msg.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047
  1. /*
  2. * linux/ipc/msg.c
  3. * Copyright (C) 1992 Krishna Balasubramanian
  4. *
  5. * Removed all the remaining kerneld mess
  6. * Catch the -EFAULT stuff properly
  7. * Use GFP_KERNEL for messages as in 1.2
  8. * Fixed up the unchecked user space derefs
  9. * Copyright (C) 1998 Alan Cox & Andi Kleen
  10. *
  11. * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
  12. *
  13. * mostly rewritten, threaded and wake-one semantics added
  14. * MSGMAX limit removed, sysctl's added
  15. * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
  16. *
  17. * support for audit of ipc object properties and permission changes
  18. * Dustin Kirkland <dustin.kirkland@us.ibm.com>
  19. *
  20. * namespaces support
  21. * OpenVZ, SWsoft Inc.
  22. * Pavel Emelianov <xemul@openvz.org>
  23. */
  24. #include <linux/capability.h>
  25. #include <linux/msg.h>
  26. #include <linux/spinlock.h>
  27. #include <linux/init.h>
  28. #include <linux/mm.h>
  29. #include <linux/proc_fs.h>
  30. #include <linux/list.h>
  31. #include <linux/security.h>
  32. #include <linux/sched.h>
  33. #include <linux/syscalls.h>
  34. #include <linux/audit.h>
  35. #include <linux/seq_file.h>
  36. #include <linux/rwsem.h>
  37. #include <linux/nsproxy.h>
  38. #include <linux/ipc_namespace.h>
  39. #include <asm/current.h>
  40. #include <asm/uaccess.h>
  41. #include "util.h"
  42. /*
  43. * one msg_receiver structure for each sleeping receiver:
  44. */
  45. struct msg_receiver {
  46. struct list_head r_list;
  47. struct task_struct *r_tsk;
  48. int r_mode;
  49. long r_msgtype;
  50. long r_maxsize;
  51. struct msg_msg *volatile r_msg;
  52. };
  53. /* one msg_sender for each sleeping sender */
  54. struct msg_sender {
  55. struct list_head list;
  56. struct task_struct *tsk;
  57. };
  58. #define SEARCH_ANY 1
  59. #define SEARCH_EQUAL 2
  60. #define SEARCH_NOTEQUAL 3
  61. #define SEARCH_LESSEQUAL 4
  62. #define SEARCH_NUMBER 5
  63. #define msg_ids(ns) ((ns)->ids[IPC_MSG_IDS])
  64. #define msg_unlock(msq) ipc_unlock(&(msq)->q_perm)
  65. static void freeque(struct ipc_namespace *, struct kern_ipc_perm *);
  66. static int newque(struct ipc_namespace *, struct ipc_params *);
  67. #ifdef CONFIG_PROC_FS
  68. static int sysvipc_msg_proc_show(struct seq_file *s, void *it);
  69. #endif
  70. /*
  71. * Scale msgmni with the available lowmem size: the memory dedicated to msg
  72. * queues should occupy at most 1/MSG_MEM_SCALE of lowmem.
  73. * Also take into account the number of nsproxies created so far.
  74. * This should be done staying within the (MSGMNI , IPCMNI/nr_ipc_ns) range.
