^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * linux/ipc/msgutil.c
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Copyright (C) 1999, 2004 Manfred Spraul
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) #include <linux/spinlock.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) #include <linux/init.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #include <linux/security.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/ipc.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/msg.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/ipc_namespace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/utsname.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/proc_ns.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/uaccess.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/sched.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include "util.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) DEFINE_SPINLOCK(mq_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) * The next 2 defines are here bc this is the only file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) * compiled when either CONFIG_SYSVIPC and CONFIG_POSIX_MQUEUE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) * and not CONFIG_IPC_NS.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) struct ipc_namespace init_ipc_ns = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) .count = REFCOUNT_INIT(1),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) .user_ns = &init_user_ns,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) .ns.inum = PROC_IPC_INIT_INO,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) #ifdef CONFIG_IPC_NS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) .ns.ops = &ipcns_operations,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) struct msg_msgseg {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) struct msg_msgseg *next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) /* the next part of the message follows immediately */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) #define DATALEN_MSG ((size_t)PAGE_SIZE-sizeof(struct msg_msg))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) #define DATALEN_SEG ((size_t)PAGE_SIZE-sizeof(struct msg_msgseg))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) static struct msg_msg *alloc_msg(size_t len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) struct msg_msg *msg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) struct msg_msgseg **pseg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) size_t alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) alen = min(len, DATALEN_MSG);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL_ACCOUNT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) if (msg == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) msg->next = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) msg->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) len -= alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) pseg = &msg->next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) while (len > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) struct msg_msgseg *seg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) cond_resched();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) alen = min(len, DATALEN_SEG);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL_ACCOUNT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) if (seg == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) goto out_err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) *pseg = seg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) seg->next = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) pseg = &seg->next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) len -= alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) return msg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) out_err:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) free_msg(msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) struct msg_msg *load_msg(const void __user *src, size_t len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) struct msg_msg *msg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) struct msg_msgseg *seg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) int err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) size_t alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) msg = alloc_msg(len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) if (msg == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) return ERR_PTR(-ENOMEM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) alen = min(len, DATALEN_MSG);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) if (copy_from_user(msg + 1, src, alen))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) goto out_err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) for (seg = msg->next; seg != NULL; seg = seg->next) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) len -= alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) src = (char __user *)src + alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) alen = min(len, DATALEN_SEG);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) if (copy_from_user(seg + 1, src, alen))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) goto out_err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) err = security_msg_msg_alloc(msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) goto out_err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) return msg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) out_err:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) free_msg(msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) return ERR_PTR(err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) #ifdef CONFIG_CHECKPOINT_RESTORE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) struct msg_msgseg *dst_pseg, *src_pseg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) size_t len = src->m_ts;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) size_t alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) if (src->m_ts > dst->m_ts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) return ERR_PTR(-EINVAL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) alen = min(len, DATALEN_MSG);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) memcpy(dst + 1, src + 1, alen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) for (dst_pseg = dst->next, src_pseg = src->next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) src_pseg != NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) dst_pseg = dst_pseg->next, src_pseg = src_pseg->next) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) len -= alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) alen = min(len, DATALEN_SEG);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) memcpy(dst_pseg + 1, src_pseg + 1, alen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) dst->m_type = src->m_type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) dst->m_ts = src->m_ts;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) return dst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) return ERR_PTR(-ENOSYS);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) int store_msg(void __user *dest, struct msg_msg *msg, size_t len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) size_t alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) struct msg_msgseg *seg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) alen = min(len, DATALEN_MSG);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) if (copy_to_user(dest, msg + 1, alen))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) for (seg = msg->next; seg != NULL; seg = seg->next) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) len -= alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) dest = (char __user *)dest + alen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) alen = min(len, DATALEN_SEG);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) if (copy_to_user(dest, seg + 1, alen))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) void free_msg(struct msg_msg *msg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) struct msg_msgseg *seg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) security_msg_msg_free(msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) seg = msg->next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) kfree(msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) while (seg != NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) struct msg_msgseg *tmp = seg->next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) cond_resched();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) kfree(seg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) seg = tmp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) }