msg.c 32 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * linux/ipc/msg.c
  4. * Copyright (C) 1992 Krishna Balasubramanian
  5. *
  6. * Removed all the remaining kerneld mess
  7. * Catch the -EFAULT stuff properly
  8. * Use GFP_KERNEL for messages as in 1.2
  9. * Fixed up the unchecked user space derefs
  10. * Copyright (C) 1998 Alan Cox & Andi Kleen
  11. *
  12. * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <[email protected]>
  13. *
  14. * mostly rewritten, threaded and wake-one semantics added
  15. * MSGMAX limit removed, sysctl's added
  16. * (c) 1999 Manfred Spraul <[email protected]>
  17. *
  18. * support for audit of ipc object properties and permission changes
  19. * Dustin Kirkland <[email protected]>
  20. *
  21. * namespaces support
  22. * OpenVZ, SWsoft Inc.
  23. * Pavel Emelianov <[email protected]>
  24. */
  25. #include <linux/capability.h>
  26. #include <linux/msg.h>
  27. #include <linux/spinlock.h>
  28. #include <linux/init.h>
  29. #include <linux/mm.h>
  30. #include <linux/proc_fs.h>
  31. #include <linux/list.h>
  32. #include <linux/security.h>
  33. #include <linux/sched/wake_q.h>
  34. #include <linux/syscalls.h>
  35. #include <linux/audit.h>
  36. #include <linux/seq_file.h>
  37. #include <linux/rwsem.h>
  38. #include <linux/nsproxy.h>
  39. #include <linux/ipc_namespace.h>
  40. #include <linux/rhashtable.h>
  41. #include <linux/percpu_counter.h>
  42. #include <asm/current.h>
  43. #include <linux/uaccess.h>
  44. #include "util.h"
  45. /* one msq_queue structure for each present queue on the system */
  46. struct msg_queue {
  47. struct kern_ipc_perm q_perm;
  48. time64_t q_stime; /* last msgsnd time */
  49. time64_t q_rtime; /* last msgrcv time */
  50. time64_t q_ctime; /* last change time */
  51. unsigned long q_cbytes; /* current number of bytes on queue */
  52. unsigned long q_qnum; /* number of messages in queue */
  53. unsigned long q_qbytes; /* max number of bytes on queue */
  54. struct pid *q_lspid; /* pid of last msgsnd */
  55. struct pid *q_lrpid; /* last receive pid */
  56. struct list_head q_messages;
  57. struct list_head q_receivers;
  58. struct list_head q_senders;
  59. } __randomize_layout;
  60. /*
  61. * MSG_BARRIER Locking:
  62. *
  63. * Similar to the optimization used in ipc/mqueue.c, one syscall return path
  64. * does not acquire any locks when it sees that a message exists in
  65. * msg_receiver.r_msg. Therefore r_msg is set using smp_store_release()
  66. * and accessed using READ_ONCE()+smp_acquire__after_ctrl_dep(). In addition,
  67. * wake_q_add_safe() is used. See ipc/mqueue.c for more details
  68. */
  69. /* one msg_receiver structure for each sleeping receiver */
  70. struct msg_receiver {
  71. struct list_head r_list;
  72. struct task_struct *r_tsk;
  73. int r_mode;
  74. long r_msgtype;
  75. long r_maxsize;
  76. struct msg_msg *r_msg;
  77. };
  78. /* one msg_sender for each sleeping sender */
  79. struct msg_sender {
  80. struct list_head list;
  81. struct task_struct *tsk;
  82. size_t msgsz;
  83. };
  84. #define SEARCH_ANY 1
  85. #define SEARCH_EQUAL 2
  86. #define SEARCH_NOTEQUAL 3
  87. #define SEARCH_LESSEQUAL 4
  88. #define SEARCH_NUMBER 5
  89. #define msg_ids(ns) ((ns)->ids[IPC_MSG_IDS])
  90. static inline struct msg_queue *msq_obtain_object(struct ipc_namespace *ns, int id)
  91. {
  92. struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&msg_ids(ns), id);
  93. if (IS_ERR(ipcp))
  94. return ERR_CAST(ipcp);
  95. return container_of(ipcp, struct msg_queue, q_perm);
  96. }
  97. static inline struct msg_queue *msq_obtain_object_check(struct ipc_namespace *ns,
  98. int id)
  99. {
  100. struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&msg_ids(ns), id);
  101. if (IS_ERR(ipcp))
  102. return ERR_CAST(ipcp);
  103. return container_of(ipcp, struct msg_queue, q_perm);
  104. }
  105. static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
  106. {
  107. ipc_rmid(&msg_ids(ns), &s->q_perm);
  108. }
  109. static void msg_rcu_free(struct rcu_head *head)
  110. {
  111. struct kern_ipc_perm *p = container_of(head, struct kern_ipc_perm, rcu);
  112. struct msg_queue *msq = container_of(p, struct msg_queue, q_perm);
  113. security_msg_queue_free(&msq->q_perm);
  114. kfree(msq);
  115. }
  116. /**
  117. * newque - Create a new msg queue
  118. * @ns: namespace
  119. * @params: ptr to the structure that contains the key and msgflg
  120. *
  121. * Called with msg_ids.rwsem held (writer)
  122. */
  123. static int newque(struct ipc_namespace *ns, struct ipc_params *params)
  124. {
  125. struct msg_queue *msq;
  126. int retval;
  127. key_t key = params->key;
  128. int msgflg = params->flg;
  129. msq = kmalloc(sizeof(*msq), GFP_KERNEL_ACCOUNT);
  130. if (unlikely(!msq))
  131. return -ENOMEM;
  132. msq->q_perm.mode = msgflg & S_IRWXUGO;
  133. msq->q_perm.key = key;
  134. msq->q_perm.security = NULL;
  135. retval = security_msg_queue_alloc(&msq->q_perm);
  136. if (retval) {
  137. kfree(msq);
  138. return retval;
  139. }
  140. msq->q_stime = msq->q_rtime = 0;
  141. msq->q_ctime = ktime_get_real_seconds();
  142. msq->q_cbytes = msq->q_qnum = 0;
  143. msq->q_qbytes = ns->msg_ctlmnb;
  144. msq->q_lspid = msq->q_lrpid = NULL;
  145. INIT_LIST_HEAD(&msq->q_messages);
  146. INIT_LIST_HEAD(&msq->q_receivers);
  147. INIT_LIST_HEAD(&msq->q_senders);
  148. /* ipc_addid() locks msq upon success. */
  149. retval = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
  150. if (retval < 0) {
  151. ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
  152. return retval;
  153. }
  154. ipc_unlock_object(&msq->q_perm);
  155. rcu_read_unlock();
  156. return msq->q_perm.id;
  157. }
  158. static inline bool msg_fits_inqueue(struct msg_queue *msq, size_t msgsz)
  159. {
  160. return msgsz + msq->q_cbytes <= msq->q_qbytes &&
  161. 1 + msq->q_qnum <= msq->q_qbytes;
  162. }
  163. static inline void ss_add(struct msg_queue *msq,
  164. struct msg_sender *mss, size_t msgsz)
  165. {
  166. mss->tsk = current;
  167. mss->msgsz = msgsz;
  168. /*
  169. * No memory barrier required: we did ipc_lock_object(),
  170. * and the waker obtains that lock before calling wake_q_add().
