msg.c 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * linux/ipc/msg.c
  4. * Copyright (C) 1992 Krishna Balasubramanian
  5. *
  6. * Removed all the remaining kerneld mess
  7. * Catch the -EFAULT stuff properly
  8. * Use GFP_KERNEL for messages as in 1.2
  9. * Fixed up the unchecked user space derefs
  10. * Copyright (C) 1998 Alan Cox & Andi Kleen
  11. *
  12. * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
  13. *
  14. * mostly rewritten, threaded and wake-one semantics added
  15. * MSGMAX limit removed, sysctl's added
  16. * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
  17. *
  18. * support for audit of ipc object properties and permission changes
  19. * Dustin Kirkland <dustin.kirkland@us.ibm.com>
  20. *
  21. * namespaces support
  22. * OpenVZ, SWsoft Inc.
  23. * Pavel Emelianov <xemul@openvz.org>
  24. */
  25. #include <linux/capability.h>
  26. #include <linux/msg.h>
  27. #include <linux/spinlock.h>
  28. #include <linux/init.h>
  29. #include <linux/mm.h>
  30. #include <linux/proc_fs.h>
  31. #include <linux/list.h>
  32. #include <linux/security.h>
  33. #include <linux/sched/wake_q.h>
  34. #include <linux/syscalls.h>
  35. #include <linux/audit.h>
  36. #include <linux/seq_file.h>
  37. #include <linux/rwsem.h>
  38. #include <linux/nsproxy.h>
  39. #include <linux/ipc_namespace.h>
  40. #include <linux/rhashtable.h>
  41. #include <asm/current.h>
  42. #include <linux/uaccess.h>
  43. #include "util.h"
  44. /* one msq_queue structure for each present queue on the system */
  45. struct msg_queue {
  46. struct kern_ipc_perm q_perm;
  47. time64_t q_stime; /* last msgsnd time */
  48. time64_t q_rtime; /* last msgrcv time */
  49. time64_t q_ctime; /* last change time */
  50. unsigned long q_cbytes; /* current number of bytes on queue */
  51. unsigned long q_qnum; /* number of messages in queue */
  52. unsigned long q_qbytes; /* max number of bytes on queue */
  53. struct pid *q_lspid; /* pid of last msgsnd */
  54. struct pid *q_lrpid; /* last receive pid */
  55. struct list_head q_messages;
  56. struct list_head q_receivers;
  57. struct list_head q_senders;
  58. } __randomize_layout;
  59. /*
  60. * MSG_BARRIER Locking:
  61. *
  62. * Similar to the optimization used in ipc/mqueue.c, one syscall return path
  63. * does not acquire any locks when it sees that a message exists in
  64. * msg_receiver.r_msg. Therefore r_msg is set using smp_store_release()
  65. * and accessed using READ_ONCE()+smp_acquire__after_ctrl_dep(). In addition,
  66. * wake_q_add_safe() is used. See ipc/mqueue.c for more details
  67. */
  68. /* one msg_receiver structure for each sleeping receiver */
  69. struct msg_receiver {
  70. struct list_head r_list;
  71. struct task_struct *r_tsk;
  72. int r_mode;
  73. long r_msgtype;
  74. long r_maxsize;
  75. struct msg_msg *r_msg;
  76. };
  77. /* one msg_sender for each sleeping sender */
  78. struct msg_sender {
  79. struct list_head list;
  80. struct task_struct *tsk;
  81. size_t msgsz;
  82. };
  83. #define SEARCH_ANY 1
  84. #define SEARCH_EQUAL 2
  85. #define SEARCH_NOTEQUAL 3
  86. #define SEARCH_LESSEQUAL 4
  87. #define SEARCH_NUMBER 5
  88. #define msg_ids(ns) ((ns)->ids[IPC_MSG_IDS])
  89. static inline struct msg_queue *msq_obtain_object(struct ipc_namespace *ns, int id)
  90. {
  91. struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&msg_ids(ns), id);
  92. if (IS_ERR(ipcp))
  93. return ERR_CAST(ipcp);
  94. return container_of(ipcp, struct msg_queue, q_perm);
  95. }
  96. static inline struct msg_queue *msq_obtain_object_check(struct ipc_namespace *ns,
  97. int id)
  98. {
  99. struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&msg_ids(ns), id);
  100. if (IS_ERR(ipcp))
  101. return ERR_CAST(ipcp);
  102. return container_of(ipcp, struct msg_queue, q_perm);
  103. }
  104. static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
  105. {
  106. ipc_rmid(&msg_ids(ns), &s->q_perm);
  107. }
  108. static void msg_rcu_free(struct rcu_head *head)
  109. {
  110. struct kern_ipc_perm *p = container_of(head, struct kern_ipc_perm, rcu);
  111. struct msg_queue *msq = container_of(p, struct msg_queue, q_perm);
  112. security_msg_queue_free(&msq->q_perm);
  113. kvfree(msq);
  114. }
  115. /**
  116. * newque - Create a new msg queue
  117. * @ns: namespace
  118. * @params: ptr to the structure that contains the key and msgflg
  119. *
  120. * Called with msg_ids.rwsem held (writer)
  121. */
  122. static int newque(struct ipc_namespace *ns, struct ipc_params *params)
  123. {
  124. struct msg_queue *msq;
  125. int retval;
  126. key_t key = params->key;
  127. int msgflg = params->flg;
  128. msq = kvmalloc(sizeof(*msq), GFP_KERNEL);
  129. if (unlikely(!msq))
  130. return -ENOMEM;
  131. msq->q_perm.mode = msgflg & S_IRWXUGO;
  132. msq->q_perm.key = key;
  133. msq->q_perm.security = NULL;
  134. retval = security_msg_queue_alloc(&msq->q_perm);
  135. if (retval) {
  136. kvfree(msq);
  137. return retval;
  138. }
  139. msq->q_stime = msq->q_rtime = 0;
  140. msq->q_ctime = ktime_get_real_seconds();
  141. msq->q_cbytes = msq->q_qnum = 0;
  142. msq->q_qbytes = ns->msg_ctlmnb;
  143. msq->q_lspid = msq->q_lrpid = NULL;
  144. INIT_LIST_HEAD(&msq->q_messages);
  145. INIT_LIST_HEAD(&msq->q_receivers);
  146. INIT_LIST_HEAD(&msq->q_senders);
  147. /* ipc_addid() locks msq upon success. */
  148. retval = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
  149. if (retval < 0) {
  150. ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
  151. return retval;
  152. }
  153. ipc_unlock_object(&msq->q_perm);
  154. rcu_read_unlock();
  155. return msq->q_perm.id;
  156. }
  157. static inline bool msg_fits_inqueue(struct msg_queue *msq, size_t msgsz)
  158. {
  159. return msgsz + msq->q_cbytes <= msq->q_qbytes &&
  160. 1 + msq->q_qnum <= msq->q_qbytes;
  161. }
  162. static inline void ss_add(struct msg_queue *msq,
  163. struct msg_sender *mss, size_t msgsz)
  164. {
  165. mss->tsk = current;
  166. mss->msgsz = msgsz;
  167. /*
  168. * No memory barrier required: we did ipc_lock_object(),
  169. * and the waker obtains that lock before calling wake_q_add().
