[deliverable/linux.git] / ipc / msg.c

/*
 * linux/ipc/msg.c
 * Copyright (C) 1992 Krishna Balasubramanian 
 *
 * Removed all the remaining kerneld mess
 * Catch the -EFAULT stuff properly
 * Use GFP_KERNEL for messages as in 1.2
 * Fixed up the unchecked user space derefs
 * Copyright (C) 1998 Alan Cox & Andi Kleen
 *
 * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
 *
 * mostly rewritten, threaded and wake-one semantics added
 * MSGMAX limit removed, sysctl's added
 * (c) 1999 Manfred Spraul <manfred@colorfullife.com>
 *
 * support for audit of ipc object properties and permission changes
 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
 */

#include <linux/capability.h>
#include <linux/slab.h>
#include <linux/msg.h>
#include <linux/spinlock.h>
#include <linux/init.h>
#include <linux/proc_fs.h>
#include <linux/list.h>
#include <linux/security.h>
#include <linux/sched.h>
#include <linux/syscalls.h>
#include <linux/audit.h>
#include <linux/seq_file.h>
#include <linux/mutex.h>

#include <asm/current.h>
#include <asm/uaccess.h>
#include "util.h"

/* sysctl: */
int msg_ctlmax = MSGMAX;
int msg_ctlmnb = MSGMNB;
int msg_ctlmni = MSGMNI;

/* one msg_receiver structure for each sleeping receiver */
struct msg_receiver {
	struct list_head r_list;
	struct task_struct* r_tsk;

	int r_mode;
	long r_msgtype;
	long r_maxsize;

	struct msg_msg* volatile r_msg;
};

/* one msg_sender for each sleeping sender */
struct msg_sender {
	struct list_head list;
	struct task_struct* tsk;
};

#define SEARCH_ANY		1
#define SEARCH_EQUAL		2
#define SEARCH_NOTEQUAL		3
#define SEARCH_LESSEQUAL	4

static atomic_t msg_bytes = ATOMIC_INIT(0);
static atomic_t msg_hdrs = ATOMIC_INIT(0);

static struct ipc_ids msg_ids;

#define msg_lock(id)	((struct msg_queue*)ipc_lock(&msg_ids,id))
#define msg_unlock(msq)	ipc_unlock(&(msq)->q_perm)
#define msg_rmid(id)	((struct msg_queue*)ipc_rmid(&msg_ids,id))
#define msg_checkid(msq, msgid)	\
	ipc_checkid(&msg_ids,&msq->q_perm,msgid)
#define msg_buildid(id, seq) \
	ipc_buildid(&msg_ids, id, seq)

static void freeque (struct msg_queue *msq, int id);
static int newque (key_t key, int msgflg);
#ifdef CONFIG_PROC_FS
static int sysvipc_msg_proc_show(struct seq_file *s, void *it);
#endif

void __init msg_init (void)
{
	ipc_init_ids(&msg_ids,msg_ctlmni);
	ipc_init_proc_interface("sysvipc/msg",
				"       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
				&msg_ids,
				sysvipc_msg_proc_show);
}

static int newque (key_t key, int msgflg)
{
	int id;
	int retval;
	struct msg_queue *msq;

	msq  = ipc_rcu_alloc(sizeof(*msq));
	if (!msq) 
		return -ENOMEM;

	msq->q_perm.mode = (msgflg & S_IRWXUGO);
	msq->q_perm.key = key;

	msq->q_perm.security = NULL;
	retval = security_msg_queue_alloc(msq);
	if (retval) {
		ipc_rcu_putref(msq);
		return retval;
	}

	id = ipc_addid(&msg_ids, &msq->q_perm, msg_ctlmni);
	if(id == -1) {
		security_msg_queue_free(msq);
		ipc_rcu_putref(msq);
		return -ENOSPC;
	}

	msq->q_id = msg_buildid(id,msq->q_perm.seq);
	msq->q_stime = msq->q_rtime = 0;
	msq->q_ctime = get_seconds();
	msq->q_cbytes = msq->q_qnum = 0;
	msq->q_qbytes = msg_ctlmnb;
	msq->q_lspid = msq->q_lrpid = 0;
	INIT_LIST_HEAD(&msq->q_messages);
	INIT_LIST_HEAD(&msq->q_receivers);
	INIT_LIST_HEAD(&msq->q_senders);
	msg_unlock(msq);

	return msq->q_id;
}

static inline void ss_add(struct msg_queue* msq, struct msg_sender* mss)
{
	mss->tsk=current;
	current->state=TASK_INTERRUPTIBLE;
	list_add_tail(&mss->list,&msq->q_senders);
}

static inline void ss_del(struct msg_sender* mss)
{
	if(mss->list.next != NULL)
		list_del(&mss->list);
}

static void ss_wakeup(struct list_head* h, int kill)
{
	struct list_head *tmp;

	tmp = h->next;
	while (tmp != h) {
		struct msg_sender* mss;
		
		mss = list_entry(tmp,struct msg_sender,list);
		tmp = tmp->next;
		if(kill)
			mss->list.next=NULL;
		wake_up_process(mss->tsk);
	}
}

static void expunge_all(struct msg_queue* msq, int res)
{
	struct list_head *tmp;

	tmp = msq->q_receivers.next;
	while (tmp != &msq->q_receivers) {
		struct msg_receiver* msr;
		
		msr = list_entry(tmp,struct msg_receiver,r_list);
		tmp = tmp->next;
		msr->r_msg = NULL;
		wake_up_process(msr->r_tsk);
		smp_mb();
		msr->r_msg = ERR_PTR(res);
	}
}
/* 
 * freeque() wakes up waiters on the sender and receiver waiting queue, 
 * removes the message queue from message queue ID 
 * array, and cleans up all the messages associated with this queue.
 *
 * msg_ids.mutex and the spinlock for this message queue is hold
 * before freeque() is called. msg_ids.mutex remains locked on exit.
 */
static void freeque (struct msg_queue *msq, int id)
{
	struct list_head *tmp;

	expunge_all(msq,-EIDRM);
	ss_wakeup(&msq->q_senders,1);
	msq = msg_rmid(id);
	msg_unlock(msq);
		
	tmp = msq->q_messages.next;
	while(tmp != &msq->q_messages) {
		struct msg_msg* msg = list_entry(tmp,struct msg_msg,m_list);
		tmp = tmp->next;
		atomic_dec(&msg_hdrs);
		free_msg(msg);
	}
	atomic_sub(msq->q_cbytes, &msg_bytes);
	security_msg_queue_free(msq);
	ipc_rcu_putref(msq);
}

asmlinkage long sys_msgget (key_t key, int msgflg)
{
	int id, ret = -EPERM;
	struct msg_queue *msq;
	
	mutex_lock(&msg_ids.mutex);
	if (key == IPC_PRIVATE) 
		ret = newque(key, msgflg);
	else if ((id = ipc_findkey(&msg_ids, key)) == -1) { /* key not used */
		if (!(msgflg & IPC_CREAT))
			ret = -ENOENT;
		else
			ret = newque(key, msgflg);
	} else if (msgflg & IPC_CREAT && msgflg & IPC_EXCL) {
		ret = -EEXIST;
	} else {
		msq = msg_lock(id);
		BUG_ON(msq==NULL);
		if (ipcperms(&msq->q_perm, msgflg))
			ret = -EACCES;
		else {
			int qid = msg_buildid(id, msq->q_perm.seq);
		    	ret = security_msg_queue_associate(msq, msgflg);
			if (!ret)
				ret = qid;
		}
		msg_unlock(msq);
	}
	mutex_unlock(&msg_ids.mutex);
	return ret;
}

static inline unsigned long copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
{
	switch(version) {
	case IPC_64:
		return copy_to_user (buf, in, sizeof(*in));
	case IPC_OLD:
	    {
		struct msqid_ds out;

		memset(&out,0,sizeof(out));

		ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);

		out.msg_stime		= in->msg_stime;
		out.msg_rtime		= in->msg_rtime;
		out.msg_ctime		= in->msg_ctime;

		if(in->msg_cbytes > USHRT_MAX)
			out.msg_cbytes	= USHRT_MAX;
		else
			out.msg_cbytes	= in->msg_cbytes;
		out.msg_lcbytes		= in->msg_cbytes;

		if(in->msg_qnum > USHRT_MAX)
			out.msg_qnum	= USHRT_MAX;
		else
			out.msg_qnum	= in->msg_qnum;

		if(in->msg_qbytes > USHRT_MAX)
			out.msg_qbytes	= USHRT_MAX;
		else
			out.msg_qbytes	= in->msg_qbytes;
		out.msg_lqbytes		= in->msg_qbytes;

		out.msg_lspid		= in->msg_lspid;
		out.msg_lrpid		= in->msg_lrpid;

		return copy_to_user (buf, &out, sizeof(out));
	    }
	default:
		return -EINVAL;
	}
}

struct msq_setbuf {
	unsigned long	qbytes;
	uid_t		uid;
	gid_t		gid;
	mode_t		mode;
};

static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
{
	switch(version) {
	case IPC_64:
	    {
		struct msqid64_ds tbuf;

		if (copy_from_user (&tbuf, buf, sizeof (tbuf)))
			return -EFAULT;

		out->qbytes		= tbuf.msg_qbytes;
		out->uid		= tbuf.msg_perm.uid;
		out->gid		= tbuf.msg_perm.gid;
		out->mode		= tbuf.msg_perm.mode;

		return 0;
	    }
	case IPC_OLD:
	    {
		struct msqid_ds tbuf_old;

		if (copy_from_user (&tbuf_old, buf, sizeof (tbuf_old)))
			return -EFAULT;

		out->uid		= tbuf_old.msg_perm.uid;
		out->gid		= tbuf_old.msg_perm.gid;
		out->mode		= tbuf_old.msg_perm.mode;

		if(tbuf_old.msg_qbytes == 0)
			out->qbytes	= tbuf_old.msg_lqbytes;
		else
			out->qbytes	= tbuf_old.msg_qbytes;

		return 0;
	    }
	default:
		return -EINVAL;
	}
}

asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
{
	int err, version;
	struct msg_queue *msq;
	struct msq_setbuf setbuf;
	struct kern_ipc_perm *ipcp;
	
	if (msqid < 0 || cmd < 0)
		return -EINVAL;

	version = ipc_parse_version(&cmd);

	switch (cmd) {
	case IPC_INFO: 
	case MSG_INFO: 
	{ 
		struct msginfo msginfo;
		int max_id;
		if (!buf)
			return -EFAULT;
		/* We must not return kernel stack data.
		 * due to padding, it's not enough
		 * to set all member fields.
		 */

		err = security_msg_queue_msgctl(NULL, cmd);
		if (err)
			return err;

		memset(&msginfo,0,sizeof(msginfo));	
		msginfo.msgmni = msg_ctlmni;
		msginfo.msgmax = msg_ctlmax;
		msginfo.msgmnb = msg_ctlmnb;
		msginfo.msgssz = MSGSSZ;
		msginfo.msgseg = MSGSEG;
		mutex_lock(&msg_ids.mutex);
		if (cmd == MSG_INFO) {
			msginfo.msgpool = msg_ids.in_use;
			msginfo.msgmap = atomic_read(&msg_hdrs);
			msginfo.msgtql = atomic_read(&msg_bytes);
		} else {
			msginfo.msgmap = MSGMAP;
			msginfo.msgpool = MSGPOOL;
			msginfo.msgtql = MSGTQL;
		}
		max_id = msg_ids.max_id;
		mutex_unlock(&msg_ids.mutex);
		if (copy_to_user (buf, &msginfo, sizeof(struct msginfo)))
			return -EFAULT;
		return (max_id < 0) ? 0: max_id;
	}
	case MSG_STAT:
	case IPC_STAT:
	{
		struct msqid64_ds tbuf;
		int success_return;
		if (!buf)
			return -EFAULT;
		if(cmd == MSG_STAT && msqid >= msg_ids.entries->size)
			return -EINVAL;

		memset(&tbuf,0,sizeof(tbuf));

		msq = msg_lock(msqid);
		if (msq == NULL)
			return -EINVAL;

		if(cmd == MSG_STAT) {
			success_return = msg_buildid(msqid, msq->q_perm.seq);
		} else {
			err = -EIDRM;
			if (msg_checkid(msq,msqid))
				goto out_unlock;
			success_return = 0;
		}
		err = -EACCES;
		if (ipcperms (&msq->q_perm, S_IRUGO))
			goto out_unlock;

		err = security_msg_queue_msgctl(msq, cmd);
		if (err)
			goto out_unlock;

		kernel_to_ipc64_perm(&msq->q_perm, &tbuf.msg_perm);
		tbuf.msg_stime  = msq->q_stime;
		tbuf.msg_rtime  = msq->q_rtime;
		tbuf.msg_ctime  = msq->q_ctime;
		tbuf.msg_cbytes = msq->q_cbytes;
		tbuf.msg_qnum   = msq->q_qnum;
		tbuf.msg_qbytes = msq->q_qbytes;
		tbuf.msg_lspid  = msq->q_lspid;
		tbuf.msg_lrpid  = msq->q_lrpid;
		msg_unlock(msq);
		if (copy_msqid_to_user(buf, &tbuf, version))
			return -EFAULT;
		return success_return;
	}
	case IPC_SET:
		if (!buf)
			return -EFAULT;
		if (copy_msqid_from_user (&setbuf, buf, version))
			return -EFAULT;
		break;
	case IPC_RMID:
		break;
	default:
		return  -EINVAL;
	}

	mutex_lock(&msg_ids.mutex);
	msq = msg_lock(msqid);
	err=-EINVAL;
	if (msq == NULL)
		goto out_up;

	err = -EIDRM;
	if (msg_checkid(msq,msqid))
		goto out_unlock_up;
	ipcp = &msq->q_perm;

	err = audit_ipc_obj(ipcp);
	if (err)
		goto out_unlock_up;
	if (cmd==IPC_SET) {
		err = audit_ipc_set_perm(setbuf.qbytes, setbuf.uid, setbuf.gid, setbuf.mode);
		if (err)
			goto out_unlock_up;
	}