  75. */
  76. void recompute_msgmni(struct ipc_namespace *ns)
  77. {
  78. struct sysinfo i;
  79. unsigned long allowed;
  80. int nb_ns;
  81. si_meminfo(&i);
  82. allowed = (((i.totalram - i.totalhigh) / MSG_MEM_SCALE) * i.mem_unit)
  83. / MSGMNB;
  84. nb_ns = atomic_read(&nr_ipc_ns);
  85. allowed /= nb_ns;
  86. if (allowed < MSGMNI) {
  87. ns->msg_ctlmni = MSGMNI;
  88. return;
  89. }
  90. if (allowed > IPCMNI / nb_ns) {
  91. ns->msg_ctlmni = IPCMNI / nb_ns;
  92. return;
  93. }
  94. ns->msg_ctlmni = allowed;
  95. }
  96. void msg_init_ns(struct ipc_namespace *ns)
  97. {
  98. ns->msg_ctlmax = MSGMAX;
  99. ns->msg_ctlmnb = MSGMNB;
  100. recompute_msgmni(ns);
  101. atomic_set(&ns->msg_bytes, 0);
  102. atomic_set(&ns->msg_hdrs, 0);
  103. ipc_init_ids(&ns->ids[IPC_MSG_IDS]);
  104. }
  105. #ifdef CONFIG_IPC_NS
  106. void msg_exit_ns(struct ipc_namespace *ns)
  107. {
  108. free_ipcs(ns, &msg_ids(ns), freeque);
  109. idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
  110. }
  111. #endif
  112. void __init msg_init(void)
  113. {
  114. msg_init_ns(&init_ipc_ns);
  115. printk(KERN_INFO "msgmni has been set to %d\n",
  116. init_ipc_ns.msg_ctlmni);
  117. ipc_init_proc_interface("sysvipc/msg",
  118. " key msqid perms cbytes qnum lspid lrpid uid gid cuid cgid stime rtime ctime\n",
  119. IPC_MSG_IDS, sysvipc_msg_proc_show);
  120. }
  121. static inline struct msg_queue *msq_obtain_object(struct ipc_namespace *ns, int id)
  122. {
  123. struct kern_ipc_perm *ipcp = ipc_obtain_object(&msg_ids(ns), id);
  124. if (IS_ERR(ipcp))
  125. return ERR_CAST(ipcp);
  126. return container_of(ipcp, struct msg_queue, q_perm);
  127. }
  128. static inline struct msg_queue *msq_obtain_object_check(struct ipc_namespace *ns,
  129. int id)
  130. {
  131. struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&msg_ids(ns), id);
  132. if (IS_ERR(ipcp))
  133. return ERR_CAST(ipcp);
  134. return container_of(ipcp, struct msg_queue, q_perm);
  135. }
  136. static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
  137. {
  138. ipc_rmid(&msg_ids(ns), &s->q_perm);
  139. }
  140. /**
  141. * newque - Create a new msg queue
  142. * @ns: namespace
  143. * @params: ptr to the structure that contains the key and msgflg
  144. *
  145. * Called with msg_ids.rw_mutex held (writer)
  146. */
  147. static int newque(struct ipc_namespace *ns, struct ipc_params *params)
  148. {
  149. struct msg_queue *msq;
  150. int id, retval;
  151. key_t key = params->key;
  152. int msgflg = params->flg;
  153. msq = ipc_rcu_alloc(sizeof(*msq));
  154. if (!msq)
  155. return -ENOMEM;
  156. msq->q_perm.mode = msgflg & S_IRWXUGO;
  157. msq->q_perm.key = key;
  158. msq->q_perm.security = NULL;
  159. retval = security_msg_queue_alloc(msq);
  160. if (retval) {
  161. ipc_rcu_putref(msq);
  162. return retval;
  163. }
  164. /* ipc_addid() locks msq upon success. */
  165. id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
  166. if (id < 0) {
  167. security_msg_queue_free(msq);
  168. ipc_rcu_putref(msq);
  169. return id;
  170. }
  171. msq->q_stime = msq->q_rtime = 0;
  172. msq->q_ctime = get_seconds();
  173. msq->q_cbytes = msq->q_qnum = 0;
  174. msq->q_qbytes = ns->msg_ctlmnb;
  175. msq->q_lspid = msq->q_lrpid = 0;
  176. INIT_LIST_HEAD(&msq->q_messages);
  177. INIT_LIST_HEAD(&msq->q_receivers);
  178. INIT_LIST_HEAD(&msq->q_senders);
  179. ipc_unlock_object(&msq->q_perm);
  180. rcu_read_unlock();
  181. return msq->q_perm.id;
  182. }
  183. static inline void ss_add(struct msg_queue *msq, struct msg_sender *mss)
  184. {
  185. mss->tsk = current;
  186. current->state = TASK_INTERRUPTIBLE;
  187. list_add_tail(&mss->list, &msq->q_senders);
  188. }
  189. static inline void ss_del(struct msg_sender *mss)
  190. {
  191. if (mss->list.next != NULL)
  192. list_del(&mss->list);
  193. }
  194. static void ss_wakeup(struct list_head *h, int kill)
  195. {
  196. struct msg_sender *mss, *t;
  197. list_for_each_entry_safe(mss, t, h, list) {
  198. if (kill)
  199. mss->list.next = NULL;
  200. wake_up_process(mss->tsk);
  201. }
  202. }
  203. static void expunge_all(struct msg_queue *msq, int res)
  204. {
  205. struct msg_receiver *msr, *t;
  206. list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
  207. msr->r_msg = NULL;
  208. wake_up_process(msr->r_tsk);
  209. smp_mb();
  210. msr->r_msg = ERR_PTR(res);
  211. }
  212. }
  213. /*
  214. * freeque() wakes up waiters on the sender and receiver waiting queue,
  215. * removes the message queue from message queue ID IDR, and cleans up all the
  216. * messages associated with this queue.
