1 /* 2 * linux/ipc/util.c 3 * Copyright (C) 1992 Krishna Balasubramanian 4 * 5 * Sep 1997 - Call suser() last after "normal" permission checks so we 6 * get BSD style process accounting right. 7 * Occurs in several places in the IPC code. 8 * Chris Evans, <chris@ferret.lmh.ox.ac.uk> 9 * Nov 1999 - ipc helper functions, unified SMP locking 10 * Manfred Spraul <manfred@colorfullife.com> 11 * Oct 2002 - One lock per IPC id. RCU ipc_free for lock-free grow_ary(). 12 * Mingming Cao <cmm@us.ibm.com> 13 * Mar 2006 - support for audit of ipc object properties 14 * Dustin Kirkland <dustin.kirkland@us.ibm.com> 15 * Jun 2006 - namespaces ssupport 16 * OpenVZ, SWsoft Inc. 17 * Pavel Emelianov <xemul@openvz.org> 18 */ 19 20 #include <linux/mm.h> 21 #include <linux/shm.h> 22 #include <linux/init.h> 23 #include <linux/msg.h> 24 #include <linux/vmalloc.h> 25 #include <linux/slab.h> 26 #include <linux/capability.h> 27 #include <linux/highuid.h> 28 #include <linux/security.h> 29 #include <linux/rcupdate.h> 30 #include <linux/workqueue.h> 31 #include <linux/seq_file.h> 32 #include <linux/proc_fs.h> 33 #include <linux/audit.h> 34 #include <linux/nsproxy.h> 35 #include <linux/rwsem.h> 36 #include <linux/memory.h> 37 #include <linux/ipc_namespace.h> 38 39 #include <asm/unistd.h> 40 41 #include "util.h" 42 43 struct ipc_proc_iface { 44 const char *path; 45 const char *header; 46 int ids; 47 int (*show)(struct seq_file *, void *); 48 }; 49 50 struct ipc_namespace init_ipc_ns = { 51 .kref = { 52 .refcount = ATOMIC_INIT(2), 53 }, 54 }; 55 56 atomic_t nr_ipc_ns = ATOMIC_INIT(1); 57 58 59 #ifdef CONFIG_MEMORY_HOTPLUG 60 61 static void ipc_memory_notifier(struct work_struct *work) 62 { 63 ipcns_notify(IPCNS_MEMCHANGED); 64 } 65 66 static DECLARE_WORK(ipc_memory_wq, ipc_memory_notifier); 67 68 69 static int ipc_memory_callback(struct notifier_block *self, 70 unsigned long action, void *arg) 71 { 72 switch (action) { 73 case MEM_ONLINE: /* memory successfully brought online */ 74 case MEM_OFFLINE: /* or offline: it's time to recompute msgmni */ 75 /* 76 * This is done by invoking the ipcns notifier chain with the 77 * IPC_MEMCHANGED event. 78 * In order not to keep the lock on the hotplug memory chain 79 * for too long, queue a work item that will, when waken up, 80 * activate the ipcns notification chain. 81 * No need to keep several ipc work items on the queue. 82 */ 83 if (!work_pending(&ipc_memory_wq)) 84 schedule_work(&ipc_memory_wq); 85 break; 86 case MEM_GOING_ONLINE: 87 case MEM_GOING_OFFLINE: 88 case MEM_CANCEL_ONLINE: 89 case MEM_CANCEL_OFFLINE: 90 default: 91 break; 92 } 93 94 return NOTIFY_OK; 95 } 96 97 #endif /* CONFIG_MEMORY_HOTPLUG */ 98 99 /** 100 * ipc_init - initialise IPC subsystem 101 * 102 * The various system5 IPC resources (semaphores, messages and shared 103 * memory) are initialised 104 * A callback routine is registered into the memory hotplug notifier 105 * chain: since msgmni scales to lowmem this callback routine will be 106 * called upon successful memory add / remove to recompute msmgni. 