ns)	((ns)->ids[IPC_MSG_IDS])
  90
  91static inline struct msg_queue *msq_obtain_object(struct ipc_namespace *ns, int id)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  92{
  93	struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&msg_ids(ns), id);
  94
  95	if (IS_ERR(ipcp))
  96		return ERR_CAST(ipcp);
  97
  98	return container_of(ipcp, struct msg_queue, q_perm);
  99}
 100
 101static inline struct msg_queue *msq_obtain_object_check(struct ipc_namespace *ns,
 102							int id)
 103{
 104	struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&msg_ids(ns), id);
 105
 106	if (IS_ERR(ipcp))
 107		return ERR_CAST(ipcp);
 108
 109	return container_of(ipcp, struct msg_queue, q_perm);
 110}
 111
 112static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
 113{
 114	ipc_rmid(&msg_ids(ns), &s->q_perm);
 115}
 116
 117static void msg_rcu_free(struct rcu_head *head)
 118{
 119	struct kern_ipc_perm *p = container_of(head, struct kern_ipc_perm, rcu);
 120	struct msg_queue *msq = container_of(p, struct msg_queue, q_perm);
 121
 122	security_msg_queue_free(&msq->q_perm);
 123	kvfree(msq);
 124}
 125
 126/**
 127 * newque - Create a new msg queue
 128 * @ns: namespace
 129 * @params: ptr to the structure that contains the key and msgflg
 130 *
 131 * Called with msg_ids.rwsem held (writer)
 132 */
 133static int newque(struct ipc_namespace *ns, struct ipc_params *params)
 134{
 135	struct msg_queue *msq;
 136	int retval;
 137	key_t key = params->key;
 138	int msgflg = params->flg;
 139
 140	msq = kvmalloc(sizeof(*msq), GFP_KERNEL);
 141	if (unlikely(!msq))
 142		return -ENOMEM;
 143
 144	msq->q_perm.mode = msgflg & S_IRWXUGO;
 145	msq->q_perm.key = key;
 146
 147	msq->q_perm.security = NULL;
 148	retval = security_msg_queue_alloc(&msq->q_perm);
 149	if (retval) {
 150		kvfree(msq);
 151		return retval;
 152	}
 153
 
 
 
 
 
 
 
 
 
 
 154	msq->q_stime = msq->q_rtime = 0;
 155	msq->q_ctime = ktime_get_real_seconds();
 156	msq->q_cbytes = msq->q_qnum = 0;
 157	msq->q_qbytes = ns->msg_ctlmnb;
 158	msq->q_lspid = msq->q_lrpid = NULL;
 159	INIT_LIST_HEAD(&msq->q_messages);
 160	INIT_LIST_HEAD(&msq->q_receivers);
 161	INIT_LIST_HEAD(&msq->q_senders);
 162
 163	/* ipc_addid() locks msq upon success. */
 164	retval = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
 165	if (retval < 0) {
 166		ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
 167		return retval;
 168	}
 169
 170	ipc_unlock_object(&msq->q_perm);
 171	rcu_read_unlock();
 172
 173	return msq->q_perm.id;
 174}
 175
 176static inline bool msg_fits_inqueue(struct msg_queue *msq, size_t msgsz)
 177{
 178	return msgsz + msq->q_cbytes <= msq->q_qbytes &&
 179		1 + msq->q_qnum <= msq->q_qbytes;
 180}
 181
 182static inline void ss_add(struct msg_queue *msq,
 183			  struct msg_sender *mss, size_t msgsz)
 184{
 185	mss->tsk = current;
 186	mss->msgsz = msgsz;
 187	__set_current_state(TASK_INTERRUPTIBLE);
 188	list_add_tail(&mss->list, &msq->q_senders);
 189}
 190
 191static inline void ss_del(struct msg_sender *mss)
 192{
 193	if (mss->list.next)
 194		list_del(&mss->list);
 195}
 196
 197static void ss_wakeup(struct msg_queue *msq,
 198		      struct wake_q_head *wake_q, bool kill)
 199{
 200	struct msg_sender *mss, *t;
 201	struct task_struct *stop_tsk = NULL;
 202	struct list_head *h = &msq->q_senders;
 
 
 203
 204	list_for_each_entry_safe(mss, t, h, list) {
 
 205		if (kill)
 206			mss->list.next = NULL;
 207
 208		/*
 209		 * Stop at the first task we don't wakeup,
 210		 * we've already iterated the original
 211		 * sender queue.
 212		 */
 213		else if (stop_tsk == mss->tsk)
 214			break;
 215		/*
 216		 * We are not in an EIDRM scenario here, therefore
 217		 * verify that we really need to wakeup the task.
 218		 * To maintain current semantics and wakeup order,
 219		 * move the sender to the tail on behalf of the
 220		 * blocked task.
 221		 */
 222		else if (!msg_fits_inqueue(msq, mss->msgsz)) {
 223			if (!stop_tsk)
 224				stop_tsk = mss->tsk;
 225
 226			list_move_tail(&mss->list, &msq->q_senders);
 227			continue;
 228		}
 229
 230		wake_q_add(wake_q, mss->tsk);
 231	}
 232}
 233
 234static void expunge_all(struct msg_queue *msq, int res,
 235			struct wake_q_head *wake_q)
 236{
 237	struct msg_receiver *msr, *t;
 
 
 
 
 238
 239	list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
 240		wake_q_add(wake_q, msr->r_tsk);
 241		WRITE_ONCE(msr->r_msg, ERR_PTR(res));
 