  217. *
  218. * msg_ids.rw_mutex (writer) and the spinlock for this message queue are held
  219. * before freeque() is called. msg_ids.rw_mutex remains locked on exit.
  220. */
  221. static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
  222. {
  223. struct msg_msg *msg, *t;
  224. struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
  225. expunge_all(msq, -EIDRM);
  226. ss_wakeup(&msq->q_senders, 1);
  227. msg_rmid(ns, msq);
  228. msg_unlock(msq);
  229. list_for_each_entry_safe(msg, t, &msq->q_messages, m_list) {
  230. atomic_dec(&ns->msg_hdrs);
  231. free_msg(msg);
  232. }
  233. atomic_sub(msq->q_cbytes, &ns->msg_bytes);
  234. security_msg_queue_free(msq);
  235. ipc_rcu_putref(msq);
  236. }
  237. /*
  238. * Called with msg_ids.rw_mutex and ipcp locked.
  239. */
  240. static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
  241. {
  242. struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
  243. return security_msg_queue_associate(msq, msgflg);
  244. }
  245. SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
  246. {
  247. struct ipc_namespace *ns;
  248. struct ipc_ops msg_ops;
  249. struct ipc_params msg_params;
  250. ns = current->nsproxy->ipc_ns;
  251. msg_ops.getnew = newque;
  252. msg_ops.associate = msg_security;
  253. msg_ops.more_checks = NULL;
  254. msg_params.key = key;
  255. msg_params.flg = msgflg;
  256. return ipcget(ns, &msg_ids(ns), &msg_ops, &msg_params);
  257. }
  258. static inline unsigned long
  259. copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
  260. {
  261. switch(version) {
  262. case IPC_64:
  263. return copy_to_user(buf, in, sizeof(*in));
  264. case IPC_OLD:
  265. {
  266. struct msqid_ds out;
  267. memset(&out, 0, sizeof(out));
  268. ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
  269. out.msg_stime = in->msg_stime;
  270. out.msg_rtime = in->msg_rtime;
  271. out.msg_ctime = in->msg_ctime;
  272. if (in->msg_cbytes > USHRT_MAX)
  273. out.msg_cbytes = USHRT_MAX;
  274. else
  275. out.msg_cbytes = in->msg_cbytes;
  276. out.msg_lcbytes = in->msg_cbytes;
  277. if (in->msg_qnum > USHRT_MAX)
  278. out.msg_qnum = USHRT_MAX;
  279. else
  280. out.msg_qnum = in->msg_qnum;
  281. if (in->msg_qbytes > USHRT_MAX)
  282. out.msg_qbytes = USHRT_MAX;
  283. else
  284. out.msg_qbytes = in->msg_qbytes;
  285. out.msg_lqbytes = in->msg_qbytes;
  286. out.msg_lspid = in->msg_lspid;
  287. out.msg_lrpid = in->msg_lrpid;
  288. return copy_to_user(buf, &out, sizeof(out));
  289. }
  290. default:
  291. return -EINVAL;
  292. }
  293. }
  294. static inline unsigned long
  295. copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
  296. {
  297. switch(version) {
  298. case IPC_64:
  299. if (copy_from_user(out, buf, sizeof(*out)))
  300. return -EFAULT;
  301. return 0;
  302. case IPC_OLD:
  303. {
  304. struct msqid_ds tbuf_old;
  305. if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
  306. return -EFAULT;
  307. out->msg_perm.uid = tbuf_old.msg_perm.uid;
  308. out->msg_perm.gid = tbuf_old.msg_perm.gid;
  309. out->msg_perm.mode = tbuf_old.msg_perm.mode;
  310. if (tbuf_old.msg_qbytes == 0)
  311. out->msg_qbytes = tbuf_old.msg_lqbytes;
  312. else
  313. out->msg_qbytes = tbuf_old.msg_qbytes;
  314. return 0;
  315. }
  316. default:
  317. return -EINVAL;
  318. }
  319. }
  320. /*
  321. * This function handles some msgctl commands which require the rw_mutex
  322. * to be held in write mode.