107 */ 108 109 static int __init ipc_init(void) 110 { 111 sem_init(); 112 msg_init(); 113 shm_init(); 114 hotplug_memory_notifier(ipc_memory_callback, IPC_CALLBACK_PRI); 115 register_ipcns_notifier(&init_ipc_ns); 116 return 0; 117 } 118 __initcall(ipc_init); 119 120 /** 121 * ipc_init_ids - initialise IPC identifiers 122 * @ids: Identifier set 123 * 124 * Set up the sequence range to use for the ipc identifier range (limited 125 * below IPCMNI) then initialise the ids idr. 126 */ 127 128 void ipc_init_ids(struct ipc_ids *ids) 129 { 130 init_rwsem(&ids->rw_mutex); 131 132 ids->in_use = 0; 133 ids->seq = 0; 134 { 135 int seq_limit = INT_MAX/SEQ_MULTIPLIER; 136 if (seq_limit > USHORT_MAX) 137 ids->seq_max = USHORT_MAX; 138 else 139 ids->seq_max = seq_limit; 140 } 141 142 idr_init(&ids->ipcs_idr); 143 } 144 145 #ifdef CONFIG_PROC_FS 146 static const struct file_operations sysvipc_proc_fops; 147 /** 148 * ipc_init_proc_interface - Create a proc interface for sysipc types using a seq_file interface. 149 * @path: Path in procfs 150 * @header: Banner to be printed at the beginning of the file. 151 * @ids: ipc id table to iterate. 152 * @show: show routine. 153 */ 154 void __init ipc_init_proc_interface(const char *path, const char *header, 155 int ids, int (*show)(struct seq_file *, void *)) 156 { 157 struct proc_dir_entry *pde; 158 struct ipc_proc_iface *iface; 159 160 iface = kmalloc(sizeof(*iface), GFP_KERNEL); 161 if (!iface) 162 return; 163 iface->path = path; 164 iface->header = header; 165 iface->ids = ids; 166 iface->show = show; 167 168 pde = proc_create_data(path, 169 S_IRUGO, /* world readable */ 170 NULL, /* parent dir */ 171 &sysvipc_proc_fops, 172 iface); 173 if (!pde) { 174 kfree(iface); 175 } 176 } 177 #endif 178 179 /** 180 * ipc_findkey - find a key in an ipc identifier set 181 * @ids: Identifier set 182 * @key: The key to find 183 * 184 * Requires ipc_ids.rw_mutex locked. 185 * Returns the LOCKED pointer to the ipc structure if found or NULL 186 * if not. 187 * If key is found ipc points to the owning ipc structure 188 */ 189 190 static struct kern_ipc_perm *ipc_findkey(struct ipc_ids *ids, key_t key) 191 { 192 struct kern_ipc_perm *ipc; 193 int next_id; 194 int total; 195 196 for (total = 0, next_id = 0; total < ids->in_use; next_id++) { 197 ipc = idr_find(&ids->ipcs_idr, next_id); 198 199 if (ipc == NULL) 200 continue; 201 202 if (ipc->key != key) { 203 total++; 204 continue; 205 } 206 207 ipc_lock_by_ptr(ipc); 208 return ipc; 209 } 210 211 return NULL; 212 } 213 214 /** 215 * ipc_get_maxid - get the last assigned id 216 * @ids: IPC identifier set 217 * 218 * Called with ipc_ids.rw_mutex held. 219 */ 220 221 int ipc_get_maxid(struct ipc_ids *ids) 222 { 223 struct kern_ipc_perm *ipc; 224 int max_id = -1; 225 int total, id; 226 227 if (ids->in_use == 0) 228 return -1; 229 230 if (ids->in_use == IPCMNI) 231 return IPCMNI - 1; 232 233 /* Look for the last assigned id */ 234 total = 0; 235 for (id = 0; id < IPCMNI && total < ids->in_use; id++) { 236 ipc = idr_find(&ids->ipcs_idr, id); 237 if (ipc != NULL) { 238 max_id = id; 239 total++; 240 } 241 } 242 return max_id; 243 } 244 245 /** 246 * ipc_addid - add an IPC identifier 247 * @ids: IPC identifier set 248 * @new: new IPC permission set 249 * @size: limit for the number of used ids 250 * 251 * Add an entry 'new' to the IPC ids idr. The permissions object is 252 * initialised and the first free entry is set up and the id assigned 253 * is returned. The 'new' entry is returned in a locked state on success. 254 * On failure the entry is not locked and a negative err-code is returned. 255 * 256 * Called with ipc_ids.rw_mutex held as a writer. 