1 /* 2 * linux/ipc/msg.c 3 * Copyright (C) 1992 Krishna Balasubramanian 4 * 5 * Removed all the remaining kerneld mess 6 * Catch the -EFAULT stuff properly 7 * Use GFP_KERNEL for messages as in 1.2 8 * Fixed up the unchecked user space derefs 9 * Copyright (C) 1998 Alan Cox & Andi Kleen 10 * 11 * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com> 12 * 13 * mostly rewritten, threaded and wake-one semantics added 14 * MSGMAX limit removed, sysctl's added 15 * (c) 1999 Manfred Spraul <manfred@colorfullife.com> 16 * 17 * support for audit of ipc object properties and permission changes 18 * Dustin Kirkland <dustin.kirkland@us.ibm.com> 19 */ 20 21 #include <linux/capability.h> 22 #include <linux/config.h> 23 #include <linux/slab.h> 24 #include <linux/msg.h> 25 #include <linux/spinlock.h> 26 #include <linux/init.h> 27 #include <linux/proc_fs.h> 28 #include <linux/list.h> 29 #include <linux/security.h> 30 #include <linux/sched.h> 31 #include <linux/syscalls.h> 32 #include <linux/audit.h> 33 #include <linux/seq_file.h> 34 #include <linux/mutex.h> 35 36 #include <asm/current.h> 37 #include <asm/uaccess.h> 38 #include "util.h" 39 40 /* sysctl: */ 41 int msg_ctlmax = MSGMAX; 42 int msg_ctlmnb = MSGMNB; 43 int msg_ctlmni = MSGMNI; 44 45 /* one msg_receiver structure for each sleeping receiver */ 46 struct msg_receiver { 47 struct list_head r_list; 48 struct task_struct* r_tsk; 49 50 int r_mode; 51 long r_msgtype; 52 long r_maxsize; 53 54 struct msg_msg* volatile r_msg; 55 }; 56 57 /* one msg_sender for each sleeping sender */ 58 struct msg_sender { 59 struct list_head list; 60 struct task_struct* tsk; 61 }; 62 63 #define SEARCH_ANY 1 64 #define SEARCH_EQUAL 2 65 #define SEARCH_NOTEQUAL 3 66 #define SEARCH_LESSEQUAL 4 67 68 static atomic_t msg_bytes = ATOMIC_INIT(0); 69 static atomic_t msg_hdrs = ATOMIC_INIT(0); 70 71 static struct ipc_ids msg_ids; 72 73 #define msg_lock(id) ((struct msg_queue*)ipc_lock(&msg_ids,id)) 74 #define msg_unlock(msq) ipc_unlock(&(msq)->q_perm) 75 #define msg_rmid(id) ((struct msg_queue*)ipc_rmid(&msg_ids,id)) 76 #define msg_checkid(msq, msgid) \ 77 ipc_checkid(&msg_ids,&msq->q_perm,msgid) 78 #define msg_buildid(id, seq) \ 79 ipc_buildid(&msg_ids, id, seq) 80 81 static void freeque (struct msg_queue *msq, int id); 82 static int newque (key_t key, int msgflg); 83 #ifdef CONFIG_PROC_FS 84 static int sysvipc_msg_proc_show(struct seq_file *s, void *it); 85 #endif 86 87 void __init msg_init (void) 88 { 89 ipc_init_ids(&msg_ids,msg_ctlmni); 90 ipc_init_proc_interface("sysvipc/msg", 91 " key msqid perms cbytes qnum lspid lrpid uid gid cuid cgid stime rtime ctime\n", 92 &msg_ids, 93 sysvipc_msg_proc_show); 94 } 95 96 static int newque (key_t key, int msgflg) 97 { 98 int id; 99 int retval; 100 struct msg_queue *msq; 101 102 msq = ipc_rcu_alloc(sizeof(*msq)); 103 if (!msq) 104 return -ENOMEM; 105 106 msq->q_perm.mode = (msgflg & S_IRWXUGO); 107 msq->q_perm.key = key; 108 109 msq->q_perm.security = NULL; 110 retval = security_msg_queue_alloc(msq); 111 if (retval) { 112 ipc_rcu_putref(msq); 113 return retval; 114 } 115 116 id = ipc_addid(&msg_ids, &msq->q_perm, msg_ctlmni); 117 if(id == -1) { 118 security_msg_queue_free(msq); 119 ipc_rcu_putref(msq); 120 return -ENOSPC; 121 } 122 123 msq->q_id = msg_buildid(id,msq->q_perm.seq); 124 msq->q_stime = msq->q_rtime = 0; 125 msq->q_ctime = get_seconds(); 126 msq->q_cbytes = msq->q_qnum = 0; 127 msq->q_qbytes = msg_ctlmnb; 128 msq->q_lspid = msq->q_lrpid = 0; 129 INIT_LIST_HEAD(&msq->q_messages); 130 INIT_LIST_HEAD(&msq->q_receivers); 131 INIT_LIST_HEAD(&msq->q_senders); 132 msg_unlock(msq); 133 134 return msq->q_id; 135 } 136 137 static inline void ss_add(struct msg_queue* msq, struct msg_sender* mss) 138 { 139 mss->tsk=current; 140 current->state=TASK_INTERRUPTIBLE; 141 list_add_tail(&mss->list,&msq->q_senders); 142 } 143 144 static inline void ss_del(struct msg_sender* mss) 145 { 146 if(mss->list.next != NULL) 147 list_del(&mss->list); 148 } 149 150 static void ss_wakeup(struct list_head* h, int kill) 151 { 152 struct list_head *tmp; 153 154 tmp = h->next; 155 while (tmp != h) { 156 struct msg_sender* mss; 157 158 mss = list_entry(tmp,struct msg_sender,list); 159 tmp = tmp->next; 160 if(kill) 161 mss->list.next=NULL; 162 wake_up_process(mss->tsk); 163 } 164 } 165 166 static void expunge_all(struct msg_queue* msq, int res) 167 { 168 struct list_head *tmp; 169 170 tmp = msq->q_receivers.next; 171 while (tmp != &msq->q_receivers) { 172 struct msg_receiver* msr; 173 174 msr = list_entry(tmp,struct msg_receiver,r_list); 175 tmp = tmp->next; 176 msr->r_msg = NULL; 177 wake_up_process(msr->r_tsk); 178 smp_mb(); 179 msr->r_msg = ERR_PTR(res); 180 } 181 } 182 /* 183 * freeque() wakes up waiters on the sender and receiver waiting queue, 184 * removes the message queue from message queue ID 185 * array, and cleans up all the messages associated with this queue. 186 * 187 * msg_ids.mutex and the spinlock for this message queue is hold 188 * before freeque() is called. msg_ids.mutex remains locked on exit. 189 */ 190 static void freeque (struct msg_queue *msq, int id) 191 { 192 struct list_head *tmp; 193 194 expunge_all(msq,-EIDRM); 195 ss_wakeup(&msq->q_senders,1); 196 msq = msg_rmid(id); 197 msg_unlock(msq); 198 199 tmp = msq->q_messages.next; 200 while(tmp != &msq->q_messages) { 201 struct msg_msg* msg = list_entry(tmp,struct msg_msg,m_list); 202 tmp = tmp->next; 203 atomic_dec(&msg_hdrs); 204 free_msg(msg); 205 } 206 atomic_sub(msq->q_cbytes, &msg_bytes); 207 security_msg_queue_free(msq); 208 ipc_rcu_putref(msq); 209 } 210 211 asmlinkage long sys_msgget (key_t key, int msgflg) 212 { 213 int id, ret = -EPERM; 214 struct msg_queue *msq; 215 216 mutex_lock(&msg_ids.mutex); 217 if (key == IPC_PRIVATE) 218 ret = newque(key, msgflg); 219 else if ((id = ipc_findkey(&msg_ids, key)) == -1) { /* key not used */ 220 if (!