1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * linux/ipc/msg.c 4 * Copyright (C) 1992 Krishna Balasubramanian 5 * 6 * Removed all the remaining kerneld mess 7 * Catch the -EFAULT stuff properly 8 * Use GFP_KERNEL for messages as in 1.2 9 * Fixed up the unchecked user space derefs 10 * Copyright (C) 1998 Alan Cox & Andi Kleen 11 * 12 * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com> 13 * 14 * mostly rewritten, threaded and wake-one semantics added 15 * MSGMAX limit removed, sysctl's added 16 * (c) 1999 Manfred Spraul <manfred@colorfullife.com> 17 * 18 * support for audit of ipc object properties and permission changes 19 * Dustin Kirkland <dustin.kirkland@us.ibm.com> 20 * 21 * namespaces support 22 * OpenVZ, SWsoft Inc. 23 * Pavel Emelianov <xemul@openvz.org> 24 */ 25 26 #include <linux/capability.h> 27 #include <linux/msg.h> 28 #include <linux/spinlock.h> 29 #include <linux/init.h> 30 #include <linux/mm.h> 31 #include <linux/proc_fs.h> 32 #include <linux/list.h> 33 #include <linux/security.h> 34 #include <linux/sched/wake_q.h> 35 #include <linux/syscalls.h> 36 #include <linux/audit.h> 37 #include <linux/seq_file.h> 38 #include <linux/rwsem.h> 39 #include <linux/nsproxy.h> 40 #include <linux/ipc_namespace.h> 41 42 #include <asm/current.h> 43 #include <linux/uaccess.h> 44 #include "util.h" 45 46 /* one msg_receiver structure for each sleeping receiver */ 47 struct msg_receiver { 48 struct list_head r_list; 49 struct task_struct *r_tsk; 50 51 int r_mode; 52 long r_msgtype; 53 long r_maxsize; 54 55 struct msg_msg *r_msg; 56 }; 57 58 /* one msg_sender for each sleeping sender */ 59 struct msg_sender { 60 struct list_head list; 61 struct task_struct *tsk; 62 size_t msgsz; 63 }; 64 65 #define SEARCH_ANY 1 66 #define SEARCH_EQUAL 2 67 #define SEARCH_NOTEQUAL 3 68 #define SEARCH_LESSEQUAL 4 69 #define SEARCH_NUMBER 5 70 71 #define msg_ids(ns) ((ns)->ids[IPC_MSG_IDS]) 72 73 static inline struct msg_queue *msq_obtain_object(struct ipc_namespace *ns, int id) 74 { 75 struct kern_ipc_perm *ipcp = ipc_obtain_object_idr(&msg_ids(ns), id); 76 77 if (IS_ERR(ipcp)) 78 return ERR_CAST(ipcp); 79 80 return container_of(ipcp, struct msg_queue, q_perm); 81 } 82 83 static inline struct msg_queue *msq_obtain_object_check(struct ipc_namespace *ns, 84 int id) 85 { 86 struct kern_ipc_perm *ipcp = ipc_obtain_object_check(&msg_ids(ns), id); 87 88 if (IS_ERR(ipcp)) 89 return ERR_CAST(ipcp); 90 91 return container_of(ipcp, struct msg_queue, q_perm); 92 } 93 94 static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s) 95 { 96 ipc_rmid(&msg_ids(ns), &s->q_perm); 97 } 98 99 static void msg_rcu_free(struct rcu_head *head) 100 { 101 struct kern_ipc_perm *p = container_of(head, struct kern_ipc_perm, rcu); 102 struct msg_queue *msq = container_of(p, struct msg_queue, q_perm); 103 104 security_msg_queue_free(msq); 105 kvfree(msq); 106 } 107 108 /** 109 * newque - Create a new msg queue 110 * @ns: namespace 111 * @params: ptr to the structure that contains the key and msgflg 112 * 113 * Called with msg_ids.rwsem held (writer) 114 */ 115 static int newque(struct ipc_namespace *ns, struct ipc_params *params) 116 { 117 struct msg_queue *msq; 118 int retval; 119 key_t key = params->key; 120 int msgflg = params->flg; 121 122 msq = kvmalloc(sizeof(*msq), GFP_KERNEL); 123 if (unlikely(!msq)) 124 return -ENOMEM; 125 126 msq->q_perm.mode = msgflg & S_IRWXUGO; 127 msq->q_perm.key = key; 128 129 msq->q_perm.security = NULL; 130 retval = security_msg_queue_alloc(msq); 131 if (retval) { 132 kvfree(msq); 133 return retval; 134 } 135 136 msq->q_stime = msq->q_rtime = 0; 137 msq->q_ctime = ktime_get_real_seconds(); 138 msq->q_cbytes = msq->q_qnum = 0; 139 msq->q_qbytes = ns->msg_ctlmnb; 140 msq->q_lspid = msq->q_lrpid = 0; 141 INIT_LIST_HEAD(&msq->q_messages); 142 INIT_LIST_HEAD(&msq->q_receivers); 143 INIT_LIST_HEAD(&msq->q_senders); 144 145 /* ipc_addid() locks