Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * linux/ipc/msg.c
0004  * Copyright (C) 1992 Krishna Balasubramanian
0005  *
0006  * Removed all the remaining kerneld mess
0007  * Catch the -EFAULT stuff properly
0008  * Use GFP_KERNEL for messages as in 1.2
0009  * Fixed up the unchecked user space derefs
0010  * Copyright (C) 1998 Alan Cox & Andi Kleen
0011  *
0012  * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
0013  *
0014  * mostly rewritten, threaded and wake-one semantics added
0015  * MSGMAX limit removed, sysctl's added
0016  * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
0017  *
0018  * support for audit of ipc object properties and permission changes
0019  * Dustin Kirkland <dustin.kirkland@us.ibm.com>
0020  *
0021  * namespaces support
0022  * OpenVZ, SWsoft Inc.
0023  * Pavel Emelianov <xemul@openvz.org>
0024  */
0025 
0026 #include <linux/capability.h>
0027 #include <linux/msg.h>
0028 #include <linux/spinlock.h>
0029 #include <linux/init.h>
0030 #include <linux/mm.h>
0031 #include <linux/proc_fs.h>
0032 #include <linux/list.h>
0033 #include <linux/security.h>
0034 #include <linux/sched/wake_q.h>
0035 #include <linux/syscalls.h>
0036 #include <linux/audit.h>
0037 #include <linux/seq_file.h>
0038 #include <linux/rwsem.h>
0039 #include <linux/nsproxy.h>
0040 #include <linux/ipc_namespace.h>
0041 #include <linux/rhashtable.h>
0042 
0043 #include <asm/current.h>
0044 #include <linux/uaccess.h>
0045 #include "util.h"
0046 
0047 /* one msq_queue structure for each present queue on the system */
0048 struct msg_queue {
0049     struct kern_ipc_perm q_perm;
0050     time64_t q_stime;       /* last msgsnd time */
0051     time64_t q_rtime;       /* last msgrcv time */
0052     time64_t q_ctime;       /* last change time */
0053     unsigned long q_cbytes;     /* current number of bytes on queue */
0054     unsigned long q_qnum;       /* number of messages in queue */
0055     unsigned long q_qbytes;     /* max number of bytes on queue */
0056     struct pid *q_lspid;        /* pid of last msgsnd */
0057     struct pid *q_lrpid;        /* last receive pid */
0058 
0059     struct list_head q_messages;
0060     struct list_head q_receivers;
0061     struct list_head q_senders;
0062 } __randomize_layout;
0063 
0064 /*
0065  * MSG_BARRIER Locking:
0066  *
0067  * Similar to the optimization used in ipc/mqueue.c, one syscall return path
0068  * does not acquire any locks when it sees that a message exists in
0069  * msg_receiver.r_msg. Therefore r_msg is set using smp_store_release()
0070  * and accessed using READ_ONCE()+smp_acquire__after_ctrl_dep(). In addition,
0071  * wake_q_add_safe() is used. See ipc/mqueue.c for more details
0072  */
0073 
0074 /* one msg_receiver structure for each sleeping receiver */
0075 struct msg_receiver {
0076     struct list_head    r_list;
0077     struct task_struct  *r_tsk;
0078 
0079     int         r_mode;
0080     long            r_msgtype;
0081     long            r_maxsize;
0082 
0083     struct msg_msg      *r_msg;
0084 };
0085 
0086 /* one msg_sender for each sleeping sender */
0087 struct msg_sender {
0088     struct list_head    list;
0089     struct task_struct  *tsk;
0090     size_t                  msgsz;
0091 };
0092 
0093 #define SEARCH_ANY      1
0094 #define SEARCH_EQUAL        2
0095 #define SEARCH_NOTEQUAL     3
0096 #define SEARCH_LESSEQUAL    4
0097 #define SEARCH_NUMBER       5
0098 
0099 #define msg_ids(ns) ((ns)->ids[IPC_MSG_IDS])
0100 
0101 static inline struct msg_queue *msq_obtain_object(struct ipc_namespace *ns, int id)
0102 {
0103     struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&msg_ids(ns), id);
0104 
0105     if (IS_ERR(ipcp))
0106         return ERR_CAST(ipcp);
0107 
0108     return container_of(ipcp, struct msg_queue, q_perm);
0109 }
0110 
0111 static inline struct msg_queue *msq_obtain_object_check(struct ipc_namespace *ns,
0112                             int id)
0113 {
0114     struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&msg_ids(ns), id);
0115 
0116     if (IS_ERR(ipcp))
0117         return ERR_CAST(ipcp);
0118 
0119     return container_of(ipcp, struct msg_queue, q_perm);
0120 }
0121 
0122 static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
0123 {
0124     ipc_rmid(&msg_ids(ns), &s->q_perm);
0125 }
0126 
0127 static void msg_rcu_free(struct rcu_head *head)
0128 {
0129     struct kern_ipc_perm *p = container_of(head, struct kern_ipc_perm, rcu);
0130     struct msg_queue *msq = container_of(p, struct msg_queue, q_perm);
0131 
0132     security_msg_queue_free(&msq->q_perm);
0133     kfree(msq);
0134 }
0135 
0136 /**
0137  * newque - Create a new msg queue
0138  * @ns: namespace
0139  * @params: ptr to the structure that contains the key and msgflg
0140  *
0141  * Called with msg_ids.rwsem held (writer)
0142  */
0143 static int newque(struct ipc_namespace *ns, struct ipc_params *params)
0144 {
0145     struct msg_queue *msq;
0146     int retval;
0147     key_t key = params->key;
0148     int msgflg = params->flg;
0149 
0150     msq = kmalloc(sizeof(*msq), GFP_KERNEL_ACCOUNT);
0151     if (unlikely(!msq))
0152         return -ENOMEM;
0153 
0154     msq->q_perm.mode = msgflg & S_IRWXUGO;
0155     msq->q_perm.key = key;
0156 
0157     msq->q_perm.security = NULL;
0158     retval = security_msg_queue_alloc(&msq->q_perm);
0159     if (retval) {
0160         kfree(msq);
0161         return retval;
0162     }
0163 
0164     msq->q_stime = msq->q_rtime = 0;
0165     msq->q_ctime = ktime_get_real_seconds();
0166     msq->q_cbytes = msq->q_qnum = 0;
0167     msq->q_qbytes = ns->msg_ctlmnb;
0168     msq->q_lspid = msq->q_lrpid = NULL;
0169     INIT_LIST_HEAD(&msq->q_messages);
0170     INIT_LIST_HEAD(&msq->q_receivers);
0171     INIT_LIST_HEAD(&msq->q_senders);
0172 
0173     /* ipc_addid() locks msq upon success. */
0174     retval = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
0175     if (retval < 0) {
0176         ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
0177         return retval;
0178     }
0179 
0180     ipc_unlock_object(&msq->q_perm);
0181     rcu_read_unlock();
0182 
0183     return msq->q_perm.id;
0184 }
0185 
0186 static inline bool msg_fits_inqueue(struct msg_queue *msq, size_t msgsz)
0187 {
0188     return msgsz + msq->q_cbytes <= msq->q_qbytes &&
0189         1 + msq->q_qnum <= msq->q_qbytes;
0190 }
0191 
0192 static inline void ss_add(struct msg_queue *msq,
0193               struct msg_sender *mss, size_t msgsz)
0194 {
0195     mss->tsk = current;
0196     mss->msgsz = msgsz;
0197     /*
0198      * No memory barrier required: we did ipc_lock_object(),
0199      * and the waker obtains that lock before calling wake_q_add().