  170. */
  171. __set_current_state(TASK_INTERRUPTIBLE);
  172. list_add_tail(&mss->list, &msq->q_senders);
  173. }
  174. static inline void ss_del(struct msg_sender *mss)
  175. {
  176. if (mss->list.next)
  177. list_del(&mss->list);
  178. }
  179. static void ss_wakeup(struct msg_queue *msq,
  180. struct wake_q_head *wake_q, bool kill)
  181. {
  182. struct msg_sender *mss, *t;
  183. struct task_struct *stop_tsk = NULL;
  184. struct list_head *h = &msq->q_senders;
  185. list_for_each_entry_safe(mss, t, h, list) {
  186. if (kill)
  187. mss->list.next = NULL;
  188. /*
  189. * Stop at the first task we don't wakeup,
  190. * we've already iterated the original
  191. * sender queue.
  192. */
  193. else if (stop_tsk == mss->tsk)
  194. break;
  195. /*
  196. * We are not in an EIDRM scenario here, therefore
  197. * verify that we really need to wakeup the task.
  198. * To maintain current semantics and wakeup order,
  199. * move the sender to the tail on behalf of the
  200. * blocked task.
  201. */
  202. else if (!msg_fits_inqueue(msq, mss->msgsz)) {
  203. if (!stop_tsk)
  204. stop_tsk = mss->tsk;
  205. list_move_tail(&mss->list, &msq->q_senders);
  206. continue;
  207. }
  208. wake_q_add(wake_q, mss->tsk);
  209. }
  210. }
  211. static void expunge_all(struct msg_queue *msq, int res,
  212. struct wake_q_head *wake_q)
  213. {
  214. struct msg_receiver *msr, *t;
  215. list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
  216. struct task_struct *r_tsk;
  217. r_tsk = get_task_struct(msr->r_tsk);
  218. /* see MSG_BARRIER for purpose/pairing */
  219. smp_store_release(&msr->r_msg, ERR_PTR(res));
  220. wake_q_add_safe(wake_q, r_tsk);
  221. }
  222. }
  223. /*
  224. * freeque() wakes up waiters on the sender and receiver waiting queue,
  225. * removes the message queue from message queue ID IDR, and cleans up all the
  226. * messages associated with this queue.
  227. *
  228. * msg_ids.rwsem (writer) and the spinlock for this message queue are held
  229. * before freeque() is called. msg_ids.rwsem remains locked on exit.
  230. */
  231. static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
  232. __releases(RCU)
  233. __releases(&msq->q_perm)
  234. {
  235. struct msg_msg *msg, *t;
  236. struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
  237. DEFINE_WAKE_Q(wake_q);
  238. expunge_all(msq, -EIDRM, &wake_q);
  239. ss_wakeup(msq, &wake_q, true);
  240. msg_rmid(ns, msq);
  241. ipc_unlock_object(&msq->q_perm);
  242. wake_up_q(&wake_q);
  243. rcu_read_unlock();
  244. list_for_each_entry_safe(msg, t, &msq->q_messages, m_list) {
  245. atomic_dec(&ns->msg_hdrs);
  246. free_msg(msg);
  247. }
  248. atomic_sub(msq->q_cbytes, &ns->msg_bytes);
  249. ipc_update_pid(&msq->q_lspid, NULL);
  250. ipc_update_pid(&msq->q_lrpid, NULL);
  251. ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
  252. }
  253. long ksys_msgget(key_t key, int msgflg)
  254. {
  255. struct ipc_namespace *ns;
  256. static const struct ipc_ops msg_ops = {
  257. .getnew = newque,
  258. .associate = security_msg_queue_associate,
  259. };
  260. struct ipc_params msg_params;
  261. ns = current->nsproxy->ipc_ns;
  262. msg_params.key = key;
  263. msg_params.flg = msgflg;
  264. return ipcget(ns, &msg_ids(ns), &msg_ops, &msg_params);
  265. }
  266. SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
  267. {
  268. return ksys_msgget(key, msgflg);
  269. }
  270. static inline unsigned long
  271. copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
  272. {
  273. switch (version) {
  274. case IPC_64:
  275. return copy_to_user(buf, in, sizeof(*in));
  276. case IPC_OLD:
  277. {
  278. struct msqid_ds out;
  279. memset(&out, 0, sizeof(out));
  280. ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
  281. out.msg_stime = in->msg_stime;