msq upon success. */ 146 retval = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni); 147 if (retval < 0) { 148 call_rcu(&msq->q_perm.rcu, msg_rcu_free); 149 return retval; 150 } 151 152 ipc_unlock_object(&msq->q_perm); 153 rcu_read_unlock(); 154 155 return msq->q_perm.id; 156 } 157 158 static inline bool msg_fits_inqueue(struct msg_queue *msq, size_t msgsz) 159 { 160 return msgsz + msq->q_cbytes <= msq->q_qbytes && 161 1 + msq->q_qnum <= msq->q_qbytes; 162 } 163 164 static inline void ss_add(struct msg_queue *msq, 165 struct msg_sender *mss, size_t msgsz) 166 { 167 mss->tsk = current; 168 mss->msgsz = msgsz; 169 __set_current_state(TASK_INTERRUPTIBLE); 170 list_add_tail(&mss->list, &msq->q_senders); 171 } 172 173 static inline void ss_del(struct msg_sender *mss) 174 { 175 if (mss->list.next) 176 list_del(&mss->list); 177 } 178 179 static void ss_wakeup(struct msg_queue *msq, 180 struct wake_q_head *wake_q, bool kill) 181 { 182 struct msg_sender *mss, *t; 183 struct task_struct *stop_tsk = NULL; 184 struct list_head *h = &msq->q_senders; 185 186 list_for_each_entry_safe(mss, t, h, list) { 187 if (kill) 188 mss->list.next = NULL; 189 190 /* 191 * Stop at the first task we don't wakeup, 192 * we've already iterated the original 193 * sender queue. 194 */ 195 else if (stop_tsk == mss->tsk) 196 break; 197 /* 198 * We are not in an EIDRM scenario here, therefore 199 * verify that we really need to wakeup the task. 200 * To maintain current semantics and wakeup order, 201 * move the sender to the tail on behalf of the 202 * blocked task. 203 */ 204 else if (!msg_fits_inqueue(msq, mss->msgsz)) { 205 if (!stop_tsk) 206 stop_tsk = mss->tsk; 207 208 list_move_tail(&mss->list, &msq->q_senders); 209 continue; 210 } 211 212 wake_q_add(wake_q, mss->tsk); 213 } 214 } 215 216 static void expunge_all(struct msg_queue *msq, int res, 217 struct wake_q_head *wake_q) 218 { 219 struct msg_receiver *msr, *t; 220 221 list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) { 222 wake_q_add(wake_q, msr->r_tsk); 223 WRITE_ONCE(msr->r_msg, ERR_PTR(res)); 224 } 225 } 226 227 /* 228 * freeque() wakes up waiters on the sender and receiver waiting queue, 229 * removes the message queue from message queue ID IDR, and cleans up all the 230 * messages associated with this queue. 231 * 232 * msg_ids.rwsem (writer) and the spinlock for this message queue are held 233 * before freeque() is called. msg_ids.rwsem remains locked on exit. 234 */ 235 static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp) 236 { 237 struct msg_msg *msg, *t; 238 struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm); 239 DEFINE_WAKE_Q(wake_q); 240 241 expunge_all(msq, -EIDRM, &wake_q); 242 ss_wakeup(msq, &wake_q, true); 243 msg_rmid(ns, msq); 244 ipc_unlock_object(&msq->q_perm); 245 wake_up_q(&wake_q); 246 rcu_read_unlock(); 247 248 list_for_each_entry_safe(msg, t, &msq->q_messages, m_list) { 249 atomic_dec(&ns->msg_hdrs); 250 free_msg(msg); 251 } 252 atomic_sub(msq->q_cbytes, &ns->msg_bytes); 253 ipc_rcu_putref(&msq->q_perm, msg_rcu_free); 254 } 255 256 /* 257 * Called with msg_ids.rwsem and ipcp locked. 258 */ 259 static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg) 260 { 261 struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm); 262 263 return security_msg_queue_associate(msq, msgflg); 264 } 265 266 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg) 267 { 268 struct ipc_namespace *ns; 269 static const struct ipc_ops msg_ops = { 270 .getnew = newque, 271 .associate = msg_security, 272 }; 273 struct ipc_params msg_params; 274 275 ns = current->nsproxy->ipc_ns; 276 277 msg_params.key = key; 278 msg_params.flg = msgflg; 279 280 return ipcget(ns, &msg_ids(ns), &msg_ops, &msg_params); 281 } 282 283 static inline unsigned long 284 copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version) 285 { 286 switch (version) { 287 case IPC_64: 288 