  171. */
  172. __set_current_state(TASK_INTERRUPTIBLE);
  173. list_add_tail(&mss->list, &msq->q_senders);
  174. }
  175. static inline void ss_del(struct msg_sender *mss)
  176. {
  177. if (mss->list.next)
  178. list_del(&mss->list);
  179. }
  180. static void ss_wakeup(struct msg_queue *msq,
  181. struct wake_q_head *wake_q, bool kill)
  182. {
  183. struct msg_sender *mss, *t;
  184. struct task_struct *stop_tsk = NULL;
  185. struct list_head *h = &msq->q_senders;
  186. list_for_each_entry_safe(mss, t, h, list) {
  187. if (kill)
  188. mss->list.next = NULL;
  189. /*
  190. * Stop at the first task we don't wakeup,
  191. * we've already iterated the original
  192. * sender queue.
  193. */
  194. else if (stop_tsk == mss->tsk)
  195. break;
  196. /*
  197. * We are not in an EIDRM scenario here, therefore
  198. * verify that we really need to wakeup the task.
  199. * To maintain current semantics and wakeup order,
  200. * move the sender to the tail on behalf of the
  201. * blocked task.
  202. */
  203. else if (!msg_fits_inqueue(msq, mss->msgsz)) {
  204. if (!stop_tsk)
  205. stop_tsk = mss->tsk;
  206. list_move_tail(&mss->list, &msq->q_senders);
  207. continue;
  208. }
  209. wake_q_add(wake_q, mss->tsk);
  210. }
  211. }
  212. static void expunge_all(struct msg_queue *msq, int res,
  213. struct wake_q_head *wake_q)
  214. {
  215. struct msg_receiver *msr, *t;
  216. list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
  217. struct task_struct *r_tsk;
  218. r_tsk = get_task_struct(msr->r_tsk);
  219. /* see MSG_BARRIER for purpose/pairing */
  220. smp_store_release(&msr->r_msg, ERR_PTR(res));
  221. wake_q_add_safe(wake_q, r_tsk);
  222. }
  223. }
  224. /*
  225. * freeque() wakes up waiters on the sender and receiver waiting queue,
  226. * removes the message queue from message queue ID IDR, and cleans up all the
  227. * messages associated with this queue.
  228. *
  229. * msg_ids.rwsem (writer) and the spinlock for this message queue are held
  230. * before freeque() is called. msg_ids.rwsem remains locked on exit.
  231. */
  232. static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
  233. __releases(RCU)
  234. __releases(&msq->q_perm)
  235. {
  236. struct msg_msg *msg, *t;
  237. struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
  238. DEFINE_WAKE_Q(wake_q);
  239. expunge_all(msq, -EIDRM, &wake_q);
  240. ss_wakeup(msq, &wake_q, true);
  241. msg_rmid(ns, msq);
  242. ipc_unlock_object(&msq->q_perm);
  243. wake_up_q(&wake_q);
  244. rcu_read_unlock();
  245. list_for_each_entry_safe(msg, t, &msq->q_messages, m_list) {
  246. percpu_counter_sub_local(&ns->percpu_msg_hdrs, 1);
  247. free_msg(msg);
  248. }
  249. percpu_counter_sub_local(&ns->percpu_msg_bytes, msq->q_cbytes);
  250. ipc_update_pid(&msq->q_lspid, NULL);
  251. ipc_update_pid(&msq->q_lrpid, NULL);
  252. ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
  253. }
  254. long ksys_msgget(key_t key, int msgflg)
  255. {
  256. struct ipc_namespace *ns;
  257. static const struct ipc_ops msg_ops = {
  258. .getnew = newque,
  259. .associate = security_msg_queue_associate,
  260. };
  261. struct ipc_params msg_params;
  262. ns = current->nsproxy->ipc_ns;
  263. msg_params.key = key;
  264. msg_params.flg = msgflg;
  265. return ipcget(ns, &msg_ids(ns), &msg_ops, &msg_params);
  266. }
  267. SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
  268. {
  269. return ksys_msgget(key, msgflg);
  270. }
  271. static inline unsigned long
  272. copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
  273. {
  274. switch (version) {
  275. case IPC_64:
  276. return copy_to_user(buf, in, sizeof(*in));
  277. case IPC_OLD:
  278. {
  279. struct msqid_ds out;
  280. memset(&out, 0, sizeof(out));
  281. ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
  282. out.msg_stime = in->msg_stime;
  283. out.msg_rtime = in->msg_rtime;
  284. out.msg_ctime = in->msg_ctime;
  285. if (in->msg_cbytes > USHRT_MAX)
  286. out.msg_cbytes = USHRT_MAX;
  287. else
  288. out.msg_cbytes = in->msg_cbytes;
  289. out.msg_lcbytes = in->msg_cbytes;
  290. if (in->msg_qnum > USHRT_MAX)
  291. out.msg_qnum = USHRT_MAX;
  292. else
  293. out.msg_qnum = in->msg_qnum;
  294. if (in->msg_qbytes > USHRT_MAX)
  295. out.msg_qbytes = USHRT_MAX;
  296. else
  297. out.msg_qbytes = in->msg_qbytes;
  298. out.msg_lqbytes = in->msg_qbytes;
  299. out.msg_lspid = in->msg_lspid;
  300. out.msg_lrpid = in->msg_lrpid;
  301. return copy_to_user(buf, &out, sizeof(out));
  302. }
  303. default:
  304. return -EINVAL;
  305. }
  306. }
  307. static inline unsigned long
  308. copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
  309. {
  310. switch (version) {
  311. case IPC_64:
  312. if (copy_from_user(out, buf, sizeof(*out)))
  313. return -EFAULT;
  314. return 0;
  315. case IPC_OLD:
  316. {
  317. struct msqid_ds tbuf_old;
  318. if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
  319. return -EFAULT;
  320. out->msg_perm.uid = tbuf_old.msg_perm.uid;
  321. out->msg_perm.gid = tbuf_old.msg_perm.gid;
  322. out->msg_perm.mode = tbuf_old.msg_perm.mode;
  323. if (tbuf_old.msg_qbytes == 0)
  324. out->msg_qbytes = tbuf_old.msg_lqbytes;
  325. else
  326. out->msg_qbytes = tbuf_old.msg_qbytes;
  327. return 0;
  328. }
  329. default:
  330. return -EINVAL;
  331. }
  332. }
  333. /*
  334. * This function handles some msgctl commands which require the rwsem
  335. * to be held in write mode.