	err = -EPERM;
	if (current->euid != ipcp->cuid && 
	    current->euid != ipcp->uid && !capable(CAP_SYS_ADMIN))
	    /* We _could_ check for CAP_CHOWN above, but we don't */
		goto out_unlock_up;

	err = security_msg_queue_msgctl(msq, cmd);
	if (err)
		goto out_unlock_up;

	switch (cmd) {
	case IPC_SET:
	{
		err = -EPERM;
		if (setbuf.qbytes > msg_ctlmnb && !capable(CAP_SYS_RESOURCE))
			goto out_unlock_up;

		msq->q_qbytes = setbuf.qbytes;

		ipcp->uid = setbuf.uid;
		ipcp->gid = setbuf.gid;
		ipcp->mode = (ipcp->mode & ~S_IRWXUGO) | 
			(S_IRWXUGO & setbuf.mode);
		msq->q_ctime = get_seconds();
		/* sleeping receivers might be excluded by
		 * stricter permissions.
		 */
		expunge_all(msq,-EAGAIN);
		/* sleeping senders might be able to send
		 * due to a larger queue size.
		 */
		ss_wakeup(&msq->q_senders,0);
		msg_unlock(msq);
		break;
	}
	case IPC_RMID:
		freeque (msq, msqid); 
		break;
	}
	err = 0;
out_up:
	mutex_unlock(&msg_ids.mutex);
	return err;
out_unlock_up:
	msg_unlock(msq);
	goto out_up;
out_unlock:
	msg_unlock(msq);
	return err;
}

static int testmsg(struct msg_msg* msg,long type,int mode)
{
	switch(mode)
	{
		case SEARCH_ANY:
			return 1;
		case SEARCH_LESSEQUAL:
			if(msg->m_type <=type)
				return 1;
			break;
		case SEARCH_EQUAL:
			if(msg->m_type == type)
				return 1;
			break;
		case SEARCH_NOTEQUAL:
			if(msg->m_type != type)
				return 1;
			break;
	}
	return 0;
}

static inline int pipelined_send(struct msg_queue* msq, struct msg_msg* msg)
{
	struct list_head* tmp;

	tmp = msq->q_receivers.next;
	while (tmp != &msq->q_receivers) {
		struct msg_receiver* msr;
		msr = list_entry(tmp,struct msg_receiver,r_list);
		tmp = tmp->next;
		if(testmsg(msg,msr->r_msgtype,msr->r_mode) &&
		   !security_msg_queue_msgrcv(msq, msg, msr->r_tsk, msr->r_msgtype, msr->r_mode)) {
			list_del(&msr->r_list);
			if(msr->r_maxsize < msg->m_ts) {
				msr->r_msg = NULL;
				wake_up_process(msr->r_tsk);
				smp_mb();
				msr->r_msg = ERR_PTR(-E2BIG);
			} else {
				msr->r_msg = NULL;
				msq->q_lrpid = msr->r_tsk->pid;
				msq->q_rtime = get_seconds();
				wake_up_process(msr->r_tsk);
				smp_mb();
				msr->r_msg = msg;
				return 1;
			}
		}
	}
	return 0;
}

asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
{
	struct msg_queue *msq;
	struct msg_msg *msg;
	long mtype;
	int err;
	
	if (msgsz > msg_ctlmax || (long) msgsz < 0 || msqid < 0)
		return -EINVAL;
	if (get_user(mtype, &msgp->mtype))
		return -EFAULT; 
	if (mtype < 1)
		return -EINVAL;

	msg = load_msg(msgp->mtext, msgsz);
	if(IS_ERR(msg))
		return PTR_ERR(msg);

	msg->m_type = mtype;
	msg->m_ts = msgsz;

	msq = msg_lock(msqid);
	err=-EINVAL;
	if(msq==NULL)
		goto out_free;

	err= -EIDRM;
	if (msg_checkid(msq,msqid))
		goto out_unlock_free;

	for (;;) {
		struct msg_sender s;

		err=-EACCES;
		if (ipcperms(&msq->q_perm, S_IWUGO))
			goto out_unlock_free;

		err = security_msg_queue_msgsnd(msq, msg, msgflg);
		if (err)
			goto out_unlock_free;

		if(msgsz + msq->q_cbytes <= msq->q_qbytes &&
				1 + msq->q_qnum <= msq->q_qbytes) {
			break;
		}

		/* queue full, wait: */
		if(msgflg&IPC_NOWAIT) {
			err=-EAGAIN;
			goto out_unlock_free;
		}
		ss_add(msq, &s);
		ipc_rcu_getref(msq);
		msg_unlock(msq);
		schedule();

		ipc_lock_by_ptr(&msq->q_perm);
		ipc_rcu_putref(msq);
		if (msq->q_perm.deleted) {
			err = -EIDRM;
			goto out_unlock_free;
		}
		ss_del(&s);
		
		if (signal_pending(current)) {
			err=-ERESTARTNOHAND;
			goto out_unlock_free;
		}
	}

	msq->q_lspid = current->tgid;
	msq->q_stime = get_seconds();

	if(!pipelined_send(msq,msg)) {
		/* noone is waiting for this message, enqueue it */
		list_add_tail(&msg->m_list,&msq->q_messages);
		msq->q_cbytes += msgsz;
		msq->q_qnum++;
		atomic_add(msgsz,&msg_bytes);
		atomic_inc(&msg_hdrs);
	}
	
	err = 0;
	msg = NULL;

out_unlock_free:
	msg_unlock(msq);
out_free:
	if(msg!=NULL)
		free_msg(msg);
	return err;
}

static inline int convert_mode(long* msgtyp, int msgflg)
{
	/* 
	 *  find message of correct type.
	 *  msgtyp = 0 => get first.
	 *  msgtyp > 0 => get first message of matching type.
	 *  msgtyp < 0 => get message with least type must be < abs(msgtype).  
	 */
	if(*msgtyp==0)
		return SEARCH_ANY;
	if(*msgtyp<0) {
		*msgtyp=-(*msgtyp);
		return SEARCH_LESSEQUAL;
	}
	if(msgflg & MSG_EXCEPT)
		return SEARCH_NOTEQUAL;
	return SEARCH_EQUAL;
}

asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
			    long msgtyp, int msgflg)
{
	struct msg_queue *msq;
	struct msg_msg *msg;
	int mode;

	if (msqid < 0 || (long) msgsz < 0)
		return -EINVAL;
	mode = convert_mode(&msgtyp,msgflg);

	msq = msg_lock(msqid);
	if(msq==NULL)
		return -EINVAL;

	msg = ERR_PTR(-EIDRM);
	if (msg_checkid(msq,msqid))
		goto out_unlock;

	for (;;) {
		struct msg_receiver msr_d;
		struct list_head* tmp;

		msg = ERR_PTR(-EACCES);
		if (ipcperms (&msq->q_perm, S_IRUGO))
			goto out_unlock;

