Linux Audio

Check our new training course

Loading...
v3.5.6
 
  1/*
  2 * linux/ipc/msg.c
  3 * Copyright (C) 1992 Krishna Balasubramanian
  4 *
  5 * Removed all the remaining kerneld mess
  6 * Catch the -EFAULT stuff properly
  7 * Use GFP_KERNEL for messages as in 1.2
  8 * Fixed up the unchecked user space derefs
  9 * Copyright (C) 1998 Alan Cox & Andi Kleen
 10 *
 11 * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
 12 *
 13 * mostly rewritten, threaded and wake-one semantics added
 14 * MSGMAX limit removed, sysctl's added
 15 * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
 16 *
 17 * support for audit of ipc object properties and permission changes
 18 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
 19 *
 20 * namespaces support
 21 * OpenVZ, SWsoft Inc.
 22 * Pavel Emelianov <xemul@openvz.org>
 23 */
 24
 25#include <linux/capability.h>
 26#include <linux/msg.h>
 27#include <linux/spinlock.h>
 28#include <linux/init.h>
 29#include <linux/mm.h>
 30#include <linux/proc_fs.h>
 31#include <linux/list.h>
 32#include <linux/security.h>
 33#include <linux/sched.h>
 34#include <linux/syscalls.h>
 35#include <linux/audit.h>
 36#include <linux/seq_file.h>
 37#include <linux/rwsem.h>
 38#include <linux/nsproxy.h>
 39#include <linux/ipc_namespace.h>
 40
 41#include <asm/current.h>
 42#include <asm/uaccess.h>
 43#include "util.h"
 44
 45/*
 46 * one msg_receiver structure for each sleeping receiver:
 47 */
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 48struct msg_receiver {
 49	struct list_head	r_list;
 50	struct task_struct	*r_tsk;
 51
 52	int			r_mode;
 53	long			r_msgtype;
 54	long			r_maxsize;
 55
 56	struct msg_msg		*volatile r_msg;
 57};
 58
 59/* one msg_sender for each sleeping sender */
 60struct msg_sender {
 61	struct list_head	list;
 62	struct task_struct	*tsk;
 
 63};
 64
 65#define SEARCH_ANY		1
 66#define SEARCH_EQUAL		2
 67#define SEARCH_NOTEQUAL		3
 68#define SEARCH_LESSEQUAL	4
 
 69
 70#define msg_ids(ns)	((ns)->ids[IPC_MSG_IDS])
 71
 72#define msg_unlock(msq)		ipc_unlock(&(msq)->q_perm)
 73
 74static void freeque(struct ipc_namespace *, struct kern_ipc_perm *);
 75static int newque(struct ipc_namespace *, struct ipc_params *);
 76#ifdef CONFIG_PROC_FS
 77static int sysvipc_msg_proc_show(struct seq_file *s, void *it);
 78#endif
 79
 80/*
 81 * Scale msgmni with the available lowmem size: the memory dedicated to msg
 82 * queues should occupy at most 1/MSG_MEM_SCALE of lowmem.
 83 * Also take into account the number of nsproxies created so far.
 84 * This should be done staying within the (MSGMNI , IPCMNI/nr_ipc_ns) range.
 85 */
 86void recompute_msgmni(struct ipc_namespace *ns)
 87{
 88	struct sysinfo i;
 89	unsigned long allowed;
 90	int nb_ns;
 91
 92	si_meminfo(&i);
 93	allowed = (((i.totalram - i.totalhigh) / MSG_MEM_SCALE) * i.mem_unit)
 94		/ MSGMNB;
 95	nb_ns = atomic_read(&nr_ipc_ns);
 96	allowed /= nb_ns;
 97
 98	if (allowed < MSGMNI) {
 99		ns->msg_ctlmni = MSGMNI;
100		return;
101	}
102
103	if (allowed > IPCMNI / nb_ns) {
104		ns->msg_ctlmni = IPCMNI / nb_ns;
105		return;
106	}
107
108	ns->msg_ctlmni = allowed;
109}
110
111void msg_init_ns(struct ipc_namespace *ns)
112{
113	ns->msg_ctlmax = MSGMAX;
114	ns->msg_ctlmnb = MSGMNB;
115
116	recompute_msgmni(ns);
117
118	atomic_set(&ns->msg_bytes, 0);
119	atomic_set(&ns->msg_hdrs, 0);
120	ipc_init_ids(&ns->ids[IPC_MSG_IDS]);
121}
122
123#ifdef CONFIG_IPC_NS
124void msg_exit_ns(struct ipc_namespace *ns)
125{
126	free_ipcs(ns, &msg_ids(ns), freeque);
127	idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
128}
129#endif
130
131void __init msg_init(void)
132{
133	msg_init_ns(&init_ipc_ns);
134
135	printk(KERN_INFO "msgmni has been set to %d\n",
136		init_ipc_ns.msg_ctlmni);
137
138	ipc_init_proc_interface("sysvipc/msg",
139				"       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
140				IPC_MSG_IDS, sysvipc_msg_proc_show);
141}
142
143/*
144 * msg_lock_(check_) routines are called in the paths where the rw_mutex
145 * is not held.
146 */
147static inline struct msg_queue *msg_lock(struct ipc_namespace *ns, int id)
148{
149	struct kern_ipc_perm *ipcp = ipc_lock(&msg_ids(ns), id);
150
151	if (IS_ERR(ipcp))
152		return (struct msg_queue *)ipcp;
153
154	return container_of(ipcp, struct msg_queue, q_perm);
155}
156
157static inline struct msg_queue *msg_lock_check(struct ipc_namespace *ns,
158						int id)
159{
160	struct kern_ipc_perm *ipcp = ipc_lock_check(&msg_ids(ns), id);
161
162	if (IS_ERR(ipcp))
163		return (struct msg_queue *)ipcp;
164
165	return container_of(ipcp, struct msg_queue, q_perm);
166}
167
168static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
169{
170	ipc_rmid(&msg_ids(ns), &s->q_perm);
171}
172
 
 
 
 
 
 
 
 
 
173/**
174 * newque - Create a new msg queue
175 * @ns: namespace
176 * @params: ptr to the structure that contains the key and msgflg
177 *
178 * Called with msg_ids.rw_mutex held (writer)
179 */
180static int newque(struct ipc_namespace *ns, struct ipc_params *params)
181{
182	struct msg_queue *msq;
183	int id, retval;
184	key_t key = params->key;
185	int msgflg = params->flg;
186
187	msq = ipc_rcu_alloc(sizeof(*msq));
188	if (!msq)
189		return -ENOMEM;
190
191	msq->q_perm.mode = msgflg & S_IRWXUGO;
192	msq->q_perm.key = key;
193
194	msq->q_perm.security = NULL;
195	retval = security_msg_queue_alloc(msq);
196	if (retval) {
197		ipc_rcu_putref(msq);
198		return retval;
199	}
200
201	/*
202	 * ipc_addid() locks msq
203	 */
204	id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
205	if (id < 0) {
206		security_msg_queue_free(msq);
207		ipc_rcu_putref(msq);
208		return id;
209	}
210
211	msq->q_stime = msq->q_rtime = 0;
212	msq->q_ctime = get_seconds();
213	msq->q_cbytes = msq->q_qnum = 0;
214	msq->q_qbytes = ns->msg_ctlmnb;
215	msq->q_lspid = msq->q_lrpid = 0;
216	INIT_LIST_HEAD(&msq->q_messages);
217	INIT_LIST_HEAD(&msq->q_receivers);
218	INIT_LIST_HEAD(&msq->q_senders);
219
220	msg_unlock(msq);
 
 
 
 
 
 
 
 
221
222	return msq->q_perm.id;
223}
224
225static inline void ss_add(struct msg_queue *msq, struct msg_sender *mss)
 
 
 
 
 
 
 
226{
227	mss->tsk = current;
228	current->state = TASK_INTERRUPTIBLE;
 
229	list_add_tail(&mss->list, &msq->q_senders);
230}
231
232static inline void ss_del(struct msg_sender *mss)
233{
234	if (mss->list.next != NULL)
235		list_del(&mss->list);
236}
237
238static void ss_wakeup(struct list_head *h, int kill)
 
239{
240	struct list_head *tmp;
241
242	tmp = h->next;
243	while (tmp != h) {
244		struct msg_sender *mss;
245
246		mss = list_entry(tmp, struct msg_sender, list);
247		tmp = tmp->next;
248		if (kill)
249			mss->list.next = NULL;
250		wake_up_process(mss->tsk);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
251	}
252}
253
254static void expunge_all(struct msg_queue *msq, int res)
 
255{
256	struct list_head *tmp;
257
258	tmp = msq->q_receivers.next;
259	while (tmp != &msq->q_receivers) {
260		struct msg_receiver *msr;
261
262		msr = list_entry(tmp, struct msg_receiver, r_list);
263		tmp = tmp->next;
264		msr->r_msg = NULL;
265		wake_up_process(msr->r_tsk);
266		smp_mb();
267		msr->r_msg = ERR_PTR(res);
268	}
269}
270
271/*
272 * freeque() wakes up waiters on the sender and receiver waiting queue,
273 * removes the message queue from message queue ID IDR, and cleans up all the
274 * messages associated with this queue.
275 *
276 * msg_ids.rw_mutex (writer) and the spinlock for this message queue are held
277 * before freeque() is called. msg_ids.rw_mutex remains locked on exit.
278 */
279static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
280{
281	struct list_head *tmp;
282	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
 