0200      */
0201     __set_current_state(TASK_INTERRUPTIBLE);
0202     list_add_tail(&mss->list, &msq->q_senders);
0203 }
0204 
0205 static inline void ss_del(struct msg_sender *mss)
0206 {
0207     if (mss->list.next)
0208         list_del(&mss->list);
0209 }
0210 
0211 static void ss_wakeup(struct msg_queue *msq,
0212               struct wake_q_head *wake_q, bool kill)
0213 {
0214     struct msg_sender *mss, *t;
0215     struct task_struct *stop_tsk = NULL;
0216     struct list_head *h = &msq->q_senders;
0217 
0218     list_for_each_entry_safe(mss, t, h, list) {
0219         if (kill)
0220             mss->list.next = NULL;
0221 
0222         /*
0223          * Stop at the first task we don't wakeup,
0224          * we've already iterated the original
0225          * sender queue.
0226          */
0227         else if (stop_tsk == mss->tsk)
0228             break;
0229         /*
0230          * We are not in an EIDRM scenario here, therefore
0231          * verify that we really need to wakeup the task.
0232          * To maintain current semantics and wakeup order,
0233          * move the sender to the tail on behalf of the
0234          * blocked task.
0235          */
0236         else if (!msg_fits_inqueue(msq, mss->msgsz)) {
0237             if (!stop_tsk)
0238                 stop_tsk = mss->tsk;
0239 
0240             list_move_tail(&mss->list, &msq->q_senders);
0241             continue;
0242         }
0243 
0244         wake_q_add(wake_q, mss->tsk);
0245     }
0246 }
0247 
0248 static void expunge_all(struct msg_queue *msq, int res,
0249             struct wake_q_head *wake_q)
0250 {
0251     struct msg_receiver *msr, *t;
0252 
0253     list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
0254         struct task_struct *r_tsk;
0255 
0256         r_tsk = get_task_struct(msr->r_tsk);
0257 
0258         /* see MSG_BARRIER for purpose/pairing */
0259         smp_store_release(&msr->r_msg, ERR_PTR(res));
0260         wake_q_add_safe(wake_q, r_tsk);
0261     }
0262 }
0263 
0264 /*
0265  * freeque() wakes up waiters on the sender and receiver waiting queue,
0266  * removes the message queue from message queue ID IDR, and cleans up all the
0267  * messages associated with this queue.
0268  *
0269  * msg_ids.rwsem (writer) and the spinlock for this message queue are held
0270  * before freeque() is called. msg_ids.rwsem remains locked on exit.
0271  */
0272 static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
0273     __releases(RCU)
0274     __releases(&msq->q_perm)
0275 {
0276     struct msg_msg *msg, *t;
0277     struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
0278     DEFINE_WAKE_Q(wake_q);
0279 
0280     expunge_all(msq, -EIDRM, &wake_q);
0281     ss_wakeup(msq, &wake_q, true);
0282     msg_rmid(ns, msq);
0283     ipc_unlock_object(&msq->q_perm);
0284     wake_up_q(&wake_q);
0285     rcu_read_unlock();
0286 
0287     list_for_each_entry_safe(msg, t, &msq->q_messages, m_list) {
0288         atomic_dec(&ns->msg_hdrs);
0289         free_msg(msg);
0290     }
0291     atomic_sub(msq->q_cbytes, &ns->msg_bytes);
0292     ipc_update_pid(&msq->q_lspid, NULL);
0293     ipc_update_pid(&msq->q_lrpid, NULL);
0294     ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
0295 }
0296 
0297 long ksys_msgget(key_t key, int msgflg)
0298 {
0299     struct ipc_namespace *ns;
0300     static const struct ipc_ops msg_ops = {
0301         .getnew = newque,
0302         .associate = security_msg_queue_associate,
0303     };
0304     struct ipc_params msg_params;
0305 
0306     ns = current->nsproxy->ipc_ns;
0307 
0308     msg_params.key = key;
0309     msg_params.flg = msgflg;
0310 
0311     return ipcget(ns, &msg_ids(ns), &msg_ops, &msg_params);
0312 }
0313 
0314 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
0315 {
0316     return ksys_msgget(key, msgflg);
0317 }
0318 
0319 static inline unsigned long
0320 copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
0321 {
0322     switch (version) {
0323     case IPC_64:
0324         return copy_to_user(buf, in, sizeof(*in));
0325     case IPC_OLD:
0326     {
0327         struct msqid_ds out;
0328 
0329         memset(&out, 0, sizeof(out));
0330 
0331         ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
0332 
0333         out.msg_stime       = in->msg_stime;
0334         out.msg_rtime       = in->msg_rtime;
0335         out.msg_ctime       = in->msg_ctime;
0336 
0337         if (in->msg_cbytes > USHRT_MAX)