  282. out.msg_rtime = in->msg_rtime;
  283. out.msg_ctime = in->msg_ctime;
  284. if (in->msg_cbytes > USHRT_MAX)
  285. out.msg_cbytes = USHRT_MAX;
  286. else
  287. out.msg_cbytes = in->msg_cbytes;
  288. out.msg_lcbytes = in->msg_cbytes;
  289. if (in->msg_qnum > USHRT_MAX)
  290. out.msg_qnum = USHRT_MAX;
  291. else
  292. out.msg_qnum = in->msg_qnum;
  293. if (in->msg_qbytes > USHRT_MAX)
  294. out.msg_qbytes = USHRT_MAX;
  295. else
  296. out.msg_qbytes = in->msg_qbytes;
  297. out.msg_lqbytes = in->msg_qbytes;
  298. out.msg_lspid = in->msg_lspid;
  299. out.msg_lrpid = in->msg_lrpid;
  300. return copy_to_user(buf, &out, sizeof(out));
  301. }
  302. default:
  303. return -EINVAL;
  304. }
  305. }
  306. static inline unsigned long
  307. copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
  308. {
  309. switch (version) {
  310. case IPC_64:
  311. if (copy_from_user(out, buf, sizeof(*out)))
  312. return -EFAULT;
  313. return 0;
  314. case IPC_OLD:
  315. {
  316. struct msqid_ds tbuf_old;
  317. if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
  318. return -EFAULT;
  319. out->msg_perm.uid = tbuf_old.msg_perm.uid;
  320. out->msg_perm.gid = tbuf_old.msg_perm.gid;
  321. out->msg_perm.mode = tbuf_old.msg_perm.mode;
  322. if (tbuf_old.msg_qbytes == 0)
  323. out->msg_qbytes = tbuf_old.msg_lqbytes;
  324. else
  325. out->msg_qbytes = tbuf_old.msg_qbytes;
  326. return 0;
  327. }
  328. default:
  329. return -EINVAL;
  330. }
  331. }
  332. /*
  333. * This function handles some msgctl commands which require the rwsem
  334. * to be held in write mode.
  335. * NOTE: no locks must be held, the rwsem is taken inside this function.
  336. */
  337. static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
  338. struct ipc64_perm *perm, int msg_qbytes)
  339. {
  340. struct kern_ipc_perm *ipcp;
  341. struct msg_queue *msq;
  342. int err;
  343. down_write(&msg_ids(ns).rwsem);
  344. rcu_read_lock();
  345. ipcp = ipcctl_obtain_check(ns, &msg_ids(ns), msqid, cmd,
  346. perm, msg_qbytes);
  347. if (IS_ERR(ipcp)) {
  348. err = PTR_ERR(ipcp);
  349. goto out_unlock1;
  350. }
  351. msq = container_of(ipcp, struct msg_queue, q_perm);
  352. err = security_msg_queue_msgctl(&msq->q_perm, cmd);
  353. if (err)
  354. goto out_unlock1;
  355. switch (cmd) {
  356. case IPC_RMID:
  357. ipc_lock_object(&msq->q_perm);
  358. /* freeque unlocks the ipc object and rcu */
  359. freeque(ns, ipcp);
  360. goto out_up;
  361. case IPC_SET:
  362. {
  363. DEFINE_WAKE_Q(wake_q);
  364. if (msg_qbytes > ns->msg_ctlmnb &&
  365. !capable(CAP_SYS_RESOURCE)) {
  366. err = -EPERM;
  367. goto out_unlock1;
  368. }
  369. ipc_lock_object(&msq->q_perm);
  370. err = ipc_update_perm(perm, ipcp);
  371. if (err)
  372. goto out_unlock0;
  373. msq->q_qbytes = msg_qbytes;
  374. msq->q_ctime = ktime_get_real_seconds();
  375. /*
  376. * Sleeping receivers might be excluded by
  377. * stricter permissions.
  378. */
  379. expunge_all(msq, -EAGAIN, &wake_q);
  380. /*
  381. * Sleeping senders might be able to send
  382. * due to a larger queue size.
  383. */
  384. ss_wakeup(msq, &wake_q, false);
  385. ipc_unlock_object(&msq->q_perm);
  386. wake_up_q(&wake_q);
  387. goto out_unlock1;
  388. }
  389. default:
  390. err = -EINVAL;
  391. goto out_unlock1;
  392. }
  393. out_unlock0:
  394. ipc_unlock_object(&msq->q_perm);
  395. out_unlock1:
  396. rcu_read_unlock();
  397. out_up:
  398. up_write(&msg_ids(ns).rwsem);
  399. return err;
  400. }
  401. static int msgctl_info(struct ipc_namespace *ns, int msqid,
  402. int cmd, struct msginfo *msginfo)
  403. {
  404. int err;
  405. int max_idx;
  406. /*
  407. * We must not return kernel stack data.
  408. * due to padding, it's not enough
  409. * to set all member fields.