283
284	expunge_all(msq, -EIDRM);
285	ss_wakeup(&msq->q_senders, 1);
286	msg_rmid(ns, msq);
287	msg_unlock(msq);
288
289	tmp = msq->q_messages.next;
290	while (tmp != &msq->q_messages) {
291		struct msg_msg *msg = list_entry(tmp, struct msg_msg, m_list);
292
293		tmp = tmp->next;
294		atomic_dec(&ns->msg_hdrs);
295		free_msg(msg);
296	}
297	atomic_sub(msq->q_cbytes, &ns->msg_bytes);
298	security_msg_queue_free(msq);
299	ipc_rcu_putref(msq);
 
300}
301
302/*
303 * Called with msg_ids.rw_mutex and ipcp locked.
304 */
305static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
306{
307	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
308
309	return security_msg_queue_associate(msq, msgflg);
310}
311
312SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
313{
314	struct ipc_namespace *ns;
315	struct ipc_ops msg_ops;
 
 
 
316	struct ipc_params msg_params;
317
318	ns = current->nsproxy->ipc_ns;
319
320	msg_ops.getnew = newque;
321	msg_ops.associate = msg_security;
322	msg_ops.more_checks = NULL;
323
324	msg_params.key = key;
325	msg_params.flg = msgflg;
326
327	return ipcget(ns, &msg_ids(ns), &msg_ops, &msg_params);
328}
329
 
 
 
 
 
330static inline unsigned long
331copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
332{
333	switch(version) {
334	case IPC_64:
335		return copy_to_user(buf, in, sizeof(*in));
336	case IPC_OLD:
337	{
338		struct msqid_ds out;
339
340		memset(&out, 0, sizeof(out));
341
342		ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
343
344		out.msg_stime		= in->msg_stime;
345		out.msg_rtime		= in->msg_rtime;
346		out.msg_ctime		= in->msg_ctime;
347
348		if (in->msg_cbytes > USHRT_MAX)
349			out.msg_cbytes	= USHRT_MAX;
350		else
351			out.msg_cbytes	= in->msg_cbytes;
352		out.msg_lcbytes		= in->msg_cbytes;
353
354		if (in->msg_qnum > USHRT_MAX)
355			out.msg_qnum	= USHRT_MAX;
356		else
357			out.msg_qnum	= in->msg_qnum;
358
359		if (in->msg_qbytes > USHRT_MAX)
360			out.msg_qbytes	= USHRT_MAX;
361		else
362			out.msg_qbytes	= in->msg_qbytes;
363		out.msg_lqbytes		= in->msg_qbytes;
364
365		out.msg_lspid		= in->msg_lspid;
366		out.msg_lrpid		= in->msg_lrpid;
367
368		return copy_to_user(buf, &out, sizeof(out));
369	}
370	default:
371		return -EINVAL;
372	}
373}
374
375static inline unsigned long
376copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
377{
378	switch(version) {
379	case IPC_64:
380		if (copy_from_user(out, buf, sizeof(*out)))
381			return -EFAULT;
382		return 0;
383	case IPC_OLD:
384	{
385		struct msqid_ds tbuf_old;
386
387		if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
388			return -EFAULT;
389
390		out->msg_perm.uid      	= tbuf_old.msg_perm.uid;
391		out->msg_perm.gid      	= tbuf_old.msg_perm.gid;
392		out->msg_perm.mode     	= tbuf_old.msg_perm.mode;
393
394		if (tbuf_old.msg_qbytes == 0)
395			out->msg_qbytes	= tbuf_old.msg_lqbytes;
396		else
397			out->msg_qbytes	= tbuf_old.msg_qbytes;
398
399		return 0;
400	}
401	default:
402		return -EINVAL;
403	}
404}
405
406/*
407 * This function handles some msgctl commands which require the rw_mutex
408 * to be held in write mode.
409 * NOTE: no locks must be held, the rw_mutex is taken inside this function.
410 */
411static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
412		       struct msqid_ds __user *buf, int version)
413{
414	struct kern_ipc_perm *ipcp;
415	struct msqid64_ds uninitialized_var(msqid64);
416	struct msg_queue *msq;
417	int err;
418
419	if (cmd == IPC_SET) {
420		if (copy_msqid_from_user(&msqid64, buf, version))
421			return -EFAULT;
422	}
423
424	ipcp = ipcctl_pre_down(ns, &msg_ids(ns), msqid, cmd,
425			       &msqid64.msg_perm, msqid64.msg_qbytes);
426	if (IS_ERR(ipcp))
427		return PTR_ERR(ipcp);
 
 
428
429	msq = container_of(ipcp, struct msg_queue, q_perm);
430
431	err = security_msg_queue_msgctl(msq, cmd);
432	if (err)
433		goto out_unlock;
434
435	switch (cmd) {
436	case IPC_RMID:
 
 
437		freeque(ns, ipcp);
438		goto out_up;
439	case IPC_SET:
440		if (msqid64.msg_qbytes > ns->msg_ctlmnb &&
 
 
 
441		    !capable(CAP_SYS_RESOURCE)) {
442			err = -EPERM;
443			goto out_unlock;
444		}
445
446		msq->q_qbytes = msqid64.msg_qbytes;
 
 
 
 
 
447
448		ipc_update_perm(&msqid64.msg_perm, ipcp);
449		msq->q_ctime = get_seconds();
450		/* sleeping receivers might be excluded by
451		 * stricter permissions.
452		 */
453		expunge_all(msq, -EAGAIN);
454		/* sleeping senders might be able to send
 
455		 * due to a larger queue size.
456		 */
457		ss_wakeup(&msq->q_senders, 0);
458		break;
 
 
 
 
459	default:
460		err = -EINVAL;
 
461	}
462out_unlock:
463	msg_unlock(msq);
 
 
 
464out_up:
465	up_write(&msg_ids(ns).rw_mutex);
466	return err;
467}
468
469SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
470{
471	struct msg_queue *msq;
472	int err, version;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
473	struct ipc_namespace *ns;
 
 
474
475	if (msqid < 0 || cmd < 0)
476		return -EINVAL;
477
478	version = ipc_parse_version(&cmd);
479	ns = current->nsproxy->ipc_ns;
480
481	switch (cmd) {
482	case IPC_INFO:
483	case MSG_INFO:
484	{
485		struct msginfo msginfo;
486		int max_id;
487
488		if (!buf)
489			return -EFAULT;
490		/*
491		 * We must not return kernel stack data.
492		 * due to padding, it's not enough
493		 * to set all member fields.
494		 */
495		err = security_msg_queue_msgctl(NULL, cmd);
496		if (err)
497			return err;
498
499		memset(&msginfo, 0, sizeof(msginfo));
500		msginfo.msgmni = ns->msg_ctlmni;
501		msginfo.msgmax = ns->msg_ctlmax;
502		msginfo.msgmnb = ns->msg_ctlmnb;
503		msginfo.msgssz = MSGSSZ;
504		msginfo.msgseg = MSGSEG;
505		down_read(&msg_ids(ns).rw_mutex);
506		if (cmd == MSG_INFO) {
507			msginfo.msgpool = msg_ids(ns).in_use;
508			msginfo.msgmap = atomic_read(&ns->msg_hdrs);
509			msginfo.msgtql = atomic_read(&ns->msg_bytes);
510		} else {
511			msginfo.msgmap = MSGMAP;
512			msginfo.msgpool = MSGPOOL;
513			msginfo.msgtql = MSGTQL;
514		}
515		max_id = ipc_get_maxid(&msg_ids(ns));
516		up_read(&msg_ids(ns).rw_mutex);
517		if (copy_to_user(buf, &msginfo, sizeof(struct msginfo)))
518			return -EFAULT;
519		return (max_id < 0) ? 0 : max_id;
520	}
521	case MSG_STAT:	/* msqid is an index rather than a msg queue id */
 
522	case IPC_STAT:
523	{
524		struct msqid64_ds tbuf;
525		int success_return;
526
527		if (!buf)
 
 
 
528			return -EFAULT;
 
 
 
 
 
 
 
529
530		if (cmd == MSG_STAT) {
531			msq = msg_lock(ns, msqid);
532			if (IS_ERR(msq))
533				return PTR_ERR(msq);
534			success_return = msq->q_perm.id;
535		} else {
536			msq = msg_lock_check(ns, msqid);
537			if (IS_ERR(msq))
538				return PTR_ERR(msq);
539			success_return = 0;
540		}
541		err = -EACCES;
542		if (ipcperms(ns, &msq->q_perm, S_IRUGO))
543			goto out_unlock;
544
545		err = security_msg_queue_msgctl(msq, cmd);
546		if (err)
547			goto out_unlock;
548
549		memset(&tbuf, 0, sizeof(tbuf));
 
 
 
 
 
 
 
 
 
 
 
 
 
 
550
551		kernel_to_ipc64_perm(&msq->q_perm, &tbuf.msg_perm);
552		tbuf.msg_stime  = msq->q_stime;
553		tbuf.msg_rtime  = msq->q_rtime;
554		tbuf.msg_ctime  = msq->q_ctime;
555		tbuf.msg_cbytes = msq->q_cbytes;
556		tbuf.msg_qnum   = msq->q_qnum;
557		tbuf.msg_qbytes = msq->q_qbytes;
558		tbuf.msg_lspid  = msq->q_lspid;
559		tbuf.msg_lrpid  = msq->q_lrpid;
560		msg_unlock(msq);
561		if (copy_msqid_to_user(buf, &tbuf, version))
 
 
 