return copy_to_user(buf, in, sizeof(*in)); 289 case IPC_OLD: 290 { 291 struct msqid_ds out; 292 293 memset(&out, 0, sizeof(out)); 294 295 ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm); 296 297 out.msg_stime = in->msg_stime; 298 out.msg_rtime = in->msg_rtime; 299 out.msg_ctime = in->msg_ctime; 300 301 if (in->msg_cbytes > USHRT_MAX) 302 out.msg_cbytes = USHRT_MAX; 303 else 304 out.msg_cbytes = in->msg_cbytes; 305 out.msg_lcbytes = in->msg_cbytes; 306 307 if (in->msg_qnum > USHRT_MAX) 308 out.msg_qnum = USHRT_MAX; 309 else 310 out.msg_qnum = in->msg_qnum; 311 312 if (in->msg_qbytes > USHRT_MAX) 313 out.msg_qbytes = USHRT_MAX; 314 else 315 out.msg_qbytes = in->msg_qbytes; 316 out.msg_lqbytes = in->msg_qbytes; 317 318 out.msg_lspid = in->msg_lspid; 319 out.msg_lrpid = in->msg_lrpid; 320 321 return copy_to_user(buf, &out, sizeof(out)); 322 } 323 default: 324 return -EINVAL; 325 } 326 } 327 328 static inline unsigned long 329 copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version) 330 { 331 switch (version) { 332 case IPC_64: 333 if (copy_from_user(out, buf, sizeof(*out))) 334 return -EFAULT; 335 return 0; 336 case IPC_OLD: 337 { 338 struct msqid_ds tbuf_old; 339 340 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old))) 341 return -EFAULT; 342 343 out->msg_perm.uid = tbuf_old.msg_perm.uid; 344 out->msg_perm.gid = tbuf_old.msg_perm.gid; 345 out->msg_perm.mode = tbuf_old.msg_perm.mode; 346 347 if (tbuf_old.msg_qbytes == 0) 348 out->msg_qbytes = tbuf_old.msg_lqbytes; 349 else 350 out->msg_qbytes = tbuf_old.msg_qbytes; 351 352 return 0; 353 } 354 default: 355 return -EINVAL; 356 } 357 } 358 359 /* 360 * This function handles some msgctl commands which require the rwsem 361 * to be held in write mode. 362 * NOTE: no locks must be held, the rwsem is taken inside this function. 363 */ 364 static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd, 365 struct msqid64_ds *msqid64) 366 { 367 struct kern_ipc_perm *ipcp; 368 struct msg_queue *msq; 369 int err; 370 371 down_write(&msg_ids(ns).rwsem); 372 rcu_read_lock(); 373 374 ipcp = ipcctl_pre_down_nolock(ns, &msg_ids(ns), msqid, cmd, 375 &msqid64->msg_perm, msqid64->msg_qbytes); 376 if (IS_ERR(ipcp)) { 377 err = PTR_ERR(ipcp); 378 goto out_unlock1; 379 } 380 381 msq = container_of(ipcp, struct msg_queue, q_perm); 382 383 err = security_msg_queue_msgctl(msq, cmd); 384 if (err) 385 goto out_unlock1; 386 387 switch (cmd) { 388 case IPC_RMID: 389 ipc_lock_object(&msq->q_perm); 390 /* freeque unlocks the ipc object and rcu */ 391 freeque(ns, ipcp); 392 goto out_up; 393 case IPC_SET: 394 { 395 DEFINE_WAKE_Q(wake_q); 396 397 if (msqid64->msg_qbytes > ns->msg_ctlmnb && 398 !capable(CAP_SYS_RESOURCE)) { 399 err = -EPERM; 400 goto out_unlock1; 401 } 402 403 ipc_lock_object(&msq->q_perm); 404 err = ipc_update_perm(&msqid64->msg_perm, ipcp); 405 if (err) 406 goto out_unlock0; 407 408 msq->q_qbytes = msqid64->msg_qbytes; 409 410 msq->q_ctime = ktime_get_real_seconds(); 411 /* 412 * Sleeping receivers might be excluded by 413 * stricter permissions. 414 */ 415 expunge_all(msq, -EAGAIN, &wake_q); 416 /* 417 * Sleeping senders might be able to send 418 * due to a larger queue size. 419 */ 420 ss_wakeup(msq, &wake_q, false); 421 ipc_unlock_object(&msq->q_perm); 422 wake_up_q(&wake_q); 423 424 goto out_unlock1; 425 } 426 default: 427 err = -EINVAL; 428 goto out_unlock1; 429 } 430 431 out_unlock0: 432 ipc_unlock_object(&msq->q_perm); 433 out_unlock1: 434 rcu_read_unlock(); 435 out_up: 436 up_write(&msg_ids(ns).rwsem); 437 return err; 438 } 439 440 static int msgctl_info(struct ipc_namespace *ns, int msqid, 441 int cmd, struct msginfo *msginfo) 442 { 443 int err; 444 int max_id; 445 446 /* 447 * We must not return kernel stack data. 448 * due to padding, it's not enough 449 * to set all member fields. 