257 */ 258 259 int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size) 260 { 261 int id, err; 262 263 if (size > IPCMNI) 264 size = IPCMNI; 265 266 if (ids->in_use >= size) 267 return -ENOSPC; 268 269 err = idr_get_new(&ids->ipcs_idr, new, &id); 270 if (err) 271 return err; 272 273 ids->in_use++; 274 275 new->cuid = new->uid = current->euid; 276 new->gid = new->cgid = current->egid; 277 278 new->seq = ids->seq++; 279 if(ids->seq > ids->seq_max) 280 ids->seq = 0; 281 282 new->id = ipc_buildid(id, new->seq); 283 spin_lock_init(&new->lock); 284 new->deleted = 0; 285 rcu_read_lock(); 286 spin_lock(&new->lock); 287 return id; 288 } 289 290 /** 291 * ipcget_new - create a new ipc object 292 * @ns: namespace 293 * @ids: IPC identifer set 294 * @ops: the actual creation routine to call 295 * @params: its parameters 296 * 297 * This routine is called by sys_msgget, sys_semget() and sys_shmget() 298 * when the key is IPC_PRIVATE. 299 */ 300 static int ipcget_new(struct ipc_namespace *ns, struct ipc_ids *ids, 301 struct ipc_ops *ops, struct ipc_params *params) 302 { 303 int err; 304 retry: 305 err = idr_pre_get(&ids->ipcs_idr, GFP_KERNEL); 306 307 if (!err) 308 return -ENOMEM; 309 310 down_write(&ids->rw_mutex); 311 err = ops->getnew(ns, params); 312 up_write(&ids->rw_mutex); 313 314 if (err == -EAGAIN) 315 goto retry; 316 317 return err; 318 } 319 320 /** 321 * ipc_check_perms - check security and permissions for an IPC 322 * @ipcp: ipc permission set 323 * @ops: the actual security routine to call 324 * @params: its parameters 325 * 326 * This routine is called by sys_msgget(), sys_semget() and sys_shmget() 327 * when the key is not IPC_PRIVATE and that key already exists in the 328 * ids IDR. 329 * 330 * On success, the IPC id is returned. 331 * 332 * It is called with ipc_ids.rw_mutex and ipcp->lock held. 333 */ 334 static int ipc_check_perms(struct kern_ipc_perm *ipcp, struct ipc_ops *ops, 335 struct ipc_params *params) 336 { 337 int err; 338 339 if (ipcperms(ipcp, params->flg)) 340 err = -EACCES; 341 else { 342 err = ops->associate(ipcp, params->flg); 343 if (!err) 344 err = ipcp->id; 345 } 346 347 return err; 348 } 349 350 /** 351 * ipcget_public - get an ipc object or create a new one 352 * @ns: namespace 353 * @ids: IPC identifer set 354 * @ops: the actual creation routine to call 355 * @params: its parameters 356 * 357 * This routine is called by sys_msgget, sys_semget() and sys_shmget() 358 * when the key is not IPC_PRIVATE. 359 * It adds a new entry if the key is not found and does some permission 360 * / security checkings if the key is found. 361 * 362 * On success, the ipc id is returned. 363 */ 364 static int ipcget_public(struct ipc_namespace *ns, struct ipc_ids *ids, 365 struct ipc_ops *ops, struct ipc_params *params) 366 { 367 struct kern_ipc_perm *ipcp; 368 int flg = params->flg; 369 int err; 370 retry: 371 err = idr_pre_get(&ids->ipcs_idr, GFP_KERNEL); 372 373 /* 374 * Take the lock as a writer since we are potentially going to add 375 * a new entry + read locks are not "upgradable" 376 */ 377 down_write(&ids->rw_mutex); 378 ipcp = ipc_findkey(ids, params->key); 379 if (ipcp == NULL) { 380 /* key not used */ 381 if (!