0338             out.msg_cbytes  = USHRT_MAX;
0339         else
0340             out.msg_cbytes  = in->msg_cbytes;
0341         out.msg_lcbytes     = in->msg_cbytes;
0342 
0343         if (in->msg_qnum > USHRT_MAX)
0344             out.msg_qnum    = USHRT_MAX;
0345         else
0346             out.msg_qnum    = in->msg_qnum;
0347 
0348         if (in->msg_qbytes > USHRT_MAX)
0349             out.msg_qbytes  = USHRT_MAX;
0350         else
0351             out.msg_qbytes  = in->msg_qbytes;
0352         out.msg_lqbytes     = in->msg_qbytes;
0353 
0354         out.msg_lspid       = in->msg_lspid;
0355         out.msg_lrpid       = in->msg_lrpid;
0356 
0357         return copy_to_user(buf, &out, sizeof(out));
0358     }
0359     default:
0360         return -EINVAL;
0361     }
0362 }
0363 
0364 static inline unsigned long
0365 copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
0366 {
0367     switch (version) {
0368     case IPC_64:
0369         if (copy_from_user(out, buf, sizeof(*out)))
0370             return -EFAULT;
0371         return 0;
0372     case IPC_OLD:
0373     {
0374         struct msqid_ds tbuf_old;
0375 
0376         if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
0377             return -EFAULT;
0378 
0379         out->msg_perm.uid   = tbuf_old.msg_perm.uid;
0380         out->msg_perm.gid   = tbuf_old.msg_perm.gid;
0381         out->msg_perm.mode  = tbuf_old.msg_perm.mode;
0382 
0383         if (tbuf_old.msg_qbytes == 0)
0384             out->msg_qbytes = tbuf_old.msg_lqbytes;
0385         else
0386             out->msg_qbytes = tbuf_old.msg_qbytes;
0387 
0388         return 0;
0389     }
0390     default:
0391         return -EINVAL;
0392     }
0393 }
0394 
0395 /*
0396  * This function handles some msgctl commands which require the rwsem
0397  * to be held in write mode.
0398  * NOTE: no locks must be held, the rwsem is taken inside this function.
0399  */
0400 static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
0401             struct ipc64_perm *perm, int msg_qbytes)
0402 {
0403     struct kern_ipc_perm *ipcp;
0404     struct msg_queue *msq;
0405     int err;
0406 
0407     down_write(&msg_ids(ns).rwsem);
0408     rcu_read_lock();
0409 
0410     ipcp = ipcctl_obtain_check(ns, &msg_ids(ns), msqid, cmd,
0411                       perm, msg_qbytes);
0412     if (IS_ERR(ipcp)) {
0413         err = PTR_ERR(ipcp);
0414         goto out_unlock1;
0415     }
0416 
0417     msq = container_of(ipcp, struct msg_queue, q_perm);
0418 
0419     err = security_msg_queue_msgctl(&msq->q_perm, cmd);
0420     if (err)
0421         goto out_unlock1;
0422 
0423     switch (cmd) {
0424     case IPC_RMID:
0425         ipc_lock_object(&msq->q_perm);
0426         /* freeque unlocks the ipc object and rcu */
0427         freeque(ns, ipcp);
0428         goto out_up;
0429     case IPC_SET:
0430     {
0431         DEFINE_WAKE_Q(wake_q);
0432 
0433         if (msg_qbytes > ns->msg_ctlmnb &&
0434             !capable(CAP_SYS_RESOURCE)) {
0435             err = -EPERM;
0436             goto out_unlock1;
0437         }
0438 
0439         ipc_lock_object(&msq->q_perm);
0440         err = ipc_update_perm(perm, ipcp);
0441         if (err)
0442             goto out_unlock0;
0443 
0444         msq->q_qbytes = msg_qbytes;
0445 
0446         msq->q_ctime = ktime_get_real_seconds();
0447         /*
0448          * Sleeping receivers might be excluded by
0449          * stricter permissions.
0450          */
0451         expunge_all(msq, -EAGAIN, &wake_q);
0452         /*
0453          * Sleeping senders might be able to send
0454          * due to a larger queue size.
0455          */
0456         ss_wakeup(msq, &wake_q, false);
0457         ipc_unlock_object(&msq->q_perm);
0458         wake_up_q(&wake_q);
0459 
0460         goto out_unlock1;
0461     }
0462     default:
0463         err = -EINVAL;
0464         goto out_unlock1;
0465     }
0466 
0467 out_unlock0:
0468     ipc_unlock_object(&msq->q_perm);
0469 out_unlock1:
0470     rcu_read_unlock();
0471 out_up:
0472     up_write(&msg_ids(ns).rwsem);
0473     return err;
0474 }
0475 
0476 static int msgctl_info(struct ipc_namespace *ns, int msqid,
0477              int cmd, struct msginfo *msginfo)
0478 {
0479     int err;
0480     int max_idx;
0481 
0482     /*
0483      * We must not return kernel stack data.
0484      * due to padding, it's not enough
0485      * to set all member fields.