 
 
 242	}
 243}
 244
 245/*
 246 * freeque() wakes up waiters on the sender and receiver waiting queue,
 247 * removes the message queue from message queue ID IDR, and cleans up all the
 248 * messages associated with this queue.
 249 *
 250 * msg_ids.rwsem (writer) and the spinlock for this message queue are held
 251 * before freeque() is called. msg_ids.rwsem remains locked on exit.
 252 */
 253static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
 254{
 255	struct msg_msg *msg, *t;
 256	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
 257	DEFINE_WAKE_Q(wake_q);
 258
 259	expunge_all(msq, -EIDRM, &wake_q);
 260	ss_wakeup(msq, &wake_q, true);
 261	msg_rmid(ns, msq);
 262	ipc_unlock_object(&msq->q_perm);
 263	wake_up_q(&wake_q);
 264	rcu_read_unlock();
 
 
 265
 266	list_for_each_entry_safe(msg, t, &msq->q_messages, m_list) {
 267		atomic_dec(&ns->msg_hdrs);
 268		free_msg(msg);
 269	}
 270	atomic_sub(msq->q_cbytes, &ns->msg_bytes);
 271	ipc_update_pid(&msq->q_lspid, NULL);
 272	ipc_update_pid(&msq->q_lrpid, NULL);
 273	ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
 274}
 275
 276long ksys_msgget(key_t key, int msgflg)
 
 
 
 
 
 
 
 
 
 
 277{
 278	struct ipc_namespace *ns;
 279	static const struct ipc_ops msg_ops = {
 280		.getnew = newque,
 281		.associate = security_msg_queue_associate,
 282	};
 283	struct ipc_params msg_params;
 284
 285	ns = current->nsproxy->ipc_ns;
 286
 
 
 
 
 287	msg_params.key = key;
 288	msg_params.flg = msgflg;
 289
 290	return ipcget(ns, &msg_ids(ns), &msg_ops, &msg_params);
 291}
 292
 293SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
 294{
 295	return ksys_msgget(key, msgflg);
 296}
 297
 298static inline unsigned long
 299copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
 300{
 301	switch (version) {
 302	case IPC_64:
 303		return copy_to_user(buf, in, sizeof(*in));
 304	case IPC_OLD:
 305	{
 306		struct msqid_ds out;
 307
 308		memset(&out, 0, sizeof(out));
 309
 310		ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
 311
 312		out.msg_stime		= in->msg_stime;
 313		out.msg_rtime		= in->msg_rtime;
 314		out.msg_ctime		= in->msg_ctime;
 315
 316		if (in->msg_cbytes > USHRT_MAX)
 317			out.msg_cbytes	= USHRT_MAX;
 318		else
 319			out.msg_cbytes	= in->msg_cbytes;
 320		out.msg_lcbytes		= in->msg_cbytes;
 321
 322		if (in->msg_qnum > USHRT_MAX)
 323			out.msg_qnum	= USHRT_MAX;
 324		else
 325			out.msg_qnum	= in->msg_qnum;
 326
 327		if (in->msg_qbytes > USHRT_MAX)
 328			out.msg_qbytes	= USHRT_MAX;
 329		else
 330			out.msg_qbytes	= in->msg_qbytes;
 331		out.msg_lqbytes		= in->msg_qbytes;
 332
 333		out.msg_lspid		= in->msg_lspid;
 334		out.msg_lrpid		= in->msg_lrpid;
 335
 336		return copy_to_user(buf, &out, sizeof(out));
 337	}
 338	default:
 339		return -EINVAL;
 340	}
 341}
 342
 343static inline unsigned long
 344copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
 345{
 346	switch (version) {
 347	case IPC_64:
 348		if (copy_from_user(out, buf, sizeof(*out)))
 349			return -EFAULT;
 350		return 0;
 351	case IPC_OLD:
 352	{
 353		struct msqid_ds tbuf_old;
 354
 355		if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
 356			return -EFAULT;
 357
 358		out->msg_perm.uid	= tbuf_old.msg_perm.uid;
 359		out->msg_perm.gid	= tbuf_old.msg_perm.gid;
 360		out->msg_perm.mode	= tbuf_old.msg_perm.mode;
 361
 362		if (tbuf_old.msg_qbytes == 0)
 363			out->msg_qbytes	= tbuf_old.msg_lqbytes;
 364		else
 365			out->msg_qbytes	= tbuf_old.msg_qbytes;
 366
 367		return 0;
 368	}
 369	default:
 370		return -EINVAL;
 371	}
 372}
 373
 374/*
 375 * This function handles some msgctl commands which require the rwsem
 376 * to be held in write mode.
 377 * NOTE: no locks must be held, the rwsem is taken inside this function.
 378 */
 379static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
 380			struct msqid64_ds *msqid64)
 381{
 382	struct kern_ipc_perm *ipcp;
 
 383	struct msg_queue *msq;
 384	int err;
 385
 386	down_write(&msg_ids(ns).rwsem);
 387	rcu_read_lock();
 