(msgflg & IPC_CREAT)) 221 ret = -ENOENT; 222 else 223 ret = newque(key, msgflg); 224 } else if (msgflg & IPC_CREAT && msgflg & IPC_EXCL) { 225 ret = -EEXIST; 226 } else { 227 msq = msg_lock(id); 228 BUG_ON(msq==NULL); 229 if (ipcperms(&msq->q_perm, msgflg)) 230 ret = -EACCES; 231 else { 232 int qid = msg_buildid(id, msq->q_perm.seq); 233 ret = security_msg_queue_associate(msq, msgflg); 234 if (!ret) 235 ret = qid; 236 } 237 msg_unlock(msq); 238 } 239 mutex_unlock(&msg_ids.mutex); 240 return ret; 241 } 242 243 static inline unsigned long copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version) 244 { 245 switch(version) { 246 case IPC_64: 247 return copy_to_user (buf, in, sizeof(*in)); 248 case IPC_OLD: 249 { 250 struct msqid_ds out; 251 252 memset(&out,0,sizeof(out)); 253 254 ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm); 255 256 out.msg_stime = in->msg_stime; 257 out.msg_rtime = in->msg_rtime; 258 out.msg_ctime = in->msg_ctime; 259 260 if(in->msg_cbytes > USHRT_MAX) 261 out.msg_cbytes = USHRT_MAX; 262 else 263 out.msg_cbytes = in->msg_cbytes; 264 out.msg_lcbytes = in->msg_cbytes; 265 266 if(in->msg_qnum > USHRT_MAX) 267 out.msg_qnum = USHRT_MAX; 268 else 269 out.msg_qnum = in->msg_qnum; 270 271 if(in->msg_qbytes > USHRT_MAX) 272 out.msg_qbytes = USHRT_MAX; 273 else 274 out.msg_qbytes = in->msg_qbytes; 275 out.msg_lqbytes = in->msg_qbytes; 276 277 out.msg_lspid = in->msg_lspid; 278 out.msg_lrpid = in->msg_lrpid; 279 280 return copy_to_user (buf, &out, sizeof(out)); 281 } 282 default: 283 return -EINVAL; 284 } 285 } 286 287 struct msq_setbuf { 288 unsigned long qbytes; 289 uid_t uid; 290 gid_t gid; 291 mode_t mode; 292 }; 293 294 static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version) 295 { 296 switch(version) { 297 case IPC_64: 298 { 299 struct msqid64_ds tbuf; 300 301 if (copy_from_user (&tbuf, buf, sizeof (tbuf))) 302 return -EFAULT; 303 304 out->qbytes = tbuf.msg_qbytes; 305 out->uid = tbuf.msg_perm.uid; 306 out->gid = tbuf.msg_perm.gid; 307 out->mode = tbuf.msg_perm.mode; 308 309 return 0; 310 } 311 case IPC_OLD: 312 { 313 struct msqid_ds tbuf_old; 314 315 if (copy_from_user (&tbuf_old, buf, sizeof (tbuf_old))) 316 return -EFAULT; 317 318 out->uid = tbuf_old.msg_perm.uid; 319 out->gid = tbuf_old.msg_perm.gid; 320 out->mode = tbuf_old.msg_perm.mode; 321 322 if(tbuf_old.msg_qbytes == 0) 323 out->qbytes = tbuf_old.msg_lqbytes; 324 else 325 out->qbytes = tbuf_old.msg_qbytes; 326 327 return 0; 328 } 329 default: 330 return -EINVAL; 331 } 332 } 333 334 asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf) 335 { 336 int err, version; 337 struct msg_queue *msq; 338 struct msq_setbuf setbuf; 339 struct kern_ipc_perm *ipcp; 340 341 if (msqid < 0 || cmd < 0) 342 return -EINVAL; 343 344 version = ipc_parse_version(&cmd); 345 346 switch (cmd) { 347 case IPC_INFO: 348 case MSG_INFO: 349 { 350 struct msginfo msginfo; 351 int max_id; 352 if (!buf) 353 return -EFAULT; 354 /* We must not return kernel stack data. 355 * due to padding, it's not enough 356 * to set all member fields. 