0486      */
0487     err = security_msg_queue_msgctl(NULL, cmd);
0488     if (err)
0489         return err;
0490 
0491     memset(msginfo, 0, sizeof(*msginfo));
0492     msginfo->msgmni = ns->msg_ctlmni;
0493     msginfo->msgmax = ns->msg_ctlmax;
0494     msginfo->msgmnb = ns->msg_ctlmnb;
0495     msginfo->msgssz = MSGSSZ;
0496     msginfo->msgseg = MSGSEG;
0497     down_read(&msg_ids(ns).rwsem);
0498     if (cmd == MSG_INFO) {
0499         msginfo->msgpool = msg_ids(ns).in_use;
0500         msginfo->msgmap = atomic_read(&ns->msg_hdrs);
0501         msginfo->msgtql = atomic_read(&ns->msg_bytes);
0502     } else {
0503         msginfo->msgmap = MSGMAP;
0504         msginfo->msgpool = MSGPOOL;
0505         msginfo->msgtql = MSGTQL;
0506     }
0507     max_idx = ipc_get_maxidx(&msg_ids(ns));
0508     up_read(&msg_ids(ns).rwsem);
0509     return (max_idx < 0) ? 0 : max_idx;
0510 }
0511 
0512 static int msgctl_stat(struct ipc_namespace *ns, int msqid,
0513              int cmd, struct msqid64_ds *p)
0514 {
0515     struct msg_queue *msq;
0516     int err;
0517 
0518     memset(p, 0, sizeof(*p));
0519 
0520     rcu_read_lock();
0521     if (cmd == MSG_STAT || cmd == MSG_STAT_ANY) {
0522         msq = msq_obtain_object(ns, msqid);
0523         if (IS_ERR(msq)) {
0524             err = PTR_ERR(msq);
0525             goto out_unlock;
0526         }
0527     } else { /* IPC_STAT */
0528         msq = msq_obtain_object_check(ns, msqid);
0529         if (IS_ERR(msq)) {
0530             err = PTR_ERR(msq);
0531             goto out_unlock;
0532         }
0533     }
0534 
0535     /* see comment for SHM_STAT_ANY */
0536     if (cmd == MSG_STAT_ANY)
0537         audit_ipc_obj(&msq->q_perm);
0538     else {
0539         err = -EACCES;
0540         if (ipcperms(ns, &msq->q_perm, S_IRUGO))
0541             goto out_unlock;
0542     }
0543 
0544     err = security_msg_queue_msgctl(&msq->q_perm, cmd);
0545     if (err)
0546         goto out_unlock;
0547 
0548     ipc_lock_object(&msq->q_perm);
0549 
0550     if (!ipc_valid_object(&msq->q_perm)) {
0551         ipc_unlock_object(&msq->q_perm);
0552         err = -EIDRM;
0553         goto out_unlock;
0554     }
0555 
0556     kernel_to_ipc64_perm(&msq->q_perm, &p->msg_perm);
0557     p->msg_stime  = msq->q_stime;
0558     p->msg_rtime  = msq->q_rtime;
0559     p->msg_ctime  = msq->q_ctime;
0560 #ifndef CONFIG_64BIT
0561     p->msg_stime_high = msq->q_stime >> 32;
0562     p->msg_rtime_high = msq->q_rtime >> 32;
0563     p->msg_ctime_high = msq->q_ctime >> 32;
0564 #endif
0565     p->msg_cbytes = msq->q_cbytes;
0566     p->msg_qnum   = msq->q_qnum;
0567     p->msg_qbytes = msq->q_qbytes;
0568     p->msg_lspid  = pid_vnr(msq->q_lspid);
0569     p->msg_lrpid  = pid_vnr(msq->q_lrpid);
0570 
0571     if (cmd == IPC_STAT) {
0572         /*
0573          * As defined in SUS:
0574          * Return 0 on success
0575          */
0576         err = 0;
0577     } else {
0578         /*
0579          * MSG_STAT and MSG_STAT_ANY (both Linux specific)
0580          * Return the full id, including the sequence number
0581          */
0582         err = msq->q_perm.id;
0583     }
0584 
0585     ipc_unlock_object(&msq->q_perm);
0586 out_unlock:
0587     rcu_read_unlock();
0588     return err;
0589 }
0590 
0591 static long ksys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf, int version)
0592 {
0593     struct ipc_namespace *ns;
0594     struct msqid64_ds msqid64;
0595     int err;
0596 
0597     if (msqid < 0 || cmd < 0)
0598         return -EINVAL;
0599 
0600     ns = current->nsproxy->ipc_ns;
0601 
0602     switch (cmd) {
0603     case IPC_INFO:
0604     case MSG_INFO: {
0605         struct msginfo msginfo;
0606         err = msgctl_info(ns, msqid, cmd, &msginfo);
0607         if (err < 0)
0608             return err;
0609         if (copy_to_user(buf, &msginfo, sizeof(struct msginfo)))
0610             err = -EFAULT;
0611         return err;
0612     }
0613     case MSG_STAT:  /* msqid is an index rather than a msg queue id */
0614     case MSG_STAT_ANY:
0615     case IPC_STAT:
0616         err = msgctl_stat(ns, msqid, cmd, &msqid64);
0617         if (err < 0)
0618             return err;
0619         if (copy_msqid_to_user(buf, &msqid64, version))
0620             err = -EFAULT;
0621         return err;
0622     case IPC_SET:
0623         if (copy_msqid_from_user(&msqid64, buf, version))
0624             return -EFAULT;
0625         return msgctl_down(ns, msqid, cmd, &msqid64.msg_perm,
0626                    msqid64.msg_qbytes);
0627     case IPC_RMID:
0628         return msgctl_down(ns, msqid, cmd, NULL, 0);
0629     default:
0630         return  -EINVAL;
0631     }
0632 }
0633 
0634 SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
0635 {
0636     return ksys_msgctl(msqid, cmd, buf, IPC_64);
0637 }
0638 
0639 #ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
0640 long ksys_old_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
0641 {
0642     int version = ipc_parse_version(&cmd);
0643 
0644     return ksys_msgctl(msqid, cmd, buf, version);
0645 }
0646 
0647 SYSCALL_DEFINE3(old_msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
0648 {
0649     return ksys_old_msgctl(msqid, cmd, buf);
0650 }
0651 #endif
0652 
0653 #ifdef CONFIG_COMPAT
0654 
0655 struct compat_msqid_ds {
0656     struct compat_ipc_perm msg_perm;
0657     compat_uptr_t msg_first;
0658     compat_uptr_t msg_last;
0659     old_time32_t msg_stime;
0660     old_time32_t msg_rtime;
0661     old_time32_t msg_ctime;
