|
@@ -388,31 +388,14 @@ copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-struct msq_setbuf {
|
|
|
- unsigned long qbytes;
|
|
|
- uid_t uid;
|
|
|
- gid_t gid;
|
|
|
- mode_t mode;
|
|
|
-};
|
|
|
-
|
|
|
static inline unsigned long
|
|
|
-copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
|
|
|
+copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
|
|
|
{
|
|
|
switch(version) {
|
|
|
case IPC_64:
|
|
|
- {
|
|
|
- struct msqid64_ds tbuf;
|
|
|
-
|
|
|
- if (copy_from_user(&tbuf, buf, sizeof(tbuf)))
|
|
|
+ if (copy_from_user(out, buf, sizeof(*out)))
|
|
|
return -EFAULT;
|
|
|
-
|
|
|
- out->qbytes = tbuf.msg_qbytes;
|
|
|
- out->uid = tbuf.msg_perm.uid;
|
|
|
- out->gid = tbuf.msg_perm.gid;
|
|
|
- out->mode = tbuf.msg_perm.mode;
|
|
|
-
|
|
|
return 0;
|
|
|
- }
|
|
|
case IPC_OLD:
|
|
|
{
|
|
|
struct msqid_ds tbuf_old;
|
|
@@ -420,14 +403,14 @@ copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
|
|
|
if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
|
|
|
return -EFAULT;
|
|
|
|
|
|
- out->uid = tbuf_old.msg_perm.uid;
|
|
|
- out->gid = tbuf_old.msg_perm.gid;
|
|
|
- out->mode = tbuf_old.msg_perm.mode;
|
|
|
+ out->msg_perm.uid = tbuf_old.msg_perm.uid;
|
|
|
+ out->msg_perm.gid = tbuf_old.msg_perm.gid;
|
|
|
+ out->msg_perm.mode = tbuf_old.msg_perm.mode;
|
|
|
|
|
|
if (tbuf_old.msg_qbytes == 0)
|
|
|
- out->qbytes = tbuf_old.msg_lqbytes;
|
|
|
+ out->msg_qbytes = tbuf_old.msg_lqbytes;
|
|
|
else
|
|
|
- out->qbytes = tbuf_old.msg_qbytes;
|
|
|
+ out->msg_qbytes = tbuf_old.msg_qbytes;
|
|
|
|
|
|
return 0;
|
|
|
}
|
|
@@ -445,12 +428,12 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
|
|
|
struct msqid_ds __user *buf, int version)
|
|
|
{
|
|
|
struct kern_ipc_perm *ipcp;
|
|
|
- struct msq_setbuf setbuf;
|
|
|
+ struct msqid64_ds msqid64;
|
|
|
struct msg_queue *msq;
|
|
|
int err;
|
|
|
|
|
|
if (cmd == IPC_SET) {
|
|
|
- if (copy_msqid_from_user(&setbuf, buf, version))
|
|
|
+ if (copy_msqid_from_user(&msqid64, buf, version))
|
|
|
return -EFAULT;
|
|
|
}
|
|
|
|
|
@@ -468,8 +451,10 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
|
|
|
goto out_unlock;
|
|
|
|
|
|
if (cmd == IPC_SET) {
|
|
|
- err = audit_ipc_set_perm(setbuf.qbytes, setbuf.uid, setbuf.gid,
|
|
|
- setbuf.mode);
|
|
|
+ err = audit_ipc_set_perm(msqid64.msg_qbytes,
|
|
|
+ msqid64.msg_perm.uid,
|
|
|
+ msqid64.msg_perm.gid,
|
|
|
+ msqid64.msg_perm.mode);
|
|
|
if (err)
|
|
|
goto out_unlock;
|
|
|
}
|
|
@@ -491,18 +476,18 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
|
|
|
freeque(ns, ipcp);
|
|
|
goto out_up;
|
|
|
case IPC_SET:
|
|
|
- if (setbuf.qbytes > ns->msg_ctlmnb &&
|
|
|
+ if (msqid64.msg_qbytes > ns->msg_ctlmnb &&
|
|
|
!capable(CAP_SYS_RESOURCE)) {
|
|
|
err = -EPERM;
|
|
|
goto out_unlock;
|
|
|
}
|
|
|
|
|
|
- msq->q_qbytes = setbuf.qbytes;
|
|
|
+ msq->q_qbytes = msqid64.msg_qbytes;
|
|
|
|
|
|
- ipcp->uid = setbuf.uid;
|
|
|
- ipcp->gid = setbuf.gid;
|
|
|
+ ipcp->uid = msqid64.msg_perm.uid;
|
|
|
+ ipcp->gid = msqid64.msg_perm.gid;
|
|
|
ipcp->mode = (ipcp->mode & ~S_IRWXUGO) |
|
|
|
- (S_IRWXUGO & setbuf.mode);
|
|
|
+ (S_IRWXUGO & msqid64.msg_perm.mode);
|
|
|
msq->q_ctime = get_seconds();
|
|
|
/* sleeping receivers might be excluded by
|
|
|
* stricter permissions.
|