 
 388
 389	ipcp = ipcctl_obtain_check(ns, &msg_ids(ns), msqid, cmd,
 390				      &msqid64->msg_perm, msqid64->msg_qbytes);
 391	if (IS_ERR(ipcp)) {
 392		err = PTR_ERR(ipcp);
 393		goto out_unlock1;
 394	}
 395
 396	msq = container_of(ipcp, struct msg_queue, q_perm);
 397
 398	err = security_msg_queue_msgctl(&msq->q_perm, cmd);
 399	if (err)
 400		goto out_unlock1;
 401
 402	switch (cmd) {
 403	case IPC_RMID:
 404		ipc_lock_object(&msq->q_perm);
 405		/* freeque unlocks the ipc object and rcu */
 406		freeque(ns, ipcp);
 407		goto out_up;
 408	case IPC_SET:
 409	{
 410		DEFINE_WAKE_Q(wake_q);
 411
 412		if (msqid64->msg_qbytes > ns->msg_ctlmnb &&
 413		    !capable(CAP_SYS_RESOURCE)) {
 414			err = -EPERM;
 415			goto out_unlock1;
 416		}
 417
 418		ipc_lock_object(&msq->q_perm);
 419		err = ipc_update_perm(&msqid64->msg_perm, ipcp);
 420		if (err)
 421			goto out_unlock0;
 422
 423		msq->q_qbytes = msqid64->msg_qbytes;
 424
 425		msq->q_ctime = ktime_get_real_seconds();
 426		/*
 427		 * Sleeping receivers might be excluded by
 428		 * stricter permissions.
 429		 */
 430		expunge_all(msq, -EAGAIN, &wake_q);
 431		/*
 432		 * Sleeping senders might be able to send
 433		 * due to a larger queue size.
 434		 */
 435		ss_wakeup(msq, &wake_q, false);
 436		ipc_unlock_object(&msq->q_perm);
 437		wake_up_q(&wake_q);
 438
 439		goto out_unlock1;
 440	}
 441	default:
 442		err = -EINVAL;
 443		goto out_unlock1;
 444	}
 445
 446out_unlock0:
 447	ipc_unlock_object(&msq->q_perm);
 448out_unlock1:
 449	rcu_read_unlock();
 450out_up:
 451	up_write(&msg_ids(ns).rwsem);
 452	return err;
 453}
 454
 455static int msgctl_info(struct ipc_namespace *ns, int msqid,
 456			 int cmd, struct msginfo *msginfo)
 457{
 458	int err;
 459	int max_idx;
 460
 461	/*
 462	 * We must not return kernel stack data.
 463	 * due to padding, it's not enough
 464	 * to set all member fields.
 465	 */
 466	err = security_msg_queue_msgctl(NULL, cmd);
 467	if (err)
 468		return err;
 469
 470	memset(msginfo, 0, sizeof(*msginfo));
 471	msginfo->msgmni = ns->msg_ctlmni;
 472	msginfo->msgmax = ns->msg_ctlmax;
 473	msginfo->msgmnb = ns->msg_ctlmnb;
 474	msginfo->msgssz = MSGSSZ;
 475	msginfo->msgseg = MSGSEG;
 476	down_read(&msg_ids(ns).rwsem);
 477	if (cmd == MSG_INFO) {
 478		msginfo->msgpool = msg_ids(ns).in_use;
 479		msginfo->msgmap = atomic_read(&ns->msg_hdrs);
 480		msginfo->msgtql = atomic_read(&ns->msg_bytes);
 481	} else {
 482		msginfo->msgmap = MSGMAP;
 483		msginfo->msgpool = MSGPOOL;
 484		msginfo->msgtql = MSGTQL;
 485	}
 486	max_idx = ipc_get_maxidx(&msg_ids(ns));
 487	up_read(&msg_ids(ns).rwsem);
 488	return (max_idx < 0) ? 0 : max_idx;
 489}
 490
 491static int msgctl_stat(struct ipc_namespace *ns, int msqid,
 492			 int cmd, struct msqid64_ds *p)
 493{
 494	struct msg_queue *msq;
 495	int err;
 496
 497	memset(p, 0, sizeof(*p));
 498
 499	rcu_read_lock();
 500	if (cmd == MSG_STAT || cmd == MSG_STAT_ANY) {
 501		msq = msq_obtain_object(ns, msqid);
 502		if (IS_ERR(msq)) {
 503			err = PTR_ERR(msq);
 504			goto out_unlock;
 505		}
 506	} else { /* IPC_STAT */
 507		msq = msq_obtain_object_check(ns, msqid);
 508		if (IS_ERR(msq)) {
 509			err = PTR_ERR(msq);
 510			goto out_unlock;
 511		}
 512	}
 513
 514	/* see comment for SHM_STAT_ANY */
 515	if (cmd == MSG_STAT_ANY)
 516		audit_ipc_obj(&msq->q_perm);
 517	else {
 518		err = -EACCES;
 519		if (ipcperms(ns, &msq->q_perm, S_IRUGO))
 520			goto out_unlock;
 521	}
 522
 523	err = security_msg_queue_msgctl(&msq->q_perm, cmd);
 524	if (err)
 525		goto out_unlock;
 526
 527	ipc_lock_object(&msq->q_perm);
 528
 529	if (!ipc_valid_object(&msq->q_perm)) {
 530		ipc_unlock_object(&msq->q_perm);
 531		err = -EIDRM;
 532		goto out_unlock;
 533	}
 534
 535	kernel_to_ipc64_perm(&msq->q_perm, &p->msg_perm);
 536	p->msg_stime  = msq->q_stime;
 537	p->msg_rtime  = msq->q_rtime;
 538	p->msg_ctime  = msq->q_ctime;
 539#ifndef CONFIG_64BIT
 540	p->msg_stime_high = msq->q_stime >> 32;
 541	p->msg_rtime_high = msq->q_rtime >> 32;
 542	p->msg_ctime_high = msq->q_ctime >> 32;
 543#endif
 544	p->msg_cbytes = msq->q_cbytes;
 545	p->msg_qnum   = msq->q_qnum;
 546	p->msg_qbytes = msq->q_qbytes;
 547	p->msg_lspid  = pid_vnr(msq->q_lspid);
 548	p->msg_lrpid  = pid_vnr(msq->q_lrpid);
 549
 550	if (cmd == IPC_STAT) {
 551		/*
 552		 * As defined in SUS:
 553		 * Return 0 on success
 554		 */
 555		err = 0;
 556	} else {
 557		/*
 558		 * MSG_STAT and MSG_STAT_ANY (both Linux specific)
 559		 * Return the full id, including the sequence number
 560		 */
 561		err = msq->q_perm.id;
 562	}
 563
 564	ipc_unlock_object(&msq->q_perm);
 565out_unlock:
 566	rcu_read_unlock();
 567	return err;
 568}
 569
 570static long ksys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf, int version)
 571{
 572	struct ipc_namespace *ns;
 573	struct msqid64_ds msqid64;
 574	int err;
 575
 576	if (msqid < 0 || cmd < 0)
 577		return -EINVAL;
 578
 