		msg = ERR_PTR(-EAGAIN);
		tmp = msq->q_messages.next;
		while (tmp != &msq->q_messages) {
			struct msg_msg *walk_msg;
			walk_msg = list_entry(tmp,struct msg_msg,m_list);
			if(testmsg(walk_msg,msgtyp,mode) &&
			   !security_msg_queue_msgrcv(msq, walk_msg, current, msgtyp, mode)) {
				msg = walk_msg;
				if(mode == SEARCH_LESSEQUAL && walk_msg->m_type != 1) {
					msg=walk_msg;
					msgtyp=walk_msg->m_type-1;
				} else {
					msg=walk_msg;
					break;
				}
			}
			tmp = tmp->next;
		}
		if(!IS_ERR(msg)) {
			/* Found a suitable message. Unlink it from the queue. */
			if ((msgsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
				msg = ERR_PTR(-E2BIG);
				goto out_unlock;
			}
			list_del(&msg->m_list);
			msq->q_qnum--;
			msq->q_rtime = get_seconds();
			msq->q_lrpid = current->tgid;
			msq->q_cbytes -= msg->m_ts;
			atomic_sub(msg->m_ts,&msg_bytes);
			atomic_dec(&msg_hdrs);
			ss_wakeup(&msq->q_senders,0);
			msg_unlock(msq);
			break;
		}
		/* No message waiting. Wait for a message */
		if (msgflg & IPC_NOWAIT) {
			msg = ERR_PTR(-ENOMSG);
			goto out_unlock;
		}
		list_add_tail(&msr_d.r_list,&msq->q_receivers);
		msr_d.r_tsk = current;
		msr_d.r_msgtype = msgtyp;
		msr_d.r_mode = mode;
		if(msgflg & MSG_NOERROR)
			msr_d.r_maxsize = INT_MAX;
		 else
			msr_d.r_maxsize = msgsz;
		msr_d.r_msg = ERR_PTR(-EAGAIN);
		current->state = TASK_INTERRUPTIBLE;
		msg_unlock(msq);

		schedule();

		/* Lockless receive, part 1:
		 * Disable preemption.  We don't hold a reference to the queue
		 * and getting a reference would defeat the idea of a lockless
		 * operation, thus the code relies on rcu to guarantee the
		 * existance of msq:
		 * Prior to destruction, expunge_all(-EIRDM) changes r_msg.
		 * Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
		 * rcu_read_lock() prevents preemption between reading r_msg
		 * and the spin_lock() inside ipc_lock_by_ptr().
		 */
		rcu_read_lock();

		/* Lockless receive, part 2:
		 * Wait until pipelined_send or expunge_all are outside of
		 * wake_up_process(). There is a race with exit(), see
		 * ipc/mqueue.c for the details.
		 */
		msg = (struct msg_msg*) msr_d.r_msg;
		while (msg == NULL) {
			cpu_relax();
			msg = (struct msg_msg*) msr_d.r_msg;
		}

		/* Lockless receive, part 3:
		 * If there is a message or an error then accept it without
		 * locking.
		 */
		if(msg != ERR_PTR(-EAGAIN)) {
			rcu_read_unlock();
			break;
		}

		/* Lockless receive, part 3:
		 * Acquire the queue spinlock.
		 */
		ipc_lock_by_ptr(&msq->q_perm);
		rcu_read_unlock();

		/* Lockless receive, part 4:
		 * Repeat test after acquiring the spinlock.
		 */
		msg = (struct msg_msg*)msr_d.r_msg;
		if(msg != ERR_PTR(-EAGAIN))
			goto out_unlock;

		list_del(&msr_d.r_list);
		if (signal_pending(current)) {
			msg = ERR_PTR(-ERESTARTNOHAND);
out_unlock:
			msg_unlock(msq);
			break;
		}
	}
	if (IS_ERR(msg))
       		return PTR_ERR(msg);

	msgsz = (msgsz > msg->m_ts) ? msg->m_ts : msgsz;
	if (put_user (msg->m_type, &msgp->mtype) ||
	    store_msg(msgp->mtext, msg, msgsz)) {
		    msgsz = -EFAULT;
	}
	free_msg(msg);
	return msgsz;
}

#ifdef CONFIG_PROC_FS
static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
{
	struct msg_queue *msq = it;