  410. */
  411. err = security_msg_queue_msgctl(NULL, cmd);
  412. if (err)
  413. return err;
  414. memset(msginfo, 0, sizeof(*msginfo));
  415. msginfo->msgmni = ns->msg_ctlmni;
  416. msginfo->msgmax = ns->msg_ctlmax;
  417. msginfo->msgmnb = ns->msg_ctlmnb;
  418. msginfo->msgssz = MSGSSZ;
  419. msginfo->msgseg = MSGSEG;
  420. down_read(&msg_ids(ns).rwsem);
  421. if (cmd == MSG_INFO) {
  422. msginfo->msgpool = msg_ids(ns).in_use;
  423. msginfo->msgmap = atomic_read(&ns->msg_hdrs);
  424. msginfo->msgtql = atomic_read(&ns->msg_bytes);
  425. } else {
  426. msginfo->msgmap = MSGMAP;
  427. msginfo->msgpool = MSGPOOL;
  428. msginfo->msgtql = MSGTQL;
  429. }
  430. max_idx = ipc_get_maxidx(&msg_ids(ns));
  431. up_read(&msg_ids(ns).rwsem);
  432. return (max_idx < 0) ? 0 : max_idx;
  433. }
  434. static int msgctl_stat(struct ipc_namespace *ns, int msqid,
  435. int cmd, struct msqid64_ds *p)
  436. {
  437. struct msg_queue *msq;
  438. int err;
  439. memset(p, 0, sizeof(*p));
  440. rcu_read_lock();
  441. if (cmd == MSG_STAT || cmd == MSG_STAT_ANY) {
  442. msq = msq_obtain_object(ns, msqid);
  443. if (IS_ERR(msq)) {
  444. err = PTR_ERR(msq);
  445. goto out_unlock;
  446. }
  447. } else { /* IPC_STAT */
  448. msq = msq_obtain_object_check(ns, msqid);
  449. if (IS_ERR(msq)) {
  450. err = PTR_ERR(msq);
  451. goto out_unlock;
  452. }
  453. }
  454. /* see comment for SHM_STAT_ANY */
  455. if (cmd == MSG_STAT_ANY)
  456. audit_ipc_obj(&msq->q_perm);
  457. else {
  458. err = -EACCES;
  459. if (ipcperms(ns, &msq->q_perm, S_IRUGO))
  460. goto out_unlock;
  461. }
  462. err = security_msg_queue_msgctl(&msq->q_perm, cmd);
  463. if (err)
  464. goto out_unlock;
  465. ipc_lock_object(&msq->q_perm);
  466. if (!ipc_valid_object(&msq->q_perm)) {
  467. ipc_unlock_object(&msq->q_perm);
  468. err = -EIDRM;
  469. goto out_unlock;
  470. }
  471. kernel_to_ipc64_perm(&msq->q_perm, &p->msg_perm);
  472. p->msg_stime = msq->q_stime;
  473. p->msg_rtime = msq->q_rtime;
  474. p->msg_ctime = msq->q_ctime;
  475. #ifndef CONFIG_64BIT
  476. p->msg_stime_high = msq->q_stime >> 32;
  477. p->msg_rtime_high = msq->q_rtime >> 32;
  478. p->msg_ctime_high = msq->q_ctime >> 32;
  479. #endif
  480. p->msg_cbytes = msq->q_cbytes;
  481. p->msg_qnum = msq->q_qnum;
  482. p->msg_qbytes = msq->q_qbytes;
  483. p->msg_lspid = pid_vnr(msq->q_lspid);
  484. p->msg_lrpid = pid_vnr(msq->q_lrpid);
  485. if (cmd == IPC_STAT) {
  486. /*
  487. * As defined in SUS:
  488. * Return 0 on success
  489. */
  490. err = 0;
  491. } else {
  492. /*
  493. * MSG_STAT and MSG_STAT_ANY (both Linux specific)
  494. * Return the full id, including the sequence number
  495. */
  496. err = msq->q_perm.id;
  497. }
  498. ipc_unlock_object(&msq->q_perm);
  499. out_unlock:
  500. rcu_read_unlock();
  501. return err;
  502. }
  503. static long ksys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf, int version)
  504. {
  505. struct ipc_namespace *ns;
  506. struct msqid64_ds msqid64;
  507. int err;
  508. if (msqid < 0 || cmd < 0)
  509. return -EINVAL;
  510. ns = current->nsproxy->ipc_ns;
  511. switch (cmd) {
  512. case IPC_INFO:
  513. case MSG_INFO: {
  514. struct msginfo msginfo;
  515. err = msgctl_info(ns, msqid, cmd, &msginfo);
  516. if (err < 0)
  517. return err;
  518. if (copy_to_user(buf, &msginfo, sizeof(struct msginfo)))
  519. err = -EFAULT;
  520. return err;
  521. }
  522. case MSG_STAT: /* msqid is an index rather than a msg queue id */
  523. case MSG_STAT_ANY:
  524. case IPC_STAT:
  525. err = msgctl_stat(ns, msqid, cmd, &msqid64);
  526. if (err < 0)
  527. return err;
  528. if (copy_msqid_to_user(buf, &msqid64, version))
  529. err = -EFAULT;
  530. return err;
  531. case IPC_SET:
  532. if (copy_msqid_from_user(&msqid64, buf, version))
  533. return -EFAULT;
  534. return msgctl_down(ns, msqid, cmd, &msqid64.msg_perm,
  535. msqid64.msg_qbytes);
  536. case IPC_RMID:
  537. return msgctl_down(ns, msqid, cmd, NULL, 0);
  538. default:
  539. return -EINVAL;
  540. }
  541. }
  542. SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
  543. {
  544. return ksys_msgctl(msqid, cmd, buf, IPC_64);
  545. }
  546. #ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
  547. long ksys_old_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
  548. {
  549. int version = ipc_parse_version(&cmd);
  550. return ksys_msgctl(msqid, cmd, buf, version);
  551. }
  552. SYSCALL_DEFINE3(old_msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
  553. {
  554. return ksys_old_msgctl(msqid, cmd, buf);
  555. }
  556. #endif
  557. #ifdef CONFIG_COMPAT
  558. struct compat_msqid_ds {
  559. struct compat_ipc_perm msg_perm;
  560. compat_uptr_t msg_first;
  561. compat_uptr_t msg_last;