  336. * NOTE: no locks must be held, the rwsem is taken inside this function.
  337. */
  338. static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
  339. struct ipc64_perm *perm, int msg_qbytes)
  340. {
  341. struct kern_ipc_perm *ipcp;
  342. struct msg_queue *msq;
  343. int err;
  344. down_write(&msg_ids(ns).rwsem);
  345. rcu_read_lock();
  346. ipcp = ipcctl_obtain_check(ns, &msg_ids(ns), msqid, cmd,
  347. perm, msg_qbytes);
  348. if (IS_ERR(ipcp)) {
  349. err = PTR_ERR(ipcp);
  350. goto out_unlock1;
  351. }
  352. msq = container_of(ipcp, struct msg_queue, q_perm);
  353. err = security_msg_queue_msgctl(&msq->q_perm, cmd);
  354. if (err)
  355. goto out_unlock1;
  356. switch (cmd) {
  357. case IPC_RMID:
  358. ipc_lock_object(&msq->q_perm);
  359. /* freeque unlocks the ipc object and rcu */
  360. freeque(ns, ipcp);
  361. goto out_up;
  362. case IPC_SET:
  363. {
  364. DEFINE_WAKE_Q(wake_q);
  365. if (msg_qbytes > ns->msg_ctlmnb &&
  366. !capable(CAP_SYS_RESOURCE)) {
  367. err = -EPERM;
  368. goto out_unlock1;
  369. }
  370. ipc_lock_object(&msq->q_perm);
  371. err = ipc_update_perm(perm, ipcp);
  372. if (err)
  373. goto out_unlock0;
  374. msq->q_qbytes = msg_qbytes;
  375. msq->q_ctime = ktime_get_real_seconds();
  376. /*
  377. * Sleeping receivers might be excluded by
  378. * stricter permissions.
  379. */
  380. expunge_all(msq, -EAGAIN, &wake_q);
  381. /*
  382. * Sleeping senders might be able to send
  383. * due to a larger queue size.
  384. */
  385. ss_wakeup(msq, &wake_q, false);
  386. ipc_unlock_object(&msq->q_perm);
  387. wake_up_q(&wake_q);
  388. goto out_unlock1;
  389. }
  390. default:
  391. err = -EINVAL;
  392. goto out_unlock1;
  393. }
  394. out_unlock0:
  395. ipc_unlock_object(&msq->q_perm);
  396. out_unlock1:
  397. rcu_read_unlock();
  398. out_up:
  399. up_write(&msg_ids(ns).rwsem);
  400. return err;
  401. }
  402. static int msgctl_info(struct ipc_namespace *ns, int msqid,
  403. int cmd, struct msginfo *msginfo)
  404. {
  405. int err;
  406. int max_idx;
  407. /*
  408. * We must not return kernel stack data.
  409. * due to padding, it's not enough
  410. * to set all member fields.