450 */ 451 err = security_msg_queue_msgctl(NULL, cmd); 452 if (err) 453 return err; 454 455 memset(msginfo, 0, sizeof(*msginfo)); 456 msginfo->msgmni = ns->msg_ctlmni; 457 msginfo->msgmax = ns->msg_ctlmax; 458 msginfo->msgmnb = ns->msg_ctlmnb; 459 msginfo->msgssz = MSGSSZ; 460 msginfo->msgseg = MSGSEG; 461 down_read(&msg_ids(ns).rwsem); 462 if (cmd == MSG_INFO) { 463 msginfo->msgpool = msg_ids(ns).in_use; 464 msginfo->msgmap = atomic_read(&ns->msg_hdrs); 465 msginfo->msgtql = atomic_read(&ns->msg_bytes); 466 } else { 467 msginfo->msgmap = MSGMAP; 468 msginfo->msgpool = MSGPOOL; 469 msginfo->msgtql = MSGTQL; 470 } 471 max_id = ipc_get_maxid(&msg_ids(ns)); 472 up_read(&msg_ids(ns).rwsem); 473 return (max_id < 0) ? 0 : max_id; 474 } 475 476 static int msgctl_stat(struct ipc_namespace *ns, int msqid, 477 int cmd, struct msqid64_ds *p) 478 { 479 struct msg_queue *msq; 480 int id = 0; 481 int err; 482 483 memset(p, 0, sizeof(*p)); 484 485 rcu_read_lock(); 486 if (cmd == MSG_STAT) { 487 msq = msq_obtain_object(ns, msqid); 488 if (IS_ERR(msq)) { 489 err = PTR_ERR(msq); 490 goto out_unlock; 491 } 492 id = msq->q_perm.id; 493 } else { 494 msq = msq_obtain_object_check(ns, msqid); 495 if (IS_ERR(msq)) { 496 err = PTR_ERR(msq); 497 goto out_unlock; 498 } 499 } 500 501 err = -EACCES; 502 if (ipcperms(ns, &msq->q_perm, S_IRUGO)) 503 goto out_unlock; 504 505 err = security_msg_queue_msgctl(msq, cmd); 506 if (err) 507 goto out_unlock; 508 509 ipc_lock_object(&msq->q_perm); 510 511 if (!ipc_valid_object(&msq->q_perm)) { 512 ipc_unlock_object(&msq->q_perm); 513 err = -EIDRM; 514 goto out_unlock; 515 } 516 517 kernel_to_ipc64_perm(&msq->q_perm, &p->msg_perm); 518 p->msg_stime = msq->q_stime; 519 p->msg_rtime = msq->q_rtime; 520 p->msg_ctime = msq->q_ctime; 521 p->msg_cbytes = msq->q_cbytes; 522 p->msg_qnum = msq->q_qnum; 523 p->msg_qbytes = msq->q_qbytes; 524 p->msg_lspid = msq->q_lspid; 525 p->msg_lrpid = msq->q_lrpid; 526 527 ipc_unlock_object(&msq->q_perm); 528 rcu_read_unlock(); 529 return id; 530 531 out_unlock: 532 rcu_read_unlock(); 533 return err; 534 } 535 536 SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf) 537 { 538 int version; 539 struct ipc_namespace *ns; 540 struct msqid64_ds msqid64; 541 int err; 542 543 if (msqid < 0 || cmd < 0) 544 return -EINVAL; 545 546 version = ipc_parse_version(&cmd); 547 ns = current->nsproxy->ipc_ns; 548 549 switch (cmd) { 550 case IPC_INFO: 551 case MSG_INFO: { 552 struct msginfo msginfo; 553 err = msgctl_info(ns, msqid, cmd, &msginfo); 554 if (err < 0) 555 return err; 556 if (copy_to_user(buf, &msginfo, sizeof(struct msginfo))) 557 err = -EFAULT; 558 return err; 559 } 560 case MSG_STAT: /* msqid is an index rather than a msg queue id */ 561 case IPC_STAT: 562 err = msgctl_stat(ns, msqid, cmd, &msqid64); 563 if (err < 0) 564 return err; 565 if (copy_msqid_to_user(buf, &msqid64, version)) 566 err = -EFAULT; 567 return err; 568 case IPC_SET: 569 if (copy_msqid_from_user(&msqid64, buf, version)) 570 return -EFAULT; 571 /* fallthru */ 572 case IPC_RMID: 573 return msgctl_down(ns, msqid, cmd, &msqid64); 574 default: 575 return -EINVAL; 576 } 577 } 578 579 #ifdef CONFIG_COMPAT 580 581 struct compat_msqid_ds { 582 struct compat_ipc_perm msg_perm; 583 compat_uptr_t msg_first; 584 compat_uptr_t msg_last; 585 compat_time_t msg_stime; 586 compat_time_t msg_rtime; 587 compat_time_t msg_ctime; 588 compat_ulong_t msg_lcbytes; 589 compat_ulong_t msg_lqbytes; 590 unsigned short msg_cbytes; 591 unsigned short msg_qnum; 592 unsigned short msg_qbytes; 593 compat_ipc_pid_t msg_lspid; 594 compat_ipc_pid_t msg_lrpid; 595 }; 596 597 static int copy_compat_msqid_from_user(struct msqid64_ds *out, void __user *buf, 598 int version) 599 { 600 memset(out, 0, sizeof(*out)); 601 if (version == IPC_64) { 602 struct compat_msqid64_ds __user *p = buf; 603 if (get_compat_ipc64_perm(&out->msg_perm, &p->msg_perm)) 604 return -EFAULT; 605 if (get_user(out->msg_qbytes, &p->msg_qbytes)) 606 return -EFAULT; 607 } else { 608 struct compat_msqid_ds __user *p = buf; 609 if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm)) 610 return -EFAULT; 611 if (get_user(out->msg_qbytes, &p->msg_qbytes)) 612 return -EFAULT; 613 } 614 return 0; 615 } 616 617 static int copy_compat_msqid_to_user(void __user *buf, struct msqid64_ds *in, 618 int version) 619 { 620 if (version == IPC_64) { 621 struct compat_msqid64_ds v; 622 memset(&v, 0, sizeof(v)); 623 to_compat_ipc64_perm(&v.msg_perm, &in->msg_perm); 624 v.msg_stime = in->msg_stime; 625 v.msg_rtime = in->msg_rtime; 626 v.msg_ctime = in->msg_ctime; 627 v.msg_cbytes = in->msg_cbytes; 628 v.msg_qnum = in->msg_qnum; 629 v.msg_qbytes = in->msg_qbytes; 630 v.msg_lspid = in->msg_lspid; 631 v.msg_lrpid = in->msg_lrpid; 632 return copy_to_user(buf, &v, sizeof(v)); 633 } else { 634 struct compat_msqid_ds v; 635 memset(&v, 0, sizeof(v)); 636 to_compat_ipc_perm(&v.msg_perm, &in->msg_perm); 637 v.msg_stime = in->msg_stime; 638 v.msg_rtime = in->msg_rtime; 639 v.msg_ctime = in->msg_ctime; 640 v.msg_cbytes = in->msg_cbytes; 641 v.msg_qnum = in->msg_qnum; 642 v.msg_qbytes = in->msg_qbytes; 643 v.msg_lspid = in->msg_lspid; 644 v.msg_lrpid = in->msg_lrpid; 645 return copy_to_user(buf, &v, sizeof(v)); 646 } 647 } 648 649 COMPAT_SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, void __user *, uptr) 650 { 651 struct ipc_namespace *ns; 652 int err; 653 struct msqid64_ds msqid64; 654 int version = compat_ipc_parse_version(&cmd); 655 656 ns = current->nsproxy->ipc_ns; 657 658 if (msqid < 0 || cmd < 0) 659 return -EINVAL; 660 661 switch (cmd & (~IPC_64)) { 662 case IPC_INFO: 663 case MSG_INFO: { 664 struct msginfo msginfo; 665 err = msgctl_info(ns, msqid, cmd, &msginfo); 666 if (err < 0) 667 return err; 668 if (copy_to_user(uptr, &msginfo, sizeof(struct msginfo))) 669 err = -EFAULT; 670 return err; 671 } 672 case IPC_STAT: 673 case MSG_STAT: 674 err = msgctl_stat(ns, msqid, cmd, &msqid64); 675 if (err < 0) 676 return err; 677 if (copy_compat_msqid_to_user(uptr, &msqid64, version)) 678 err = -EFAULT; 679 return err; 680 case IPC_SET: 681 if (copy_compat_msqid_from_user(&msqid64, uptr, version)) 682 return -EFAULT; 683 /* fallthru */ 684 case IPC_RMID: 685 return msgctl_down(ns, msqid, cmd, &msqid64); 686 default: 687 return -EINVAL; 688 } 689 } 690 #endif 691 692 static int testmsg(struct msg_msg *msg, long type, int mode) 693 { 694 switch (mode) { 695 case SEARCH_ANY: 696 case SEARCH_NUMBER: 697 return 1; 698 case SEARCH_LESSEQUAL: 699 if (msg->m_type <= type) 700 return 1; 701 break; 702 case SEARCH_EQUAL: 703 if (msg->m_type == type) 704 return 1; 705 break; 706 case SEARCH_NOTEQUAL: 707 if (msg->m_type != type) 708 return 1; 709 break; 710 } 711 return 0; 712 } 713 714 static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg, 715 struct wake_q_head *wake_q) 716 { 717 struct msg_receiver *msr, *t; 718 719 list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) { 720 if (testmsg(msg, msr->r_msgtype, msr->r_mode) && 721 !security_msg_queue_msgrcv(msq, msg, msr->r_tsk, 722 msr->r_msgtype, msr->r_mode)) { 723 724 list_del(&msr->r_list); 725 if (msr->r_maxsize < msg->m_ts) { 726 wake_q_add(wake_q, msr->r_tsk); 727 WRITE_ONCE(msr->r_msg, ERR_PTR(-E2BIG)); 728 } else { 729 msq->q_lrpid = task_pid_vnr(msr->r_tsk); 730 msq->q_rtime = get_seconds(); 731 732 wake_q_add(wake_q, msr->r_tsk); 733 WRITE_ONCE(msr->r_msg, msg); 734 return 1; 735 } 736 } 737 } 738 739 return 0; 740 } 741 742 static long do_msgsnd(int msqid, long mtype, void __user *mtext, 743 size_t msgsz, int msgflg) 744 { 745 struct msg_queue *msq; 746 struct msg_msg *msg; 747 int err; 748 struct ipc_namespace *ns; 749 DEFINE_WAKE_Q(wake_q); 750 751 ns = current->nsproxy->ipc_ns; 752 753 if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0) 754 return -EINVAL; 755 if (mtype < 1) 756 return -EINVAL; 757 758 msg = load_msg(mtext, msgsz); 759 if (IS_ERR(msg)) 760 return PTR_ERR(msg); 761 762 msg->m_type = mtype; 763 msg->m_ts = msgsz; 764 765 rcu_read_lock(); 766 msq = msq_obtain_object_check(ns, msqid); 767 if (IS_ERR(msq)) { 768 err = PTR_ERR(msq); 769 goto out_unlock1; 770 } 771 772 ipc_lock_object(&msq->q_perm); 773 774 for (;;) { 775 struct msg_sender s; 776 777 err = -EACCES; 778 if (ipcperms(ns, &msq->q_perm, S_IWUGO)) 779 goto out_unlock0; 780 781 /* raced with RMID? */ 782 if (!ipc_valid_object(&msq->q_perm)) { 783 err = -EIDRM; 784 goto out_unlock0; 785 } 786 787 err = security_msg_queue_msgsnd(msq, msg, msgflg); 788 if (err) 789 goto out_unlock0; 790 791 if (msg_fits_inqueue(msq, msgsz)) 792 break; 793 794 /* queue full, wait: */ 795 if (msgflg & IPC_NOWAIT) { 796 err = -EAGAIN; 797 goto out_unlock0; 798 } 799 800 /* enqueue the sender and prepare to block */ 801 ss_add(msq, &s, msgsz); 802 803 if (!ipc_rcu_getref(&msq->q_perm)) { 804 err = -EIDRM; 805 goto out_unlock0; 806 } 807 808 ipc_unlock_object(&msq->q_perm); 809 rcu_read_unlock(); 810 schedule(); 811 812 rcu_read_lock(); 813 ipc_lock_object(&msq->q_perm); 814 815 ipc_rcu_putref(&msq->q_perm, msg_rcu_free); 816 /* raced with RMID? */ 817 if (!ipc_valid_object(&msq->q_perm)) { 818 err = -EIDRM; 819 goto out_unlock0; 820 } 821 ss_del(&s); 822 823 if (signal_pending(current)) { 824 err = -ERESTARTNOHAND; 825 goto out_unlock0; 826 } 827 828 } 829 830 msq->q_lspid = task_tgid_vnr(current); 831 msq->q_stime = get_seconds(); 832 833 if (!pipelined_send(msq, msg, &wake_q)) { 834 /* no one is waiting for this message, enqueue it */ 835 list_add_tail(&msg->m_list, &msq->q_messages); 836 msq->q_cbytes += msgsz; 837 msq->q_qnum++; 838 atomic_add(msgsz, &ns->msg_bytes); 839 atomic_inc(&ns->msg_hdrs); 840 } 841 842 err = 0; 843 msg = NULL; 844 845 out_unlock0: 846 ipc_unlock_object(&msq->q_perm); 847 wake_up_q(&wake_q); 848 out_unlock1: 849 rcu_read_unlock(); 850 if (msg != NULL) 851 free_msg(msg); 852 return err; 853 } 854 855 SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz, 856 int, msgflg) 857 { 858 long mtype; 859 860 if (get_user(mtype, &msgp->mtype)) 861 return -EFAULT; 862 return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg); 863 } 864 865 #ifdef CONFIG_COMPAT 866 867 struct compat_msgbuf { 868 compat_long_t mtype; 869 char mtext[1]; 870 }; 871 872 COMPAT_SYSCALL_DEFINE4(msgsnd, int, msqid, compat_uptr_t, msgp, 873 compat_ssize_t, msgsz, int, msgflg) 874 { 875 struct compat_msgbuf __user *up = compat_ptr(msgp); 876 compat_long_t mtype; 877 878 if (get_user(mtype, &up->mtype)) 879 return -EFAULT; 880 return do_msgsnd(msqid, mtype, up->mtext, (ssize_t)msgsz, msgflg); 881 } 882 #endif 883 884 static inline int convert_mode(long *msgtyp, int msgflg) 885 { 886 if (msgflg & MSG_COPY) 887 return SEARCH_NUMBER; 888 /* 889 * find message of correct type. 890 * msgtyp = 0 => get first. 891 * msgtyp > 0 => get first message of matching type. 892 * msgtyp < 0 => get message with least type must be < abs(msgtype). 893 */ 894 if (*msgtyp == 0) 895 return SEARCH_ANY; 896 if (*msgtyp < 0) { 897 if (*msgtyp == LONG_MIN) /* -LONG_MIN is undefined */ 898 *msgtyp = LONG_MAX; 899 else 900 *msgtyp = -*msgtyp; 901 return SEARCH_LESSEQUAL; 902 } 903 if (msgflg & MSG_EXCEPT) 904 return SEARCH_NOTEQUAL; 905 return SEARCH_EQUAL; 906 } 907 908 static long do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz) 909 { 910 struct msgbuf __user *msgp = dest; 911 size_t msgsz; 912 913 if (put_user(msg->m_type, &msgp->mtype)) 914 return -EFAULT; 915 916 msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz; 917 if (store_msg(msgp->mtext, msg, msgsz)) 918 return -EFAULT; 919 return msgsz; 920 } 921 922 #ifdef CONFIG_CHECKPOINT_RESTORE 923 /* 924 * This function creates new kernel message structure, large enough to store 925 * bufsz message bytes. 