0662     compat_ulong_t msg_lcbytes;
0663     compat_ulong_t msg_lqbytes;
0664     unsigned short msg_cbytes;
0665     unsigned short msg_qnum;
0666     unsigned short msg_qbytes;
0667     compat_ipc_pid_t msg_lspid;
0668     compat_ipc_pid_t msg_lrpid;
0669 };
0670 
0671 static int copy_compat_msqid_from_user(struct msqid64_ds *out, void __user *buf,
0672                     int version)
0673 {
0674     memset(out, 0, sizeof(*out));
0675     if (version == IPC_64) {
0676         struct compat_msqid64_ds __user *p = buf;
0677         if (get_compat_ipc64_perm(&out->msg_perm, &p->msg_perm))
0678             return -EFAULT;
0679         if (get_user(out->msg_qbytes, &p->msg_qbytes))
0680             return -EFAULT;
0681     } else {
0682         struct compat_msqid_ds __user *p = buf;
0683         if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm))
0684             return -EFAULT;
0685         if (get_user(out->msg_qbytes, &p->msg_qbytes))
0686             return -EFAULT;
0687     }
0688     return 0;
0689 }
0690 
0691 static int copy_compat_msqid_to_user(void __user *buf, struct msqid64_ds *in,
0692                     int version)
0693 {
0694     if (version == IPC_64) {
0695         struct compat_msqid64_ds v;
0696         memset(&v, 0, sizeof(v));
0697         to_compat_ipc64_perm(&v.msg_perm, &in->msg_perm);
0698         v.msg_stime  = lower_32_bits(in->msg_stime);
0699         v.msg_stime_high = upper_32_bits(in->msg_stime);
0700         v.msg_rtime  = lower_32_bits(in->msg_rtime);
0701         v.msg_rtime_high = upper_32_bits(in->msg_rtime);
0702         v.msg_ctime  = lower_32_bits(in->msg_ctime);
0703         v.msg_ctime_high = upper_32_bits(in->msg_ctime);
0704         v.msg_cbytes = in->msg_cbytes;
0705         v.msg_qnum = in->msg_qnum;
0706         v.msg_qbytes = in->msg_qbytes;
0707         v.msg_lspid = in->msg_lspid;
0708         v.msg_lrpid = in->msg_lrpid;
0709         return copy_to_user(buf, &v, sizeof(v));
0710     } else {
0711         struct compat_msqid_ds v;
0712         memset(&v, 0, sizeof(v));
0713         to_compat_ipc_perm(&v.msg_perm, &in->msg_perm);
0714         v.msg_stime = in->msg_stime;
0715         v.msg_rtime = in->msg_rtime;
0716         v.msg_ctime = in->msg_ctime;
0717         v.msg_cbytes = in->msg_cbytes;
0718         v.msg_qnum = in->msg_qnum;
0719         v.msg_qbytes = in->msg_qbytes;
0720         v.msg_lspid = in->msg_lspid;
0721         v.msg_lrpid = in->msg_lrpid;
0722         return copy_to_user(buf, &v, sizeof(v));
0723     }
0724 }
0725 
0726 static long compat_ksys_msgctl(int msqid, int cmd, void __user *uptr, int version)
0727 {
0728     struct ipc_namespace *ns;
0729     int err;
0730     struct msqid64_ds msqid64;
0731 
0732     ns = current->nsproxy->ipc_ns;
0733 
0734     if (msqid < 0 || cmd < 0)
0735         return -EINVAL;
0736 
0737     switch (cmd & (~IPC_64)) {
0738     case IPC_INFO:
0739     case MSG_INFO: {
0740         struct msginfo msginfo;
0741         err = msgctl_info(ns, msqid, cmd, &msginfo);
0742         if (err < 0)
0743             return err;
0744         if (copy_to_user(uptr, &msginfo, sizeof(struct msginfo)))
0745             err = -EFAULT;
0746         return err;
0747     }
0748     case IPC_STAT:
0749     case MSG_STAT:
0750     case MSG_STAT_ANY:
0751         err = msgctl_stat(ns, msqid, cmd, &msqid64);
0752         if (err < 0)
0753             return err;
0754         if (copy_compat_msqid_to_user(uptr, &msqid64, version))
0755             err = -EFAULT;
0756         return err;
0757     case IPC_SET:
0758         if (copy_compat_msqid_from_user(&msqid64, uptr, version))
0759             return -EFAULT;
0760         return msgctl_down(ns, msqid, cmd, &msqid64.msg_perm, msqid64.msg_qbytes);
0761     case IPC_RMID:
0762         return msgctl_down(ns, msqid, cmd, NULL, 0);
0763     default:
0764         return -EINVAL;
0765     }
0766 }
0767 
0768 COMPAT_SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, void __user *, uptr)
0769 {
0770     return compat_ksys_msgctl(msqid, cmd, uptr, IPC_64);
0771 }
0772 
0773 #ifdef CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION
0774 long compat_ksys_old_msgctl(int msqid, int cmd, void __user *uptr)
0775 {
0776     int version = compat_ipc_parse_version(&cmd);
0777 
0778     return compat_ksys_msgctl(msqid, cmd, uptr, version);
0779 }
0780 
0781 COMPAT_SYSCALL_DEFINE3(old_msgctl, int, msqid, int, cmd, void __user *, uptr)
0782 {
0783     return compat_ksys_old_msgctl(msqid, cmd, uptr);
0784 }
0785 #endif
0786 #endif
0787 
0788 static int testmsg(struct msg_msg *msg, long type, int mode)
0789 {
0790     switch (mode) {
0791     case SEARCH_ANY:
0792     case SEARCH_NUMBER:
0793         return 1;
0794     case SEARCH_LESSEQUAL:
0795         if (msg->m_type <= type)
0796             return 1;
0797         break;
0798     case SEARCH_EQUAL:
0799         if (msg->m_type == type)
0800             return 1;
0801         break;
0802     case SEARCH_NOTEQUAL:
0803         if (msg->m_type != type)
0804             return 1;
0805         break;
0806     }
0807     return 0;
0808 }
0809 
0810 static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg,
0811                  struct wake_q_head *wake_q)
0812 {
0813     struct msg_receiver *msr, *t;
0814 
0815     list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
0816         if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
0817             !security_msg_queue_msgrcv(&msq->q_perm, msg, msr->r_tsk,
0818                            msr->r_msgtype, msr->r_mode)) {