  411. */
  412. err = security_msg_queue_msgctl(NULL, cmd);
  413. if (err)
  414. return err;
  415. memset(msginfo, 0, sizeof(*msginfo));
  416. msginfo->msgmni = ns->msg_ctlmni;
  417. msginfo->msgmax = ns->msg_ctlmax;
  418. msginfo->msgmnb = ns->msg_ctlmnb;
  419. msginfo->msgssz = MSGSSZ;
  420. msginfo->msgseg = MSGSEG;
  421. down_read(&msg_ids(ns).rwsem);
  422. if (cmd == MSG_INFO)
  423. msginfo->msgpool = msg_ids(ns).in_use;
  424. max_idx = ipc_get_maxidx(&msg_ids(ns));
  425. up_read(&msg_ids(ns).rwsem);
  426. if (cmd == MSG_INFO) {
  427. msginfo->msgmap = min_t(int,
  428. percpu_counter_sum(&ns->percpu_msg_hdrs),
  429. INT_MAX);
  430. msginfo->msgtql = min_t(int,
  431. percpu_counter_sum(&ns->percpu_msg_bytes),
  432. INT_MAX);
  433. } else {
  434. msginfo->msgmap = MSGMAP;
  435. msginfo->msgpool = MSGPOOL;
  436. msginfo->msgtql = MSGTQL;
  437. }
  438. return (max_idx < 0) ? 0 : max_idx;
  439. }
  440. static int msgctl_stat(struct ipc_namespace *ns, int msqid,
  441. int cmd, struct msqid64_ds *p)
  442. {
  443. struct msg_queue *msq;
  444. int err;
  445. memset(p, 0, sizeof(*p));
  446. rcu_read_lock();
  447. if (cmd == MSG_STAT || cmd == MSG_STAT_ANY) {
  448. msq = msq_obtain_object(ns, msqid);
  449. if (IS_ERR(msq)) {
  450. err = PTR_ERR(msq);
  451. goto out_unlock;
  452. }
  453. } else { /* IPC_STAT */
  454. msq = msq_obtain_object_check(ns, msqid);
  455. if (IS_ERR(msq)) {
  456. err = PTR_ERR(msq);
  457. goto out_unlock;
  458. }
  459. }
  460. /* see comment for SHM_STAT_ANY */
  461. if (cmd == MSG_STAT_ANY)
  462. audit_ipc_obj(&msq->q_perm);
  463. else {
  464. err = -EACCES;
  465. if (ipcperms(ns, &msq->q_perm, S_IRUGO))
  466. goto out_unlock;
  467. }
  468. err = security_msg_queue_msgctl(&msq->q_perm, cmd);
  469. if (err)
  470. goto out_unlock;
  471. ipc_lock_object(&msq->q_perm);
  472. if (!ipc_valid_object(&msq->q_perm)) {
  473. ipc_unlock_object(&msq->q_perm);
  474. err = -EIDRM;
  475. goto out_unlock;
  476. }
  477. kernel_to_ipc64_perm(&msq->q_perm, &p->msg_perm);
  478. p->msg_stime = msq->q_stime;
  479. p->msg_rtime = msq->q_rtime;
  480. p->msg_ctime = msq->q_ctime;
  481. #ifndef CONFIG_64BIT
  482. p->msg_stime_high = msq->q_stime >> 32;
  483. p->msg_rtime_high = msq->q_rtime >> 32;
  484. p->msg_ctime_high = msq->q_ctime >> 32;
  485. #endif
  486. p->msg_cbytes = msq->q_cbytes;
  487. p->msg_qnum = msq->q_qnum;
  488. p->msg_qbytes = msq->q_qbytes;
  489. p->msg_lspid = pid_vnr(msq->q_lspid);
  490. p->msg_lrpid = pid_vnr(msq->q_lrpid);
  491. if (cmd == IPC_STAT) {
  492. /*
  493. * As defined in SUS:
  494. * Return 0 on success
  495. */
  496. err = 0;
  497. } else {
  498. /*
  499. * MSG_STAT and MSG_STAT_ANY (both Linux specific)
  500. * Return the full id, including the sequence number
  501. */
  502. err = msq->q_perm.id;
  503. }
  504. ipc_unlock_object(&msq->q_perm);
  505. out_unlock:
  506. rcu_read_unlock();
  507. return err;
  508. }
  509. static long ksys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf, int version)
  510. {
  511. struct ipc_namespace *ns;
  512. struct msqid64_ds msqid64;
  513. int err;
  514. if (msqid < 0 || cmd < 0)
  515. return -EINVAL;
  516. ns = current->nsproxy->ipc_ns;
  517. switch (cmd) {
  518. case IPC_INFO:
  519. case MSG_INFO: {
  520. struct msginfo msginfo;
  521. err = msgctl_info(ns, msqid, cmd, &msginfo);
  522. if (err < 0)
  523. return err;
  524. if (copy_to_user(buf, &msginfo, sizeof(struct msginfo)))
  525. err = -EFAULT;
  526. return err;
  527. }
  528. case MSG_STAT: /* msqid is an index rather than a msg queue id */
  529. case MSG_STAT_ANY:
  530. case IPC_STAT:
  531. err = msgctl_stat(ns, msqid, cmd, &msqid64);
  532. if (err < 0)
  533. return err;
  534. if (copy_msqid_to_user(buf, &msqid64, version))
  535. err = -EFAULT;
  536. return err;
  537. case IPC_SET:
  538. if (copy_msqid_from_user(&msqid64, buf, version))
  539. return -EFAULT;
  540. return msgctl_down(ns, msqid, cmd, &msqid64.msg_perm,
  541. msqid64.msg_qbytes);
  542. case IPC_RMID:
  543. return msgctl_down(ns, msqid, cmd, NULL, 0);
  544. default:
  545. return -EINVAL;
  546. }
  547. }
  548. SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
  549. {
  550. return ksys_msgctl(msqid, cmd, buf, IPC_64);
  551. }
  552. #ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
  553. long ksys_old_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
  554. {
  555. int version = ipc_parse_version(&cmd);
  556. return ksys_msgctl(msqid, cmd, buf, version);
  557. }
  558. SYSCALL_DEFINE3(old_msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
  559. {
  560. return ksys_old_msgctl(msqid, cmd, buf);
  561. }
  562. #endif
  563. #ifdef CONFIG_COMPAT
  564. struct compat_msqid_ds {
  565. struct compat_ipc_perm msg_perm;
  566. compat_uptr_t msg_first;
  567. compat_uptr_t msg_last;
  568. old_time32_t msg_stime;
  569. old_time32_t msg_rtime;
  570. old_time32_t msg_ctime;
  571. compat_ulong_t msg_lcbytes;
  572. compat_ulong_t msg_lqbytes;
  573. unsigned short msg_cbytes;
  574. unsigned short msg_qnum;