  562. old_time32_t msg_stime;
  563. old_time32_t msg_rtime;
  564. old_time32_t msg_ctime;
  565. compat_ulong_t msg_lcbytes;
  566. compat_ulong_t msg_lqbytes;
  567. unsigned short msg_cbytes;
  568. unsigned short msg_qnum;
  569. unsigned short msg_qbytes;
  570. compat_ipc_pid_t msg_lspid;
  571. compat_ipc_pid_t msg_lrpid;
  572. };
  573. static int copy_compat_msqid_from_user(struct msqid64_ds *out, void __user *buf,
  574. int version)
  575. {
  576. memset(out, 0, sizeof(*out));
  577. if (version == IPC_64) {
  578. struct compat_msqid64_ds __user *p = buf;
  579. if (get_compat_ipc64_perm(&out->msg_perm, &p->msg_perm))
  580. return -EFAULT;
  581. if (get_user(out->msg_qbytes, &p->msg_qbytes))
  582. return -EFAULT;
  583. } else {
  584. struct compat_msqid_ds __user *p = buf;
  585. if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm))
  586. return -EFAULT;
  587. if (get_user(out->msg_qbytes, &p->msg_qbytes))
  588. return -EFAULT;
  589. }
  590. return 0;
  591. }
  592. static int copy_compat_msqid_to_user(void __user *buf, struct msqid64_ds *in,
  593. int version)
  594. {
  595. if (version == IPC_64) {
  596. struct compat_msqid64_ds v;
  597. memset(&v, 0, sizeof(v));
  598. to_compat_ipc64_perm(&v.msg_perm, &in->msg_perm);
  599. v.msg_stime = lower_32_bits(in->msg_stime);
  600. v.msg_stime_high = upper_32_bits(in->msg_stime);
  601. v.msg_rtime = lower_32_bits(in->msg_rtime);
  602. v.msg_rtime_high = upper_32_bits(in->msg_rtime);
  603. v.msg_ctime = lower_32_bits(in->msg_ctime);
  604. v.msg_ctime_high = upper_32_bits(in->msg_ctime);
  605. v.msg_cbytes = in->msg_cbytes;
  606. v.msg_qnum = in->msg_qnum;
  607. v.msg_qbytes = in->msg_qbytes;
  608. v.msg_lspid = in->msg_lspid;
  609. v.msg_lrpid = in->msg_lrpid;
  610. return copy_to_user(buf, &v, sizeof(v));
  611. } else {
  612. struct compat_msqid_ds v;
  613. memset(&v, 0, sizeof(v));
  614. to_compat_ipc_perm(&v.msg_perm, &in->msg_perm);
  615. v.msg_stime = in->msg_stime;
  616. v.msg_rtime = in->msg_rtime;
  617. v.msg_ctime = in->msg_ctime;
  618. v.msg_cbytes = in->msg_cbytes;
  619. v.msg_qnum = in->msg_qnum;
  620. v.msg_qbytes = in->msg_qbytes;
  621. v.msg_lspid = in->msg_lspid;
  622. v.msg_lrpid = in->msg_lrpid;
  623. return copy_to_user(buf, &v, sizeof(v));
  624. }
  625. }
  626. static long compat_ksys_msgctl(int msqid, int cmd, void __user *uptr, int version)
  627. {
  628. struct ipc_namespace *ns;
  629. int err;
  630. struct msqid64_ds msqid64;
  631. ns = current->nsproxy->ipc_ns;
  632. if (msqid < 0 || cmd < 0)
  633. return -EINVAL;
  634. switch (cmd & (~IPC_64)) {
  635. case IPC_INFO:
  636. case MSG_INFO: {
  637. struct msginfo msginfo;
  638. err = msgctl_info(ns, msqid, cmd, &msginfo);
  639. if (err < 0)
  640. return err;
  641. if (copy_to_user(uptr, &msginfo, sizeof(struct msginfo)))
  642. err = -EFAULT;
  643. return err;
  644. }
  645. case IPC_STAT:
  646. case MSG_STAT:
  647. case MSG_STAT_ANY:
  648. err = msgctl_stat(ns, msqid, cmd, &msqid64);
  649. if (err < 0)
  650. return err;
  651. if (copy_compat_msqid_to_user(uptr, &msqid64, version))
  652. err = -EFAULT;
  653. return err;
  654. case IPC_SET:
  655. if (copy_compat_msqid_from_user(&msqid64, uptr, version))
  656. return -EFAULT;
  657. return msgctl_down(ns, msqid, cmd, &msqid64.msg_perm, msqid64.msg_qbytes);
  658. case IPC_RMID:
  659. return msgctl_down(ns, msqid, cmd, NULL, 0);
  660. default:
  661. return -EINVAL;
  662. }
  663. }
  664. COMPAT_SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, void __user *, uptr)
  665. {
  666. return compat_ksys_msgctl(msqid, cmd, uptr, IPC_64);
  667. }
  668. #ifdef CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION
  669. long compat_ksys_old_msgctl(int msqid, int cmd, void __user *uptr)
  670. {
  671. int version = compat_ipc_parse_version(&cmd);
  672. return compat_ksys_msgctl(msqid, cmd, uptr, version);
  673. }
  674. COMPAT_SYSCALL_DEFINE3(old_msgctl, int, msqid, int, cmd, void __user *, uptr)
  675. {
  676. return compat_ksys_old_msgctl(msqid, cmd, uptr);
  677. }
  678. #endif
  679. #endif
  680. static int testmsg(struct msg_msg *msg, long type, int mode)
  681. {
  682. switch (mode) {
  683. case SEARCH_ANY:
  684. case SEARCH_NUMBER:
  685. return 1;
  686. case SEARCH_LESSEQUAL:
  687. if (msg->m_type <= type)
  688. return 1;
  689. break;
  690. case SEARCH_EQUAL:
  691. if (msg->m_type == type)
  692. return 1;
  693. break;
  694. case SEARCH_NOTEQUAL:
  695. if (msg->m_type != type)
  696. return 1;
  697. break;
  698. }
  699. return 0;
  700. }
  701. static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg,
  702. struct wake_q_head *wake_q)
  703. {
  704. struct msg_receiver *msr, *t;
  705. list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