	return seq_printf(s,
			  "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
			  msq->q_perm.key,
			  msq->q_id,
			  msq->q_perm.mode,
			  msq->q_cbytes,
			  msq->q_qnum,
			  msq->q_lspid,
			  msq->q_lrpid,
			  msq->q_perm.uid,
			  msq->q_perm.gid,
			  msq->q_perm.cuid,
			  msq->q_perm.cgid,
			  msq->q_stime,
			  msq->q_rtime,
			  msq->q_ctime);
}
#endif
Commit	Line	Data
1da177e4 LT	1	/*
	2	* linux/ipc/msg.c
	3	* Copyright (C) 1992 Krishna Balasubramanian
	4	*
	5	* Removed all the remaining kerneld mess
	6	* Catch the -EFAULT stuff properly
	7	* Use GFP_KERNEL for messages as in 1.2
	8	* Fixed up the unchecked user space derefs
	9	* Copyright (C) 1998 Alan Cox & Andi Kleen
	10	*
	11	* /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
	12	*
	13	* mostly rewritten, threaded and wake-one semantics added
	14	* MSGMAX limit removed, sysctl's added
624dffcb	15	* (c) 1999 Manfred Spraul <manfred@colorfullife.com>
073115d6 SG	16	*
	17	* support for audit of ipc object properties and permission changes
	18	* Dustin Kirkland <dustin.kirkland@us.ibm.com>
1da177e4 LT	19	*/
1da177e4 LT	20
c59ede7b	21	#include <linux/capability.h>
1da177e4 LT	22	#include <linux/slab.h>
	23	#include <linux/msg.h>
	24	#include <linux/spinlock.h>
	25	#include <linux/init.h>
	26	#include <linux/proc_fs.h>
	27	#include <linux/list.h>
	28	#include <linux/security.h>
	29	#include <linux/sched.h>
	30	#include <linux/syscalls.h>
	31	#include <linux/audit.h>
19b4946c	32	#include <linux/seq_file.h>
5f921ae9 IM	33	#include <linux/mutex.h>
5f921ae9 IM	34
1da177e4 LT	35	#include <asm/current.h>
	36	#include <asm/uaccess.h>
	37	#include "util.h"
	38
	39	/* sysctl: */
	40	int msg_ctlmax = MSGMAX;
	41	int msg_ctlmnb = MSGMNB;
	42	int msg_ctlmni = MSGMNI;
	43
	44	/* one msg_receiver structure for each sleeping receiver */
	45	struct msg_receiver {
	46	struct list_head r_list;
	47	struct task_struct* r_tsk;
	48
	49	int r_mode;
	50	long r_msgtype;
	51	long r_maxsize;
	52
	53	struct msg_msg* volatile r_msg;
	54	};
	55
	56	/* one msg_sender for each sleeping sender */
	57	struct msg_sender {
	58	struct list_head list;
	59	struct task_struct* tsk;
	60	};
	61
	62	#define SEARCH_ANY 1
	63	#define SEARCH_EQUAL 2
	64	#define SEARCH_NOTEQUAL 3
	65	#define SEARCH_LESSEQUAL 4
	66
	67	static atomic_t msg_bytes = ATOMIC_INIT(0);
	68	static atomic_t msg_hdrs = ATOMIC_INIT(0);
	69
	70	static struct ipc_ids msg_ids;
	71
	72	#define msg_lock(id) ((struct msg_queue*)ipc_lock(&msg_ids,id))
	73	#define msg_unlock(msq) ipc_unlock(&(msq)->q_perm)
	74	#define msg_rmid(id) ((struct msg_queue*)ipc_rmid(&msg_ids,id))
	75	#define msg_checkid(msq, msgid) \
	76	ipc_checkid(&msg_ids,&msq->q_perm,msgid)
	77	#define msg_buildid(id, seq) \
	78	ipc_buildid(&msg_ids, id, seq)
	79
	80	static void freeque (struct msg_queue *msq, int id);
	81	static int newque (key_t key, int msgflg);
	82	#ifdef CONFIG_PROC_FS
19b4946c	83	static int sysvipc_msg_proc_show(struct seq_file s, void it);
1da177e4 LT	84	#endif
	85
	86	void __init msg_init (void)
	87	{
	88	ipc_init_ids(&msg_ids,msg_ctlmni);
19b4946c MW	89	ipc_init_proc_interface("sysvipc/msg",
	90	" key msqid perms cbytes qnum lspid lrpid uid gid cuid cgid stime rtime ctime\n",
	91	&msg_ids,
	92	sysvipc_msg_proc_show);
1da177e4 LT	93	}
	94
	95	static int newque (key_t key, int msgflg)
	96	{
	97	int id;
	98	int retval;
	99	struct msg_queue *msq;
	100
	101	msq = ipc_rcu_alloc(sizeof(*msq));
	102	if (!msq)
	103	return -ENOMEM;
	104
	105	msq->q_perm.mode = (msgflg & S_IRWXUGO);
	106	msq->q_perm.key = key;
	107
	108	msq->q_perm.security = NULL;
	109	retval = security_msg_queue_alloc(msq);
	110	if (retval) {
	111	ipc_rcu_putref(msq);
	112	return retval;
	113	}
	114
	115	id = ipc_addid(&msg_ids, &msq->q_perm, msg_ctlmni);
	116	if(id == -1) {
	117	security_msg_queue_free(msq);
	118	ipc_rcu_putref(msq);
	119	return -ENOSPC;
	120	}
	121
19b4946c	122	msq->q_id = msg_buildid(id,msq->q_perm.seq);
1da177e4 LT	123	msq->q_stime = msq->q_rtime = 0;
	124	msq->q_ctime = get_seconds();
	125	msq->q_cbytes = msq->q_qnum = 0;
	126	msq->q_qbytes = msg_ctlmnb;
	127	msq->q_lspid = msq->q_lrpid = 0;
	128	INIT_LIST_HEAD(&msq->q_messages);
	129	INIT_LIST_HEAD(&msq->q_receivers);
	130	INIT_LIST_HEAD(&msq->q_senders);
	131	msg_unlock(msq);
	132
19b4946c	133	return msq->q_id;
1da177e4 LT	134	}
	135
	136	static inline void ss_add(struct msg_queue* msq, struct msg_sender* mss)
	137	{
	138	mss->tsk=current;
	139	current->state=TASK_INTERRUPTIBLE;
	140	list_add_tail(&mss->list,&msq->q_senders);
	141	}
	142
	143	static inline void ss_del(struct msg_sender* mss)
	144	{
	145	if(mss->list.next != NULL)
	146	list_del(&mss->list);
	147	}
	148
	149	static void ss_wakeup(struct list_head* h, int kill)
	150	{
	151	struct list_head *tmp;
	152
	153	tmp = h->next;
	154	while (tmp != h) {
	155	struct msg_sender* mss;
	156
	157	mss = list_entry(tmp,struct msg_sender,list);
	158	tmp = tmp->next;
	159	if(kill)
	160	mss->list.next=NULL;
	161	wake_up_process(mss->tsk);
	162	}
	163	}
	164
	165	static void expunge_all(struct msg_queue* msq, int res)
	166	{
	167	struct list_head *tmp;
	168
	169	tmp = msq->q_receivers.next;
	170	while (tmp != &msq->q_receivers) {
	171	struct msg_receiver* msr;
	172
	173	msr = list_entry(tmp,struct msg_receiver,r_list);
	174	tmp = tmp->next;
	175	msr->r_msg = NULL;
	176	wake_up_process(msr->r_tsk);
	177	smp_mb();
	178	msr->r_msg = ERR_PTR(res);
	179	}
	180	}
	181	/*
	182	* freeque() wakes up waiters on the sender and receiver waiting queue,