357 */ 358 359 err = security_msg_queue_msgctl(NULL, cmd); 360 if (err) 361 return err; 362 363 memset(&msginfo,0,sizeof(msginfo)); 364 msginfo.msgmni = msg_ctlmni; 365 msginfo.msgmax = msg_ctlmax; 366 msginfo.msgmnb = msg_ctlmnb; 367 msginfo.msgssz = MSGSSZ; 368 msginfo.msgseg = MSGSEG; 369 mutex_lock(&msg_ids.mutex); 370 if (cmd == MSG_INFO) { 371 msginfo.msgpool = msg_ids.in_use; 372 msginfo.msgmap = atomic_read(&msg_hdrs); 373 msginfo.msgtql = atomic_read(&msg_bytes); 374 } else { 375 msginfo.msgmap = MSGMAP; 376 msginfo.msgpool = MSGPOOL; 377 msginfo.msgtql = MSGTQL; 378 } 379 max_id = msg_ids.max_id; 380 mutex_unlock(&msg_ids.mutex); 381 if (copy_to_user (buf, &msginfo, sizeof(struct msginfo))) 382 return -EFAULT; 383 return (max_id < 0) ? 0: max_id; 384 } 385 case MSG_STAT: 386 case IPC_STAT: 387 { 388 struct msqid64_ds tbuf; 389 int success_return; 390 if (!buf) 391 return -EFAULT; 392 if(cmd == MSG_STAT && msqid >= msg_ids.entries->size) 393 return -EINVAL; 394 395 memset(&tbuf,0,sizeof(tbuf)); 396 397 msq = msg_lock(msqid); 398 if (msq == NULL) 399 return -EINVAL; 400 401 if(cmd == MSG_STAT) { 402 success_return = msg_buildid(msqid, msq->q_perm.seq); 403 } else { 404 err = -EIDRM; 405 if (msg_checkid(msq,msqid)) 406 goto out_unlock; 407 success_return = 0; 408 } 409 err = -EACCES; 410 if (ipcperms (&msq->q_perm, S_IRUGO)) 411 goto out_unlock; 412 413 err = security_msg_queue_msgctl(msq, cmd); 414 if (err) 415 goto out_unlock; 416 417 kernel_to_ipc64_perm(&msq->q_perm, &tbuf.msg_perm); 418 tbuf.msg_stime = msq->q_stime; 419 tbuf.msg_rtime = msq->q_rtime; 420 tbuf.msg_ctime = msq->q_ctime; 421 tbuf.msg_cbytes = msq->q_cbytes; 422 tbuf.msg_qnum = msq->q_qnum; 423 tbuf.msg_qbytes = msq->q_qbytes; 424 tbuf.msg_lspid = msq->q_lspid; 425 tbuf.msg_lrpid = msq->q_lrpid; 426 msg_unlock(msq); 427 if (copy_msqid_to_user(buf, &tbuf, version)) 428 return -EFAULT; 429 return success_return; 430 } 431 case IPC_SET: 432 if (!buf) 433 return -EFAULT; 434 if (copy_msqid_from_user (&setbuf, buf, version)) 435 return -EFAULT; 436 break; 437 case IPC_RMID: 438 break; 439 default: 440 return -EINVAL; 441 } 442 443 mutex_lock(&msg_ids.mutex); 444 msq = msg_lock(msqid); 445 err=-EINVAL; 446 if (msq == NULL) 447 goto out_up; 448 449 err = -EIDRM; 450 if (msg_checkid(msq,msqid)) 451 goto out_unlock_up; 452 ipcp = &msq->q_perm; 453 454 err = audit_ipc_obj(ipcp); 455 if (err) 456 goto out_unlock_up; 457 if (cmd==IPC_SET) { 458 err = audit_ipc_set_perm(setbuf.qbytes, setbuf.uid, setbuf.gid, setbuf.mode); 459 if (err) 460 goto out_unlock_up; 461 } 462 463 err = -EPERM; 464 if (current->euid != ipcp->cuid && 465 current->euid != ipcp->uid && !capable(CAP_SYS_ADMIN)) 466 /* We _could_ check for CAP_CHOWN above, but we don't */ 467 goto out_unlock_up; 468 469 err = security_msg_queue_msgctl(msq, cmd); 470 if (err) 471 goto out_unlock_up; 472 473 switch (cmd) { 474 case IPC_SET: 475 { 476 err = -EPERM; 477 if (setbuf.qbytes > msg_ctlmnb && !capable(CAP_SYS_RESOURCE)) 478 goto out_unlock_up; 479 480 msq->q_qbytes = setbuf.qbytes; 481 482 ipcp->uid = setbuf.uid; 483 ipcp->gid = setbuf.gid; 484 ipcp->mode = (ipcp->mode & ~S_IRWXUGO) | 485 (S_IRWXUGO & setbuf.mode); 486 msq->q_ctime = get_seconds(); 487 /* sleeping receivers might be excluded by 488 * stricter permissions. 