 
562			return -EFAULT;
563		return success_return;
564	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
565	case IPC_SET:
 
 
 
566	case IPC_RMID:
567		err = msgctl_down(ns, msqid, cmd, buf, version);
568		return err;
569	default:
570		return  -EINVAL;
571	}
 
572
573out_unlock:
574	msg_unlock(msq);
575	return err;
576}
 
577
578static int testmsg(struct msg_msg *msg, long type, int mode)
579{
580	switch(mode)
581	{
582		case SEARCH_ANY:
 
 
 
583			return 1;
584		case SEARCH_LESSEQUAL:
585			if (msg->m_type <=type)
586				return 1;
587			break;
588		case SEARCH_EQUAL:
589			if (msg->m_type == type)
590				return 1;
591			break;
592		case SEARCH_NOTEQUAL:
593			if (msg->m_type != type)
594				return 1;
595			break;
596	}
597	return 0;
598}
599
600static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg)
 
601{
602	struct list_head *tmp;
603
604	tmp = msq->q_receivers.next;
605	while (tmp != &msq->q_receivers) {
606		struct msg_receiver *msr;
607
608		msr = list_entry(tmp, struct msg_receiver, r_list);
609		tmp = tmp->next;
610		if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
611		    !security_msg_queue_msgrcv(msq, msg, msr->r_tsk,
612					       msr->r_msgtype, msr->r_mode)) {
613
614			list_del(&msr->r_list);
615			if (msr->r_maxsize < msg->m_ts) {
616				msr->r_msg = NULL;
617				wake_up_process(msr->r_tsk);
618				smp_mb();
619				msr->r_msg = ERR_PTR(-E2BIG);
620			} else {
621				msr->r_msg = NULL;
622				msq->q_lrpid = task_pid_vnr(msr->r_tsk);
623				msq->q_rtime = get_seconds();
624				wake_up_process(msr->r_tsk);
625				smp_mb();
626				msr->r_msg = msg;
627
 
 
628				return 1;
629			}
630		}
631	}
 
632	return 0;
633}
634
635long do_msgsnd(int msqid, long mtype, void __user *mtext,
636		size_t msgsz, int msgflg)
637{
638	struct msg_queue *msq;
639	struct msg_msg *msg;
640	int err;
641	struct ipc_namespace *ns;
 
642
643	ns = current->nsproxy->ipc_ns;
644
645	if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0)
646		return -EINVAL;
647	if (mtype < 1)
648		return -EINVAL;
649
650	msg = load_msg(mtext, msgsz);
651	if (IS_ERR(msg))
652		return PTR_ERR(msg);
653
654	msg->m_type = mtype;
655	msg->m_ts = msgsz;
656
657	msq = msg_lock_check(ns, msqid);
 
658	if (IS_ERR(msq)) {
659		err = PTR_ERR(msq);
660		goto out_free;
661	}
662
 
 
663	for (;;) {
664		struct msg_sender s;
665
666		err = -EACCES;
667		if (ipcperms(ns, &msq->q_perm, S_IWUGO))
668			goto out_unlock_free;
 
 
 
 
 
 
669
670		err = security_msg_queue_msgsnd(msq, msg, msgflg);
671		if (err)
672			goto out_unlock_free;
673
674		if (msgsz + msq->q_cbytes <= msq->q_qbytes &&
675				1 + msq->q_qnum <= msq->q_qbytes) {
676			break;
677		}
678
679		/* queue full, wait: */
680		if (msgflg & IPC_NOWAIT) {
681			err = -EAGAIN;
682			goto out_unlock_free;
 
 
 
 
 
 
 
 
683		}
684		ss_add(msq, &s);
685		ipc_rcu_getref(msq);
686		msg_unlock(msq);
687		schedule();
688
689		ipc_lock_by_ptr(&msq->q_perm);
690		ipc_rcu_putref(msq);
691		if (msq->q_perm.deleted) {
 
 
 
692			err = -EIDRM;
693			goto out_unlock_free;
694		}
695		ss_del(&s);
696
697		if (signal_pending(current)) {
698			err = -ERESTARTNOHAND;
699			goto out_unlock_free;
700		}
 
701	}
702
703	msq->q_lspid = task_tgid_vnr(current);
704	msq->q_stime = get_seconds();
705
706	if (!pipelined_send(msq, msg)) {
707		/* no one is waiting for this message, enqueue it */
708		list_add_tail(&msg->m_list, &msq->q_messages);
709		msq->q_cbytes += msgsz;
710		msq->q_qnum++;
711		atomic_add(msgsz, &ns->msg_bytes);
712		atomic_inc(&ns->msg_hdrs);
713	}
714
715	err = 0;
716	msg = NULL;
717
718out_unlock_free:
719	msg_unlock(msq);
720out_free:
 
 
721	if (msg != NULL)
722		free_msg(msg);
723	return err;
724}
725
726SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
727		int, msgflg)
728{
729	long mtype;
730
731	if (get_user(mtype, &msgp->mtype))
732		return -EFAULT;
733	return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
734}
735
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
736static inline int convert_mode(long *msgtyp, int msgflg)
737{
 
 
738	/*
739	 *  find message of correct type.
740	 *  msgtyp = 0 => get first.
741	 *  msgtyp > 0 => get first message of matching type.
742	 *  msgtyp < 0 => get message with least type must be < abs(msgtype).
743	 */
744	if (*msgtyp == 0)
745		return SEARCH_ANY;
746	if (*msgtyp < 0) {
747		*msgtyp = -*msgtyp;
 
 
 
748		return SEARCH_LESSEQUAL;
749	}
750	if (msgflg & MSG_EXCEPT)
751		return SEARCH_NOTEQUAL;
752	return SEARCH_EQUAL;
753}
754
755long do_msgrcv(int msqid, long *pmtype, void __user *mtext,
756		size_t msgsz, long msgtyp, int msgflg)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
757{
758	struct msg_queue *msq;
759	struct msg_msg *msg;
760	int mode;
 
761	struct ipc_namespace *ns;
 
 
 
 
762
763	if (msqid < 0 || (long) msgsz < 0)
764		return -EINVAL;
 
 
 
 
 
 
 
 
765	mode = convert_mode(&msgtyp, msgflg);
766	ns = current->nsproxy->ipc_ns;
767
768	msq = msg_lock_check(ns, msqid);
769	if (IS_ERR(msq))
 
 
 
770		return PTR_ERR(msq);
 
771
772	for (;;) {
773		struct msg_receiver msr_d;
774		struct list_head *tmp;
775
776		msg = ERR_PTR(-EACCES);
777		if (ipcperms(ns, &msq->q_perm, S_IRUGO))
778			goto out_unlock;
779
780		msg = ERR_PTR(-EAGAIN);
781		tmp = msq->q_messages.next;
782		while (tmp != &msq->q_messages) {
783			struct msg_msg *walk_msg;
784
785			walk_msg = list_entry(tmp, struct msg_msg, m_list);
786			if (testmsg(walk_msg, msgtyp, mode) &&
787			    !security_msg_queue_msgrcv(msq, walk_msg, current,
788						       msgtyp, mode)) {
789
790				msg = walk_msg;
791				if (mode == SEARCH_LESSEQUAL &&
792						walk_msg->m_type != 1) {
793					msg = walk_msg;
794					msgtyp = walk_msg->m_type - 1;
795				} else {
796					msg = walk_msg;
797					break;
798				}
799			}
800			tmp = tmp->next;
801		}
 
 
802		if (!IS_ERR(msg)) {
803			/*
804			 * Found a suitable message.
805			 * Unlink it from the queue.
806			 */
807			if ((msgsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
808				msg = ERR_PTR(-E2BIG);
809				goto out_unlock;
 
 
 
 
 
 
 
 
810			}
 
811			list_del(&msg->m_list);
812			msq->q_qnum--;
813			msq->q_rtime = get_seconds();
814			msq->q_lrpid = task_tgid_vnr(current);
815			msq->q_cbytes -= msg->m_ts;
816			atomic_sub(msg->m_ts, &ns->msg_bytes);
817			atomic_dec(&ns->msg_hdrs);
818			ss_wakeup(&msq->q_senders, 0);
819			msg_unlock(msq);
820			break;
821		}
 
822		/* No message waiting. Wait for a message */
823		if (msgflg & IPC_NOWAIT) {
824			msg = ERR_PTR(-ENOMSG);
825			goto out_unlock;
826		}
 
827		list_add_tail(&msr_d.r_list, &msq->q_receivers);
828		msr_d.r_tsk = current;
829		msr_d.r_msgtype = msgtyp;
830		msr_d.r_mode = mode;
831		if (msgflg & MSG_NOERROR)
832			msr_d.r_maxsize = INT_MAX;
833		else
834			msr_d.r_maxsize = msgsz;
835		msr_d.r_msg = ERR_PTR(-EAGAIN);
836		current->state = TASK_INTERRUPTIBLE;
837		msg_unlock(msq);
838
 
 
839		schedule();
840
841		/* Lockless receive, part 1:
842		 * Disable preemption.  We don't hold a reference to the queue
843		 * and getting a reference would defeat the idea of a lockless
844		 * operation, thus the code relies on rcu to guarantee the
845		 * existence of msq:
 