	183	* removes the message queue from message queue ID
	184	* array, and cleans up all the messages associated with this queue.
	185	*
5f921ae9 IM	186	* msg_ids.mutex and the spinlock for this message queue is hold
5f921ae9 IM	187	* before freeque() is called. msg_ids.mutex remains locked on exit.
1da177e4 LT	188	*/
	189	static void freeque (struct msg_queue *msq, int id)
	190	{
	191	struct list_head *tmp;
	192
	193	expunge_all(msq,-EIDRM);
	194	ss_wakeup(&msq->q_senders,1);
	195	msq = msg_rmid(id);
	196	msg_unlock(msq);
	197
	198	tmp = msq->q_messages.next;
	199	while(tmp != &msq->q_messages) {
	200	struct msg_msg* msg = list_entry(tmp,struct msg_msg,m_list);
	201	tmp = tmp->next;
	202	atomic_dec(&msg_hdrs);
	203	free_msg(msg);
	204	}
	205	atomic_sub(msq->q_cbytes, &msg_bytes);
	206	security_msg_queue_free(msq);
	207	ipc_rcu_putref(msq);
	208	}
	209
	210	asmlinkage long sys_msgget (key_t key, int msgflg)
	211	{
	212	int id, ret = -EPERM;
	213	struct msg_queue *msq;
	214
5f921ae9	215	mutex_lock(&msg_ids.mutex);
1da177e4 LT	216	if (key == IPC_PRIVATE)
	217	ret = newque(key, msgflg);
	218	else if ((id = ipc_findkey(&msg_ids, key)) == -1) { /* key not used */
	219	if (!(msgflg & IPC_CREAT))
	220	ret = -ENOENT;
	221	else
	222	ret = newque(key, msgflg);
	223	} else if (msgflg & IPC_CREAT && msgflg & IPC_EXCL) {
	224	ret = -EEXIST;
	225	} else {
	226	msq = msg_lock(id);
8cd5283b	227	BUG_ON(msq==NULL);
1da177e4 LT	228	if (ipcperms(&msq->q_perm, msgflg))
	229	ret = -EACCES;
	230	else {
	231	int qid = msg_buildid(id, msq->q_perm.seq);
	232	ret = security_msg_queue_associate(msq, msgflg);
	233	if (!ret)
	234	ret = qid;
	235	}
	236	msg_unlock(msq);
	237	}
5f921ae9	238	mutex_unlock(&msg_ids.mutex);
1da177e4 LT	239	return ret;
	240	}
	241
	242	static inline unsigned long copy_msqid_to_user(void __user buf, struct msqid64_ds in, int version)
	243	{
	244	switch(version) {
	245	case IPC_64:
	246	return copy_to_user (buf, in, sizeof(*in));
	247	case IPC_OLD:
	248	{
	249	struct msqid_ds out;
	250
	251	memset(&out,0,sizeof(out));
	252
	253	ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
	254
	255	out.msg_stime = in->msg_stime;
	256	out.msg_rtime = in->msg_rtime;
	257	out.msg_ctime = in->msg_ctime;
	258
	259	if(in->msg_cbytes > USHRT_MAX)
	260	out.msg_cbytes = USHRT_MAX;
	261	else
	262	out.msg_cbytes = in->msg_cbytes;
	263	out.msg_lcbytes = in->msg_cbytes;
	264
	265	if(in->msg_qnum > USHRT_MAX)
	266	out.msg_qnum = USHRT_MAX;
	267	else
	268	out.msg_qnum = in->msg_qnum;
	269
	270	if(in->msg_qbytes > USHRT_MAX)
	271	out.msg_qbytes = USHRT_MAX;
	272	else
	273	out.msg_qbytes = in->msg_qbytes;
	274	out.msg_lqbytes = in->msg_qbytes;
	275
	276	out.msg_lspid = in->msg_lspid;
	277	out.msg_lrpid = in->msg_lrpid;
	278
	279	return copy_to_user (buf, &out, sizeof(out));
	280	}
	281	default:
	282	return -EINVAL;
	283	}
	284	}
	285
	286	struct msq_setbuf {
	287	unsigned long qbytes;
	288	uid_t uid;
	289	gid_t gid;
	290	mode_t mode;
	291	};
	292
	293	static inline unsigned long copy_msqid_from_user(struct msq_setbuf out, void __user buf, int version)
	294	{
	295	switch(version) {
	296	case IPC_64:
	297	{
	298	struct msqid64_ds tbuf;
	299
	300	if (copy_from_user (&tbuf, buf, sizeof (tbuf)))
	301	return -EFAULT;
	302
303	out->qbytes = tbuf.msg_qbytes;
304	out->uid = tbuf.msg_perm.uid;
305	out->gid = tbuf.msg_perm.gid;
306	out->mode = tbuf.msg_perm.mode;
307
308	return 0;
309	}
310	case IPC_OLD:
311	{
312	struct msqid_ds tbuf_old;
313
314	if (copy_from_user (&tbuf_old, buf, sizeof (tbuf_old)))
315	return -EFAULT;
316
317	out->uid = tbuf_old.msg_perm.uid;
318	out->gid = tbuf_old.msg_perm.gid;
319	out->mode = tbuf_old.msg_perm.mode;
320
321	if(tbuf_old.msg_qbytes == 0)
322	out->qbytes = tbuf_old.msg_lqbytes;
323	else
324	out->qbytes = tbuf_old.msg_qbytes;
325
326	return 0;
327	}
328	default:
329	return -EINVAL;
330	}
331	}
332
333	asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
334	{
335	int err, version;
336	struct msg_queue *msq;
337	struct msq_setbuf setbuf;
338	struct kern_ipc_perm *ipcp;
339
340	if (msqid < 0 \|\| cmd < 0)
341	return -EINVAL;
342
343	version = ipc_parse_version(&cmd);
344
345	switch (cmd) {
346	case IPC_INFO:
347	case MSG_INFO:
348	{
349	struct msginfo msginfo;
350	int max_id;
351	if (!buf)
352	return -EFAULT;
353	/* We must not return kernel stack data.
354	* due to padding, it's not enough
355	* to set all member fields.
356	*/
357
358	err = security_msg_queue_msgctl(NULL, cmd);
359	if (err)
360	return err;
361
362	memset(&msginfo,0,sizeof(msginfo));
363	msginfo.msgmni = msg_ctlmni;
364	msginfo.msgmax = msg_ctlmax;
365	msginfo.msgmnb = msg_ctlmnb;
366	msginfo.msgssz = MSGSSZ;
367	msginfo.msgseg = MSGSEG;
5f921ae9	368	mutex_lock(&msg_ids.mutex);
1da177e4 LT	369	if (cmd == MSG_INFO) {
	370	msginfo.msgpool = msg_ids.in_use;
	371	msginfo.msgmap = atomic_read(&msg_hdrs);
	372	msginfo.msgtql = atomic_read(&msg_bytes);
	373	} else {
	374	msginfo.msgmap = MSGMAP;
	375	msginfo.msgpool = MSGPOOL;
	376	msginfo.msgtql = MSGTQL;
	377	}
	378	max_id = msg_ids.max_id;
5f921ae9	379	mutex_unlock(&msg_ids.mutex);
1da177e4 LT	380	if (copy_to_user (buf, &msginfo, sizeof(struct msginfo)))
	381	return -EFAULT;
	382	return (max_id < 0) ? 0: max_id;
	383	}
	384	case MSG_STAT:
	385	case IPC_STAT:
	386	{
	387	struct msqid64_ds tbuf;
	388	int success_return;
	389	if (!buf)
	390	return -EFAULT;
	391	if(cmd == MSG_STAT && msqid >= msg_ids.entries->size)
	392	return -EINVAL;
	393
	394	memset(&tbuf,0,sizeof(tbuf));
	395
	396	msq = msg_lock(msqid);
	397	if (msq == NULL)