  323. * NOTE: no locks must be held, the rw_mutex is taken inside this function.
  324. */
  325. static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
  326. struct msqid_ds __user *buf, int version)
  327. {
  328. struct kern_ipc_perm *ipcp;
  329. struct msqid64_ds uninitialized_var(msqid64);
  330. struct msg_queue *msq;
  331. int err;
  332. if (cmd == IPC_SET) {
  333. if (copy_msqid_from_user(&msqid64, buf, version))
  334. return -EFAULT;
  335. }
  336. down_write(&msg_ids(ns).rw_mutex);
  337. rcu_read_lock();
  338. ipcp = ipcctl_pre_down_nolock(ns, &msg_ids(ns), msqid, cmd,
  339. &msqid64.msg_perm, msqid64.msg_qbytes);
  340. if (IS_ERR(ipcp)) {
  341. err = PTR_ERR(ipcp);
  342. goto out_unlock1;
  343. }
  344. msq = container_of(ipcp, struct msg_queue, q_perm);
  345. err = security_msg_queue_msgctl(msq, cmd);
  346. if (err)
  347. goto out_unlock1;
  348. switch (cmd) {
  349. case IPC_RMID:
  350. ipc_lock_object(&msq->q_perm);
  351. /* freeque unlocks the ipc object and rcu */
  352. freeque(ns, ipcp);
  353. goto out_up;
  354. case IPC_SET:
  355. if (msqid64.msg_qbytes > ns->msg_ctlmnb &&
  356. !capable(CAP_SYS_RESOURCE)) {
  357. err = -EPERM;
  358. goto out_unlock1;
  359. }
  360. ipc_lock_object(&msq->q_perm);
  361. err = ipc_update_perm(&msqid64.msg_perm, ipcp);
  362. if (err)
  363. goto out_unlock0;
  364. msq->q_qbytes = msqid64.msg_qbytes;
  365. msq->q_ctime = get_seconds();
  366. /* sleeping receivers might be excluded by
  367. * stricter permissions.
  368. */
  369. expunge_all(msq, -EAGAIN);
  370. /* sleeping senders might be able to send
  371. * due to a larger queue size.
  372. */
  373. ss_wakeup(&msq->q_senders, 0);
  374. break;
  375. default:
  376. err = -EINVAL;
  377. goto out_unlock1;
  378. }
  379. out_unlock0:
  380. ipc_unlock_object(&msq->q_perm);
  381. out_unlock1:
  382. rcu_read_unlock();
  383. out_up:
  384. up_write(&msg_ids(ns).rw_mutex);
  385. return err;
  386. }
  387. static int msgctl_nolock(struct ipc_namespace *ns, int msqid,
  388. int cmd, int version, void __user *buf)
  389. {
  390. int err;
  391. struct msg_queue *msq;
  392. switch (cmd) {
  393. case IPC_INFO:
  394. case MSG_INFO:
  395. {
  396. struct msginfo msginfo;
  397. int max_id;
  398. if (!buf)
  399. return -EFAULT;
  400. /*
  401. * We must not return kernel stack data.
  402. * due to padding, it's not enough
  403. * to set all member fields.