 579	ns = current->nsproxy->ipc_ns;
 580
 581	switch (cmd) {
 582	case IPC_INFO:
 583	case MSG_INFO: {
 
 584		struct msginfo msginfo;
 585		err = msgctl_info(ns, msqid, cmd, &msginfo);
 586		if (err < 0)
 
 
 
 
 
 
 
 
 
 587			return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 588		if (copy_to_user(buf, &msginfo, sizeof(struct msginfo)))
 589			err = -EFAULT;
 590		return err;
 591	}
 592	case MSG_STAT:	/* msqid is an index rather than a msg queue id */
 593	case MSG_STAT_ANY:
 594	case IPC_STAT:
 595		err = msgctl_stat(ns, msqid, cmd, &msqid64);
 596		if (err < 0)
 597			return err;
 598		if (copy_msqid_to_user(buf, &msqid64, version))
 599			err = -EFAULT;
 600		return err;
 601	case IPC_SET:
 602		if (copy_msqid_from_user(&msqid64, buf, version))
 603			return -EFAULT;
 604		/* fallthru */
 605	case IPC_RMID:
 606		return msgctl_down(ns, msqid, cmd, &msqid64);
 607	default:
 608		return  -EINVAL;
 609	}
 610}
 611
 612SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
 613{
 614	return ksys_msgctl(msqid, cmd, buf, IPC_64);
 615}
 
 
 
 
 
 
 
 
 
 
 616
 617#ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
 618long ksys_old_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
 619{
 620	int version = ipc_parse_version(&cmd);
 621
 622	return ksys_msgctl(msqid, cmd, buf, version);
 623}
 624
 625SYSCALL_DEFINE3(old_msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
 626{
 627	return ksys_old_msgctl(msqid, cmd, buf);
 628}
 629#endif
 630
 631#ifdef CONFIG_COMPAT
 632
 633struct compat_msqid_ds {
 634	struct compat_ipc_perm msg_perm;
 635	compat_uptr_t msg_first;
 636	compat_uptr_t msg_last;
 637	old_time32_t msg_stime;
 638	old_time32_t msg_rtime;
 639	old_time32_t msg_ctime;
 640	compat_ulong_t msg_lcbytes;
 641	compat_ulong_t msg_lqbytes;
 642	unsigned short msg_cbytes;
 643	unsigned short msg_qnum;
 644	unsigned short msg_qbytes;
 645	compat_ipc_pid_t msg_lspid;
 646	compat_ipc_pid_t msg_lrpid;
 647};
 648
 649static int copy_compat_msqid_from_user(struct msqid64_ds *out, void __user *buf,
 650					int version)
 651{
 652	memset(out, 0, sizeof(*out));
 653	if (version == IPC_64) {
 654		struct compat_msqid64_ds __user *p = buf;
 655		if (get_compat_ipc64_perm(&out->msg_perm, &p->msg_perm))
 656			return -EFAULT;
 657		if (get_user(out->msg_qbytes, &p->msg_qbytes))
 658			return -EFAULT;
 659	} else {
 660		struct compat_msqid_ds __user *p = buf;
 661		if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm))
 662			return -EFAULT;
 663		if (get_user(out->msg_qbytes, &p->msg_qbytes))
 664			return -EFAULT;
 665	}
 666	return 0;
 667}
 668
 669static int copy_compat_msqid_to_user(void __user *buf, struct msqid64_ds *in,
 670					int version)
 671{
 672	if (version == IPC_64) {
 673		struct compat_msqid64_ds v;
 674		memset(&v, 0, sizeof(v));
 675		to_compat_ipc64_perm(&v.msg_perm, &in->msg_perm);
 676		v.msg_stime	 = lower_32_bits(in->msg_stime);
 677		v.msg_stime_high = upper_32_bits(in->msg_stime);
 678		v.msg_rtime	 = lower_32_bits(in->msg_rtime);
 679		v.msg_rtime_high = upper_32_bits(in->msg_rtime);
 680		v.msg_ctime	 = lower_32_bits(in->msg_ctime);
 681		v.msg_ctime_high = upper_32_bits(in->msg_ctime);
 682		v.msg_cbytes = in->msg_cbytes;
 683		v.msg_qnum = in->msg_qnum;
 684		v.msg_qbytes = in->msg_qbytes;
 685		v.msg_lspid = in->msg_lspid;
 686		v.msg_lrpid = in->msg_lrpid;
 687		return copy_to_user(buf, &v, sizeof(v));
 688	} else {
 689		struct compat_msqid_ds v;
 690		memset(&v, 0, sizeof(v));
 691		to_compat_ipc_perm(&v.msg_perm, &in->msg_perm);
 692		v.msg_stime = in->msg_stime;
 693		v.msg_rtime = in->msg_rtime;
 694		v.msg_ctime = in->msg_ctime;
 695		v.msg_cbytes = in->msg_cbytes;
 696		v.msg_qnum = in->msg_qnum;
 697		v.msg_qbytes = in->msg_qbytes;
 698		v.msg_lspid = in->msg_lspid;
 699		v.msg_lrpid = in->msg_lrpid;
 700		return copy_to_user(buf, &v, sizeof(v));
 701	}
 702}
 703
 704static long compat_ksys_msgctl(int msqid, int cmd, void __user *uptr, int version)
 705{
 706	struct ipc_namespace *ns;
 707	int err;
 708	struct msqid64_ds msqid64;
 709
 710	ns = current->nsproxy->ipc_ns;
 711
 712	if (msqid < 0 || cmd < 0)
 713		return -EINVAL;
 714
 715	switch (cmd & (~IPC_64)) {
 716	case IPC_INFO:
 717	case MSG_INFO: {
 718		struct msginfo msginfo;
 719		err = msgctl_info(ns, msqid, cmd, &msginfo);
 720		if (err < 0)
 721			return err;
 722		if (copy_to_user(uptr, &msginfo, sizeof(struct msginfo)))
 723			err = -EFAULT;
 724		return err;
 725	}
 726	case IPC_STAT:
 727	case MSG_STAT:
 728	case MSG_STAT_ANY:
 729		err = msgctl_stat(ns, msqid, cmd, &msqid64);
 730		if (err < 0)
 731			return err;
 732		if (copy_compat_msqid_to_user(uptr, &msqid64, version))
 733			err = -EFAULT;
 734		return err;
 735	case IPC_SET:
 736		if (copy_compat_msqid_from_user(&msqid64, uptr, version))
 737			return -EFAULT;
 738		/* fallthru */
 739	case IPC_RMID:
 740		return msgctl_down(ns, msqid, cmd, &msqid64);
 