489 */ 490 expunge_all(msq,-EAGAIN); 491 /* sleeping senders might be able to send 492 * due to a larger queue size. 493 */ 494 ss_wakeup(&msq->q_senders,0); 495 msg_unlock(msq); 496 break; 497 } 498 case IPC_RMID: 499 freeque (msq, msqid); 500 break; 501 } 502 err = 0; 503 out_up: 504 mutex_unlock(&msg_ids.mutex); 505 return err; 506 out_unlock_up: 507 msg_unlock(msq); 508 goto out_up; 509 out_unlock: 510 msg_unlock(msq); 511 return err; 512 } 513 514 static int testmsg(struct msg_msg* msg,long type,int mode) 515 { 516 switch(mode) 517 { 518 case SEARCH_ANY: 519 return 1; 520 case SEARCH_LESSEQUAL: 521 if(msg->m_type <=type) 522 return 1; 523 break; 524 case SEARCH_EQUAL: 525 if(msg->m_type == type) 526 return 1; 527 break; 528 case SEARCH_NOTEQUAL: 529 if(msg->m_type != type) 530 return 1; 531 break; 532 } 533 return 0; 534 } 535 536 static inline int pipelined_send(struct msg_queue* msq, struct msg_msg* msg) 537 { 538 struct list_head* tmp; 539 540 tmp = msq->q_receivers.next; 541 while (tmp != &msq->q_receivers) { 542 struct msg_receiver* msr; 543 msr = list_entry(tmp,struct msg_receiver,r_list); 544 tmp = tmp->next; 545 if(testmsg(msg,msr->r_msgtype,msr->r_mode) && 546 !security_msg_queue_msgrcv(msq, msg, msr->r_tsk, msr->r_msgtype, msr->r_mode)) { 547 list_del(&msr->r_list); 548 if(msr->r_maxsize < msg->m_ts) { 549 msr->r_msg = NULL; 550 wake_up_process(msr->r_tsk); 551 smp_mb(); 552 msr->r_msg = ERR_PTR(-E2BIG); 553 } else { 554 msr->r_msg = NULL; 555 msq->q_lrpid = msr->r_tsk->pid; 556 msq->q_rtime = get_seconds(); 557 wake_up_process(msr->r_tsk); 558 smp_mb(); 559 msr->r_msg = msg; 560 return 1; 561 } 562 } 563 } 564 return 0; 565 } 566 567 asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg) 568 { 569 struct msg_queue *msq; 570 struct msg_msg *msg; 571 long mtype; 572 int err; 573 574 if (msgsz > msg_ctlmax || (long) msgsz < 0 || msqid < 0) 575 return -EINVAL; 576 if (get_user(mtype, &msgp->mtype)) 577 return -EFAULT; 578 if (mtype < 1) 579 return -EINVAL; 580 581 msg = load_msg(msgp->mtext, msgsz); 582 if(IS_ERR(msg)) 583 return PTR_ERR(msg); 584 585 msg->m_type = mtype; 586 msg->m_ts = msgsz; 587 588 msq = msg_lock(msqid); 589 err=-EINVAL; 590 if(msq==NULL) 591 goto out_free; 592 593 err= -EIDRM; 594 if (msg_checkid(msq,msqid)) 595 goto out_unlock_free; 596 597 for (;;) { 598 struct msg_sender s; 599 600 err=-EACCES; 601 if (ipcperms(&msq->q_perm, S_IWUGO)) 602 goto out_unlock_free; 603 604 err = security_msg_queue_msgsnd(msq, msg, msgflg); 605 if (err) 606 goto out_unlock_free; 607 608 if(msgsz + msq->q_cbytes <= msq->q_qbytes && 609 1 + msq->q_qnum <= msq->q_qbytes) { 610 break; 611 } 612 613 /* queue full, wait: */ 614 if(msgflg&IPC_NOWAIT) { 615 err=-EAGAIN; 616 goto out_unlock_free; 617 } 618 ss_add(msq, &s); 619 ipc_rcu_getref(msq); 620 msg_unlock(msq); 621 schedule(); 622 623 ipc_lock_by_ptr(&msq->q_perm); 624 ipc_rcu_putref(msq); 625 if (msq->q_perm.deleted) { 626 err = -EIDRM; 627 goto out_unlock_free; 628 } 629 ss_del(&s); 630 631 if (signal_pending(current)) { 632 err=-ERESTARTNOHAND; 633 goto out_unlock_free; 634 } 635 } 636 637 msq->q_lspid = current->tgid; 638 msq->q_stime = get_seconds(); 639 640 if(!pipelined_send(msq,msg)) { 641 /* noone is waiting for this message, enqueue it */ 642 list_add_tail(&msg->m_list,&msq->q_messages); 643 msq->q_cbytes += msgsz; 644 msq->q_qnum++; 645 atomic_add(msgsz,&msg_bytes); 646 atomic_inc(&msg_hdrs); 647 } 648 649 err = 0; 650 msg = NULL; 651 652 out_unlock_free: 653 msg_unlock(msq); 654 out_free: 655 if(msg!=NULL) 656 free_msg(msg); 657 return err; 658 } 659 660 static inline int convert_mode(long* msgtyp, int msgflg) 661 { 662 /* 663 * find message of correct type. 664 * msgtyp = 0 => get first. 665 * msgtyp > 0 => get first message of matching type. 666 * msgtyp < 0 => get message with least type must be < abs(msgtype). 667 */ 668 if(*msgtyp==0) 669 return SEARCH_ANY; 670 if(*msgtyp<0) { 671 *msgtyp=-(*msgtyp); 672 return SEARCH_LESSEQUAL; 673 } 674 if(msgflg & MSG_EXCEPT) 675 return SEARCH_NOTEQUAL; 676 return SEARCH_EQUAL; 677 } 678 679 asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz, 680 long msgtyp, int msgflg) 681 { 682 struct msg_queue *msq; 683 struct msg_msg *msg; 684 int mode; 685 686 if (msqid < 0 || (long) msgsz < 0) 687 return -EINVAL; 688 mode = convert_mode(&msgtyp,msgflg); 689 690 msq = msg_lock(msqid); 691 if(msq==NULL) 692 return -EINVAL; 693 694 msg = ERR_PTR(-EIDRM); 695 if (msg_checkid(msq,msqid)) 696 goto out_unlock; 697 698 for (;;) { 699 struct msg_receiver msr_d; 700 struct list_head* tmp; 701 702 msg = ERR_PTR(-EACCES); 703 if (ipcperms (&msq->q_perm, S_IRUGO)) 704 goto out_unlock; 705 706 msg = ERR_PTR(-EAGAIN); 707 tmp = msq->q_messages.next; 708 while (tmp != &msq->q_messages) { 709 struct msg_msg *walk_msg; 710 walk_msg = list_entry(tmp,struct msg_msg,m_list); 711 if(testmsg(walk_msg,msgtyp,mode) && 712 !security_msg_queue_msgrcv(msq, walk_msg, current, msgtyp, mode)) { 713 msg = walk_msg; 714 if(mode == SEARCH_LESSEQUAL && walk_msg->m_type != 1) { 715 msg=walk_msg; 716 msgtyp=walk_msg->m_type-1; 717 } else { 718 msg=walk_msg; 719 break; 720 } 721 } 722 tmp = tmp->next; 723 } 724 if(!IS_ERR(msg)) { 725 /* Found a suitable message. Unlink it from the queue. */ 726 if ((msgsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) { 727 msg = ERR_PTR(-E2BIG); 728 goto out_unlock; 729 } 730 list_del(&msg->m_list); 731 msq->q_qnum--; 732 msq->q_rtime = get_seconds(); 733 msq->q_lrpid = current->tgid; 734 msq->q_cbytes -= msg->m_ts; 