  404. */
  405. err = security_msg_queue_msgctl(NULL, cmd);
  406. if (err)
  407. return err;
  408. memset(&msginfo, 0, sizeof(msginfo));
  409. msginfo.msgmni = ns->msg_ctlmni;
  410. msginfo.msgmax = ns->msg_ctlmax;
  411. msginfo.msgmnb = ns->msg_ctlmnb;
  412. msginfo.msgssz = MSGSSZ;
  413. msginfo.msgseg = MSGSEG;
  414. down_read(&msg_ids(ns).rw_mutex);
  415. if (cmd == MSG_INFO) {
  416. msginfo.msgpool = msg_ids(ns).in_use;
  417. msginfo.msgmap = atomic_read(&ns->msg_hdrs);
  418. msginfo.msgtql = atomic_read(&ns->msg_bytes);
  419. } else {
  420. msginfo.msgmap = MSGMAP;
  421. msginfo.msgpool = MSGPOOL;
  422. msginfo.msgtql = MSGTQL;
  423. }
  424. max_id = ipc_get_maxid(&msg_ids(ns));
  425. up_read(&msg_ids(ns).rw_mutex);
  426. if (copy_to_user(buf, &msginfo, sizeof(struct msginfo)))
  427. return -EFAULT;
  428. return (max_id < 0) ? 0 : max_id;
  429. }
  430. case MSG_STAT:
  431. case IPC_STAT:
  432. {
  433. struct msqid64_ds tbuf;
  434. int success_return;
  435. if (!buf)
  436. return -EFAULT;
  437. memset(&tbuf, 0, sizeof(tbuf));
  438. rcu_read_lock();
  439. if (cmd == MSG_STAT) {
  440. msq = msq_obtain_object(ns, msqid);
  441. if (IS_ERR(msq)) {
  442. err = PTR_ERR(msq);
  443. goto out_unlock;
  444. }
  445. success_return = msq->q_perm.id;
  446. } else {
  447. msq = msq_obtain_object_check(ns, msqid);
  448. if (IS_ERR(msq)) {
  449. err = PTR_ERR(msq);
  450. goto out_unlock;
  451. }
  452. success_return = 0;
  453. }
  454. err = -EACCES;
  455. if (ipcperms(ns, &msq->q_perm, S_IRUGO))
  456. goto out_unlock;
  457. err = security_msg_queue_msgctl(msq, cmd);
  458. if (err)
  459. goto out_unlock;
  460. kernel_to_ipc64_perm(&msq->q_perm, &tbuf.msg_perm);
  461. tbuf.msg_stime = msq->q_stime;
  462. tbuf.msg_rtime = msq->q_rtime;
  463. tbuf.msg_ctime = msq->q_ctime;
  464. tbuf.msg_cbytes = msq->q_cbytes;
  465. tbuf.msg_qnum = msq->q_qnum;
  466. tbuf.msg_qbytes = msq->q_qbytes;
  467. tbuf.msg_lspid = msq->q_lspid;
  468. tbuf.msg_lrpid = msq->q_lrpid;
  469. rcu_read_unlock();
  470. if (copy_msqid_to_user(buf, &tbuf, version))
  471. return -EFAULT;
  472. return success_return;
  473. }
  474. default:
  475. return -EINVAL;
  476. }
  477. return err;
  478. out_unlock:
  479. rcu_read_unlock();
  480. return err;
  481. }
  482. SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
  483. {
  484. int version;
  485. struct ipc_namespace *ns;
  486. if (msqid < 0 || cmd < 0)
  487. return -EINVAL;
  488. version = ipc_parse_version(&cmd);
  489. ns = current->nsproxy->ipc_ns;
  490. switch (cmd) {
  491. case IPC_INFO:
  492. case MSG_INFO:
  493. case MSG_STAT: /* msqid is an index rather than a msg queue id */
  494. case IPC_STAT:
  495. return msgctl_nolock(ns, msqid, cmd, version, buf);
  496. case IPC_SET:
  497. case IPC_RMID:
  498. return msgctl_down(ns, msqid, cmd, buf, version);
  499. default:
  500. return -EINVAL;
  501. }
  502. }
  503. static int testmsg(struct msg_msg *msg, long type, int mode)
  504. {
  505. switch(mode)
  506. {
  507. case SEARCH_ANY:
  508. case SEARCH_NUMBER:
  509. return 1;
  510. case SEARCH_LESSEQUAL:
  511. if (msg->m_type <=type)
  512. return 1;
  513. break;
  514. case SEARCH_EQUAL:
  515. if (msg->m_type == type)
  516. return 1;
  517. break;
  518. case SEARCH_NOTEQUAL:
  519. if (msg->m_type != type)
  520. return 1;
  521. break;
  522. }
  523. return 0;
  524. }
  525. static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg)
  526. {
  527. struct msg_receiver *msr, *t;
  528. list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