846		 * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
847		 * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
848		 * rcu_read_lock() prevents preemption between reading r_msg
849		 * and the spin_lock() inside ipc_lock_by_ptr().
850		 */
851		rcu_read_lock();
852
853		/* Lockless receive, part 2:
854		 * Wait until pipelined_send or expunge_all are outside of
855		 * wake_up_process(). There is a race with exit(), see
856		 * ipc/mqueue.c for the details.
857		 */
858		msg = (struct msg_msg*)msr_d.r_msg;
859		while (msg == NULL) {
860			cpu_relax();
861			msg = (struct msg_msg *)msr_d.r_msg;
862		}
863
864		/* Lockless receive, part 3:
865		 * If there is a message or an error then accept it without
866		 * locking.
867		 */
868		if (msg != ERR_PTR(-EAGAIN)) {
869			rcu_read_unlock();
870			break;
871		}
872
873		/* Lockless receive, part 3:
874		 * Acquire the queue spinlock.
875		 */
876		ipc_lock_by_ptr(&msq->q_perm);
877		rcu_read_unlock();
878
879		/* Lockless receive, part 4:
880		 * Repeat test after acquiring the spinlock.
881		 */
882		msg = (struct msg_msg*)msr_d.r_msg;
883		if (msg != ERR_PTR(-EAGAIN))
884			goto out_unlock;
885
886		list_del(&msr_d.r_list);
887		if (signal_pending(current)) {
888			msg = ERR_PTR(-ERESTARTNOHAND);
889out_unlock:
890			msg_unlock(msq);
891			break;
892		}
 
 
893	}
894	if (IS_ERR(msg))
895		return PTR_ERR(msg);
896
897	msgsz = (msgsz > msg->m_ts) ? msg->m_ts : msgsz;
898	*pmtype = msg->m_type;
899	if (store_msg(mtext, msg, msgsz))
900		msgsz = -EFAULT;
 
 
 
 
 
901
 
902	free_msg(msg);
903
904	return msgsz;
 
 
 
 
 
 
905}
906
907SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
908		long, msgtyp, int, msgflg)
909{
910	long err, mtype;
 
 
 
 
 
 
 
911
912	err =  do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
913	if (err < 0)
914		goto out;
915
916	if (put_user(mtype, &msgp->mtype))
917		err = -EFAULT;
918out:
919	return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
920}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
921
922#ifdef CONFIG_PROC_FS
923static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
924{
925	struct msg_queue *msq = it;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
926
927	return seq_printf(s,
928			"%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
929			msq->q_perm.key,
930			msq->q_perm.id,
931			msq->q_perm.mode,
932			msq->q_cbytes,
933			msq->q_qnum,
934			msq->q_lspid,
935			msq->q_lrpid,
936			msq->q_perm.uid,
937			msq->q_perm.gid,
938			msq->q_perm.cuid,
939			msq->q_perm.cgid,
940			msq->q_stime,
941			msq->q_rtime,
942			msq->q_ctime);
943}
944#endif
v4.17
   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * linux/ipc/msg.c
   4 * Copyright (C) 1992 Krishna Balasubramanian
   5 *
   6 * Removed all the remaining kerneld mess
   7 * Catch the -EFAULT stuff properly
   8 * Use GFP_KERNEL for messages as in 1.2
   9 * Fixed up the unchecked user space derefs
  10 * Copyright (C) 1998 Alan Cox & Andi Kleen
  11 *
  12 * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
  13 *
  14 * mostly rewritten, threaded and wake-one semantics added
  15 * MSGMAX limit removed, sysctl's added
  16 * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
  17 *
  18 * support for audit of ipc object properties and permission changes
  19 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
  20 *
  21 * namespaces support
  22 * OpenVZ, SWsoft Inc.
  23 * Pavel Emelianov <xemul@openvz.org>
  24 */
  25
  26#include <linux/capability.h>
  27#include <linux/msg.h>
  28#include <linux/spinlock.h>
  29#include <linux/init.h>
  30#include <linux/mm.h>
  31#include <linux/proc_fs.h>
  32#include <linux/list.h>
  33#include <linux/security.h>
  34#include <linux/sched/wake_q.h>
  35#include <linux/syscalls.h>
  36#include <linux/audit.h>
  37#include <linux/seq_file.h>
  38#include <linux/rwsem.h>
  39#include <linux/nsproxy.h>
  40#include <linux/ipc_namespace.h>
  41
  42#include <asm/current.h>
  43#include <linux/uaccess.h>
  44#include "util.h"
  45
  46/* one msq_queue structure for each present queue on the system */
  47struct msg_queue {
  48	struct kern_ipc_perm q_perm;
  49	time64_t q_stime;		/* last msgsnd time */
  50	time64_t q_rtime;		/* last msgrcv time */
  51	time64_t q_ctime;		/* last change time */
  52	unsigned long q_cbytes;		/* current number of bytes on queue */
  53	unsigned long q_qnum;		/* number of messages in queue */
  54	unsigned long q_qbytes;		/* max number of bytes on queue */
  55	struct pid *q_lspid;		/* pid of last msgsnd */
  56	struct pid *q_lrpid;		/* last receive pid */
  57
  58	struct list_head q_messages;
  59	struct list_head q_receivers;
  60	struct list_head q_senders;
  61} __randomize_layout;
  62
  63/* one msg_receiver structure for each sleeping receiver */
  64struct msg_receiver {
  65	struct list_head	r_list;
  66	struct task_struct	*r_tsk;
  67
  68	int			r_mode;
  69	long			r_msgtype;
  70	long			r_maxsize;
  71
  72	struct msg_msg		*r_msg;
  73};
  74
  75/* one msg_sender for each sleeping sender */
  76struct msg_sender {
  77	struct list_head	list;
  78	struct task_struct	*tsk;
  79	size_t                  msgsz;
  80};
  81
  82#define SEARCH_ANY		1
  83#define SEARCH_EQUAL		2
  84#define SEARCH_NOTEQUAL		3
  85#define SEARCH_LESSEQUAL	4
  86#define SEARCH_NUMBER		5
  87
  88#define msg_ids(ns)	((ns)->ids[IPC_MSG_IDS])
  89
  90static inline struct msg_queue *msq_obtain_object(struct ipc_namespace *ns, int id)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  91{
  92	struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&msg_ids(ns), id);
  93
  94	if (IS_ERR(ipcp))
  95		return ERR_CAST(ipcp);
  96
  97	return container_of(ipcp, struct msg_queue, q_perm);
  98}
  99
 100static inline struct msg_queue *msq_obtain_object_check(struct ipc_namespace *ns,
 101							int id)
 102{
 103	struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&msg_ids(ns), id);
 104
 105	if (IS_ERR(ipcp))
 106		return ERR_CAST(ipcp);
 107
 108	return container_of(ipcp, struct msg_queue, q_perm);
 109}
 110
 111static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
 112{
 113	ipc_rmid(&msg_ids(ns), &s->q_perm);
 114}
 115
 116static void msg_rcu_free(struct rcu_head *head)
 117{
 118	struct kern_ipc_perm *p = container_of(head, struct kern_ipc_perm, rcu);
 119	struct msg_queue *msq = container_of(p, struct msg_queue, q_perm);
 120
 121	security_msg_queue_free(&msq->q_perm);
 122	kvfree(msq);
 123}
 124
 125/**
 126 * newque - Create a new msg queue
 127 * @ns: namespace
 128 * @params: ptr to the structure that contains the key and msgflg
 129 *
 130 * Called with msg_ids.rwsem held (writer)
 131 */
 132static int newque(struct ipc_namespace *ns, struct ipc_params *params)
 133{
 134	struct msg_queue *msq;
 135	int retval;
 136	key_t key = params->key;
 137	int msgflg = params->flg;
 138
 139	msq = kvmalloc(sizeof(*msq), GFP_KERNEL);
 140	if (unlikely(!msq))
 141		return -ENOMEM;
 142
 143	msq->q_perm.mode = msgflg & S_IRWXUGO;
 144	msq->q_perm.key = key;
 145
 146	msq->q_perm.security = NULL;
 147	retval = security_msg_queue_alloc(&msq->q_perm);
 148	if (retval) {
 149		kvfree(msq);
 150		return retval;
 151	}
 152
 
 
 
 
 
 
 
 
 
 
 153	msq->q_stime = msq->q_rtime = 0;
 154	msq->q_ctime = ktime_get_real_seconds();
 155	msq->q_cbytes = msq->q_qnum = 0;
 156	msq->q_qbytes = ns->msg_ctlmnb;
 157	msq->q_lspid = msq->q_lrpid = NULL;
 158	INIT_LIST_HEAD(&msq->q_messages);
 159	INIT_LIST_HEAD(&msq->q_receivers);
 160	INIT_LIST_HEAD(&msq->q_senders);
 161
 162	/* ipc_addid() locks msq upon success. */
 163	retval = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
 164	if (retval < 0) {
 165		call_rcu(&msq->q_perm.rcu, msg_rcu_free);
 166		return retval;
 167	}
 168
 169	ipc_unlock_object(&msq->q_perm);
 170	rcu_read_unlock();
 171
 172	return msq->q_perm.id;
 173}
 174
 175static inline bool msg_fits_inqueue(struct msg_queue *msq, size_t msgsz)
 176{
 177	return msgsz + msq->q_cbytes <= msq->q_qbytes &&
 178		1 + msq->q_qnum <= msq->q_qbytes;
 179}
 180
 181static inline void ss_add(struct msg_queue *msq,
 182			  struct msg_sender *mss, size_t msgsz)
 183{
 184	mss->tsk = current;
 185	mss->msgsz = msgsz;
 186	__set_current_state(TASK_INTERRUPTIBLE);
 187	list_add_tail(&mss->list, &msq->q_senders);
 188}
 189
 190static inline void ss_del(struct msg_sender *mss)
 191{
 192	if (mss->list.next)
 193		list_del(&mss->list);
 194}
 195
 196static void ss_wakeup(struct msg_queue *msq,
 197		      struct wake_q_head *wake_q, bool kill)
 198{
 199	struct msg_sender *mss, *t;
 200	struct task_struct *stop_tsk = NULL;
 201	struct list_head *h = &msq->q_senders;
 