  706. if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
  707. !security_msg_queue_msgrcv(&msq->q_perm, msg, msr->r_tsk,
  708. msr->r_msgtype, msr->r_mode)) {
  709. list_del(&msr->r_list);
  710. if (msr->r_maxsize < msg->m_ts) {
  711. wake_q_add(wake_q, msr->r_tsk);
  712. /* See expunge_all regarding memory barrier */
  713. smp_store_release(&msr->r_msg, ERR_PTR(-E2BIG));
  714. } else {
  715. ipc_update_pid(&msq->q_lrpid, task_pid(msr->r_tsk));
  716. msq->q_rtime = ktime_get_real_seconds();
  717. wake_q_add(wake_q, msr->r_tsk);
  718. /* See expunge_all regarding memory barrier */
  719. smp_store_release(&msr->r_msg, msg);
  720. return 1;
  721. }
  722. }
  723. }
  724. return 0;
  725. }
  726. static long do_msgsnd(int msqid, long mtype, void __user *mtext,
  727. size_t msgsz, int msgflg)
  728. {
  729. struct msg_queue *msq;
  730. struct msg_msg *msg;
  731. int err;
  732. struct ipc_namespace *ns;
  733. DEFINE_WAKE_Q(wake_q);
  734. ns = current->nsproxy->ipc_ns;
  735. if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0)
  736. return -EINVAL;
  737. if (mtype < 1)
  738. return -EINVAL;
  739. msg = load_msg(mtext, msgsz);
  740. if (IS_ERR(msg))
  741. return PTR_ERR(msg);
  742. msg->m_type = mtype;
  743. msg->m_ts = msgsz;
  744. rcu_read_lock();
  745. msq = msq_obtain_object_check(ns, msqid);
  746. if (IS_ERR(msq)) {
  747. err = PTR_ERR(msq);
  748. goto out_unlock1;
  749. }
  750. ipc_lock_object(&msq->q_perm);
  751. for (;;) {
  752. struct msg_sender s;
  753. err = -EACCES;
  754. if (ipcperms(ns, &msq->q_perm, S_IWUGO))
  755. goto out_unlock0;
  756. /* raced with RMID? */
  757. if (!ipc_valid_object(&msq->q_perm)) {
  758. err = -EIDRM;
  759. goto out_unlock0;
  760. }
  761. err = security_msg_queue_msgsnd(&msq->q_perm, msg, msgflg);
  762. if (err)
  763. goto out_unlock0;
  764. if (msg_fits_inqueue(msq, msgsz))
  765. break;
  766. /* queue full, wait: */
  767. if (msgflg & IPC_NOWAIT) {
  768. err = -EAGAIN;
  769. goto out_unlock0;
  770. }
  771. /* enqueue the sender and prepare to block */
  772. ss_add(msq, &s, msgsz);
  773. if (!ipc_rcu_getref(&msq->q_perm)) {
  774. err = -EIDRM;
  775. goto out_unlock0;
  776. }
  777. ipc_unlock_object(&msq->q_perm);
  778. rcu_read_unlock();
  779. schedule();
  780. rcu_read_lock();
  781. ipc_lock_object(&msq->q_perm);
  782. ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
  783. /* raced with RMID? */
  784. if (!ipc_valid_object(&msq->q_perm)) {
  785. err = -EIDRM;
  786. goto out_unlock0;
  787. }
  788. ss_del(&s);
  789. if (signal_pending(current)) {
  790. err = -ERESTARTNOHAND;
  791. goto out_unlock0;
  792. }
  793. }
  794. ipc_update_pid(&msq->q_lspid, task_tgid(current));
  795. msq->q_stime = ktime_get_real_seconds();
  796. if (!pipelined_send(msq, msg, &wake_q)) {
  797. /* no one is waiting for this message, enqueue it */
  798. list_add_tail(&msg->m_list, &msq->q_messages);
  799. msq->q_cbytes += msgsz;
  800. msq->q_qnum++;
  801. atomic_add(msgsz, &ns->msg_bytes);
  802. atomic_inc(&ns->msg_hdrs);
  803. }
  804. err = 0;
  805. msg = NULL;
  806. out_unlock0:
  807. ipc_unlock_object(&msq->q_perm);
  808. wake_up_q(&wake_q);
  809. out_unlock1:
  810. rcu_read_unlock();
  811. if (msg != NULL)
  812. free_msg(msg);
  813. return err;
  814. }
  815. long ksys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz,
  816. int msgflg)
  817. {
  818. long mtype;
  819. if (get_user(mtype, &msgp->mtype))
  820. return -EFAULT;
  821. return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
  822. }
  823. SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
  824. int, msgflg)
  825. {
  826. return ksys_msgsnd(msqid, msgp, msgsz, msgflg);
  827. }
  828. #ifdef CONFIG_COMPAT
  829. struct compat_msgbuf {
  830. compat_long_t mtype;
  831. char mtext[1];
  832. };
  833. long compat_ksys_msgsnd(int msqid, compat_uptr_t msgp,
  834. compat_ssize_t msgsz, int msgflg)
  835. {
  836. struct compat_msgbuf __user *up = compat_ptr(msgp);
  837. compat_long_t mtype;
  838. if (get_user(mtype, &up->mtype))
  839. return -EFAULT;
  840. return do_msgsnd(msqid, mtype, up->mtext, (ssize_t)msgsz, msgflg);
  841. }
  842. COMPAT_SYSCALL_DEFINE4(msgsnd, int, msqid, compat_uptr_t, msgp,
  843. compat_ssize_t, msgsz, int, msgflg)
  844. {
  845. return compat_ksys_msgsnd(msqid, msgp, msgsz, msgflg);
  846. }
  847. #endif
  848. static inline int convert_mode(long *msgtyp, int msgflg)
  849. {
  850. if (msgflg & MSG_COPY)
  851. return SEARCH_NUMBER;
  852. /*
  853. * find message of correct type.
  854. * msgtyp = 0 => get first.
  855. * msgtyp > 0 => get first message of matching type.
  856. * msgtyp < 0 => get message with least type must be < abs(msgtype).