  529. if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
  530. !security_msg_queue_msgrcv(msq, msg, msr->r_tsk,
  531. msr->r_msgtype, msr->r_mode)) {
  532. list_del(&msr->r_list);
  533. if (msr->r_maxsize < msg->m_ts) {
  534. msr->r_msg = NULL;
  535. wake_up_process(msr->r_tsk);
  536. smp_mb();
  537. msr->r_msg = ERR_PTR(-E2BIG);
  538. } else {
  539. msr->r_msg = NULL;
  540. msq->q_lrpid = task_pid_vnr(msr->r_tsk);
  541. msq->q_rtime = get_seconds();
  542. wake_up_process(msr->r_tsk);
  543. smp_mb();
  544. msr->r_msg = msg;
  545. return 1;
  546. }
  547. }
  548. }
  549. return 0;
  550. }
  551. long do_msgsnd(int msqid, long mtype, void __user *mtext,
  552. size_t msgsz, int msgflg)
  553. {
  554. struct msg_queue *msq;
  555. struct msg_msg *msg;
  556. int err;
  557. struct ipc_namespace *ns;
  558. ns = current->nsproxy->ipc_ns;
  559. if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0)
  560. return -EINVAL;
  561. if (mtype < 1)
  562. return -EINVAL;
  563. msg = load_msg(mtext, msgsz);
  564. if (IS_ERR(msg))
  565. return PTR_ERR(msg);
  566. msg->m_type = mtype;
  567. msg->m_ts = msgsz;
  568. rcu_read_lock();
  569. msq = msq_obtain_object_check(ns, msqid);
  570. if (IS_ERR(msq)) {
  571. err = PTR_ERR(msq);
  572. goto out_unlock1;
  573. }
  574. for (;;) {
  575. struct msg_sender s;
  576. err = -EACCES;
  577. if (ipcperms(ns, &msq->q_perm, S_IWUGO))
  578. goto out_unlock1;
  579. err = security_msg_queue_msgsnd(msq, msg, msgflg);
  580. if (err)
  581. goto out_unlock1;
  582. if (msgsz + msq->q_cbytes <= msq->q_qbytes &&
  583. 1 + msq->q_qnum <= msq->q_qbytes) {
  584. break;
  585. }
  586. /* queue full, wait: */
  587. if (msgflg & IPC_NOWAIT) {
  588. err = -EAGAIN;
  589. goto out_unlock1;
  590. }
  591. ipc_lock_object(&msq->q_perm);
  592. ss_add(msq, &s);
  593. if (!ipc_rcu_getref(msq)) {
  594. err = -EIDRM;
  595. goto out_unlock0;
  596. }
  597. ipc_unlock_object(&msq->q_perm);
  598. rcu_read_unlock();
  599. schedule();
  600. rcu_read_lock();
  601. ipc_lock_object(&msq->q_perm);
  602. ipc_rcu_putref(msq);
  603. if (msq->q_perm.deleted) {
  604. err = -EIDRM;
  605. goto out_unlock0;
  606. }
  607. ss_del(&s);
  608. if (signal_pending(current)) {
  609. err = -ERESTARTNOHAND;
  610. goto out_unlock0;
  611. }
  612. ipc_unlock_object(&msq->q_perm);
  613. }
  614. ipc_lock_object(&msq->q_perm);
  615. msq->q_lspid = task_tgid_vnr(current);
  616. msq->q_stime = get_seconds();
  617. if (!pipelined_send(msq, msg)) {
  618. /* no one is waiting for this message, enqueue it */
  619. list_add_tail(&msg->m_list, &msq->q_messages);
  620. msq->q_cbytes += msgsz;
  621. msq->q_qnum++;
  622. atomic_add(msgsz, &ns->msg_bytes);
  623. atomic_inc(&ns->msg_hdrs);
  624. }
  625. err = 0;
  626. msg = NULL;
  627. out_unlock0:
  628. ipc_unlock_object(&msq->q_perm);
  629. out_unlock1:
  630. rcu_read_unlock();
  631. if (msg != NULL)
  632. free_msg(msg);
  633. return err;
  634. }
  635. SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
  636. int, msgflg)
  637. {
  638. long mtype;
  639. if (get_user(mtype, &msgp->mtype))
  640. return -EFAULT;
  641. return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
  642. }
  643. static inline int convert_mode(long *msgtyp, int msgflg)
  644. {
  645. if (msgflg & MSG_COPY)
  646. return SEARCH_NUMBER;
  647. /*
  648. * find message of correct type.
  649. * msgtyp = 0 => get first.
  650. * msgtyp > 0 => get first message of matching type.
  651. * msgtyp < 0 => get message with least type must be < abs(msgtype).