 741	default:
 742		return -EINVAL;
 743	}
 744}
 745
 746COMPAT_SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, void __user *, uptr)
 747{
 748	return compat_ksys_msgctl(msqid, cmd, uptr, IPC_64);
 749}
 750
 751#ifdef CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION
 752long compat_ksys_old_msgctl(int msqid, int cmd, void __user *uptr)
 753{
 754	int version = compat_ipc_parse_version(&cmd);
 755
 756	return compat_ksys_msgctl(msqid, cmd, uptr, version);
 757}
 758
 759COMPAT_SYSCALL_DEFINE3(old_msgctl, int, msqid, int, cmd, void __user *, uptr)
 760{
 761	return compat_ksys_old_msgctl(msqid, cmd, uptr);
 762}
 763#endif
 764#endif
 765
 766static int testmsg(struct msg_msg *msg, long type, int mode)
 767{
 768	switch (mode) {
 769	case SEARCH_ANY:
 770	case SEARCH_NUMBER:
 771		return 1;
 772	case SEARCH_LESSEQUAL:
 773		if (msg->m_type <= type)
 774			return 1;
 775		break;
 776	case SEARCH_EQUAL:
 777		if (msg->m_type == type)
 778			return 1;
 779		break;
 780	case SEARCH_NOTEQUAL:
 781		if (msg->m_type != type)
 782			return 1;
 783		break;
 
 
 
 784	}
 785	return 0;
 786}
 787
 788static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg,
 789				 struct wake_q_head *wake_q)
 790{
 791	struct msg_receiver *msr, *t;
 
 
 
 
 792
 793	list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
 
 794		if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
 795		    !security_msg_queue_msgrcv(&msq->q_perm, msg, msr->r_tsk,
 796					       msr->r_msgtype, msr->r_mode)) {
 797
 798			list_del(&msr->r_list);
 799			if (msr->r_maxsize < msg->m_ts) {
 800				wake_q_add(wake_q, msr->r_tsk);
 801				WRITE_ONCE(msr->r_msg, ERR_PTR(-E2BIG));
 
 
 802			} else {
 803				ipc_update_pid(&msq->q_lrpid, task_pid(msr->r_tsk));
 804				msq->q_rtime = ktime_get_real_seconds();
 
 
 
 
 805
 806				wake_q_add(wake_q, msr->r_tsk);
 807				WRITE_ONCE(msr->r_msg, msg);
 808				return 1;
 809			}
 810		}
 811	}
 812
 813	return 0;
 814}
 815
 816static long do_msgsnd(int msqid, long mtype, void __user *mtext,
 817		size_t msgsz, int msgflg)
 818{
 819	struct msg_queue *msq;
 820	struct msg_msg *msg;
 821	int err;
 822	struct ipc_namespace *ns;
 823	DEFINE_WAKE_Q(wake_q);
 824
 825	ns = current->nsproxy->ipc_ns;
 826
 827	if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0)
 828		return -EINVAL;
 829	if (mtype < 1)
 830		return -EINVAL;
 831
 832	msg = load_msg(mtext, msgsz);
 833	if (IS_ERR(msg))
 834		return PTR_ERR(msg);
 835
 836	msg->m_type = mtype;
 837	msg->m_ts = msgsz;
 838
 839	rcu_read_lock();
 840	msq = msq_obtain_object_check(ns, msqid);
 841	if (IS_ERR(msq)) {
 842		err = PTR_ERR(msq);
 843		goto out_unlock1;
 844	}
 845
 846	ipc_lock_object(&msq->q_perm);
 847
 848	for (;;) {
 849		struct msg_sender s;
 850
 851		err = -EACCES;
 852		if (ipcperms(ns, &msq->q_perm, S_IWUGO))
 853			goto out_unlock0;
 854
 855		/* raced with RMID? */
 856		if (!ipc_valid_object(&msq->q_perm)) {
 857			err = -EIDRM;
 858			goto out_unlock0;
 859		}
 860
 861		err = security_msg_queue_msgsnd(&msq->q_perm, msg, msgflg);
 862		if (err)
 863			goto out_unlock0;
 864
 865		if (msg_fits_inqueue(msq, msgsz))
 