  575. unsigned short msg_qbytes;
  576. compat_ipc_pid_t msg_lspid;
  577. compat_ipc_pid_t msg_lrpid;
  578. };
  579. static int copy_compat_msqid_from_user(struct msqid64_ds *out, void __user *buf,
  580. int version)
  581. {
  582. memset(out, 0, sizeof(*out));
  583. if (version == IPC_64) {
  584. struct compat_msqid64_ds __user *p = buf;
  585. if (get_compat_ipc64_perm(&out->msg_perm, &p->msg_perm))
  586. return -EFAULT;
  587. if (get_user(out->msg_qbytes, &p->msg_qbytes))
  588. return -EFAULT;
  589. } else {
  590. struct compat_msqid_ds __user *p = buf;
  591. if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm))
  592. return -EFAULT;
  593. if (get_user(out->msg_qbytes, &p->msg_qbytes))
  594. return -EFAULT;
  595. }
  596. return 0;
  597. }
  598. static int copy_compat_msqid_to_user(void __user *buf, struct msqid64_ds *in,
  599. int version)
  600. {
  601. if (version == IPC_64) {
  602. struct compat_msqid64_ds v;
  603. memset(&v, 0, sizeof(v));
  604. to_compat_ipc64_perm(&v.msg_perm, &in->msg_perm);
  605. v.msg_stime = lower_32_bits(in->msg_stime);
  606. v.msg_stime_high = upper_32_bits(in->msg_stime);
  607. v.msg_rtime = lower_32_bits(in->msg_rtime);
  608. v.msg_rtime_high = upper_32_bits(in->msg_rtime);
  609. v.msg_ctime = lower_32_bits(in->msg_ctime);
  610. v.msg_ctime_high = upper_32_bits(in->msg_ctime);
  611. v.msg_cbytes = in->msg_cbytes;
  612. v.msg_qnum = in->msg_qnum;
  613. v.msg_qbytes = in->msg_qbytes;
  614. v.msg_lspid = in->msg_lspid;
  615. v.msg_lrpid = in->msg_lrpid;
  616. return copy_to_user(buf, &v, sizeof(v));
  617. } else {
  618. struct compat_msqid_ds v;
  619. memset(&v, 0, sizeof(v));
  620. to_compat_ipc_perm(&v.msg_perm, &in->msg_perm);
  621. v.msg_stime = in->msg_stime;
  622. v.msg_rtime = in->msg_rtime;
  623. v.msg_ctime = in->msg_ctime;
  624. v.msg_cbytes = in->msg_cbytes;
  625. v.msg_qnum = in->msg_qnum;
  626. v.msg_qbytes = in->msg_qbytes;
  627. v.msg_lspid = in->msg_lspid;
  628. v.msg_lrpid = in->msg_lrpid;
  629. return copy_to_user(buf, &v, sizeof(v));
  630. }
  631. }
  632. static long compat_ksys_msgctl(int msqid, int cmd, void __user *uptr, int version)
  633. {
  634. struct ipc_namespace *ns;
  635. int err;
  636. struct msqid64_ds msqid64;
  637. ns = current->nsproxy->ipc_ns;
  638. if (msqid < 0 || cmd < 0)
  639. return -EINVAL;
  640. switch (cmd & (~IPC_64)) {
  641. case IPC_INFO:
  642. case MSG_INFO: {
  643. struct msginfo msginfo;
  644. err = msgctl_info(ns, msqid, cmd, &msginfo);
  645. if (err < 0)
  646. return err;
  647. if (copy_to_user(uptr, &msginfo, sizeof(struct msginfo)))
  648. err = -EFAULT;
  649. return err;
  650. }
  651. case IPC_STAT:
  652. case MSG_STAT:
  653. case MSG_STAT_ANY:
  654. err = msgctl_stat(ns, msqid, cmd, &msqid64);
  655. if (err < 0)
  656. return err;
  657. if (copy_compat_msqid_to_user(uptr, &msqid64, version))
  658. err = -EFAULT;
  659. return err;
  660. case IPC_SET:
  661. if (copy_compat_msqid_from_user(&msqid64, uptr, version))
  662. return -EFAULT;
  663. return msgctl_down(ns, msqid, cmd, &msqid64.msg_perm, msqid64.msg_qbytes);
  664. case IPC_RMID:
  665. return msgctl_down(ns, msqid, cmd, NULL, 0);
  666. default:
  667. return -EINVAL;
  668. }
  669. }
  670. COMPAT_SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, void __user *, uptr)
  671. {
  672. return compat_ksys_msgctl(msqid, cmd, uptr, IPC_64);
  673. }
  674. #ifdef CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION
  675. long compat_ksys_old_msgctl(int msqid, int cmd, void __user *uptr)
  676. {
  677. int version = compat_ipc_parse_version(&cmd);
  678. return compat_ksys_msgctl(msqid, cmd, uptr, version);
  679. }
  680. COMPAT_SYSCALL_DEFINE3(old_msgctl, int, msqid, int, cmd, void __user *, uptr)
  681. {
  682. return compat_ksys_old_msgctl(msqid, cmd, uptr);
  683. }
  684. #endif
  685. #endif
  686. static int testmsg(struct msg_msg *msg, long type, int mode)
  687. {
  688. switch (mode) {
  689. case SEARCH_ANY:
  690. case SEARCH_NUMBER:
  691. return 1;
  692. case SEARCH_LESSEQUAL:
  693. if (msg->m_type <= type)
  694. return 1;
  695. break;
  696. case SEARCH_EQUAL:
  697. if (msg->m_type == type)
  698. return 1;
  699. break;
  700. case SEARCH_NOTEQUAL:
  701. if (msg->m_type != type)
  702. return 1;
  703. break;
  704. }
  705. return 0;
  706. }
  707. static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg,
  708. struct wake_q_head *wake_q)
  709. {
  710. struct msg_receiver *msr, *t;
  711. list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
  712. if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
  713. !security_msg_queue_msgrcv(&msq->q_perm, msg, msr->r_tsk,
  714. msr->r_msgtype, msr->r_mode)) {
  715. list_del(&msr->r_list);
  716. if (msr->r_maxsize < msg->m_ts) {
  717. wake_q_add(wake_q, msr->r_tsk);
  718. /* See expunge_all regarding memory barrier */
  719. smp_store_release(&msr->r_msg, ERR_PTR(-E2BIG));
  720. } else {
  721. ipc_update_pid(&msq->q_lrpid, task_pid(msr->r_tsk));
  722. msq->q_rtime = ktime_get_real_seconds();
  723. wake_q_add(wake_q, msr->r_tsk);