  857. */
  858. if (*msgtyp == 0)
  859. return SEARCH_ANY;
  860. if (*msgtyp < 0) {
  861. if (*msgtyp == LONG_MIN) /* -LONG_MIN is undefined */
  862. *msgtyp = LONG_MAX;
  863. else
  864. *msgtyp = -*msgtyp;
  865. return SEARCH_LESSEQUAL;
  866. }
  867. if (msgflg & MSG_EXCEPT)
  868. return SEARCH_NOTEQUAL;
  869. return SEARCH_EQUAL;
  870. }
  871. static long do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
  872. {
  873. struct msgbuf __user *msgp = dest;
  874. size_t msgsz;
  875. if (put_user(msg->m_type, &msgp->mtype))
  876. return -EFAULT;
  877. msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
  878. if (store_msg(msgp->mtext, msg, msgsz))
  879. return -EFAULT;
  880. return msgsz;
  881. }
  882. #ifdef CONFIG_CHECKPOINT_RESTORE
  883. /*
  884. * This function creates new kernel message structure, large enough to store
  885. * bufsz message bytes.
  886. */
  887. static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
  888. {
  889. struct msg_msg *copy;
  890. /*
  891. * Create dummy message to copy real message to.
  892. */
  893. copy = load_msg(buf, bufsz);
  894. if (!IS_ERR(copy))
  895. copy->m_ts = bufsz;
  896. return copy;
  897. }
  898. static inline void free_copy(struct msg_msg *copy)
  899. {
  900. if (copy)
  901. free_msg(copy);
  902. }
  903. #else
  904. static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
  905. {
  906. return ERR_PTR(-ENOSYS);
  907. }
  908. static inline void free_copy(struct msg_msg *copy)
  909. {
  910. }
  911. #endif
  912. static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
  913. {
  914. struct msg_msg *msg, *found = NULL;
  915. long count = 0;
  916. list_for_each_entry(msg, &msq->q_messages, m_list) {
  917. if (testmsg(msg, *msgtyp, mode) &&
  918. !security_msg_queue_msgrcv(&msq->q_perm, msg, current,
  919. *msgtyp, mode)) {
  920. if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
  921. *msgtyp = msg->m_type - 1;
  922. found = msg;
  923. } else if (mode == SEARCH_NUMBER) {
  924. if (*msgtyp == count)
  925. return msg;
  926. } else
  927. return msg;
  928. count++;
  929. }
  930. }
  931. return found ?: ERR_PTR(-EAGAIN);
  932. }
  933. static long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgflg,
  934. long (*msg_handler)(void __user *, struct msg_msg *, size_t))
  935. {
  936. int mode;
  937. struct msg_queue *msq;
  938. struct ipc_namespace *ns;
  939. struct msg_msg *msg, *copy = NULL;
  940. DEFINE_WAKE_Q(wake_q);
  941. ns = current->nsproxy->ipc_ns;
  942. if (msqid < 0 || (long) bufsz < 0)
  943. return -EINVAL;
  944. if (msgflg & MSG_COPY) {
  945. if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT))
  946. return -EINVAL;
  947. copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
  948. if (IS_ERR(copy))
  949. return PTR_ERR(copy);
  950. }
  951. mode = convert_mode(&msgtyp, msgflg);
  952. rcu_read_lock();
  953. msq = msq_obtain_object_check(ns, msqid);
  954. if (IS_ERR(msq)) {
  955. rcu_read_unlock();
  956. free_copy(copy);
  957. return PTR_ERR(msq);
  958. }
  959. for (;;) {
  960. struct msg_receiver msr_d;
  961. msg = ERR_PTR(-EACCES);
  962. if (ipcperms(ns, &msq->q_perm, S_IRUGO))
  963. goto out_unlock1;
  964. ipc_lock_object(&msq->q_perm);
  965. /* raced with RMID? */
  966. if (!ipc_valid_object(&msq->q_perm)) {
  967. msg = ERR_PTR(-EIDRM);
  968. goto out_unlock0;
  969. }
  970. msg = find_msg(msq, &msgtyp, mode);
  971. if (!IS_ERR(msg)) {
  972. /*
  973. * Found a suitable message.
  974. * Unlink it from the queue.
  975. */
  976. if ((bufsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
  977. msg = ERR_PTR(-E2BIG);
  978. goto out_unlock0;
  979. }
  980. /*
  981. * If we are copying, then do not unlink message and do
  982. * not update queue parameters.
  983. */
  984. if (msgflg & MSG_COPY) {
  985. msg = copy_msg(msg, copy);
  986. goto out_unlock0;
  987. }
  988. list_del(&msg->m_list);
  989. msq->q_qnum--;
  990. msq->q_rtime = ktime_get_real_seconds();
  991. ipc_update_pid(&msq->q_lrpid, task_tgid(current));
  992. msq->q_cbytes -= msg->m_ts;
  993. atomic_sub(msg->m_ts, &ns->msg_bytes);
  994. atomic_dec(&ns->msg_hdrs);
  995. ss_wakeup(msq, &wake_q, false);
  996. goto out_unlock0;
  997. }
  998. /* No message waiting. Wait for a message */
  999. if (msgflg & IPC_NOWAIT) {
  1000. msg = ERR_PTR(-ENOMSG);
  1001. goto out_unlock0;
  1002. }
  1003. list_add_tail(&msr_d.r_list, &msq->q_receivers);
  1004. msr_d.r_tsk = current;
  1005. msr_d.r_msgtype = msgtyp;
  1006. msr_d.r_mode = mode;
  1007. if (msgflg & MSG_NOERROR)
  1008. msr_d.r_maxsize = INT_MAX;
  1009. else
  1010. msr_d.r_maxsize = bufsz;
  1011. /* memory barrier not require due to ipc_lock_object() */
  1012. WRITE_ONCE(msr_d.r_msg, ERR_PTR(-EAGAIN));
  1013. /* memory barrier not required, we own ipc_lock_object() */
  1014. __set_current_state(TASK_INTERRUPTIBLE);
  1015. ipc_unlock_object(&msq->q_perm);
  1016. rcu_read_unlock();
  1017. schedule();
  1018. /*
  1019. * Lockless receive, part 1:
  1020. * We don't hold a reference to the queue and getting a
  1021. * reference would defeat the idea of a lockless operation,
  1022. * thus the code relies on rcu to guarantee the existence of
  1023. * msq:
  1024. * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
  1025. * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
  1026. */
  1027. rcu_read_lock();
  1028. /*
  1029. * Lockless receive, part 2:
  1030. * The work in pipelined_send() and expunge_all():
  1031. * - Set pointer to message
  1032. * - Queue the receiver task for later wakeup
  1033. * - Wake up the process after the lock is dropped.