 866			break;
 
 867
 868		/* queue full, wait: */
 869		if (msgflg & IPC_NOWAIT) {
 870			err = -EAGAIN;
 871			goto out_unlock0;
 872		}
 873
 874		/* enqueue the sender and prepare to block */
 875		ss_add(msq, &s, msgsz);
 876
 877		if (!ipc_rcu_getref(&msq->q_perm)) {
 878			err = -EIDRM;
 879			goto out_unlock0;
 880		}
 881
 882		ipc_unlock_object(&msq->q_perm);
 883		rcu_read_unlock();
 884		schedule();
 885
 886		rcu_read_lock();
 887		ipc_lock_object(&msq->q_perm);
 888
 889		ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
 890		/* raced with RMID? */
 891		if (!ipc_valid_object(&msq->q_perm)) {
 892			err = -EIDRM;
 893			goto out_unlock0;
 894		}
 895		ss_del(&s);
 896
 897		if (signal_pending(current)) {
 898			err = -ERESTARTNOHAND;
 899			goto out_unlock0;
 900		}
 901
 902	}
 903
 904	ipc_update_pid(&msq->q_lspid, task_tgid(current));
 905	msq->q_stime = ktime_get_real_seconds();
 906
 907	if (!pipelined_send(msq, msg, &wake_q)) {
 908		/* no one is waiting for this message, enqueue it */
 909		list_add_tail(&msg->m_list, &msq->q_messages);
 910		msq->q_cbytes += msgsz;
 911		msq->q_qnum++;
 912		atomic_add(msgsz, &ns->msg_bytes);
 913		atomic_inc(&ns->msg_hdrs);
 914	}
 915
 916	err = 0;
 917	msg = NULL;
 918
 919out_unlock0:
 920	ipc_unlock_object(&msq->q_perm);
 921	wake_up_q(&wake_q);
 922out_unlock1:
 923	rcu_read_unlock();
 924	if (msg != NULL)
 925		free_msg(msg);
 926	return err;
 927}
 928
 929long ksys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz,
 930		 int msgflg)
 931{
 932	long mtype;
 933
 934	if (get_user(mtype, &msgp->mtype))
 935		return -EFAULT;
 936	return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
 937}
 938
 939SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
 940		int, msgflg)
 941{
 942	return ksys_msgsnd(msqid, msgp, msgsz, msgflg);
 943}
 944
 945#ifdef CONFIG_COMPAT
 946
 947struct compat_msgbuf {
 948	compat_long_t mtype;
 949	char mtext[1];
 950};
 951
 952long compat_ksys_msgsnd(int msqid, compat_uptr_t msgp,
 953		       compat_ssize_t msgsz, int msgflg)
 954{
 955	struct compat_msgbuf __user *up = compat_ptr(msgp);
 956	compat_long_t mtype;
 957
 958	if (get_user(mtype, &up->mtype))
 959		return -EFAULT;
 960	return do_msgsnd(msqid, mtype, up->mtext, (ssize_t)msgsz, msgflg);
 961}
 962
 963COMPAT_SYSCALL_DEFINE4(msgsnd, int, msqid, compat_uptr_t, msgp,
 964		       compat_ssize_t, msgsz, int, msgflg)
 965{
 966	return compat_ksys_msgsnd(msqid, msgp, msgsz, msgflg);
 967}
 968#endif
 969
 970static inline int convert_mode(long *msgtyp, int msgflg)
 971{
 972	if (msgflg & MSG_COPY)
 973		return SEARCH_NUMBER;
 974	/*
 975	 *  find message of correct type.
 976	 *  msgtyp = 0 => get first.
 977	 *  msgtyp > 0 => get first message of matching type.
 978	 *  msgtyp < 0 => get message with least type must be < abs(msgtype).
 979	 */
 980	if (*msgtyp == 0)
 981		return SEARCH_ANY;
 982	if (*msgtyp < 0) {
 983		if (*msgtyp == LONG_MIN) /* -LONG_MIN is undefined */
 984			*msgtyp = LONG_MAX;
 985		else
 986			*msgtyp = -*msgtyp;
 987		return SEARCH_LESSEQUAL;
 988	}
 989	if (msgflg & MSG_EXCEPT)
 990		return SEARCH_NOTEQUAL;
 991	return SEARCH_EQUAL;
 992}
 993
 994static long do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
 995{
 996	struct msgbuf __user *msgp = dest;
 997	size_t msgsz;
 998
 999	if (put_user(msg->m_type, &msgp->mtype))
1000		return -EFAULT;
1001
1002	msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
1003	if (store_msg(msgp->mtext, msg, msgsz))
1004		return -EFAULT;
1005	return msgsz;
1006}
1007
1008#ifdef CONFIG_CHECKPOINT_RESTORE
1009/*
1010 * This function creates new kernel message structure, large enough to store
1011 * bufsz message bytes.
1012 */
1013static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
1014{
1015	struct msg_msg *copy;
1016
1017	/*
1018	 * Create dummy message to copy real message to.
1019	 */
1020	copy = load_msg(buf, bufsz);
1021	if (!IS_ERR(copy))
1022		copy->m_ts = bufsz;
1023	return copy;
1024}
1025
1026static inline void free_copy(struct msg_msg *copy)
1027{
1028	if (copy)
1029		free_msg(copy);
1030}
1031#else
1032static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
1033{
1034	return ERR_PTR(-ENOSYS);
1035}
1036
1037static inline void free_copy(struct msg_msg *copy)
1038{
1039}
1040#endif
1041
1042static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
1043{
1044	struct msg_msg *msg, *found = NULL;
1045	long count = 0;
1046
1047	list_for_each_entry(msg, &msq->q_messages, m_list) {
1048		if (testmsg(msg, *msgtyp, mode) &&
1049		    !security_msg_queue_msgrcv(&msq->q_perm, msg, current,
1050					       *msgtyp, mode)) {
1051			if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
1052				*msgtyp = msg->m_type - 1;
1053				found = msg;
1054			} else if (mode == SEARCH_NUMBER) {
1055				if (*msgtyp == count)
1056					return msg;
1057			} else
1058				return msg;
1059			count++;
1060		}
1061	}
1062
1063	return found ?: ERR_PTR(-EAGAIN);
1064}
1065
1066static long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgflg,
1067	       long (*msg_handler)(void __user *, struct msg_msg *, size_t))
1068{
 