(flg & IPC_CREAT)) 382 err = -ENOENT; 383 else if (!err) 384 err = -ENOMEM; 385 else 386 err = ops->getnew(ns, params); 387 } else { 388 /* ipc object has been locked by ipc_findkey() */ 389 390 if (flg & IPC_CREAT && flg & IPC_EXCL) 391 err = -EEXIST; 392 else { 393 err = 0; 394 if (ops->more_checks) 395 err = ops->more_checks(ipcp, params); 396 if (!err) 397 /* 398 * ipc_check_perms returns the IPC id on 399 * success 400 */ 401 err = ipc_check_perms(ipcp, ops, params); 402 } 403 ipc_unlock(ipcp); 404 } 405 up_write(&ids->rw_mutex); 406 407 if (err == -EAGAIN) 408 goto retry; 409 410 return err; 411 } 412 413 414 /** 415 * ipc_rmid - remove an IPC identifier 416 * @ids: IPC identifier set 417 * @ipcp: ipc perm structure containing the identifier to remove 418 * 419 * ipc_ids.rw_mutex (as a writer) and the spinlock for this ID are held 420 * before this function is called, and remain locked on the exit. 421 */ 422 423 void ipc_rmid(struct ipc_ids *ids, struct kern_ipc_perm *ipcp) 424 { 425 int lid = ipcid_to_idx(ipcp->id); 426 427 idr_remove(&ids->ipcs_idr, lid); 428 429 ids->in_use--; 430 431 ipcp->deleted = 1; 432 433 return; 434 } 435 436 /** 437 * ipc_alloc - allocate ipc space 438 * @size: size desired 439 * 440 * Allocate memory from the appropriate pools and return a pointer to it. 441 * NULL is returned if the allocation fails 442 */ 443 444 void* ipc_alloc(int size) 445 { 446 void* out; 447 if(size > PAGE_SIZE) 448 out = vmalloc(size); 449 else 450 out = kmalloc(size, GFP_KERNEL); 451 return out; 452 } 453 454 /** 455 * ipc_free - free ipc space 456 * @ptr: pointer returned by ipc_alloc 457 * @size: size of block 458 * 459 * Free a block created with ipc_alloc(). The caller must know the size 460 * used in the allocation call. 461 */ 462 463 void ipc_free(void* ptr, int size) 464 { 465 if(size > PAGE_SIZE) 466 vfree(ptr); 467 else 468 kfree(ptr); 469 } 470 471 /* 472 * rcu allocations: 473 * There are three headers that are prepended to the actual allocation: 474 * - during use: ipc_rcu_hdr. 475 * - during the rcu grace period: ipc_rcu_grace. 476 * - [only if vmalloc]: ipc_rcu_sched. 477 * Their lifetime doesn't overlap, thus the headers share the same memory. 478 * Unlike a normal union, they are right-aligned, thus some container_of 479 * forward/backward casting is necessary: 480 */ 481 struct ipc_rcu_hdr 482 { 483 int refcount; 484 int is_vmalloc; 485 void *data[0]; 486 }; 487 488 489 struct ipc_rcu_grace 490 { 491 struct rcu_head rcu; 492 /* "void *" makes sure alignment of following data is sane. */ 493 void *data[0]; 494 }; 495 496 struct ipc_rcu_sched 497 { 498 struct work_struct work; 499 /* "void *" makes sure alignment of following data is sane. */ 500 void *data[0]; 501 }; 502 503 #define HDRLEN_KMALLOC (sizeof(struct ipc_rcu_grace) > sizeof(struct ipc_rcu_hdr) ? \ 504 sizeof(struct ipc_rcu_grace) : sizeof(struct ipc_rcu_hdr)) 505 #define HDRLEN_VMALLOC (sizeof(struct ipc_rcu_sched) > HDRLEN_KMALLOC ? \ 506 sizeof(struct ipc_rcu_sched) : HDRLEN_KMALLOC) 507 508 static inline int rcu_use_vmalloc(int size) 509 { 510 /* Too big for a single page? */ 511 if (HDRLEN_KMALLOC + size > PAGE_SIZE) 512 return 1; 513 return 0; 514 } 515 516 /** 517 * ipc_rcu_alloc - allocate ipc and rcu space 518 * @size: size desired 519 * 520 * Allocate memory for the rcu header structure + the object. 521 * Returns the pointer to the object. 522 * NULL is returned if the allocation fails. 523 */ 524 525 void* ipc_rcu_alloc(int size) 526 { 527 void* out; 528 /* 529 * We prepend the allocation with the rcu struct, and 530 * workqueue if necessary (for vmalloc). 