 
 202
 203	list_for_each_entry_safe(mss, t, h, list) {
 
 204		if (kill)
 205			mss->list.next = NULL;
 206
 207		/*
 208		 * Stop at the first task we don't wakeup,
 209		 * we've already iterated the original
 210		 * sender queue.
 211		 */
 212		else if (stop_tsk == mss->tsk)
 213			break;
 214		/*
 215		 * We are not in an EIDRM scenario here, therefore
 216		 * verify that we really need to wakeup the task.
 217		 * To maintain current semantics and wakeup order,
 218		 * move the sender to the tail on behalf of the
 219		 * blocked task.
 220		 */
 221		else if (!msg_fits_inqueue(msq, mss->msgsz)) {
 222			if (!stop_tsk)
 223				stop_tsk = mss->tsk;
 224
 225			list_move_tail(&mss->list, &msq->q_senders);
 226			continue;
 227		}
 228
 229		wake_q_add(wake_q, mss->tsk);
 230	}
 231}
 232
 233static void expunge_all(struct msg_queue *msq, int res,
 234			struct wake_q_head *wake_q)
 235{
 236	struct msg_receiver *msr, *t;
 237
 238	list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
 239		wake_q_add(wake_q, msr->r_tsk);
 240		WRITE_ONCE(msr->r_msg, ERR_PTR(res));
 
 
 
 
 
 
 
 241	}
 242}
 243
 244/*
 245 * freeque() wakes up waiters on the sender and receiver waiting queue,
 246 * removes the message queue from message queue ID IDR, and cleans up all the
 247 * messages associated with this queue.
 248 *
 249 * msg_ids.rwsem (writer) and the spinlock for this message queue are held
 250 * before freeque() is called. msg_ids.rwsem remains locked on exit.
 251 */
 252static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
 253{
 254	struct msg_msg *msg, *t;
 255	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
 256	DEFINE_WAKE_Q(wake_q);
 257
 258	expunge_all(msq, -EIDRM, &wake_q);
 259	ss_wakeup(msq, &wake_q, true);
 260	msg_rmid(ns, msq);
 261	ipc_unlock_object(&msq->q_perm);
 262	wake_up_q(&wake_q);
 263	rcu_read_unlock();
 
 
 264
 265	list_for_each_entry_safe(msg, t, &msq->q_messages, m_list) {
 266		atomic_dec(&ns->msg_hdrs);
 267		free_msg(msg);
 268	}
 269	atomic_sub(msq->q_cbytes, &ns->msg_bytes);
 270	ipc_update_pid(&msq->q_lspid, NULL);
 271	ipc_update_pid(&msq->q_lrpid, NULL);
 272	ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
 273}
 274
 275long ksys_msgget(key_t key, int msgflg)
 
 
 
 
 
 
 
 
 
 
 276{
 277	struct ipc_namespace *ns;
 278	static const struct ipc_ops msg_ops = {
 279		.getnew = newque,
 280		.associate = security_msg_queue_associate,
 281	};
 282	struct ipc_params msg_params;
 283
 284	ns = current->nsproxy->ipc_ns;
 285
 
 
 
 
 286	msg_params.key = key;
 287	msg_params.flg = msgflg;
 288
 289	return ipcget(ns, &msg_ids(ns), &msg_ops, &msg_params);
 290}
 291
 292SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
 293{
 294	return ksys_msgget(key, msgflg);
 295}
 296
 297static inline unsigned long
 298copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
 299{
 300	switch (version) {
 301	case IPC_64:
 302		return copy_to_user(buf, in, sizeof(*in));
 303	case IPC_OLD:
 304	{
 305		struct msqid_ds out;
 306
 307		memset(&out, 0, sizeof(out));
 308
 309		ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
 310
 311		out.msg_stime		= in->msg_stime;
 312		out.msg_rtime		= in->msg_rtime;
 313		out.msg_ctime		= in->msg_ctime;
 314
 315		if (in->msg_cbytes > USHRT_MAX)
 316			out.msg_cbytes	= USHRT_MAX;
 317		else
 318			out.msg_cbytes	= in->msg_cbytes;
 319		out.msg_lcbytes		= in->msg_cbytes;
 320
 321		if (in->msg_qnum > USHRT_MAX)
 322			out.msg_qnum	= USHRT_MAX;
 323		else
 324			out.msg_qnum	= in->msg_qnum;
 325
 326		if (in->msg_qbytes > USHRT_MAX)
 327			out.msg_qbytes	= USHRT_MAX;
 328		else
 329			out.msg_qbytes	= in->msg_qbytes;
 330		out.msg_lqbytes		= in->msg_qbytes;
 331
 332		out.msg_lspid		= in->msg_lspid;
 333		out.msg_lrpid		= in->msg_lrpid;
 334
 335		return copy_to_user(buf, &out, sizeof(out));
 336	}
 337	default:
 338		return -EINVAL;
 339	}
 340}
 341
 342static inline unsigned long
 343copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
 344{
 345	switch (version) {
 346	case IPC_64:
 347		if (copy_from_user(out, buf, sizeof(*out)))
 348			return -EFAULT;
 349		return 0;
 350	case IPC_OLD:
 351	{
 352		struct msqid_ds tbuf_old;
 353
 354		if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
 355			return -EFAULT;
 356
 357		out->msg_perm.uid	= tbuf_old.msg_perm.uid;
 358		out->msg_perm.gid	= tbuf_old.msg_perm.gid;
 359		out->msg_perm.mode	= tbuf_old.msg_perm.mode;
 360
 361		if (tbuf_old.msg_qbytes == 0)
 362			out->msg_qbytes	= tbuf_old.msg_lqbytes;
 363		else
 364			out->msg_qbytes	= tbuf_old.msg_qbytes;
 365
 366		return 0;
 367	}
 368	default:
 369		return -EINVAL;
 370	}
 371}
 372
 373/*
 374 * This function handles some msgctl commands which require the rwsem
 375 * to be held in write mode.
 376 * NOTE: no locks must be held, the rwsem is taken inside this function.
 377 */
 378static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
 379			struct msqid64_ds *msqid64)
 380{
 381	struct kern_ipc_perm *ipcp;
 
 382	struct msg_queue *msq;
 383	int err;
 384
 385	down_write(&msg_ids(ns).rwsem);
 386	rcu_read_lock();
 