926 */ 927 static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz) 928 { 929 struct msg_msg *copy; 930 931 /* 932 * Create dummy message to copy real message to. 933 */ 934 copy = load_msg(buf, bufsz); 935 if (!IS_ERR(copy)) 936 copy->m_ts = bufsz; 937 return copy; 938 } 939 940 static inline void free_copy(struct msg_msg *copy) 941 { 942 if (copy) 943 free_msg(copy); 944 } 945 #else 946 static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz) 947 { 948 return ERR_PTR(-ENOSYS); 949 } 950 951 static inline void free_copy(struct msg_msg *copy) 952 { 953 } 954 #endif 955 956 static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode) 957 { 958 struct msg_msg *msg, *found = NULL; 959 long count = 0; 960 961 list_for_each_entry(msg, &msq->q_messages, m_list) { 962 if (testmsg(msg, *msgtyp, mode) && 963 !security_msg_queue_msgrcv(msq, msg, current, 964 *msgtyp, mode)) { 965 if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) { 966 *msgtyp = msg->m_type - 1; 967 found = msg; 968 } else if (mode == SEARCH_NUMBER) { 969 if (*msgtyp == count) 970 return msg; 971 } else 972 return msg; 973 count++; 974 } 975 } 976 977 return found ?: ERR_PTR(-EAGAIN); 978 } 979 980 static long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgflg, 981 long (*msg_handler)(void __user *, struct msg_msg *, size_t)) 982 { 983 int mode; 984 struct msg_queue *msq; 985 struct ipc_namespace *ns; 986 struct msg_msg *msg, *copy = NULL; 987 DEFINE_WAKE_Q(wake_q); 988 989 ns = current->nsproxy->ipc_ns; 990 991 if (msqid < 0 || (long) bufsz < 0) 992 return -EINVAL; 993 994 if (msgflg & MSG_COPY) { 995 if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT)) 996 return -EINVAL; 997 copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax)); 998 if (IS_ERR(copy)) 999 return PTR_ERR(copy); 1000 } 1001 mode = convert_mode(&msgtyp, msgflg); 1002 1003 rcu_read_lock(); 1004 msq = msq_obtain_object_check(ns, msqid); 1005 if (IS_ERR(msq)) { 1006 rcu_read_unlock(); 1007 free_copy(copy); 1008 return PTR_ERR(msq); 1009 } 1010 1011 for (;;) { 1012 struct msg_receiver msr_d; 1013 1014 msg = ERR_PTR(-EACCES); 1015 if (ipcperms(ns, &msq->q_perm, S_IRUGO)) 1016 goto out_unlock1; 1017 1018 ipc_lock_object(&msq->q_perm); 1019 1020 /* raced with RMID? */ 1021 if (!ipc_valid_object(&msq->q_perm)) { 1022 msg = ERR_PTR(-EIDRM); 1023 goto out_unlock0; 1024 } 1025 1026 msg = find_msg(msq, &msgtyp, mode); 1027 if (!IS_ERR(msg)) { 1028 /* 1029 * Found a suitable message. 1030 * Unlink it from the queue. 1031 */ 1032 if ((bufsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) { 1033 msg = ERR_PTR(-E2BIG); 1034 goto out_unlock0; 1035 } 1036 /* 1037 * If we are copying, then do not unlink message and do 1038 * not update queue parameters. 1039 */ 1040 if (msgflg & MSG_COPY) { 1041 msg = copy_msg(msg, copy); 1042 goto out_unlock0; 1043 } 1044 1045 list_del(&msg->m_list); 1046 msq->q_qnum--; 1047 msq->q_rtime = get_seconds(); 1048 msq->q_lrpid = task_tgid_vnr(current); 1049 msq->q_cbytes -= msg->m_ts; 1050 atomic_sub(msg->m_ts, &ns->msg_bytes); 1051 atomic_dec(&ns->msg_hdrs); 1052 ss_wakeup(msq, &wake_q, false); 1053 1054 goto out_unlock0; 1055 } 1056 1057 /* No message waiting. Wait for a message */ 1058 if (msgflg & IPC_NOWAIT) { 1059 msg = ERR_PTR(-ENOMSG); 1060 goto out_unlock0; 1061 } 1062 1063 list_add_tail(&msr_d.r_list, &msq->q_receivers); 1064 msr_d.r_tsk = current; 1065 msr_d.r_msgtype = msgtyp; 1066 msr_d.r_mode = mode; 1067 if (msgflg & MSG_NOERROR) 1068 msr_d.r_maxsize = INT_MAX; 1069 else 1070 msr_d.r_maxsize = bufsz; 1071 msr_d.r_msg = ERR_PTR(-EAGAIN); 1072 __set_current_state(TASK_INTERRUPTIBLE); 1073 1074 ipc_unlock_object(&msq->q_perm); 1075 rcu_read_unlock(); 1076 schedule(); 1077 1078 /* 1079 * Lockless receive, part 1: 1080 * We don't hold a reference to the queue and getting a 1081 * reference would defeat the idea of a lockless operation, 1082 * thus the code relies on rcu to guarantee the existence of 1083 * msq: 1084 * Prior to destruction, expunge_all(-EIRDM) changes r_msg. 1085 * Thus if r_msg is -EAGAIN, then the queue not yet destroyed. 