531 */ 532 if (rcu_use_vmalloc(size)) { 533 out = vmalloc(HDRLEN_VMALLOC + size); 534 if (out) { 535 out += HDRLEN_VMALLOC; 536 container_of(out, struct ipc_rcu_hdr, data)->is_vmalloc = 1; 537 container_of(out, struct ipc_rcu_hdr, data)->refcount = 1; 538 } 539 } else { 540 out = kmalloc(HDRLEN_KMALLOC + size, GFP_KERNEL); 541 if (out) { 542 out += HDRLEN_KMALLOC; 543 container_of(out, struct ipc_rcu_hdr, data)->is_vmalloc = 0; 544 container_of(out, struct ipc_rcu_hdr, data)->refcount = 1; 545 } 546 } 547 548 return out; 549 } 550 551 void ipc_rcu_getref(void *ptr) 552 { 553 container_of(ptr, struct ipc_rcu_hdr, data)->refcount++; 554 } 555 556 static void ipc_do_vfree(struct work_struct *work) 557 { 558 vfree(container_of(work, struct ipc_rcu_sched, work)); 559 } 560 561 /** 562 * ipc_schedule_free - free ipc + rcu space 563 * @head: RCU callback structure for queued work 564 * 565 * Since RCU callback function is called in bh, 566 * we need to defer the vfree to schedule_work(). 567 */ 568 static void ipc_schedule_free(struct rcu_head *head) 569 { 570 struct ipc_rcu_grace *grace; 571 struct ipc_rcu_sched *sched; 572 573 grace = container_of(head, struct ipc_rcu_grace, rcu); 574 sched = container_of(&(grace->data[0]), struct ipc_rcu_sched, 575 data[0]); 576 577 INIT_WORK(&sched->work, ipc_do_vfree); 578 schedule_work(&sched->work); 579 } 580 581 /** 582 * ipc_immediate_free - free ipc + rcu space 583 * @head: RCU callback structure that contains pointer to be freed 584 * 585 * Free from the RCU callback context. 586 */ 587 static void ipc_immediate_free(struct rcu_head *head) 588 { 589 struct ipc_rcu_grace *free = 590 container_of(head, struct ipc_rcu_grace, rcu); 591 kfree(free); 592 } 593 594 void ipc_rcu_putref(void *ptr) 595 { 596 if (--container_of(ptr, struct ipc_rcu_hdr, data)->refcount > 0) 597 return; 598 599 if (container_of(ptr, struct ipc_rcu_hdr, data)->is_vmalloc) { 600 call_rcu(&container_of(ptr, struct ipc_rcu_grace, data)->rcu, 601 ipc_schedule_free); 602 } else { 603 call_rcu(&container_of(ptr, struct ipc_rcu_grace, data)->rcu, 604 ipc_immediate_free); 605 } 606 } 607 608 /** 609 * ipcperms - check IPC permissions 610 * @ipcp: IPC permission set 611 * @flag: desired permission set. 612 * 613 * Check user, group, other permissions for access 614 * to ipc resources. return 0 if allowed 615 */ 616 617 int ipcperms (struct kern_ipc_perm *ipcp, short flag) 618 { /* flag will most probably be 0 or S_...UGO from <linux/stat.h> */ 619 int requested_mode, granted_mode, err; 620 621 if (unlikely((err = audit_ipc_obj(ipcp)))) 622 return err; 623 requested_mode = (flag >> 6) | (flag >> 3) | flag; 624 granted_mode = ipcp->mode; 625 if (current->euid == ipcp->cuid || current->euid == ipcp->uid) 626 granted_mode >>= 6; 627 else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid)) 628 granted_mode >>= 3; 629 /* is there some bit set in requested_mode but not in granted_mode? */ 630 if ((requested_mode & ~granted_mode & 0007) && 631 !capable(CAP_IPC_OWNER)) 632 return -1; 633 634 return security_ipc_permission(ipcp, flag); 635 } 636 637 /* 638 * Functions to convert between the kern_ipc_perm structure and the 639 * old/new ipc_perm structures 640 */ 641 642 /** 643 * kernel_to_ipc64_perm - convert kernel ipc permissions to user 644 * @in: kernel permissions 645 * @out: new style IPC permissions 646 * 647 * Turn the kernel object @in into a set of permissions descriptions 648 * for returning to userspace (@out). 649 */ 650 651 652 void kernel_to_ipc64_perm (struct kern_ipc_perm *in, struct ipc64_perm *out) 653 { 654 out->key = in->key; 655 out->uid = in->uid; 656 out->gid = in->gid; 657 out->cuid = in->cuid; 658 out->cgid = in->cgid; 659 out->mode = in->mode; 660 out->seq = in->seq; 661 } 662 663 /** 664 * ipc64_perm_to_ipc_perm - convert new ipc permissions to old 665 * @in: new style IPC permissions 666 * @out: old style IPC permissions 667 * 668 * Turn the new style permissions object @in into a compatibility 669 * object and store it into the @out pointer. 