0819 
0820             list_del(&msr->r_list);
0821             if (msr->r_maxsize < msg->m_ts) {
0822                 wake_q_add(wake_q, msr->r_tsk);
0823 
0824                 /* See expunge_all regarding memory barrier */
0825                 smp_store_release(&msr->r_msg, ERR_PTR(-E2BIG));
0826             } else {
0827                 ipc_update_pid(&msq->q_lrpid, task_pid(msr->r_tsk));
0828                 msq->q_rtime = ktime_get_real_seconds();
0829 
0830                 wake_q_add(wake_q, msr->r_tsk);
0831 
0832                 /* See expunge_all regarding memory barrier */
0833                 smp_store_release(&msr->r_msg, msg);
0834                 return 1;
0835             }
0836         }
0837     }
0838 
0839     return 0;
0840 }
0841 
0842 static long do_msgsnd(int msqid, long mtype, void __user *mtext,
0843         size_t msgsz, int msgflg)
0844 {
0845     struct msg_queue *msq;
0846     struct msg_msg *msg;
0847     int err;
0848     struct ipc_namespace *ns;
0849     DEFINE_WAKE_Q(wake_q);
0850 
0851     ns = current->nsproxy->ipc_ns;
0852 
0853     if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0)
0854         return -EINVAL;
0855     if (mtype < 1)
0856         return -EINVAL;
0857 
0858     msg = load_msg(mtext, msgsz);
0859     if (IS_ERR(msg))
0860         return PTR_ERR(msg);
0861 
0862     msg->m_type = mtype;
0863     msg->m_ts = msgsz;
0864 
0865     rcu_read_lock();
0866     msq = msq_obtain_object_check(ns, msqid);
0867     if (IS_ERR(msq)) {
0868         err = PTR_ERR(msq);
0869         goto out_unlock1;
0870     }
0871 
0872     ipc_lock_object(&msq->q_perm);
0873 
0874     for (;;) {
0875         struct msg_sender s;
0876 
0877         err = -EACCES;
0878         if (ipcperms(ns, &msq->q_perm, S_IWUGO))
0879             goto out_unlock0;
0880 
0881         /* raced with RMID? */
0882         if (!ipc_valid_object(&msq->q_perm)) {
0883             err = -EIDRM;
0884             goto out_unlock0;
0885         }
0886 
0887         err = security_msg_queue_msgsnd(&msq->q_perm, msg, msgflg);
0888         if (err)
0889             goto out_unlock0;
0890 
0891         if (msg_fits_inqueue(msq, msgsz))
0892             break;
0893 
0894         /* queue full, wait: */
0895         if (msgflg & IPC_NOWAIT) {
0896             err = -EAGAIN;
0897             goto out_unlock0;
0898         }
0899 
0900         /* enqueue the sender and prepare to block */
0901         ss_add(msq, &s, msgsz);
0902 
0903         if (!ipc_rcu_getref(&msq->q_perm)) {
0904             err = -EIDRM;
0905             goto out_unlock0;
0906         }
0907 
0908         ipc_unlock_object(&msq->q_perm);
0909         rcu_read_unlock();
0910         schedule();
0911 
0912         rcu_read_lock();
0913         ipc_lock_object(&msq->q_perm);
0914 
0915         ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
0916         /* raced with RMID? */
0917         if (!ipc_valid_object(&msq->q_perm)) {
0918             err = -EIDRM;
0919             goto out_unlock0;
0920         }
0921         ss_del(&s);
0922 
0923         if (signal_pending(current)) {
0924             err = -ERESTARTNOHAND;
0925             goto out_unlock0;
0926         }
0927 
0928     }
0929 
0930     ipc_update_pid(&msq->q_lspid, task_tgid(current));
0931     msq->q_stime = ktime_get_real_seconds();
0932 
0933     if (!pipelined_send(msq, msg, &wake_q)) {
0934         /* no one is waiting for this message, enqueue it */
0935         list_add_tail(&msg->m_list, &msq->q_messages);
0936         msq->q_cbytes += msgsz;
0937         msq->q_qnum++;
0938         atomic_add(msgsz, &ns->msg_bytes);
0939         atomic_inc(&ns->msg_hdrs);
0940     }
0941 
0942     err = 0;
0943     msg = NULL;
0944 
0945 out_unlock0:
0946     ipc_unlock_object(&msq->q_perm);
0947     wake_up_q(&wake_q);
0948 out_unlock1:
0949     rcu_read_unlock();
0950     if (msg != NULL)
0951         free_msg(msg);
0952     return err;
0953 }
0954 
0955 long ksys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz,
0956          int msgflg)
0957 {
0958     long mtype;
0959 
0960     if (get_user(mtype, &msgp->mtype))
0961         return -EFAULT;
0962     return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
0963 }
0964 
0965 SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
0966         int, msgflg)
0967 {
0968     return ksys_msgsnd(msqid, msgp, msgsz, msgflg);
0969 }
0970 
0971 #ifdef CONFIG_COMPAT
0972 
0973 struct compat_msgbuf {
0974     compat_long_t mtype;
0975     char mtext[1];
0976 };
0977 
0978 long compat_ksys_msgsnd(int msqid, compat_uptr_t msgp,
0979                compat_ssize_t msgsz, int msgflg)
0980 {
0981     struct compat_msgbuf __user *up = compat_ptr(msgp);
0982     compat_long_t mtype;
0983 
0984     if (get_user(mtype, &up->mtype))
0985         return -EFAULT;
0986     return do_msgsnd(msqid, mtype, up->mtext, (ssize_t)msgsz, msgflg);
0987 }
0988 
0989 COMPAT_SYSCALL_DEFINE4(msgsnd, int, msqid, compat_uptr_t, msgp,
0990                compat_ssize_t, msgsz, int, msgflg)
0991 {
0992     return compat_ksys_msgsnd(msqid, msgp, msgsz, msgflg);
0993 }
0994 #endif
0995 
0996 static inline int convert_mode(long *msgtyp, int msgflg)
0997 {
0998     if (msgflg & MSG_COPY)
0999         return SEARCH_NUMBER;
1000     /*
1001      *  find message of correct type.
1002      *  msgtyp = 0 => get first.
1003      *  msgtyp > 0 => get first message of matching type.
1004      *  msgtyp < 0 => get message with least type must be < abs(msgtype).