  652. */
  653. if (*msgtyp == 0)
  654. return SEARCH_ANY;
  655. if (*msgtyp < 0) {
  656. *msgtyp = -*msgtyp;
  657. return SEARCH_LESSEQUAL;
  658. }
  659. if (msgflg & MSG_EXCEPT)
  660. return SEARCH_NOTEQUAL;
  661. return SEARCH_EQUAL;
  662. }
  663. static long do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
  664. {
  665. struct msgbuf __user *msgp = dest;
  666. size_t msgsz;
  667. if (put_user(msg->m_type, &msgp->mtype))
  668. return -EFAULT;
  669. msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
  670. if (store_msg(msgp->mtext, msg, msgsz))
  671. return -EFAULT;
  672. return msgsz;
  673. }
  674. #ifdef CONFIG_CHECKPOINT_RESTORE
  675. /*
  676. * This function creates new kernel message structure, large enough to store
  677. * bufsz message bytes.
  678. */
  679. static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
  680. {
  681. struct msg_msg *copy;
  682. /*
  683. * Create dummy message to copy real message to.
  684. */
  685. copy = load_msg(buf, bufsz);
  686. if (!IS_ERR(copy))
  687. copy->m_ts = bufsz;
  688. return copy;
  689. }
  690. static inline void free_copy(struct msg_msg *copy)
  691. {
  692. if (copy)
  693. free_msg(copy);
  694. }
  695. #else
  696. static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
  697. {
  698. return ERR_PTR(-ENOSYS);
  699. }
  700. static inline void free_copy(struct msg_msg *copy)
  701. {
  702. }
  703. #endif
  704. static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
  705. {
  706. struct msg_msg *msg, *found = NULL;
  707. long count = 0;
  708. list_for_each_entry(msg, &msq->q_messages, m_list) {
  709. if (testmsg(msg, *msgtyp, mode) &&
  710. !security_msg_queue_msgrcv(msq, msg, current,
  711. *msgtyp, mode)) {
  712. if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
  713. *msgtyp = msg->m_type - 1;
  714. found = msg;
  715. } else if (mode == SEARCH_NUMBER) {
  716. if (*msgtyp == count)
  717. return msg;
  718. } else
  719. return msg;
  720. count++;
  721. }
  722. }
  723. return found ?: ERR_PTR(-EAGAIN);
  724. }
  725. long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgflg,
  726. long (*msg_handler)(void __user *, struct msg_msg *, size_t))
  727. {
  728. int mode;
  729. struct msg_queue *msq;
  730. struct ipc_namespace *ns;
  731. struct msg_msg *msg, *copy = NULL;
  732. ns = current->nsproxy->ipc_ns;
  733. if (msqid < 0 || (long) bufsz < 0)
  734. return -EINVAL;
  735. if (msgflg & MSG_COPY) {
  736. copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
  737. if (IS_ERR(copy))
  738. return PTR_ERR(copy);
  739. }
  740. mode = convert_mode(&msgtyp, msgflg);
  741. rcu_read_lock();
  742. msq = msq_obtain_object_check(ns, msqid);
  743. if (IS_ERR(msq)) {
  744. rcu_read_unlock();
  745. free_copy(copy);
  746. return PTR_ERR(msq);
  747. }
  748. for (;;) {
  749. struct msg_receiver msr_d;
  750. msg = ERR_PTR(-EACCES);
  751. if (ipcperms(ns, &msq->q_perm, S_IRUGO))
  752. goto out_unlock1;
  753. ipc_lock_object(&msq->q_perm);
  754. msg = find_msg(msq, &msgtyp, mode);
  755. if (!IS_ERR(msg)) {
  756. /*
  757. * Found a suitable message.
  758. * Unlink it from the queue.
  759. */
  760. if ((bufsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
  761. msg = ERR_PTR(-E2BIG);
  762. goto out_unlock0;
  763. }
  764. /*
  765. * If we are copying, then do not unlink message and do
  766. * not update queue parameters.