  724. /* See expunge_all regarding memory barrier */
  725. smp_store_release(&msr->r_msg, msg);
  726. return 1;
  727. }
  728. }
  729. }
  730. return 0;
  731. }
  732. static long do_msgsnd(int msqid, long mtype, void __user *mtext,
  733. size_t msgsz, int msgflg)
  734. {
  735. struct msg_queue *msq;
  736. struct msg_msg *msg;
  737. int err;
  738. struct ipc_namespace *ns;
  739. DEFINE_WAKE_Q(wake_q);
  740. ns = current->nsproxy->ipc_ns;
  741. if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0)
  742. return -EINVAL;
  743. if (mtype < 1)
  744. return -EINVAL;
  745. msg = load_msg(mtext, msgsz);
  746. if (IS_ERR(msg))
  747. return PTR_ERR(msg);
  748. msg->m_type = mtype;
  749. msg->m_ts = msgsz;
  750. rcu_read_lock();
  751. msq = msq_obtain_object_check(ns, msqid);
  752. if (IS_ERR(msq)) {
  753. err = PTR_ERR(msq);
  754. goto out_unlock1;
  755. }
  756. ipc_lock_object(&msq->q_perm);
  757. for (;;) {
  758. struct msg_sender s;
  759. err = -EACCES;
  760. if (ipcperms(ns, &msq->q_perm, S_IWUGO))
  761. goto out_unlock0;
  762. /* raced with RMID? */
  763. if (!ipc_valid_object(&msq->q_perm)) {
  764. err = -EIDRM;
  765. goto out_unlock0;
  766. }
  767. err = security_msg_queue_msgsnd(&msq->q_perm, msg, msgflg);
  768. if (err)
  769. goto out_unlock0;
  770. if (msg_fits_inqueue(msq, msgsz))
  771. break;
  772. /* queue full, wait: */
  773. if (msgflg & IPC_NOWAIT) {
  774. err = -EAGAIN;
  775. goto out_unlock0;
  776. }
  777. /* enqueue the sender and prepare to block */
  778. ss_add(msq, &s, msgsz);
  779. if (!ipc_rcu_getref(&msq->q_perm)) {
  780. err = -EIDRM;
  781. goto out_unlock0;
  782. }
  783. ipc_unlock_object(&msq->q_perm);
  784. rcu_read_unlock();
  785. schedule();
  786. rcu_read_lock();
  787. ipc_lock_object(&msq->q_perm);
  788. ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
  789. /* raced with RMID? */
  790. if (!ipc_valid_object(&msq->q_perm)) {
  791. err = -EIDRM;
  792. goto out_unlock0;
  793. }
  794. ss_del(&s);
  795. if (signal_pending(current)) {
  796. err = -ERESTARTNOHAND;
  797. goto out_unlock0;
  798. }
  799. }
  800. ipc_update_pid(&msq->q_lspid, task_tgid(current));
  801. msq->q_stime = ktime_get_real_seconds();
  802. if (!pipelined_send(msq, msg, &wake_q)) {
  803. /* no one is waiting for this message, enqueue it */
  804. list_add_tail(&msg->m_list, &msq->q_messages);
  805. msq->q_cbytes += msgsz;
  806. msq->q_qnum++;
  807. percpu_counter_add_local(&ns->percpu_msg_bytes, msgsz);
  808. percpu_counter_add_local(&ns->percpu_msg_hdrs, 1);
  809. }
  810. err = 0;
  811. msg = NULL;
  812. out_unlock0:
  813. ipc_unlock_object(&msq->q_perm);
  814. wake_up_q(&wake_q);
  815. out_unlock1:
  816. rcu_read_unlock();
  817. if (msg != NULL)
  818. free_msg(msg);
  819. return err;
  820. }
  821. long ksys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz,
  822. int msgflg)
  823. {
  824. long mtype;
  825. if (get_user(mtype, &msgp->mtype))
  826. return -EFAULT;
  827. return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
  828. }
  829. SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
  830. int, msgflg)
  831. {
  832. return ksys_msgsnd(msqid, msgp, msgsz, msgflg);
  833. }
  834. #ifdef CONFIG_COMPAT
  835. struct compat_msgbuf {
  836. compat_long_t mtype;
  837. char mtext[1];
  838. };
  839. long compat_ksys_msgsnd(int msqid, compat_uptr_t msgp,
  840. compat_ssize_t msgsz, int msgflg)
  841. {
  842. struct compat_msgbuf __user *up = compat_ptr(msgp);
  843. compat_long_t mtype;
  844. if (get_user(mtype, &up->mtype))
  845. return -EFAULT;
  846. return do_msgsnd(msqid, mtype, up->mtext, (ssize_t)msgsz, msgflg);
  847. }
  848. COMPAT_SYSCALL_DEFINE4(msgsnd, int, msqid, compat_uptr_t, msgp,
  849. compat_ssize_t, msgsz, int, msgflg)
  850. {
  851. return compat_ksys_msgsnd(msqid, msgp, msgsz, msgflg);
  852. }
  853. #endif
  854. static inline int convert_mode(long *msgtyp, int msgflg)
  855. {
  856. if (msgflg & MSG_COPY)
  857. return SEARCH_NUMBER;
  858. /*
  859. * find message of correct type.
  860. * msgtyp = 0 => get first.
  861. * msgtyp > 0 => get first message of matching type.
  862. * msgtyp < 0 => get message with least type must be < abs(msgtype).
  863. */
  864. if (*msgtyp == 0)
  865. return SEARCH_ANY;
  866. if (*msgtyp < 0) {
  867. if (*msgtyp == LONG_MIN) /* -LONG_MIN is undefined */
  868. *msgtyp = LONG_MAX;
  869. else
  870. *msgtyp = -*msgtyp;
  871. return SEARCH_LESSEQUAL;
  872. }
  873. if (msgflg & MSG_EXCEPT)
  874. return SEARCH_NOTEQUAL;
  875. return SEARCH_EQUAL;
  876. }
  877. static long do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
  878. {
  879. struct msgbuf __user *msgp = dest;
  880. size_t msgsz;
  881. if (put_user(msg->m_type, &msgp->mtype))
  882. return -EFAULT;
  883. msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
  884. if (store_msg(msgp->mtext, msg, msgsz))
  885. return -EFAULT;
  886. return msgsz;
  887. }
  888. #ifdef CONFIG_CHECKPOINT_RESTORE
  889. /*
  890. * This function creates new kernel message structure, large enough to store
  891. * bufsz message bytes.