 
 387
 388	ipcp = ipcctl_pre_down_nolock(ns, &msg_ids(ns), msqid, cmd,
 389				      &msqid64->msg_perm, msqid64->msg_qbytes);
 390	if (IS_ERR(ipcp)) {
 391		err = PTR_ERR(ipcp);
 392		goto out_unlock1;
 393	}
 394
 395	msq = container_of(ipcp, struct msg_queue, q_perm);
 396
 397	err = security_msg_queue_msgctl(&msq->q_perm, cmd);
 398	if (err)
 399		goto out_unlock1;
 400
 401	switch (cmd) {
 402	case IPC_RMID:
 403		ipc_lock_object(&msq->q_perm);
 404		/* freeque unlocks the ipc object and rcu */
 405		freeque(ns, ipcp);
 406		goto out_up;
 407	case IPC_SET:
 408	{
 409		DEFINE_WAKE_Q(wake_q);
 410
 411		if (msqid64->msg_qbytes > ns->msg_ctlmnb &&
 412		    !capable(CAP_SYS_RESOURCE)) {
 413			err = -EPERM;
 414			goto out_unlock1;
 415		}
 416
 417		ipc_lock_object(&msq->q_perm);
 418		err = ipc_update_perm(&msqid64->msg_perm, ipcp);
 419		if (err)
 420			goto out_unlock0;
 421
 422		msq->q_qbytes = msqid64->msg_qbytes;
 423
 424		msq->q_ctime = ktime_get_real_seconds();
 425		/*
 426		 * Sleeping receivers might be excluded by
 427		 * stricter permissions.
 428		 */
 429		expunge_all(msq, -EAGAIN, &wake_q);
 430		/*
 431		 * Sleeping senders might be able to send
 432		 * due to a larger queue size.
 433		 */
 434		ss_wakeup(msq, &wake_q, false);
 435		ipc_unlock_object(&msq->q_perm);
 436		wake_up_q(&wake_q);
 437
 438		goto out_unlock1;
 439	}
 440	default:
 441		err = -EINVAL;
 442		goto out_unlock1;
 443	}
 444
 445out_unlock0:
 446	ipc_unlock_object(&msq->q_perm);
 447out_unlock1:
 448	rcu_read_unlock();
 449out_up:
 450	up_write(&msg_ids(ns).rwsem);
 451	return err;
 452}
 453
 454static int msgctl_info(struct ipc_namespace *ns, int msqid,
 455			 int cmd, struct msginfo *msginfo)
 456{
 457	int err;
 458	int max_id;
 459
 460	/*
 461	 * We must not return kernel stack data.
 462	 * due to padding, it's not enough
 463	 * to set all member fields.
 464	 */
 465	err = security_msg_queue_msgctl(NULL, cmd);
 466	if (err)
 467		return err;
 468
 469	memset(msginfo, 0, sizeof(*msginfo));
 470	msginfo->msgmni = ns->msg_ctlmni;
 471	msginfo->msgmax = ns->msg_ctlmax;
 472	msginfo->msgmnb = ns->msg_ctlmnb;
 473	msginfo->msgssz = MSGSSZ;
 474	msginfo->msgseg = MSGSEG;
 475	down_read(&msg_ids(ns).rwsem);
 476	if (cmd == MSG_INFO) {
 477		msginfo->msgpool = msg_ids(ns).in_use;
 478		msginfo->msgmap = atomic_read(&ns->msg_hdrs);
 479		msginfo->msgtql = atomic_read(&ns->msg_bytes);
 480	} else {
 481		msginfo->msgmap = MSGMAP;
 482		msginfo->msgpool = MSGPOOL;
 483		msginfo->msgtql = MSGTQL;
 484	}
 485	max_id = ipc_get_maxid(&msg_ids(ns));
 486	up_read(&msg_ids(ns).rwsem);
 487	return (max_id < 0) ? 0 : max_id;
 488}
 489
 490static int msgctl_stat(struct ipc_namespace *ns, int msqid,
 491			 int cmd, struct msqid64_ds *p)
 492{
 493	struct msg_queue *msq;
 494	int id = 0;
 495	int err;
 496
 497	memset(p, 0, sizeof(*p));
 498
 499	rcu_read_lock();
 500	if (cmd == MSG_STAT || cmd == MSG_STAT_ANY) {
 501		msq = msq_obtain_object(ns, msqid);
 502		if (IS_ERR(msq)) {
 503			err = PTR_ERR(msq);
 504			goto out_unlock;
 505		}
 506		id = msq->q_perm.id;
 507	} else { /* IPC_STAT */
 508		msq = msq_obtain_object_check(ns, msqid);
 509		if (IS_ERR(msq)) {
 510			err = PTR_ERR(msq);
 511			goto out_unlock;
 512		}
 513	}
 514
 515	/* see comment for SHM_STAT_ANY */
 516	if (cmd == MSG_STAT_ANY)
 517		audit_ipc_obj(&msq->q_perm);
 518	else {
 519		err = -EACCES;
 520		if (ipcperms(ns, &msq->q_perm, S_IRUGO))
 521			goto out_unlock;
 522	}
 523
 524	err = security_msg_queue_msgctl(&msq->q_perm, cmd);
 525	if (err)
 526		goto out_unlock;
 527
 528	ipc_lock_object(&msq->q_perm);
 529
 530	if (!ipc_valid_object(&msq->q_perm)) {
 531		ipc_unlock_object(&msq->q_perm);
 532		err = -EIDRM;
 533		goto out_unlock;
 534	}
 535
 536	kernel_to_ipc64_perm(&msq->q_perm, &p->msg_perm);
 537	p->msg_stime  = msq->q_stime;
 538	p->msg_rtime  = msq->q_rtime;
 539	p->msg_ctime  = msq->q_ctime;
 540	p->msg_cbytes = msq->q_cbytes;
 541	p->msg_qnum   = msq->q_qnum;
 542	p->msg_qbytes = msq->q_qbytes;
 543	p->msg_lspid  = pid_vnr(msq->q_lspid);
 544	p->msg_lrpid  = pid_vnr(msq->q_lrpid);
 545
 546	ipc_unlock_object(&msq->q_perm);
 547	rcu_read_unlock();
 548	return id;
 549
 550out_unlock:
 551	rcu_read_unlock();
 552	return err;
 553}
 554
 555long ksys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
 556{
 557	int version;
 558	struct ipc_namespace *ns;
 559	struct msqid64_ds msqid64;
 560	int err;
 561
 562	if (msqid < 0 || cmd < 0)
 563		return -EINVAL;
 564
 565	version = ipc_parse_version(&cmd);
 566	ns = current->nsproxy->ipc_ns;
 567
 568	switch (cmd) {
 569	case IPC_INFO:
 570	case MSG_INFO: {
 
 571		struct msginfo msginfo;
 572		err = msgctl_info(ns, msqid, cmd, &msginfo);
 573		if (err < 0)
 
 
 
 
 
 
 
 
 
 574			return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 575		if (copy_to_user(buf, &msginfo, sizeof(struct msginfo)))
 576			err = -EFAULT;
 577		return err;
 578	}
 579	case MSG_STAT:	/* msqid is an index rather than a msg queue id */
 580	case MSG_STAT_ANY:
 581	case IPC_STAT:
 582		err = msgctl_stat(ns, msqid, cmd, &msqid64);
 583		if (err < 0)
 584			return err;
 585		if (copy_msqid_to_user(buf, &msqid64, version))
 586			err = -EFAULT;
 587		return err;
 588	case IPC_SET:
 589		if (copy_msqid_from_user(&msqid64, buf, version))
 590			return -EFAULT;
 591		/* fallthru */
 592	case IPC_RMID:
 593		return msgctl_down(ns, msqid, cmd, &msqid64);
 594	default:
 595		return  -EINVAL;
 596	}
 597}
 598
 599SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
 600{
 601	return ksys_msgctl(msqid, cmd, buf);
 602}
 
 
 
 
 
 
 
 
 
 
 603
 604#ifdef CONFIG_COMPAT
 
 
 605
 606struct compat_msqid_ds {
 607	struct compat_ipc_perm msg_perm;
 608	compat_uptr_t msg_first;
 609	compat_uptr_t msg_last;
 610	compat_time_t msg_stime;
 611	compat_time_t msg_rtime;
 612	compat_time_t msg_ctime;
 613	compat_ulong_t msg_lcbytes;
 614	compat_ulong_t msg_lqbytes;
 615	unsigned short msg_cbytes;
 616	unsigned short msg_qnum;
 617	unsigned short msg_qbytes;
 618	compat_ipc_pid_t msg_lspid;
 619	compat_ipc_pid_t msg_lrpid;
 620};
 621
 622static int copy_compat_msqid_from_user(struct msqid64_ds *out, void __user *buf,
 623					int version)
 624{
 625	memset(out, 0, sizeof(*out));
 626	if (version == IPC_64) {
 627		struct compat_msqid64_ds __user *p = buf;
 628		if (get_compat_ipc64_perm(&out->msg_perm, &p->msg_perm))
 629			return -EFAULT;
 630		if (get_user(out->msg_qbytes, &p->msg_qbytes))
 631			return -EFAULT;
 632	} else {
 633		struct compat_msqid_ds __user *p = buf;
 634		if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm))
 635			return -EFAULT;
 636		if (get_user(out->msg_qbytes, &p->msg_qbytes))
 637			return -EFAULT;
 
 638	}
 639	return 0;
 640}
 641
 642static int copy_compat_msqid_to_user(void __user *buf, struct msqid64_ds *in,
 643					int version)
 644{
 645	if (version == IPC_64) {
 646		struct compat_msqid64_ds v;
 647		memset(&v, 0, sizeof(v));
 648		to_compat_ipc64_perm(&v.msg_perm, &in->msg_perm);
 649		v.msg_stime = in->msg_stime;
 650		v.msg_rtime = in->msg_rtime;
 651		v.msg_ctime = in->msg_ctime;
 652		v.msg_cbytes = in->msg_cbytes;
 653		v.msg_qnum = in->msg_qnum;
 654		v.msg_qbytes = in->msg_qbytes;
 655		v.msg_lspid = in->msg_lspid;
 656		v.msg_lrpid = in->msg_lrpid;
 657		return copy_to_user(buf, &v, sizeof(v));
 658	} else {
 659		struct compat_msqid_ds v;
 660		memset(&v, 0, sizeof(v));
 661		to_compat_ipc_perm(&v.msg_perm, &in->msg_perm);
 662		v.msg_stime = in->msg_stime;
 663		v.msg_rtime = in->msg_rtime;
 664		v.msg_ctime = in->msg_ctime;
 665		v.msg_cbytes = in->msg_cbytes;
 666		v.msg_qnum = in->msg_qnum;
 667		v.msg_qbytes = in->msg_qbytes;
 668		v.msg_lspid = in->msg_lspid;
 669		v.msg_lrpid = in->msg_lrpid;
 670		return copy_to_user(buf, &v, sizeof(v));
 671	}
 672}
 673
 674long compat_ksys_msgctl(int msqid, int cmd, void __user *uptr)
 675{
 676	struct ipc_namespace *ns;
 677	int err;
 678	struct msqid64_ds msqid64;
 679	int version = compat_ipc_parse_version(&cmd);
 680
 681	ns = current->nsproxy->ipc_ns;
 682
 683	if (msqid < 0 || cmd < 0)
 684		return -EINVAL;
 685
 686	switch (cmd & (~IPC_64)) {
 687	case IPC_INFO:
 688	case MSG_INFO: {
 689		struct msginfo msginfo;
 690		err = msgctl_info(ns, msqid, cmd, &msginfo);
 691		if (err < 0)
 692			return err;
 693		if (copy_to_user(uptr, &msginfo, sizeof(struct msginfo)))
 694			err = -EFAULT;
 695		return err;
 696	}
 697	case IPC_STAT:
 698	case MSG_STAT:
 699	case MSG_STAT_ANY:
 700		err = msgctl_stat(ns, msqid, cmd, &msqid64);
 701		if (err < 0)
 702			return err;
 703		if (copy_compat_msqid_to_user(uptr, &msqid64, version))
 704			err = -EFAULT;
 705		return err;
 706	case IPC_SET:
 707		if (copy_compat_msqid_from_user(&msqid64, uptr, version))
 708			return -EFAULT;
 709		/* fallthru */
 710	case IPC_RMID:
 711		return msgctl_down(ns, msqid, cmd, &msqid64);
 