670 */ 671 672 void ipc64_perm_to_ipc_perm (struct ipc64_perm *in, struct ipc_perm *out) 673 { 674 out->key = in->key; 675 SET_UID(out->uid, in->uid); 676 SET_GID(out->gid, in->gid); 677 SET_UID(out->cuid, in->cuid); 678 SET_GID(out->cgid, in->cgid); 679 out->mode = in->mode; 680 out->seq = in->seq; 681 } 682 683 /** 684 * ipc_lock - Lock an ipc structure without rw_mutex held 685 * @ids: IPC identifier set 686 * @id: ipc id to look for 687 * 688 * Look for an id in the ipc ids idr and lock the associated ipc object. 689 * 690 * The ipc object is locked on exit. 691 * 692 * This is the routine that should be called when the rw_mutex is not already 693 * held, i.e. idr tree not protected: it protects the idr tree in read mode 694 * during the idr_find(). 695 */ 696 697 struct kern_ipc_perm *ipc_lock(struct ipc_ids *ids, int id) 698 { 699 struct kern_ipc_perm *out; 700 int lid = ipcid_to_idx(id); 701 702 down_read(&ids->rw_mutex); 703 704 rcu_read_lock(); 705 out = idr_find(&ids->ipcs_idr, lid); 706 if (out == NULL) { 707 rcu_read_unlock(); 708 up_read(&ids->rw_mutex); 709 return ERR_PTR(-EINVAL); 710 } 711 712 up_read(&ids->rw_mutex); 713 714 spin_lock(&out->lock); 715 716 /* ipc_rmid() may have already freed the ID while ipc_lock 717 * was spinning: here verify that the structure is still valid 718 */ 719 if (out->deleted) { 720 spin_unlock(&out->lock); 721 rcu_read_unlock(); 722 return ERR_PTR(-EINVAL); 723 } 724 725 return out; 726 } 727 728 /** 729 * ipc_lock_down - Lock an ipc structure with rw_sem held 730 * @ids: IPC identifier set 731 * @id: ipc id to look for 732 * 733 * Look for an id in the ipc ids idr and lock the associated ipc object. 734 * 735 * The ipc object is locked on exit. 736 * 737 * This is the routine that should be called when the rw_mutex is already 738 * held, i.e. idr tree protected. 739 */ 740 741 struct kern_ipc_perm *ipc_lock_down(struct ipc_ids *ids, int id) 742 { 743 struct kern_ipc_perm *out; 744 int lid = ipcid_to_idx(id); 745 746 rcu_read_lock(); 747 out = idr_find(&ids->ipcs_idr, lid); 748 if (out == NULL) { 749 rcu_read_unlock(); 750 return ERR_PTR(-EINVAL); 751 } 752 753 spin_lock(&out->lock); 754 755 /* 756 * No need to verify that the structure is still valid since the 757 * rw_mutex is held. 758 */ 759 return out; 760 } 761 762 struct kern_ipc_perm *ipc_lock_check_down(struct ipc_ids *ids, int id) 763 { 764 struct kern_ipc_perm *out; 765 766 out = ipc_lock_down(ids, id); 767 if (IS_ERR(out)) 768 return out; 769 770 if (ipc_checkid(out, id)) { 771 ipc_unlock(out); 772 return ERR_PTR(-EIDRM); 773 } 774 775 return out; 776 } 777 778 struct kern_ipc_perm *ipc_lock_check(struct ipc_ids *ids, int id) 779 { 780 struct kern_ipc_perm *out; 781 782 out = ipc_lock(ids, id); 783 if (IS_ERR(out)) 784 return out; 785 786 if (ipc_checkid(out, id)) { 787 ipc_unlock(out); 788 return ERR_PTR(-EIDRM); 789 } 790 791 return out; 792 } 793 794 /** 795 * ipcget - Common sys_*get() code 796 * @ns : namsepace 797 * @ids : IPC identifier set 798 * @ops : operations to be called on ipc object creation, permission checks 799 * and further checks 800 * @params : the parameters needed by the previous operations. 