  892. */
  893. static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
  894. {
  895. struct msg_msg *copy;
  896. /*
  897. * Create dummy message to copy real message to.
  898. */
  899. copy = load_msg(buf, bufsz);
  900. if (!IS_ERR(copy))
  901. copy->m_ts = bufsz;
  902. return copy;
  903. }
  904. static inline void free_copy(struct msg_msg *copy)
  905. {
  906. if (copy)
  907. free_msg(copy);
  908. }
  909. #else
  910. static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
  911. {
  912. return ERR_PTR(-ENOSYS);
  913. }
  914. static inline void free_copy(struct msg_msg *copy)
  915. {
  916. }
  917. #endif
  918. static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
  919. {
  920. struct msg_msg *msg, *found = NULL;
  921. long count = 0;
  922. list_for_each_entry(msg, &msq->q_messages, m_list) {
  923. if (testmsg(msg, *msgtyp, mode) &&
  924. !security_msg_queue_msgrcv(&msq->q_perm, msg, current,
  925. *msgtyp, mode)) {
  926. if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
  927. *msgtyp = msg->m_type - 1;
  928. found = msg;
  929. } else if (mode == SEARCH_NUMBER) {
  930. if (*msgtyp == count)
  931. return msg;
  932. } else
  933. return msg;
  934. count++;
  935. }
  936. }
  937. return found ?: ERR_PTR(-EAGAIN);
  938. }
  939. static long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgflg,
  940. long (*msg_handler)(void __user *, struct msg_msg *, size_t))
  941. {
  942. int mode;
  943. struct msg_queue *msq;
  944. struct ipc_namespace *ns;
  945. struct msg_msg *msg, *copy = NULL;
  946. DEFINE_WAKE_Q(wake_q);
  947. ns = current->nsproxy->ipc_ns;
  948. if (msqid < 0 || (long) bufsz < 0)
  949. return -EINVAL;
  950. if (msgflg & MSG_COPY) {
  951. if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT))
  952. return -EINVAL;
  953. copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
  954. if (IS_ERR(copy))
  955. return PTR_ERR(copy);
  956. }
  957. mode = convert_mode(&msgtyp, msgflg);
  958. rcu_read_lock();
  959. msq = msq_obtain_object_check(ns, msqid);
  960. if (IS_ERR(msq)) {
  961. rcu_read_unlock();
  962. free_copy(copy);
  963. return PTR_ERR(msq);
  964. }
  965. for (;;) {
  966. struct msg_receiver msr_d;
  967. msg = ERR_PTR(-EACCES);
  968. if (ipcperms(ns, &msq->q_perm, S_IRUGO))
  969. goto out_unlock1;
  970. ipc_lock_object(&msq->q_perm);
  971. /* raced with RMID? */
  972. if (!ipc_valid_object(&msq->q_perm)) {
  973. msg = ERR_PTR(-EIDRM);
  974. goto out_unlock0;
  975. }
  976. msg = find_msg(msq, &msgtyp, mode);
  977. if (!IS_ERR(msg)) {
  978. /*
  979. * Found a suitable message.
  980. * Unlink it from the queue.
  981. */
  982. if ((bufsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
  983. msg = ERR_PTR(-E2BIG);
  984. goto out_unlock0;
  985. }
  986. /*
  987. * If we are copying, then do not unlink message and do
  988. * not update queue parameters.
  989. */
  990. if (msgflg & MSG_COPY) {
  991. msg = copy_msg(msg, copy);
  992. goto out_unlock0;
  993. }
  994. list_del(&msg->m_list);
  995. msq->q_qnum--;
  996. msq->q_rtime = ktime_get_real_seconds();
  997. ipc_update_pid(&msq->q_lrpid, task_tgid(current));
  998. msq->q_cbytes -= msg->m_ts;
  999. percpu_counter_sub_local(&ns->percpu_msg_bytes, msg->m_ts);
  1000. percpu_counter_sub_local(&ns->percpu_msg_hdrs, 1);
  1001. ss_wakeup(msq, &wake_q, false);
  1002. goto out_unlock0;
  1003. }
  1004. /* No message waiting. Wait for a message */
  1005. if (msgflg & IPC_NOWAIT) {
  1006. msg = ERR_PTR(-ENOMSG);
  1007. goto out_unlock0;
  1008. }
  1009. list_add_tail(&msr_d.r_list, &msq->q_receivers);
  1010. msr_d.r_tsk = current;
  1011. msr_d.r_msgtype = msgtyp;
  1012. msr_d.r_mode = mode;
  1013. if (msgflg & MSG_NOERROR)
  1014. msr_d.r_maxsize = INT_MAX;
  1015. else
  1016. msr_d.r_maxsize = bufsz;
  1017. /* memory barrier not require due to ipc_lock_object() */
  1018. WRITE_ONCE(msr_d.r_msg, ERR_PTR(-EAGAIN));
  1019. /* memory barrier not required, we own ipc_lock_object() */
  1020. __set_current_state(TASK_INTERRUPTIBLE);
  1021. ipc_unlock_object(&msq->q_perm);
  1022. rcu_read_unlock();
  1023. schedule();
  1024. /*
  1025. * Lockless receive, part 1:
  1026. * We don't hold a reference to the queue and getting a
  1027. * reference would defeat the idea of a lockless operation,
  1028. * thus the code relies on rcu to guarantee the existence of
  1029. * msq:
  1030. * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
  1031. * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
  1032. */
  1033. rcu_read_lock();
  1034. /*
  1035. * Lockless receive, part 2:
  1036. * The work in pipelined_send() and expunge_all():
  1037. * - Set pointer to message
  1038. * - Queue the receiver task for later wakeup
  1039. * - Wake up the process after the lock is dropped.
  1040. *
  1041. * Should the process wake up before this wakeup (due to a
  1042. * signal) it will either see the message and continue ...