 712	default:
 713		return -EINVAL;
 714	}
 715}
 716
 717COMPAT_SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, void __user *, uptr)
 718{
 719	return compat_ksys_msgctl(msqid, cmd, uptr);
 720}
 721#endif
 722
 723static int testmsg(struct msg_msg *msg, long type, int mode)
 724{
 725	switch (mode) {
 726	case SEARCH_ANY:
 727	case SEARCH_NUMBER:
 728		return 1;
 729	case SEARCH_LESSEQUAL:
 730		if (msg->m_type <= type)
 731			return 1;
 732		break;
 733	case SEARCH_EQUAL:
 734		if (msg->m_type == type)
 735			return 1;
 736		break;
 737	case SEARCH_NOTEQUAL:
 738		if (msg->m_type != type)
 739			return 1;
 740		break;
 
 
 
 741	}
 742	return 0;
 743}
 744
 745static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg,
 746				 struct wake_q_head *wake_q)
 747{
 748	struct msg_receiver *msr, *t;
 
 
 
 
 749
 750	list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
 
 751		if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
 752		    !security_msg_queue_msgrcv(&msq->q_perm, msg, msr->r_tsk,
 753					       msr->r_msgtype, msr->r_mode)) {
 754
 755			list_del(&msr->r_list);
 756			if (msr->r_maxsize < msg->m_ts) {
 757				wake_q_add(wake_q, msr->r_tsk);
 758				WRITE_ONCE(msr->r_msg, ERR_PTR(-E2BIG));
 
 
 759			} else {
 760				ipc_update_pid(&msq->q_lrpid, task_pid(msr->r_tsk));
 
 761				msq->q_rtime = get_seconds();
 
 
 
 762
 763				wake_q_add(wake_q, msr->r_tsk);
 764				WRITE_ONCE(msr->r_msg, msg);
 765				return 1;
 766			}
 767		}
 768	}
 769
 770	return 0;
 771}
 772
 773static long do_msgsnd(int msqid, long mtype, void __user *mtext,
 774		size_t msgsz, int msgflg)
 775{
 776	struct msg_queue *msq;
 777	struct msg_msg *msg;
 778	int err;
 779	struct ipc_namespace *ns;
 780	DEFINE_WAKE_Q(wake_q);
 781
 782	ns = current->nsproxy->ipc_ns;
 783
 784	if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0)
 785		return -EINVAL;
 786	if (mtype < 1)
 787		return -EINVAL;
 788
 789	msg = load_msg(mtext, msgsz);
 790	if (IS_ERR(msg))
 791		return PTR_ERR(msg);
 792
 793	msg->m_type = mtype;
 794	msg->m_ts = msgsz;
 795
 796	rcu_read_lock();
 797	msq = msq_obtain_object_check(ns, msqid);
 798	if (IS_ERR(msq)) {
 799		err = PTR_ERR(msq);
 800		goto out_unlock1;
 801	}
 802
 803	ipc_lock_object(&msq->q_perm);
 804
 805	for (;;) {
 806		struct msg_sender s;
 807
 808		err = -EACCES;
 809		if (ipcperms(ns, &msq->q_perm, S_IWUGO))
 810			goto out_unlock0;
 811
 812		/* raced with RMID? */
 813		if (!ipc_valid_object(&msq->q_perm)) {
 814			err = -EIDRM;
 815			goto out_unlock0;
 816		}
 817
 818		err = security_msg_queue_msgsnd(&msq->q_perm, msg, msgflg);
 819		if (err)
 820			goto out_unlock0;
 821
 822		if (msg_fits_inqueue(msq, msgsz))
 
 823			break;
 
 824
 825		/* queue full, wait: */
 826		if (msgflg & IPC_NOWAIT) {
 827			err = -EAGAIN;
 828			goto out_unlock0;
 829		}
 830
 831		/* enqueue the sender and prepare to block */
 832		ss_add(msq, &s, msgsz);
 833
 834		if (!ipc_rcu_getref(&msq->q_perm)) {
 835			err = -EIDRM;
 836			goto out_unlock0;
 837		}
 838
 839		ipc_unlock_object(&msq->q_perm);
 840		rcu_read_unlock();
 841		schedule();
 842
 843		rcu_read_lock();
 844		ipc_lock_object(&msq->q_perm);
 845
 846		ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
 847		/* raced with RMID? */
 848		if (!ipc_valid_object(&msq->q_perm)) {
 849			err = -EIDRM;
 850			goto out_unlock0;
 851		}
 852		ss_del(&s);
 853
 854		if (signal_pending(current)) {
 855			err = -ERESTARTNOHAND;
 856			goto out_unlock0;
 857		}
 858
 859	}
 860
 861	ipc_update_pid(&msq->q_lspid, task_tgid(current));
 862	msq->q_stime = get_seconds();
 863
 864	if (!pipelined_send(msq, msg, &wake_q)) {
 865		/* no one is waiting for this message, enqueue it */
 866		list_add_tail(&msg->m_list, &msq->q_messages);
 867		msq->q_cbytes += msgsz;
 868		msq->q_qnum++;
 869		atomic_add(msgsz, &ns->msg_bytes);
 870		atomic_inc(&ns->msg_hdrs);
 871	}
 872
 873	err = 0;
 874	msg = NULL;
 875
 876out_unlock0:
 877	ipc_unlock_object(&msq->q_perm);
 878	wake_up_q(&wake_q);
 879out_unlock1:
 880	rcu_read_unlock();
 881	if (msg != NULL)
 882		free_msg(msg);
 883	return err;
 884}
 885
 886long ksys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz,
 887		 int msgflg)
 888{
 889	long mtype;
 890
 891	if (get_user(mtype, &msgp->mtype))
 892		return -EFAULT;
 893	return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
 894}
 895
 896SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
 897		int, msgflg)
 898{
 899	return ksys_msgsnd(msqid, msgp, msgsz, msgflg);
 900}
 901
 902#ifdef CONFIG_COMPAT
 903
 904struct compat_msgbuf {
 905	compat_long_t mtype;
 906	char mtext[1];
 907};
 908
 909long compat_ksys_msgsnd(int msqid, compat_uptr_t msgp,
 910		       compat_ssize_t msgsz, int msgflg)
 911{
 912	struct compat_msgbuf __user *up = compat_ptr(msgp);
 913	compat_long_t mtype;
 914
 915	if (get_user(mtype, &up->mtype))
 916		return -EFAULT;
 917	return do_msgsnd(msqid, mtype, up->mtext, (ssize_t)msgsz, msgflg);
 918}
 919
 920COMPAT_SYSCALL_DEFINE4(msgsnd, int, msqid, compat_uptr_t, msgp,
 921		       compat_ssize_t, msgsz, int, msgflg)
 922{
 923	return compat_ksys_msgsnd(msqid, msgp, msgsz, msgflg);
 924}
 925#endif
 926
 927static inline int convert_mode(long *msgtyp, int msgflg)
 928{
 929	if (msgflg & MSG_COPY)
 930		return SEARCH_NUMBER;
 931	/*
 932	 *  find message of correct type.
 933	 *  msgtyp = 0 => get first.
 934	 *  msgtyp > 0 => get first message of matching type.
 935	 *  msgtyp < 0 => get message with least type must be < abs(msgtype).
 936	 */
 937	if (*msgtyp == 0)
 938		return SEARCH_ANY;
 939	if (*msgtyp < 0) {
 940		if (*msgtyp == LONG_MIN) /* -LONG_MIN is undefined */
 941			*msgtyp = LONG_MAX;
 942		else
 943			*msgtyp = -*msgtyp;
 944		return SEARCH_LESSEQUAL;
 945	}
 946	if (msgflg & MSG_EXCEPT)
 947		return SEARCH_NOTEQUAL;
 948	return SEARCH_EQUAL;
 949}
 950
 951static long do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
 952{
 953	struct msgbuf __user *msgp = dest;
 954	size_t msgsz;
 955
 956	if (put_user(msg->m_type, &msgp->mtype))
 957		return -EFAULT;
 958
 959	msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
 960	if (store_msg(msgp->mtext, msg, msgsz))
 961		return -EFAULT;
 962	return msgsz;
 963}
 964
 965#ifdef CONFIG_CHECKPOINT_RESTORE
 966/*
 967 * This function creates new kernel message structure, large enough to store
 968 * bufsz message bytes.
 969 */
 970static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
 971{
 972	struct msg_msg *copy;
 973
 974	/*
 975	 * Create dummy message to copy real message to.
 976	 */
 977	copy = load_msg(buf, bufsz);
 978	if (!IS_ERR(copy))
 979		copy->m_ts = bufsz;
 980	return copy;
 981}
 982
 983static inline void free_copy(struct msg_msg *copy)
 984{
 985	if (copy)
 986		free_msg(copy);
 987}
 988#else
 989static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
 990{
 991	return ERR_PTR(-ENOSYS);
 992}
 993
 994static inline void free_copy(struct msg_msg *copy)
 995{
 996}
 997#endif
 998
 999static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
1000{
1001	struct msg_msg *msg, *found = NULL;
1002	long count = 0;
1003
1004	list_for_each_entry(msg, &msq->q_messages, m_list) {
1005		if (testmsg(msg, *msgtyp, mode) &&
1006		    !security_msg_queue_msgrcv(&msq->q_perm, msg, current,
1007					       *msgtyp, mode)) {
1008			if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
1009				*msgtyp = msg->m_type - 1;
1010				found = msg;
1011			} else if (mode == SEARCH_NUMBER) {
1012				if (*msgtyp == count)
1013					return msg;
1014			} else
1015				return msg;
1016			count++;
1017		}
1018	}
1019
1020	return found ?: ERR_PTR(-EAGAIN);
1021}
1022
1023static long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgflg,
1024	       long (*msg_handler)(void __user *, struct msg_msg *, size_t))
1025{
 