  1034. *
  1035. * Should the process wake up before this wakeup (due to a
  1036. * signal) it will either see the message and continue ...
  1037. */
  1038. msg = READ_ONCE(msr_d.r_msg);
  1039. if (msg != ERR_PTR(-EAGAIN)) {
  1040. /* see MSG_BARRIER for purpose/pairing */
  1041. smp_acquire__after_ctrl_dep();
  1042. goto out_unlock1;
  1043. }
  1044. /*
  1045. * ... or see -EAGAIN, acquire the lock to check the message
  1046. * again.
  1047. */
  1048. ipc_lock_object(&msq->q_perm);
  1049. msg = READ_ONCE(msr_d.r_msg);
  1050. if (msg != ERR_PTR(-EAGAIN))
  1051. goto out_unlock0;
  1052. list_del(&msr_d.r_list);
  1053. if (signal_pending(current)) {
  1054. msg = ERR_PTR(-ERESTARTNOHAND);
  1055. goto out_unlock0;
  1056. }
  1057. ipc_unlock_object(&msq->q_perm);
  1058. }
  1059. out_unlock0:
  1060. ipc_unlock_object(&msq->q_perm);
  1061. wake_up_q(&wake_q);
  1062. out_unlock1:
  1063. rcu_read_unlock();
  1064. if (IS_ERR(msg)) {
  1065. free_copy(copy);
  1066. return PTR_ERR(msg);
  1067. }
  1068. bufsz = msg_handler(buf, msg, bufsz);
  1069. free_msg(msg);
  1070. return bufsz;
  1071. }
  1072. long ksys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
  1073. long msgtyp, int msgflg)
  1074. {
  1075. return do_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg, do_msg_fill);
  1076. }
  1077. SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
  1078. long, msgtyp, int, msgflg)
  1079. {
  1080. return ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
  1081. }
  1082. #ifdef CONFIG_COMPAT
  1083. static long compat_do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
  1084. {
  1085. struct compat_msgbuf __user *msgp = dest;
  1086. size_t msgsz;
  1087. if (put_user(msg->m_type, &msgp->mtype))
  1088. return -EFAULT;
  1089. msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
  1090. if (store_msg(msgp->mtext, msg, msgsz))
  1091. return -EFAULT;
  1092. return msgsz;
  1093. }
  1094. long compat_ksys_msgrcv(int msqid, compat_uptr_t msgp, compat_ssize_t msgsz,
  1095. compat_long_t msgtyp, int msgflg)
  1096. {
  1097. return do_msgrcv(msqid, compat_ptr(msgp), (ssize_t)msgsz, (long)msgtyp,
  1098. msgflg, compat_do_msg_fill);
  1099. }
  1100. COMPAT_SYSCALL_DEFINE5(msgrcv, int, msqid, compat_uptr_t, msgp,
  1101. compat_ssize_t, msgsz, compat_long_t, msgtyp,
  1102. int, msgflg)
  1103. {
  1104. return compat_ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
  1105. }
  1106. #endif
  1107. void msg_init_ns(struct ipc_namespace *ns)
  1108. {
  1109. ns->msg_ctlmax = MSGMAX;
  1110. ns->msg_ctlmnb = MSGMNB;
  1111. ns->msg_ctlmni = MSGMNI;
  1112. atomic_set(&ns->msg_bytes, 0);
  1113. atomic_set(&ns->msg_hdrs, 0);
  1114. ipc_init_ids(&ns->ids[IPC_MSG_IDS]);
  1115. }
  1116. #ifdef CONFIG_IPC_NS
  1117. void msg_exit_ns(struct ipc_namespace *ns)
  1118. {
  1119. free_ipcs(ns, &msg_ids(ns), freeque);
  1120. idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
  1121. rhashtable_destroy(&ns->ids[IPC_MSG_IDS].key_ht);
  1122. }
  1123. #endif
  1124. #ifdef CONFIG_PROC_FS
  1125. static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
  1126. {
  1127. struct pid_namespace *pid_ns = ipc_seq_pid_ns(s);
  1128. struct user_namespace *user_ns = seq_user_ns(s);
  1129. struct kern_ipc_perm *ipcp = it;
  1130. struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
  1131. seq_printf(s,
  1132. "%10d %10d %4o %10lu %10lu %5u %5u %5u %5u %5u %5u %10llu %10llu %10llu\n",
  1133. msq->q_perm.key,
  1134. msq->q_perm.id,
  1135. msq->q_perm.mode,
  1136. msq->q_cbytes,
  1137. msq->q_qnum,
  1138. pid_nr_ns(msq->q_lspid, pid_ns),
  1139. pid_nr_ns(msq->q_lrpid, pid_ns),
  1140. from_kuid_munged(user_ns, msq->q_perm.uid),
  1141. from_kgid_munged(user_ns, msq->q_perm.gid),
  1142. from_kuid_munged(user_ns, msq->q_perm.cuid),
  1143. from_kgid_munged(user_ns, msq->q_perm.cgid),
  1144. msq->q_stime,
  1145. msq->q_rtime,
  1146. msq->q_ctime);
  1147. return 0;
  1148. }
  1149. #endif
  1150. void __init msg_init(void)
  1151. {
  1152. msg_init_ns(&init_ipc_ns);
  1153. ipc_init_proc_interface("sysvipc/msg",
  1154. " key msqid perms cbytes qnum lspid lrpid uid gid cuid cgid stime rtime ctime\n",
  1155. IPC_MSG_IDS, sysvipc_msg_proc_show);
  1156. }