  1043. */
  1044. msg = READ_ONCE(msr_d.r_msg);
  1045. if (msg != ERR_PTR(-EAGAIN)) {
  1046. /* see MSG_BARRIER for purpose/pairing */
  1047. smp_acquire__after_ctrl_dep();
  1048. goto out_unlock1;
  1049. }
  1050. /*
  1051. * ... or see -EAGAIN, acquire the lock to check the message
  1052. * again.
  1053. */
  1054. ipc_lock_object(&msq->q_perm);
  1055. msg = READ_ONCE(msr_d.r_msg);
  1056. if (msg != ERR_PTR(-EAGAIN))
  1057. goto out_unlock0;
  1058. list_del(&msr_d.r_list);
  1059. if (signal_pending(current)) {
  1060. msg = ERR_PTR(-ERESTARTNOHAND);
  1061. goto out_unlock0;
  1062. }
  1063. ipc_unlock_object(&msq->q_perm);
  1064. }
  1065. out_unlock0:
  1066. ipc_unlock_object(&msq->q_perm);
  1067. wake_up_q(&wake_q);
  1068. out_unlock1:
  1069. rcu_read_unlock();
  1070. if (IS_ERR(msg)) {
  1071. free_copy(copy);
  1072. return PTR_ERR(msg);
  1073. }
  1074. bufsz = msg_handler(buf, msg, bufsz);
  1075. free_msg(msg);
  1076. return bufsz;
  1077. }
  1078. long ksys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
  1079. long msgtyp, int msgflg)
  1080. {
  1081. return do_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg, do_msg_fill);
  1082. }
  1083. SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
  1084. long, msgtyp, int, msgflg)
  1085. {
  1086. return ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
  1087. }
  1088. #ifdef CONFIG_COMPAT
  1089. static long compat_do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
  1090. {
  1091. struct compat_msgbuf __user *msgp = dest;
  1092. size_t msgsz;
  1093. if (put_user(msg->m_type, &msgp->mtype))
  1094. return -EFAULT;
  1095. msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
  1096. if (store_msg(msgp->mtext, msg, msgsz))
  1097. return -EFAULT;
  1098. return msgsz;
  1099. }
  1100. long compat_ksys_msgrcv(int msqid, compat_uptr_t msgp, compat_ssize_t msgsz,
  1101. compat_long_t msgtyp, int msgflg)
  1102. {
  1103. return do_msgrcv(msqid, compat_ptr(msgp), (ssize_t)msgsz, (long)msgtyp,
  1104. msgflg, compat_do_msg_fill);
  1105. }
  1106. COMPAT_SYSCALL_DEFINE5(msgrcv, int, msqid, compat_uptr_t, msgp,
  1107. compat_ssize_t, msgsz, compat_long_t, msgtyp,
  1108. int, msgflg)
  1109. {
  1110. return compat_ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
  1111. }
  1112. #endif
  1113. int msg_init_ns(struct ipc_namespace *ns)
  1114. {
  1115. int ret;
  1116. ns->msg_ctlmax = MSGMAX;
  1117. ns->msg_ctlmnb = MSGMNB;
  1118. ns->msg_ctlmni = MSGMNI;
  1119. ret = percpu_counter_init(&ns->percpu_msg_bytes, 0, GFP_KERNEL);
  1120. if (ret)
  1121. goto fail_msg_bytes;
  1122. ret = percpu_counter_init(&ns->percpu_msg_hdrs, 0, GFP_KERNEL);
  1123. if (ret)
  1124. goto fail_msg_hdrs;
  1125. ipc_init_ids(&ns->ids[IPC_MSG_IDS]);
  1126. return 0;
  1127. fail_msg_hdrs:
  1128. percpu_counter_destroy(&ns->percpu_msg_bytes);
  1129. fail_msg_bytes:
  1130. return ret;
  1131. }
  1132. #ifdef CONFIG_IPC_NS
  1133. void msg_exit_ns(struct ipc_namespace *ns)
  1134. {
  1135. free_ipcs(ns, &msg_ids(ns), freeque);
  1136. idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
  1137. rhashtable_destroy(&ns->ids[IPC_MSG_IDS].key_ht);
  1138. percpu_counter_destroy(&ns->percpu_msg_bytes);
  1139. percpu_counter_destroy(&ns->percpu_msg_hdrs);
  1140. }
  1141. #endif
  1142. #ifdef CONFIG_PROC_FS
  1143. static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
  1144. {
  1145. struct pid_namespace *pid_ns = ipc_seq_pid_ns(s);
  1146. struct user_namespace *user_ns = seq_user_ns(s);
  1147. struct kern_ipc_perm *ipcp = it;
  1148. struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
  1149. seq_printf(s,
  1150. "%10d %10d %4o %10lu %10lu %5u %5u %5u %5u %5u %5u %10llu %10llu %10llu\n",
  1151. msq->q_perm.key,
  1152. msq->q_perm.id,
  1153. msq->q_perm.mode,
  1154. msq->q_cbytes,
  1155. msq->q_qnum,
  1156. pid_nr_ns(msq->q_lspid, pid_ns),
  1157. pid_nr_ns(msq->q_lrpid, pid_ns),
  1158. from_kuid_munged(user_ns, msq->q_perm.uid),
  1159. from_kgid_munged(user_ns, msq->q_perm.gid),
  1160. from_kuid_munged(user_ns, msq->q_perm.cuid),
  1161. from_kgid_munged(user_ns, msq->q_perm.cgid),
  1162. msq->q_stime,
  1163. msq->q_rtime,
  1164. msq->q_ctime);
  1165. return 0;
  1166. }
  1167. #endif
  1168. void __init msg_init(void)
  1169. {
  1170. msg_init_ns(&init_ipc_ns);
  1171. ipc_init_proc_interface("sysvipc/msg",
  1172. " key msqid perms cbytes qnum lspid lrpid uid gid cuid cgid stime rtime ctime\n",
  1173. IPC_MSG_IDS, sysvipc_msg_proc_show);
  1174. }