1005      */
1006     if (*msgtyp == 0)
1007         return SEARCH_ANY;
1008     if (*msgtyp < 0) {
1009         if (*msgtyp == LONG_MIN) /* -LONG_MIN is undefined */
1010             *msgtyp = LONG_MAX;
1011         else
1012             *msgtyp = -*msgtyp;
1013         return SEARCH_LESSEQUAL;
1014     }
1015     if (msgflg & MSG_EXCEPT)
1016         return SEARCH_NOTEQUAL;
1017     return SEARCH_EQUAL;
1018 }
1019 
1020 static long do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
1021 {
1022     struct msgbuf __user *msgp = dest;
1023     size_t msgsz;
1024 
1025     if (put_user(msg->m_type, &msgp->mtype))
1026         return -EFAULT;
1027 
1028     msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
1029     if (store_msg(msgp->mtext, msg, msgsz))
1030         return -EFAULT;
1031     return msgsz;
1032 }
1033 
1034 #ifdef CONFIG_CHECKPOINT_RESTORE
1035 /*
1036  * This function creates new kernel message structure, large enough to store
1037  * bufsz message bytes.
1038  */
1039 static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
1040 {
1041     struct msg_msg *copy;
1042 
1043     /*
1044      * Create dummy message to copy real message to.
1045      */
1046     copy = load_msg(buf, bufsz);
1047     if (!IS_ERR(copy))
1048         copy->m_ts = bufsz;
1049     return copy;
1050 }
1051 
1052 static inline void free_copy(struct msg_msg *copy)
1053 {
1054     if (copy)
1055         free_msg(copy);
1056 }
1057 #else
1058 static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
1059 {
1060     return ERR_PTR(-ENOSYS);
1061 }
1062 
1063 static inline void free_copy(struct msg_msg *copy)
1064 {
1065 }
1066 #endif
1067 
1068 static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
1069 {
1070     struct msg_msg *msg, *found = NULL;
1071     long count = 0;
1072 
1073     list_for_each_entry(msg, &msq->q_messages, m_list) {
1074         if (testmsg(msg, *msgtyp, mode) &&
1075             !security_msg_queue_msgrcv(&msq->q_perm, msg, current,
1076                            *msgtyp, mode)) {
1077             if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
1078                 *msgtyp = msg->m_type - 1;
1079                 found = msg;
1080             } else if (mode == SEARCH_NUMBER) {
1081                 if (*msgtyp == count)
1082                     return msg;
1083             } else
1084                 return msg;
1085             count++;
1086         }
1087     }
1088 
1089     return found ?: ERR_PTR(-EAGAIN);
1090 }
1091 
1092 static long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgflg,
1093            long (*msg_handler)(void __user *, struct msg_msg *, size_t))
1094 {
1095     int mode;
1096     struct msg_queue *msq;
1097     struct ipc_namespace *ns;
1098     struct msg_msg *msg, *copy = NULL;
1099     DEFINE_WAKE_Q(wake_q);
1100 
1101     ns = current->nsproxy->ipc_ns;
1102 
1103     if (msqid < 0 || (long) bufsz < 0)
1104         return -EINVAL;
1105 
1106     if (msgflg & MSG_COPY) {
1107         if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT))
1108             return -EINVAL;
1109         copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
1110         if (IS_ERR(copy))
1111             return PTR_ERR(copy);
1112     }
1113     mode = convert_mode(&msgtyp, msgflg);
1114 
1115     rcu_read_lock();
1116     msq = msq_obtain_object_check(ns, msqid);
1117     if (IS_ERR(msq)) {
1118         rcu_read_unlock();
1119         free_copy(copy);
1120         return PTR_ERR(msq);
1121     }
1122 
1123     for (;;) {
1124         struct msg_receiver msr_d;
1125 
1126         msg = ERR_PTR(-EACCES);
1127         if (ipcperms(ns, &msq->q_perm, S_IRUGO))
1128             goto out_unlock1;
1129 
1130         ipc_lock_object(&msq->q_perm);
1131 
1132         /* raced with RMID? */
1133         if (!ipc_valid_object(&msq->q_perm)) {
1134             msg = ERR_PTR(-EIDRM);
1135             goto out_unlock0;
1136         }
1137 
1138         msg = find_msg(msq, &msgtyp, mode);
1139         if (!IS_ERR(msg)) {
1140             /*
1141              * Found a suitable message.
1142              * Unlink it from the queue.
1143              */
1144             if ((bufsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
1145                 msg = ERR_PTR(-E2BIG);
1146                 goto out_unlock0;
1147             }
1148             /*
1149              * If we are copying, then do not unlink message and do
1150              * not update queue parameters.
1151              */
1152             if (msgflg & MSG_COPY) {
1153                 msg = copy_msg(msg, copy);
1154                 goto out_unlock0;
1155             }
1156 
1157             list_del(&msg->m_list);
1158             msq->q_qnum--;
1159             msq->q_rtime = ktime_get_real_seconds();
1160             ipc_update_pid(&msq->q_lrpid, task_tgid(current));
1161             msq->q_cbytes -= msg->m_ts;
1162             atomic_sub(msg->m_ts, &ns->msg_bytes);
1163             atomic_dec(&ns->msg_hdrs);
1164             ss_wakeup(msq, &wake_q, false);
1165 
1166             goto out_unlock0;
1167         }
1168 
1169         /* No message waiting. Wait for a message */
1170         if (msgflg & IPC_NOWAIT) {
1171             msg = ERR_PTR(-ENOMSG);
1172             goto out_unlock0;
1173         }
1174 
1175         list_add_tail(&msr_d.r_list, &msq->q_receivers);
1176         msr_d.r_tsk = current;
1177         msr_d.r_msgtype = msgtyp;
1178         msr_d.r_mode = mode;
1179         if (msgflg & MSG_NOERROR)
1180             msr_d.r_maxsize = INT_MAX;
1181         else
1182             msr_d.r_maxsize = bufsz;
1183 
1184         /* memory barrier not require due to ipc_lock_object() */
1185         WRITE_ONCE(msr_d.r_msg, ERR_PTR(-EAGAIN));
1186 
1187         /* memory barrier not required, we own ipc_lock_object() */
1188         __set_current_state(TASK_INTERRUPTIBLE);
1189 
1190         ipc_unlock_object(&msq->q_perm);
1191         rcu_read_unlock();
1192         schedule();
1193 
1194         /*
1195          * Lockless receive, part 1:
1196          * We don't hold a reference to the queue and getting a
1197          * reference would defeat the idea of a lockless operation,
1198          * thus the code relies on rcu to guarantee the existence of
1199          * msq:
1200          * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
1201          * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
1202          */
1203         rcu_read_lock();
1204 
1205         /*
1206          * Lockless receive, part 2:
1207          * The work in pipelined_send() and expunge_all():
1208          * - Set pointer to message
1209          * - Queue the receiver task for later wakeup
1210          * - Wake up the process after the lock is dropped.