  767. */
  768. if (msgflg & MSG_COPY) {
  769. msg = copy_msg(msg, copy);
  770. goto out_unlock0;
  771. }
  772. list_del(&msg->m_list);
  773. msq->q_qnum--;
  774. msq->q_rtime = get_seconds();
  775. msq->q_lrpid = task_tgid_vnr(current);
  776. msq->q_cbytes -= msg->m_ts;
  777. atomic_sub(msg->m_ts, &ns->msg_bytes);
  778. atomic_dec(&ns->msg_hdrs);
  779. ss_wakeup(&msq->q_senders, 0);
  780. goto out_unlock0;
  781. }
  782. /* No message waiting. Wait for a message */
  783. if (msgflg & IPC_NOWAIT) {
  784. msg = ERR_PTR(-ENOMSG);
  785. goto out_unlock0;
  786. }
  787. list_add_tail(&msr_d.r_list, &msq->q_receivers);
  788. msr_d.r_tsk = current;
  789. msr_d.r_msgtype = msgtyp;
  790. msr_d.r_mode = mode;
  791. if (msgflg & MSG_NOERROR)
  792. msr_d.r_maxsize = INT_MAX;
  793. else
  794. msr_d.r_maxsize = bufsz;
  795. msr_d.r_msg = ERR_PTR(-EAGAIN);
  796. current->state = TASK_INTERRUPTIBLE;
  797. ipc_unlock_object(&msq->q_perm);
  798. rcu_read_unlock();
  799. schedule();
  800. /* Lockless receive, part 1:
  801. * Disable preemption. We don't hold a reference to the queue
  802. * and getting a reference would defeat the idea of a lockless
  803. * operation, thus the code relies on rcu to guarantee the
  804. * existence of msq:
  805. * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
  806. * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
  807. * rcu_read_lock() prevents preemption between reading r_msg
  808. * and acquiring the q_perm.lock in ipc_lock_object().
  809. */
  810. rcu_read_lock();
  811. /* Lockless receive, part 2:
  812. * Wait until pipelined_send or expunge_all are outside of
  813. * wake_up_process(). There is a race with exit(), see
  814. * ipc/mqueue.c for the details.
  815. */
  816. msg = (struct msg_msg*)msr_d.r_msg;
  817. while (msg == NULL) {
  818. cpu_relax();
  819. msg = (struct msg_msg *)msr_d.r_msg;
  820. }
  821. /* Lockless receive, part 3:
  822. * If there is a message or an error then accept it without
  823. * locking.
  824. */
  825. if (msg != ERR_PTR(-EAGAIN))
  826. goto out_unlock1;
  827. /* Lockless receive, part 3:
  828. * Acquire the queue spinlock.
  829. */
  830. ipc_lock_object(&msq->q_perm);
  831. /* Lockless receive, part 4:
  832. * Repeat test after acquiring the spinlock.
  833. */
  834. msg = (struct msg_msg*)msr_d.r_msg;
  835. if (msg != ERR_PTR(-EAGAIN))
  836. goto out_unlock0;
  837. list_del(&msr_d.r_list);
  838. if (signal_pending(current)) {
  839. msg = ERR_PTR(-ERESTARTNOHAND);
  840. goto out_unlock0;
  841. }
  842. ipc_unlock_object(&msq->q_perm);
  843. }
  844. out_unlock0:
  845. ipc_unlock_object(&msq->q_perm);
  846. out_unlock1:
  847. rcu_read_unlock();
  848. if (IS_ERR(msg)) {
  849. free_copy(copy);
  850. return PTR_ERR(msg);
  851. }
  852. bufsz = msg_handler(buf, msg, bufsz);
  853. free_msg(msg);
  854. return bufsz;
  855. }
  856. SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
  857. long, msgtyp, int, msgflg)
  858. {
  859. return do_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg, do_msg_fill);
  860. }
  861. #ifdef CONFIG_PROC_FS
  862. static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
  863. {
  864. struct user_namespace *user_ns = seq_user_ns(s);
  865. struct msg_queue *msq = it;
  866. return seq_printf(s,
  867. "%10d %10d %4o %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
  868. msq->q_perm.key,
  869. msq->q_perm.id,
  870. msq->q_perm.mode,
  871. msq->q_cbytes,
  872. msq->q_qnum,
  873. msq->q_lspid,
  874. msq->q_lrpid,
  875. from_kuid_munged(user_ns, msq->q_perm.uid),
  876. from_kgid_munged(user_ns, msq->q_perm.gid),
  877. from_kuid_munged(user_ns, msq->q_perm.cuid),
  878. from_kgid_munged(user_ns, msq->q_perm.cgid),
  879. msq->q_stime,
  880. msq->q_rtime,
  881. msq->q_ctime);
  882. }
  883. #endif