1086 */ 1087 rcu_read_lock(); 1088 1089 /* 1090 * Lockless receive, part 2: 1091 * The work in pipelined_send() and expunge_all(): 1092 * - Set pointer to message 1093 * - Queue the receiver task for later wakeup 1094 * - Wake up the process after the lock is dropped. 1095 * 1096 * Should the process wake up before this wakeup (due to a 1097 * signal) it will either see the message and continue ... 1098 */ 1099 msg = READ_ONCE(msr_d.r_msg); 1100 if (msg != ERR_PTR(-EAGAIN)) 1101 goto out_unlock1; 1102 1103 /* 1104 * ... or see -EAGAIN, acquire the lock to check the message 1105 * again. 1106 */ 1107 ipc_lock_object(&msq->q_perm); 1108 1109 msg = msr_d.r_msg; 1110 if (msg != ERR_PTR(-EAGAIN)) 1111 goto out_unlock0; 1112 1113 list_del(&msr_d.r_list); 1114 if (signal_pending(current)) { 1115 msg = ERR_PTR(-ERESTARTNOHAND); 1116 goto out_unlock0; 1117 } 1118 1119 ipc_unlock_object(&msq->q_perm); 1120 } 1121 1122 out_unlock0: 1123 ipc_unlock_object(&msq->q_perm); 1124 wake_up_q(&wake_q); 1125 out_unlock1: 1126 rcu_read_unlock(); 1127 if (IS_ERR(msg)) { 1128 free_copy(copy); 1129 return PTR_ERR(msg); 1130 } 1131 1132 bufsz = msg_handler(buf, msg, bufsz); 1133 free_msg(msg); 1134 1135 return bufsz; 1136 } 1137 1138 SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz, 1139 long, msgtyp, int, msgflg) 1140 { 1141 return do_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg, do_msg_fill); 1142 } 1143 1144 #ifdef CONFIG_COMPAT 1145 static long compat_do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz) 1146 { 1147 struct compat_msgbuf __user *msgp = dest; 1148 size_t msgsz; 1149 1150 if (put_user(msg->m_type, &msgp->mtype)) 1151 return -EFAULT; 1152 1153 msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz; 1154 if (store_msg(msgp->mtext, msg, msgsz)) 1155 return -EFAULT; 1156 return msgsz; 1157 } 1158 1159 COMPAT_SYSCALL_DEFINE5(msgrcv, int, msqid, compat_uptr_t, msgp, 1160 compat_ssize_t, msgsz, compat_long_t, msgtyp, int, msgflg) 1161 { 1162 return do_msgrcv(msqid, compat_ptr(msgp), (ssize_t)msgsz, (long)msgtyp, 1163 msgflg, compat_do_msg_fill); 1164 } 1165 #endif 1166 1167 int msg_init_ns(struct ipc_namespace *ns) 1168 { 1169 ns->msg_ctlmax = MSGMAX; 1170 ns->msg_ctlmnb = MSGMNB; 1171 ns->msg_ctlmni = MSGMNI; 1172 1173 atomic_set(&ns->msg_bytes, 0); 1174 atomic_set(&ns->msg_hdrs, 0); 1175 return ipc_init_ids(&ns->ids[IPC_MSG_IDS]); 1176 } 1177 1178 #ifdef CONFIG_IPC_NS 1179 void msg_exit_ns(struct ipc_namespace *ns) 1180 { 1181 free_ipcs(ns, &msg_ids(ns), freeque); 1182 idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr); 1183 rhashtable_destroy(&ns->ids[IPC_MSG_IDS].key_ht); 1184 } 1185 #endif 1186 1187 #ifdef CONFIG_PROC_FS 1188 static int sysvipc_msg_proc_show(struct seq_file *s, void *it) 1189 { 1190 struct user_namespace *user_ns = seq_user_ns(s); 1191 struct kern_ipc_perm *ipcp = it; 1192 struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm); 1193 1194 seq_printf(s, 1195 "%10d %10d %4o %10lu %10lu %5u %5u %5u %5u %5u %5u %10llu %10llu %10llu\n", 1196 msq->q_perm.key, 1197 msq->q_perm.id, 1198 msq->q_perm.mode, 1199 msq->q_cbytes, 1200 msq->q_qnum, 1201 msq->q_lspid, 1202 msq->q_lrpid, 1203 from_kuid_munged(user_ns, msq->q_perm.uid), 1204 from_kgid_munged(user_ns, msq->q_perm.gid), 1205 from_kuid_munged(user_ns, msq->q_perm.cuid), 1206 from_kgid_munged(user_ns, msq->q_perm.cgid), 1207 msq->q_stime, 1208 msq->q_rtime, 1209 msq->q_ctime); 1210 1211 return 0; 1212 } 1213 #endif 1214 1215 int __init msg_init(void) 1216 { 1217 const int err = msg_init_ns(&init_ipc_ns); 1218 1219 ipc_init_proc_interface("sysvipc/msg", 1220 " key msqid perms cbytes qnum lspid lrpid uid gid cuid cgid stime rtime ctime\n", 1221 IPC_MSG_IDS, sysvipc_msg_proc_show); 1222 return err; 1223 } 1224