 
1069	int mode;
1070	struct msg_queue *msq;
1071	struct ipc_namespace *ns;
1072	struct msg_msg *msg, *copy = NULL;
1073	DEFINE_WAKE_Q(wake_q);
1074
1075	ns = current->nsproxy->ipc_ns;
1076
1077	if (msqid < 0 || (long) bufsz < 0)
1078		return -EINVAL;
1079
1080	if (msgflg & MSG_COPY) {
1081		if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT))
1082			return -EINVAL;
1083		copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
1084		if (IS_ERR(copy))
1085			return PTR_ERR(copy);
1086	}
1087	mode = convert_mode(&msgtyp, msgflg);
 
1088
1089	rcu_read_lock();
1090	msq = msq_obtain_object_check(ns, msqid);
1091	if (IS_ERR(msq)) {
1092		rcu_read_unlock();
1093		free_copy(copy);
1094		return PTR_ERR(msq);
1095	}
1096
1097	for (;;) {
1098		struct msg_receiver msr_d;
 
1099
1100		msg = ERR_PTR(-EACCES);
1101		if (ipcperms(ns, &msq->q_perm, S_IRUGO))
1102			goto out_unlock1;
1103
1104		ipc_lock_object(&msq->q_perm);
1105
1106		/* raced with RMID? */
1107		if (!ipc_valid_object(&msq->q_perm)) {
1108			msg = ERR_PTR(-EIDRM);
1109			goto out_unlock0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1110		}
1111
1112		msg = find_msg(msq, &msgtyp, mode);
1113		if (!IS_ERR(msg)) {
1114			/*
1115			 * Found a suitable message.
1116			 * Unlink it from the queue.
1117			 */
1118			if ((bufsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
1119				msg = ERR_PTR(-E2BIG);
1120				goto out_unlock0;
1121			}
1122			/*
1123			 * If we are copying, then do not unlink message and do
1124			 * not update queue parameters.
1125			 */
1126			if (msgflg & MSG_COPY) {
1127				msg = copy_msg(msg, copy);
1128				goto out_unlock0;
1129			}
1130
1131			list_del(&msg->m_list);
1132			msq->q_qnum--;
1133			msq->q_rtime = ktime_get_real_seconds();
1134			ipc_update_pid(&msq->q_lrpid, task_tgid(current));
1135			msq->q_cbytes -= msg->m_ts;
1136			atomic_sub(msg->m_ts, &ns->msg_bytes);
1137			atomic_dec(&ns->msg_hdrs);
1138			ss_wakeup(msq, &wake_q, false);
1139
1140			goto out_unlock0;
1141		}
1142
1143		/* No message waiting. Wait for a message */
1144		if (msgflg & IPC_NOWAIT) {
1145			msg = ERR_PTR(-ENOMSG);
1146			goto out_unlock0;
1147		}
1148
1149		list_add_tail(&msr_d.r_list, &msq->q_receivers);
1150		msr_d.r_tsk = current;
1151		msr_d.r_msgtype = msgtyp;
1152		msr_d.r_mode = mode;
1153		if (msgflg & MSG_NOERROR)
1154			msr_d.r_maxsize = INT_MAX;
1155		else
1156			msr_d.r_maxsize = bufsz;
1157		msr_d.r_msg = ERR_PTR(-EAGAIN);
1158		__set_current_state(TASK_INTERRUPTIBLE);
 
1159
1160		ipc_unlock_object(&msq->q_perm);
1161		rcu_read_unlock();
1162		schedule();
1163
1164		/*
1165		 * Lockless receive, part 1:
1166		 * We don't hold a reference to the queue and getting a
1167		 * reference would defeat the idea of a lockless operation,
1168		 * thus the code relies on rcu to guarantee the existence of
1169		 * msq:
1170		 * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
1171		 * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
 
 
1172		 */
1173		rcu_read_lock();
1174
1175		/*
1176		 * Lockless receive, part 2:
1177		 * The work in pipelined_send() and expunge_all():
1178		 * - Set pointer to message
1179		 * - Queue the receiver task for later wakeup
1180		 * - Wake up the process after the lock is dropped.
1181		 *
1182		 * Should the process wake up before this wakeup (due to a
1183		 * signal) it will either see the message and continue ...
 