801 * 802 * Common routine called by sys_msgget(), sys_semget() and sys_shmget(). 803 */ 804 int ipcget(struct ipc_namespace *ns, struct ipc_ids *ids, 805 struct ipc_ops *ops, struct ipc_params *params) 806 { 807 if (params->key == IPC_PRIVATE) 808 return ipcget_new(ns, ids, ops, params); 809 else 810 return ipcget_public(ns, ids, ops, params); 811 } 812 813 /** 814 * ipc_update_perm - update the permissions of an IPC. 815 * @in: the permission given as input. 816 * @out: the permission of the ipc to set. 817 */ 818 void ipc_update_perm(struct ipc64_perm *in, struct kern_ipc_perm *out) 819 { 820 out->uid = in->uid; 821 out->gid = in->gid; 822 out->mode = (out->mode & ~S_IRWXUGO) 823 | (in->mode & S_IRWXUGO); 824 } 825 826 /** 827 * ipcctl_pre_down - retrieve an ipc and check permissions for some IPC_XXX cmd 828 * @ids: the table of ids where to look for the ipc 829 * @id: the id of the ipc to retrieve 830 * @cmd: the cmd to check 831 * @perm: the permission to set 832 * @extra_perm: one extra permission parameter used by msq 833 * 834 * This function does some common audit and permissions check for some IPC_XXX 835 * cmd and is called from semctl_down, shmctl_down and msgctl_down. 836 * It must be called without any lock held and 837 * - retrieves the ipc with the given id in the given table. 838 * - performs some audit and permission check, depending on the given cmd 839 * - returns the ipc with both ipc and rw_mutex locks held in case of success 840 * or an err-code without any lock held otherwise. 841 */ 842 struct kern_ipc_perm *ipcctl_pre_down(struct ipc_ids *ids, int id, int cmd, 843 struct ipc64_perm *perm, int extra_perm) 844 { 845 struct kern_ipc_perm *ipcp; 846 int err; 847 848 down_write(&ids->rw_mutex); 849 ipcp = ipc_lock_check_down(ids, id); 850 if (IS_ERR(ipcp)) { 851 err = PTR_ERR(ipcp); 852 goto out_up; 853 } 854 855 err = audit_ipc_obj(ipcp); 856 if (err) 857 goto out_unlock; 858 859 if (cmd == IPC_SET) { 860 err = audit_ipc_set_perm(extra_perm, perm->uid, 861 perm->gid, perm->mode); 862 if (err) 863 goto out_unlock; 864 } 865 if (current->euid == ipcp->cuid || 866 current->euid == ipcp->uid || capable(CAP_SYS_ADMIN)) 867 return ipcp; 868 869 err = -EPERM; 870 out_unlock: 871 ipc_unlock(ipcp); 872 out_up: 873 up_write(&ids->rw_mutex); 874 return ERR_PTR(err); 875 } 876 877 #ifdef __ARCH_WANT_IPC_PARSE_VERSION 878 879 880 /** 881 * ipc_parse_version - IPC call version 882 * @cmd: pointer to command 883 * 884 * Return IPC_64 for new style IPC and IPC_OLD for old style IPC. 885 * The @cmd value is turned from an encoding command and version into 886 * just the command code. 887 */ 888 889 int ipc_parse_version (int *cmd) 890 { 891 if (*cmd & IPC_64) { 892 *cmd ^= IPC_64; 893 return IPC_64; 894 } else { 895 return IPC_OLD; 896 } 897 } 898 899 #endif /* __ARCH_WANT_IPC_PARSE_VERSION */ 900 901 #ifdef CONFIG_PROC_FS 902 struct ipc_proc_iter { 903 struct ipc_namespace *ns; 904 struct ipc_proc_iface *iface; 905 }; 906 907 /* 908 * This routine locks the ipc structure found at least at position pos. 909 */ 910 static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, 911 loff_t *new_pos) 912 { 913 struct kern_ipc_perm *ipc; 914 int total, id; 915 916 total = 0; 917 for (id = 0; id < pos && total < ids->in_use; id++) { 918 ipc = idr_find(&ids->ipcs_idr, id); 919 if (ipc != NULL) 920 total++; 921 } 922 923 if (total >= ids->in_use) 924 return NULL; 925 926 for ( ; pos < IPCMNI; pos++) { 