1211          *
1212          * Should the process wake up before this wakeup (due to a
1213          * signal) it will either see the message and continue ...
1214          */
1215         msg = READ_ONCE(msr_d.r_msg);
1216         if (msg != ERR_PTR(-EAGAIN)) {
1217             /* see MSG_BARRIER for purpose/pairing */
1218             smp_acquire__after_ctrl_dep();
1219 
1220             goto out_unlock1;
1221         }
1222 
1223          /*
1224           * ... or see -EAGAIN, acquire the lock to check the message
1225           * again.
1226           */
1227         ipc_lock_object(&msq->q_perm);
1228 
1229         msg = READ_ONCE(msr_d.r_msg);
1230         if (msg != ERR_PTR(-EAGAIN))
1231             goto out_unlock0;
1232 
1233         list_del(&msr_d.r_list);
1234         if (signal_pending(current)) {
1235             msg = ERR_PTR(-ERESTARTNOHAND);
1236             goto out_unlock0;
1237         }
1238 
1239         ipc_unlock_object(&msq->q_perm);
1240     }
1241 
1242 out_unlock0:
1243     ipc_unlock_object(&msq->q_perm);
1244     wake_up_q(&wake_q);
1245 out_unlock1:
1246     rcu_read_unlock();
1247     if (IS_ERR(msg)) {
1248         free_copy(copy);
1249         return PTR_ERR(msg);
1250     }
1251 
1252     bufsz = msg_handler(buf, msg, bufsz);
1253     free_msg(msg);
1254 
1255     return bufsz;
1256 }
1257 
1258 long ksys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
1259          long msgtyp, int msgflg)
1260 {
1261     return do_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg, do_msg_fill);
1262 }
1263 
1264 SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
1265         long, msgtyp, int, msgflg)
1266 {
1267     return ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
1268 }
1269 
1270 #ifdef CONFIG_COMPAT
1271 static long compat_do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
1272 {
1273     struct compat_msgbuf __user *msgp = dest;
1274     size_t msgsz;
1275 
1276     if (put_user(msg->m_type, &msgp->mtype))
1277         return -EFAULT;
1278 
1279     msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
1280     if (store_msg(msgp->mtext, msg, msgsz))
1281         return -EFAULT;
1282     return msgsz;
1283 }
1284 
1285 long compat_ksys_msgrcv(int msqid, compat_uptr_t msgp, compat_ssize_t msgsz,
1286             compat_long_t msgtyp, int msgflg)
1287 {
1288     return do_msgrcv(msqid, compat_ptr(msgp), (ssize_t)msgsz, (long)msgtyp,
1289              msgflg, compat_do_msg_fill);
1290 }
1291 
1292 COMPAT_SYSCALL_DEFINE5(msgrcv, int, msqid, compat_uptr_t, msgp,
1293                compat_ssize_t, msgsz, compat_long_t, msgtyp,
1294                int, msgflg)
1295 {
1296     return compat_ksys_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg);
1297 }
1298 #endif
1299 
1300 void msg_init_ns(struct ipc_namespace *ns)
1301 {
1302     ns->msg_ctlmax = MSGMAX;
1303     ns->msg_ctlmnb = MSGMNB;
1304     ns->msg_ctlmni = MSGMNI;
1305 
1306     atomic_set(&ns->msg_bytes, 0);
1307     atomic_set(&ns->msg_hdrs, 0);
1308     ipc_init_ids(&ns->ids[IPC_MSG_IDS]);
1309 }
1310 
1311 #ifdef CONFIG_IPC_NS
1312 void msg_exit_ns(struct ipc_namespace *ns)
1313 {
1314     free_ipcs(ns, &msg_ids(ns), freeque);
1315     idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
1316     rhashtable_destroy(&ns->ids[IPC_MSG_IDS].key_ht);
1317 }
1318 #endif
1319 
1320 #ifdef CONFIG_PROC_FS
1321 static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
1322 {
1323     struct pid_namespace *pid_ns = ipc_seq_pid_ns(s);
1324     struct user_namespace *user_ns = seq_user_ns(s);
1325     struct kern_ipc_perm *ipcp = it;
1326     struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
1327 
1328     seq_printf(s,
1329            "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10llu %10llu %10llu\n",
1330            msq->q_perm.key,
1331            msq->q_perm.id,
1332            msq->q_perm.mode,
1333            msq->q_cbytes,
1334            msq->q_qnum,
1335            pid_nr_ns(msq->q_lspid, pid_ns),
1336            pid_nr_ns(msq->q_lrpid, pid_ns),
1337            from_kuid_munged(user_ns, msq->q_perm.uid),
1338            from_kgid_munged(user_ns, msq->q_perm.gid),
1339            from_kuid_munged(user_ns, msq->q_perm.cuid),
1340            from_kgid_munged(user_ns, msq->q_perm.cgid),
1341            msq->q_stime,
1342            msq->q_rtime,
1343            msq->q_ctime);
1344 
1345     return 0;
1346 }
1347 #endif
1348 
1349 void __init msg_init(void)
1350 {
1351     msg_init_ns(&init_ipc_ns);
1352 
1353     ipc_init_proc_interface("sysvipc/msg",
1354                 "       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
1355                 IPC_MSG_IDS, sysvipc_msg_proc_show);
1356 }
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!