 
 
 
 
1184		 */
1185		msg = READ_ONCE(msr_d.r_msg);
1186		if (msg != ERR_PTR(-EAGAIN))
1187			goto out_unlock1;
 
1188
1189		 /*
1190		  * ... or see -EAGAIN, acquire the lock to check the message
1191		  * again.
1192		  */
1193		ipc_lock_object(&msq->q_perm);
1194
1195		msg = msr_d.r_msg;
 
 
 
1196		if (msg != ERR_PTR(-EAGAIN))
1197			goto out_unlock0;
1198
1199		list_del(&msr_d.r_list);
1200		if (signal_pending(current)) {
1201			msg = ERR_PTR(-ERESTARTNOHAND);
1202			goto out_unlock0;
 
 
1203		}
1204
1205		ipc_unlock_object(&msq->q_perm);
1206	}
 
 
1207
1208out_unlock0:
1209	ipc_unlock_object(&msq->q_perm);
1210	wake_up_q(&wake_q);
1211out_unlock1:
1212	rcu_read_unlock();
1213	if (IS_ERR(msg)) {
1214		free_copy(copy);
1215		return PTR_ERR(msg);
1216	}
1217
1218	bufsz = msg_handler(buf, msg, bufsz);
1219	free_msg(msg);
1220
1221	return bufsz;
1222}
1223
1224long ksys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
1225		 long msgtyp, int msgflg)
1226{
1227	return do_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg, do_msg_fill);
1228}
1229
1230SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
1231		long, msgtyp, int, msgflg)
1232{
1233	return ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
1234}
1235
1236#ifdef CONFIG_COMPAT
1237static long compat_do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
1238{
1239	struct compat_msgbuf __user *msgp = dest;
1240	size_t msgsz;
1241
1242	if (put_user(msg->m_type, &msgp->mtype))
1243		return -EFAULT;
1244
1245	msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
1246	if (store_msg(msgp->mtext, msg, msgsz))
1247		return -EFAULT;
1248	return msgsz;
1249}
1250
1251long compat_ksys_msgrcv(int msqid, compat_uptr_t msgp, compat_ssize_t msgsz,
1252			compat_long_t msgtyp, int msgflg)
1253{
1254	return do_msgrcv(msqid, compat_ptr(msgp), (ssize_t)msgsz, (long)msgtyp,
1255			 msgflg, compat_do_msg_fill);
1256}
1257
1258COMPAT_SYSCALL_DEFINE5(msgrcv, int, msqid, compat_uptr_t, msgp,
1259		       compat_ssize_t, msgsz, compat_long_t, msgtyp,
1260		       int, msgflg)
1261{
1262	return compat_ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
1263}
1264#endif
1265
1266void msg_init_ns(struct ipc_namespace *ns)
1267{
1268	ns->msg_ctlmax = MSGMAX;
1269	ns->msg_ctlmnb = MSGMNB;
1270	ns->msg_ctlmni = MSGMNI;
1271
1272	atomic_set(&ns->msg_bytes, 0);
1273	atomic_set(&ns->msg_hdrs, 0);
1274	ipc_init_ids(&ns->ids[IPC_MSG_IDS]);
1275}
1276
1277#ifdef CONFIG_IPC_NS
1278void msg_exit_ns(struct ipc_namespace *ns)
1279{
1280	free_ipcs(ns, &msg_ids(ns), freeque);
1281	idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
1282	rhashtable_destroy(&ns->ids[IPC_MSG_IDS].key_ht);
1283}
1284#endif
1285
1286#ifdef CONFIG_PROC_FS
1287static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
1288{
1289	struct pid_namespace *pid_ns = ipc_seq_pid_ns(s);
1290	struct user_namespace *user_ns = seq_user_ns(s);
1291	struct kern_ipc_perm *ipcp = it;
1292	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
1293
1294	seq_printf(s,
1295		   "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10llu %10llu %10llu\n",
1296		   msq->q_perm.key,
1297		   msq->q_perm.id,
1298		   msq->q_perm.mode,
1299		   msq->q_cbytes,
1300		   msq->q_qnum,
1301		   pid_nr_ns(msq->q_lspid, pid_ns),
1302		   pid_nr_ns(msq->q_lrpid, pid_ns),
1303		   from_kuid_munged(user_ns, msq->q_perm.uid),
1304		   from_kgid_munged(user_ns, msq->q_perm.gid),
1305		   from_kuid_munged(user_ns, msq->q_perm.cuid),
1306		   from_kgid_munged(user_ns, msq->q_perm.cgid),
1307		   msq->q_stime,
1308		   msq->q_rtime,
1309		   msq->q_ctime);
1310
1311	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1312}
1313#endif
1314
1315void __init msg_init(void)
1316{
1317	msg_init_ns(&init_ipc_ns);
1318
1319	ipc_init_proc_interface("sysvipc/msg",
1320				"       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
1321				IPC_MSG_IDS, sysvipc_msg_proc_show);
1322}