735 atomic_sub(msg->m_ts,&msg_bytes); 736 atomic_dec(&msg_hdrs); 737 ss_wakeup(&msq->q_senders,0); 738 msg_unlock(msq); 739 break; 740 } 741 /* No message waiting. Wait for a message */ 742 if (msgflg & IPC_NOWAIT) { 743 msg = ERR_PTR(-ENOMSG); 744 goto out_unlock; 745 } 746 list_add_tail(&msr_d.r_list,&msq->q_receivers); 747 msr_d.r_tsk = current; 748 msr_d.r_msgtype = msgtyp; 749 msr_d.r_mode = mode; 750 if(msgflg & MSG_NOERROR) 751 msr_d.r_maxsize = INT_MAX; 752 else 753 msr_d.r_maxsize = msgsz; 754 msr_d.r_msg = ERR_PTR(-EAGAIN); 755 current->state = TASK_INTERRUPTIBLE; 756 msg_unlock(msq); 757 758 schedule(); 759 760 /* Lockless receive, part 1: 761 * Disable preemption. We don't hold a reference to the queue 762 * and getting a reference would defeat the idea of a lockless 763 * operation, thus the code relies on rcu to guarantee the 764 * existance of msq: 765 * Prior to destruction, expunge_all(-EIRDM) changes r_msg. 766 * Thus if r_msg is -EAGAIN, then the queue not yet destroyed. 767 * rcu_read_lock() prevents preemption between reading r_msg 768 * and the spin_lock() inside ipc_lock_by_ptr(). 769 */ 770 rcu_read_lock(); 771 772 /* Lockless receive, part 2: 773 * Wait until pipelined_send or expunge_all are outside of 774 * wake_up_process(). There is a race with exit(), see 775 * ipc/mqueue.c for the details. 776 */ 777 msg = (struct msg_msg*) msr_d.r_msg; 778 while (msg == NULL) { 779 cpu_relax(); 780 msg = (struct msg_msg*) msr_d.r_msg; 781 } 782 783 /* Lockless receive, part 3: 784 * If there is a message or an error then accept it without 785 * locking. 786 */ 787 if(msg != ERR_PTR(-EAGAIN)) { 788 rcu_read_unlock(); 789 break; 790 } 791 792 /* Lockless receive, part 3: 793 * Acquire the queue spinlock. 794 */ 795 ipc_lock_by_ptr(&msq->q_perm); 796 rcu_read_unlock(); 797 798 /* Lockless receive, part 4: 799 * Repeat test after acquiring the spinlock. 800 */ 801 msg = (struct msg_msg*)msr_d.r_msg; 802 if(msg != ERR_PTR(-EAGAIN)) 803 goto out_unlock; 804 805 list_del(&msr_d.r_list); 806 if (signal_pending(current)) { 807 msg = ERR_PTR(-ERESTARTNOHAND); 808 out_unlock: 809 msg_unlock(msq); 810 break; 811 } 812 } 813 if (IS_ERR(msg)) 814 return PTR_ERR(msg); 815 816 msgsz = (msgsz > msg->m_ts) ? msg->m_ts : msgsz; 817 if (put_user (msg->m_type, &msgp->mtype) || 818 store_msg(msgp->mtext, msg, msgsz)) { 819 msgsz = -EFAULT; 820 } 821 free_msg(msg); 822 return msgsz; 823 } 824 825 #ifdef CONFIG_PROC_FS 826 static int sysvipc_msg_proc_show(struct seq_file *s, void *it) 827 { 828 struct msg_queue *msq = it; 829 830 return seq_printf(s, 831 "%10d %10d %4o %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n", 832 msq->q_perm.key, 833 msq->q_id, 834 msq->q_perm.mode, 835 msq->q_cbytes, 836 msq->q_qnum, 837 msq->q_lspid, 838 msq->q_lrpid, 839 msq->q_perm.uid, 840 msq->q_perm.gid, 841 msq->q_perm.cuid, 842 msq->q_perm.cgid, 843 msq->q_stime, 844 msq->q_rtime, 845 msq->q_ctime); 846 } 847 #endif 848