927 ipc = idr_find(&ids->ipcs_idr, pos); 928 if (ipc != NULL) { 929 *new_pos = pos + 1; 930 ipc_lock_by_ptr(ipc); 931 return ipc; 932 } 933 } 934 935 /* Out of range - return NULL to terminate iteration */ 936 return NULL; 937 } 938 939 static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos) 940 { 941 struct ipc_proc_iter *iter = s->private; 942 struct ipc_proc_iface *iface = iter->iface; 943 struct kern_ipc_perm *ipc = it; 944 945 /* If we had an ipc id locked before, unlock it */ 946 if (ipc && ipc != SEQ_START_TOKEN) 947 ipc_unlock(ipc); 948 949 return sysvipc_find_ipc(&iter->ns->ids[iface->ids], *pos, pos); 950 } 951 952 /* 953 * File positions: pos 0 -> header, pos n -> ipc id = n - 1. 954 * SeqFile iterator: iterator value locked ipc pointer or SEQ_TOKEN_START. 955 */ 956 static void *sysvipc_proc_start(struct seq_file *s, loff_t *pos) 957 { 958 struct ipc_proc_iter *iter = s->private; 959 struct ipc_proc_iface *iface = iter->iface; 960 struct ipc_ids *ids; 961 962 ids = &iter->ns->ids[iface->ids]; 963 964 /* 965 * Take the lock - this will be released by the corresponding 966 * call to stop(). 967 */ 968 down_read(&ids->rw_mutex); 969 970 /* pos < 0 is invalid */ 971 if (*pos < 0) 972 return NULL; 973 974 /* pos == 0 means header */ 975 if (*pos == 0) 976 return SEQ_START_TOKEN; 977 978 /* Find the (pos-1)th ipc */ 979 return sysvipc_find_ipc(ids, *pos - 1, pos); 980 } 981 982 static void sysvipc_proc_stop(struct seq_file *s, void *it) 983 { 984 struct kern_ipc_perm *ipc = it; 985 struct ipc_proc_iter *iter = s->private; 986 struct ipc_proc_iface *iface = iter->iface; 987 struct ipc_ids *ids; 988 989 /* If we had a locked structure, release it */ 990 if (ipc && ipc != SEQ_START_TOKEN) 991 ipc_unlock(ipc); 992 993 ids = &iter->ns->ids[iface->ids]; 994 /* Release the lock we took in start() */ 995 up_read(&ids->rw_mutex); 996 } 997 998 static int sysvipc_proc_show(struct seq_file *s, void *it) 999 { 1000 struct ipc_proc_iter *iter = s->private; 1001 struct ipc_proc_iface *iface = iter->iface; 1002 1003 if (it == SEQ_START_TOKEN) 1004 return seq_puts(s, iface->header); 1005 1006 return iface->show(s, it); 1007 } 1008 1009 static struct seq_operations sysvipc_proc_seqops = { 1010 .start = sysvipc_proc_start, 1011 .stop = sysvipc_proc_stop, 1012 .next = sysvipc_proc_next, 1013 .show = sysvipc_proc_show, 1014 }; 1015 1016 static int sysvipc_proc_open(struct inode *inode, struct file *file) 1017 { 1018 int ret; 1019 struct seq_file *seq; 1020 struct ipc_proc_iter *iter; 1021 1022 ret = -ENOMEM; 1023 iter = kmalloc(sizeof(*iter), GFP_KERNEL); 1024 if (!iter) 1025 goto out; 1026 1027 ret = seq_open(file, &sysvipc_proc_seqops); 1028 if (ret) 1029 goto out_kfree; 1030 1031 seq = file->private_data; 1032 seq->private = iter; 1033 1034 iter->iface = PDE(inode)->data; 1035 iter->ns = get_ipc_ns(current->nsproxy->ipc_ns); 1036 out: 1037 return ret; 1038 out_kfree: 1039 kfree(iter); 1040 goto out; 1041 } 1042 1043 static int sysvipc_proc_release(struct inode *inode, struct file *file) 1044 { 1045 struct seq_file *seq = file->private_data; 1046 struct ipc_proc_iter *iter = seq->private; 1047 put_ipc_ns(iter->ns); 1048 return seq_release_private(inode, file); 1049 } 1050 1051 static const struct file_operations sysvipc_proc_fops = { 1052 .open = sysvipc_proc_open, 1053 .read = seq_read, 1054 .llseek = seq_lseek, 1055 .release = sysvipc_proc_release, 1056 }; 1057 #endif /* CONFIG_PROC_FS */ 1058