	398	return -EINVAL;
	399
	400	if(cmd == MSG_STAT) {
	401	success_return = msg_buildid(msqid, msq->q_perm.seq);
	402	} else {
	403	err = -EIDRM;
	404	if (msg_checkid(msq,msqid))
	405	goto out_unlock;
	406	success_return = 0;
	407	}
	408	err = -EACCES;
	409	if (ipcperms (&msq->q_perm, S_IRUGO))
	410	goto out_unlock;
	411
	412	err = security_msg_queue_msgctl(msq, cmd);
	413	if (err)
	414	goto out_unlock;
	415
	416	kernel_to_ipc64_perm(&msq->q_perm, &tbuf.msg_perm);
	417	tbuf.msg_stime = msq->q_stime;
	418	tbuf.msg_rtime = msq->q_rtime;
	419	tbuf.msg_ctime = msq->q_ctime;
	420	tbuf.msg_cbytes = msq->q_cbytes;
	421	tbuf.msg_qnum = msq->q_qnum;
	422	tbuf.msg_qbytes = msq->q_qbytes;
	423	tbuf.msg_lspid = msq->q_lspid;
	424	tbuf.msg_lrpid = msq->q_lrpid;
	425	msg_unlock(msq);
	426	if (copy_msqid_to_user(buf, &tbuf, version))
	427	return -EFAULT;
	428	return success_return;
	429	}
	430	case IPC_SET:
	431	if (!buf)
	432	return -EFAULT;
	433	if (copy_msqid_from_user (&setbuf, buf, version))
	434	return -EFAULT;
1da177e4 LT	435	break;
	436	case IPC_RMID:
	437	break;
	438	default:
	439	return -EINVAL;
	440	}
	441
5f921ae9	442	mutex_lock(&msg_ids.mutex);
1da177e4 LT	443	msq = msg_lock(msqid);
	444	err=-EINVAL;
	445	if (msq == NULL)
	446	goto out_up;
	447
	448	err = -EIDRM;
	449	if (msg_checkid(msq,msqid))
	450	goto out_unlock_up;
	451	ipcp = &msq->q_perm;
073115d6 SG	452
	453	err = audit_ipc_obj(ipcp);
	454	if (err)
	455	goto out_unlock_up;
ac03221a LK	456	if (cmd==IPC_SET) {
	457	err = audit_ipc_set_perm(setbuf.qbytes, setbuf.uid, setbuf.gid, setbuf.mode);
	458	if (err)
	459	goto out_unlock_up;
	460	}
073115d6	461
1da177e4 LT	462	err = -EPERM;
	463	if (current->euid != ipcp->cuid &&
	464	current->euid != ipcp->uid && !capable(CAP_SYS_ADMIN))
	465	/* We _could_ check for CAP_CHOWN above, but we don't */
	466	goto out_unlock_up;
	467
	468	err = security_msg_queue_msgctl(msq, cmd);
	469	if (err)
	470	goto out_unlock_up;
	471
	472	switch (cmd) {
	473	case IPC_SET:
	474	{
	475	err = -EPERM;
	476	if (setbuf.qbytes > msg_ctlmnb && !capable(CAP_SYS_RESOURCE))
	477	goto out_unlock_up;
	478
	479	msq->q_qbytes = setbuf.qbytes;
	480
	481	ipcp->uid = setbuf.uid;
	482	ipcp->gid = setbuf.gid;
	483	ipcp->mode = (ipcp->mode & ~S_IRWXUGO) \|
	484	(S_IRWXUGO & setbuf.mode);
	485	msq->q_ctime = get_seconds();
	486	/* sleeping receivers might be excluded by
	487	* stricter permissions.
	488	*/
	489	expunge_all(msq,-EAGAIN);
	490	/* sleeping senders might be able to send
	491	* due to a larger queue size.
	492	*/
	493	ss_wakeup(&msq->q_senders,0);
	494	msg_unlock(msq);
	495	break;
	496	}
	497	case IPC_RMID:
	498	freeque (msq, msqid);
	499	break;
	500	}
	501	err = 0;
	502	out_up:
5f921ae9	503	mutex_unlock(&msg_ids.mutex);
1da177e4 LT	504	return err;
	505	out_unlock_up:
	506	msg_unlock(msq);
	507	goto out_up;
	508	out_unlock:
	509	msg_unlock(msq);
	510	return err;
	511	}
	512
	513	static int testmsg(struct msg_msg* msg,long type,int mode)
	514	{
	515	switch(mode)
	516	{
	517	case SEARCH_ANY:
	518	return 1;
	519	case SEARCH_LESSEQUAL:
	520	if(msg->m_type <=type)
	521	return 1;
	522	break;
	523	case SEARCH_EQUAL:
	524	if(msg->m_type == type)
	525	return 1;
	526	break;
	527	case SEARCH_NOTEQUAL:
	528	if(msg->m_type != type)
	529	return 1;
	530	break;
	531	}
	532	return 0;
	533	}
	534
	535	static inline int pipelined_send(struct msg_queue* msq, struct msg_msg* msg)
	536	{
	537	struct list_head* tmp;
	538
	539	tmp = msq->q_receivers.next;
	540	while (tmp != &msq->q_receivers) {
	541	struct msg_receiver* msr;
	542	msr = list_entry(tmp,struct msg_receiver,r_list);
	543	tmp = tmp->next;
	544	if(testmsg(msg,msr->r_msgtype,msr->r_mode) &&
	545	!security_msg_queue_msgrcv(msq, msg, msr->r_tsk, msr->r_msgtype, msr->r_mode)) {
	546	list_del(&msr->r_list);
	547	if(msr->r_maxsize < msg->m_ts) {
	548	msr->r_msg = NULL;
	549	wake_up_process(msr->r_tsk);
	550	smp_mb();
	551	msr->r_msg = ERR_PTR(-E2BIG);
	552	} else {
	553	msr->r_msg = NULL;
	554	msq->q_lrpid = msr->r_tsk->pid;
	555	msq->q_rtime = get_seconds();
	556	wake_up_process(msr->r_tsk);
	557	smp_mb();
	558	msr->r_msg = msg;
	559	return 1;
	560	}
	561	}
	562	}
	563	return 0;
	564	}
	565
	566	asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
	567	{
568	struct msg_queue *msq;
569	struct msg_msg *msg;
570	long mtype;
571	int err;
572
573	if (msgsz > msg_ctlmax \|\| (long) msgsz < 0 \|\| msqid < 0)
574	return -EINVAL;
575	if (get_user(mtype, &msgp->mtype))
576	return -EFAULT;
577	if (mtype < 1)
578	return -EINVAL;
579
580	msg = load_msg(msgp->mtext, msgsz);
581	if(IS_ERR(msg))
582	return PTR_ERR(msg);
583
584	msg->m_type = mtype;
585	msg->m_ts = msgsz;
586
587	msq = msg_lock(msqid);
588	err=-EINVAL;
589	if(msq==NULL)
590	goto out_free;
591
592	err= -EIDRM;
593	if (msg_checkid(msq,msqid))
594	goto out_unlock_free;
595
596	for (;;) {
597	struct msg_sender s;
598
599	err=-EACCES;
600	if (ipcperms(&msq->q_perm, S_IWUGO))
601	goto out_unlock_free;
602
603	err = security_msg_queue_msgsnd(msq, msg, msgflg);
604	if (err)
605	goto out_unlock_free;
606
607	if(msgsz + msq->q_cbytes <= msq->q_qbytes &&
608	1 + msq->q_qnum <= msq->q_qbytes) {
609	break;
610	}
611
612	/* queue full, wait: */
613	if(msgflg&IPC_NOWAIT) {
614	err=-EAGAIN;
615	goto out_unlock_free;
616	}
617	ss_add(msq, &s);
618	ipc_rcu_getref(msq);
619	msg_unlock(msq);
620	schedule();
621
622	ipc_lock_by_ptr(&msq->q_perm);
623	ipc_rcu_putref(msq);
624	if (msq->q_perm.deleted) {
625	err = -EIDRM;
626	goto out_unlock_free;
627	}
628	ss_del(&s);
629
630	if (signal_pending(current)) {