 
1026	int mode;
1027	struct msg_queue *msq;
1028	struct ipc_namespace *ns;
1029	struct msg_msg *msg, *copy = NULL;
1030	DEFINE_WAKE_Q(wake_q);
1031
1032	ns = current->nsproxy->ipc_ns;
1033
1034	if (msqid < 0 || (long) bufsz < 0)
1035		return -EINVAL;
1036
1037	if (msgflg & MSG_COPY) {
1038		if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT))
1039			return -EINVAL;
1040		copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
1041		if (IS_ERR(copy))
1042			return PTR_ERR(copy);
1043	}
1044	mode = convert_mode(&msgtyp, msgflg);
 
1045
1046	rcu_read_lock();
1047	msq = msq_obtain_object_check(ns, msqid);
1048	if (IS_ERR(msq)) {
1049		rcu_read_unlock();
1050		free_copy(copy);
1051		return PTR_ERR(msq);
1052	}
1053
1054	for (;;) {
1055		struct msg_receiver msr_d;
 
1056
1057		msg = ERR_PTR(-EACCES);
1058		if (ipcperms(ns, &msq->q_perm, S_IRUGO))
1059			goto out_unlock1;
1060
1061		ipc_lock_object(&msq->q_perm);
1062
1063		/* raced with RMID? */
1064		if (!ipc_valid_object(&msq->q_perm)) {
1065			msg = ERR_PTR(-EIDRM);
1066			goto out_unlock0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1067		}
1068
1069		msg = find_msg(msq, &msgtyp, mode);
1070		if (!IS_ERR(msg)) {
1071			/*
1072			 * Found a suitable message.
1073			 * Unlink it from the queue.
1074			 */
1075			if ((bufsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
1076				msg = ERR_PTR(-E2BIG);
1077				goto out_unlock0;
1078			}
1079			/*
1080			 * If we are copying, then do not unlink message and do
1081			 * not update queue parameters.
1082			 */
1083			if (msgflg & MSG_COPY) {
1084				msg = copy_msg(msg, copy);
1085				goto out_unlock0;
1086			}
1087
1088			list_del(&msg->m_list);
1089			msq->q_qnum--;
1090			msq->q_rtime = get_seconds();
1091			ipc_update_pid(&msq->q_lrpid, task_tgid(current));
1092			msq->q_cbytes -= msg->m_ts;
1093			atomic_sub(msg->m_ts, &ns->msg_bytes);
1094			atomic_dec(&ns->msg_hdrs);
1095			ss_wakeup(msq, &wake_q, false);
1096
1097			goto out_unlock0;
1098		}
1099
1100		/* No message waiting. Wait for a message */
1101		if (msgflg & IPC_NOWAIT) {
1102			msg = ERR_PTR(-ENOMSG);
1103			goto out_unlock0;
1104		}
1105
1106		list_add_tail(&msr_d.r_list, &msq->q_receivers);
1107		msr_d.r_tsk = current;
1108		msr_d.r_msgtype = msgtyp;
1109		msr_d.r_mode = mode;
1110		if (msgflg & MSG_NOERROR)
1111			msr_d.r_maxsize = INT_MAX;
1112		else
1113			msr_d.r_maxsize = bufsz;
1114		msr_d.r_msg = ERR_PTR(-EAGAIN);
1115		__set_current_state(TASK_INTERRUPTIBLE);
 
1116
1117		ipc_unlock_object(&msq->q_perm);
1118		rcu_read_unlock();
1119		schedule();
1120
1121		/*
1122		 * Lockless receive, part 1:
1123		 * We don't hold a reference to the queue and getting a
1124		 * reference would defeat the idea of a lockless operation,
1125		 * thus the code relies on rcu to guarantee the existence of
1126		 * msq:
1127		 * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
1128		 * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
 
 
1129		 */
1130		rcu_read_lock();
1131
1132		/*
1133		 * Lockless receive, part 2:
1134		 * The work in pipelined_send() and expunge_all():
1135		 * - Set pointer to message
1136		 * - Queue the receiver task for later wakeup
1137		 * - Wake up the process after the lock is dropped.
1138		 *
1139		 * Should the process wake up before this wakeup (due to a
1140		 * signal) it will either see the message and continue ...
 
 
 
 
 
1141		 */
1142		msg = READ_ONCE(msr_d.r_msg);
1143		if (msg != ERR_PTR(-EAGAIN))
1144			goto out_unlock1;
 
1145
1146		 /*
1147		  * ... or see -EAGAIN, acquire the lock to check the message
1148		  * again.
1149		  */
1150		ipc_lock_object(&msq->q_perm);
1151
1152		msg = msr_d.r_msg;
 
 
 
1153		if (msg != ERR_PTR(-EAGAIN))
1154			goto out_unlock0;
1155
1156		list_del(&msr_d.r_list);
1157		if (signal_pending(current)) {
1158			msg = ERR_PTR(-ERESTARTNOHAND);
1159			goto out_unlock0;
 
 
1160		}
1161
1162		ipc_unlock_object(&msq->q_perm);
1163	}
 
 
1164
1165out_unlock0:
1166	ipc_unlock_object(&msq->q_perm);
1167	wake_up_q(&wake_q);
1168out_unlock1:
1169	rcu_read_unlock();
1170	if (IS_ERR(msg)) {
1171		free_copy(copy);
1172		return PTR_ERR(msg);
1173	}
1174
1175	bufsz = msg_handler(buf, msg, bufsz);
1176	free_msg(msg);
1177
1178	return bufsz;
1179}
1180
1181long ksys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
1182		 long msgtyp, int msgflg)
1183{
1184	return do_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg, do_msg_fill);
1185}
1186
1187SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
1188		long, msgtyp, int, msgflg)
1189{
1190	return ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
1191}
1192
1193#ifdef CONFIG_COMPAT
1194static long compat_do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
1195{
1196	struct compat_msgbuf __user *msgp = dest;
1197	size_t msgsz;
1198
1199	if (put_user(msg->m_type, &msgp->mtype))
1200		return -EFAULT;
1201
1202	msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
1203	if (store_msg(msgp->mtext, msg, msgsz))
1204		return -EFAULT;
1205	return msgsz;
1206}
1207
1208long compat_ksys_msgrcv(int msqid, compat_uptr_t msgp, compat_ssize_t msgsz,
1209			compat_long_t msgtyp, int msgflg)
1210{
1211	return do_msgrcv(msqid, compat_ptr(msgp), (ssize_t)msgsz, (long)msgtyp,
1212			 msgflg, compat_do_msg_fill);
1213}
1214
1215COMPAT_SYSCALL_DEFINE5(msgrcv, int, msqid, compat_uptr_t, msgp,
1216		       compat_ssize_t, msgsz, compat_long_t, msgtyp,
1217		       int, msgflg)
1218{
1219	return compat_ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
1220}
1221#endif
1222
1223int msg_init_ns(struct ipc_namespace *ns)
1224{
1225	ns->msg_ctlmax = MSGMAX;
1226	ns->msg_ctlmnb = MSGMNB;
1227	ns->msg_ctlmni = MSGMNI;
1228
1229	atomic_set(&ns->msg_bytes, 0);
1230	atomic_set(&ns->msg_hdrs, 0);
1231	return ipc_init_ids(&ns->ids[IPC_MSG_IDS]);
1232}
1233
1234#ifdef CONFIG_IPC_NS
1235void msg_exit_ns(struct ipc_namespace *ns)
1236{
1237	free_ipcs(ns, &msg_ids(ns), freeque);
1238	idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
1239	rhashtable_destroy(&ns->ids[IPC_MSG_IDS].key_ht);
1240}
1241#endif
1242
1243#ifdef CONFIG_PROC_FS
1244static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
1245{
1246	struct pid_namespace *pid_ns = ipc_seq_pid_ns(s);
1247	struct user_namespace *user_ns = seq_user_ns(s);
1248	struct kern_ipc_perm *ipcp = it;
1249	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
1250
1251	seq_printf(s,
1252		   "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10llu %10llu %10llu\n",
1253		   msq->q_perm.key,
1254		   msq->q_perm.id,
1255		   msq->q_perm.mode,
1256		   msq->q_cbytes,
1257		   msq->q_qnum,
1258		   pid_nr_ns(msq->q_lspid, pid_ns),
1259		   pid_nr_ns(msq->q_lrpid, pid_ns),
1260		   from_kuid_munged(user_ns, msq->q_perm.uid),
1261		   from_kgid_munged(user_ns, msq->q_perm.gid),
1262		   from_kuid_munged(user_ns, msq->q_perm.cuid),
1263		   from_kgid_munged(user_ns, msq->q_perm.cgid),
1264		   msq->q_stime,
1265		   msq->q_rtime,
1266		   msq->q_ctime);
1267
1268	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1269}
1270#endif
1271
1272int __init msg_init(void)
1273{
1274	const int err = msg_init_ns(&init_ipc_ns);
1275
1276	ipc_init_proc_interface("sysvipc/msg",
1277				"       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
1278				IPC_MSG_IDS, sysvipc_msg_proc_show);
1279	return err;
1280}