631	err=-ERESTARTNOHAND;
632	goto out_unlock_free;
633	}
634	}
635
636	msq->q_lspid = current->tgid;
637	msq->q_stime = get_seconds();
638
639	if(!pipelined_send(msq,msg)) {
640	/* noone is waiting for this message, enqueue it */
641	list_add_tail(&msg->m_list,&msq->q_messages);
642	msq->q_cbytes += msgsz;
643	msq->q_qnum++;
644	atomic_add(msgsz,&msg_bytes);
645	atomic_inc(&msg_hdrs);
646	}
647
648	err = 0;
649	msg = NULL;
650
651	out_unlock_free:
652	msg_unlock(msq);
653	out_free:
654	if(msg!=NULL)
655	free_msg(msg);
656	return err;
657	}
658
659	static inline int convert_mode(long* msgtyp, int msgflg)
660	{
661	/*
662	* find message of correct type.
663	* msgtyp = 0 => get first.
664	* msgtyp > 0 => get first message of matching type.
665	* msgtyp < 0 => get message with least type must be < abs(msgtype).
666	*/
667	if(*msgtyp==0)
668	return SEARCH_ANY;
669	if(*msgtyp<0) {
670	msgtyp=-(msgtyp);
671	return SEARCH_LESSEQUAL;
672	}
673	if(msgflg & MSG_EXCEPT)
674	return SEARCH_NOTEQUAL;
675	return SEARCH_EQUAL;
676	}
677
678	asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
679	long msgtyp, int msgflg)
680	{
681	struct msg_queue *msq;
682	struct msg_msg *msg;
683	int mode;
684
685	if (msqid < 0 \|\| (long) msgsz < 0)
686	return -EINVAL;
687	mode = convert_mode(&msgtyp,msgflg);
688
689	msq = msg_lock(msqid);
690	if(msq==NULL)
691	return -EINVAL;
692
693	msg = ERR_PTR(-EIDRM);
694	if (msg_checkid(msq,msqid))
695	goto out_unlock;
696
697	for (;;) {
698	struct msg_receiver msr_d;
699	struct list_head* tmp;
700
701	msg = ERR_PTR(-EACCES);
702	if (ipcperms (&msq->q_perm, S_IRUGO))
703	goto out_unlock;
704
705	msg = ERR_PTR(-EAGAIN);
706	tmp = msq->q_messages.next;
707	while (tmp != &msq->q_messages) {
708	struct msg_msg *walk_msg;
709	walk_msg = list_entry(tmp,struct msg_msg,m_list);
710	if(testmsg(walk_msg,msgtyp,mode) &&
711	!security_msg_queue_msgrcv(msq, walk_msg, current, msgtyp, mode)) {
712	msg = walk_msg;
713	if(mode == SEARCH_LESSEQUAL && walk_msg->m_type != 1) {
714	msg=walk_msg;
715	msgtyp=walk_msg->m_type-1;
716	} else {
717	msg=walk_msg;
718	break;
719	}
720	}
721	tmp = tmp->next;
722	}
723	if(!IS_ERR(msg)) {
724	/* Found a suitable message. Unlink it from the queue. */
725	if ((msgsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
726	msg = ERR_PTR(-E2BIG);
727	goto out_unlock;
728	}
729	list_del(&msg->m_list);
730	msq->q_qnum--;
731	msq->q_rtime = get_seconds();
732	msq->q_lrpid = current->tgid;
733	msq->q_cbytes -= msg->m_ts;
734	atomic_sub(msg->m_ts,&msg_bytes);
735	atomic_dec(&msg_hdrs);
736	ss_wakeup(&msq->q_senders,0);
737	msg_unlock(msq);
738	break;
739	}
740	/* No message waiting. Wait for a message */
741	if (msgflg & IPC_NOWAIT) {
742	msg = ERR_PTR(-ENOMSG);
743	goto out_unlock;
744	}
745	list_add_tail(&msr_d.r_list,&msq->q_receivers);
746	msr_d.r_tsk = current;
747	msr_d.r_msgtype = msgtyp;
748	msr_d.r_mode = mode;
749	if(msgflg & MSG_NOERROR)
750	msr_d.r_maxsize = INT_MAX;
751	else
752	msr_d.r_maxsize = msgsz;
753	msr_d.r_msg = ERR_PTR(-EAGAIN);
754	current->state = TASK_INTERRUPTIBLE;
755	msg_unlock(msq);
756
757	schedule();
758
759	/* Lockless receive, part 1:
760	* Disable preemption. We don't hold a reference to the queue
761	* and getting a reference would defeat the idea of a lockless
762	* operation, thus the code relies on rcu to guarantee the
763	* existance of msq:
764	* Prior to destruction, expunge_all(-EIRDM) changes r_msg.
765	* Thus if r_msg is -EAGAIN, then the queue not yet destroyed.
766	* rcu_read_lock() prevents preemption between reading r_msg
767	* and the spin_lock() inside ipc_lock_by_ptr().
768	*/
769	rcu_read_lock();
770
771	/* Lockless receive, part 2:
772	* Wait until pipelined_send or expunge_all are outside of
773	* wake_up_process(). There is a race with exit(), see
774	* ipc/mqueue.c for the details.
775	*/
776	msg = (struct msg_msg*) msr_d.r_msg;
777	while (msg == NULL) {
778	cpu_relax();
779	msg = (struct msg_msg*) msr_d.r_msg;
780	}
781
782	/* Lockless receive, part 3:
783	* If there is a message or an error then accept it without
784	* locking.
785	*/
786	if(msg != ERR_PTR(-EAGAIN)) {
787	rcu_read_unlock();
788	break;
789	}
790
791	/* Lockless receive, part 3:
792	* Acquire the queue spinlock.
793	*/
794	ipc_lock_by_ptr(&msq->q_perm);
795	rcu_read_unlock();
796
797	/* Lockless receive, part 4:
798	* Repeat test after acquiring the spinlock.
799	*/
800	msg = (struct msg_msg*)msr_d.r_msg;
801	if(msg != ERR_PTR(-EAGAIN))
802	goto out_unlock;
803
804	list_del(&msr_d.r_list);
805	if (signal_pending(current)) {
806	msg = ERR_PTR(-ERESTARTNOHAND);
807	out_unlock:
808	msg_unlock(msq);
809	break;
810	}
811	}
812	if (IS_ERR(msg))
813	return PTR_ERR(msg);
814
815	msgsz = (msgsz > msg->m_ts) ? msg->m_ts : msgsz;
816	if (put_user (msg->m_type, &msgp->mtype) \|\|
817	store_msg(msgp->mtext, msg, msgsz)) {
818	msgsz = -EFAULT;
819	}
820	free_msg(msg);
821	return msgsz;
822	}
823
824	#ifdef CONFIG_PROC_FS
19b4946c	825	static int sysvipc_msg_proc_show(struct seq_file s, void it)
1da177e4	826	{
19b4946c MW	827	struct msg_queue *msq = it;
	828
	829	return seq_printf(s,
	830	"%10d %10d %4o %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
	831	msq->q_perm.key,
	832	msq->q_id,
	833	msq->q_perm.mode,
	834	msq->q_cbytes,
	835	msq->q_qnum,
	836	msq->q_lspid,
	837	msq->q_lrpid,
	838	msq->q_perm.uid,
	839	msq->q_perm.gid,
	840	msq->q_perm.cuid,
	841	msq->q_perm.cgid,
	842	msq->q_stime,
	843	msq->q_rtime,
	844	msq->q_ctime);
1da177e4 LT	845	}
1da177e4 LT	846	#endif