]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/sysv_msg.c
xnu-7195.101.1.tar.gz
[apple/xnu.git] / bsd / kern / sysv_msg.c
1 /*
2 * Copyright (c) 2000-2019 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Implementation of SVID messages
30 *
31 * Author: Daniel Boulet
32 *
33 * Copyright 1993 Daniel Boulet and RTMX Inc.
34 *
35 * This system call was implemented by Daniel Boulet under contract from RTMX.
36 *
37 * Redistribution and use in source forms, with and without modification,
38 * are permitted provided that this entire comment appears intact.
39 *
40 * Redistribution in binary form may occur without any restrictions.
41 * Obviously, it would be nice if you gave credit where credit is due
42 * but requiring it would be too onerous.
43 *
44 * This software is provided ``AS IS'' without any warranties of any kind.
45 */
46 /*
47 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
48 * support for mandatory and extensible security protections. This notice
49 * is included in support of clause 2.2 (b) of the Apple Public License,
50 * Version 2.0.
51 */
52
53 #include <sys/param.h>
54 #include <sys/systm.h>
55 #include <sys/kernel.h>
56 #include <sys/proc_internal.h>
57 #include <sys/kauth.h>
58 #include <sys/msg.h>
59 #include <sys/malloc.h>
60 #include <mach/mach_types.h>
61
62 #include <security/audit/audit.h>
63
64 #include <sys/filedesc.h>
65 #include <sys/file_internal.h>
66 #include <sys/sysctl.h>
67 #include <sys/sysproto.h>
68 #include <sys/ipcs.h>
69
70 #if CONFIG_MACF
71 #include <security/mac_framework.h>
72 #endif
73
74 #if SYSV_MSG
75
76 static int msginit(void *);
77
78 #define MSG_DEBUG
79 #undef MSG_DEBUG_OK
80
81 /* Uncomment this line to see MAC debugging output. */
82 /* #define MAC_DEBUG */
83 #if CONFIG_MACF_DEBUG
84 #define MPRINTF(a) printf(a)
85 #else
86 #define MPRINTF(a)
87 #endif
88 static void msg_freehdr(struct msg *msghdr);
89
90 typedef int sy_call_t(struct proc *, void *, int *);
91
92 /* XXX casting to (sy_call_t *) is bogus, as usual. */
93 static sy_call_t* const msgcalls[] = {
94 (sy_call_t *)msgctl, (sy_call_t *)msgget,
95 (sy_call_t *)msgsnd, (sy_call_t *)msgrcv
96 };
97
98 static int nfree_msgmaps; /* # of free map entries */
99 static short free_msgmaps; /* free map entries list head */
100 static struct msg *free_msghdrs; /* list of free msg headers */
101 char *msgpool; /* MSGMAX byte long msg buffer pool */
102 struct msgmap *msgmaps; /* MSGSEG msgmap structures */
103 struct msg *msghdrs; /* MSGTQL msg headers */
104 struct msqid_kernel *msqids; /* MSGMNI msqid_kernel structs (wrapping user_msqid_ds structs) */
105
106 static LCK_GRP_DECLARE(sysv_msg_subsys_lck_grp, "sysv_msg_subsys_lock");
107 static LCK_MTX_DECLARE(sysv_msg_subsys_mutex, &sysv_msg_subsys_lck_grp);
108
109 #define SYSV_MSG_SUBSYS_LOCK() lck_mtx_lock(&sysv_msg_subsys_mutex)
110 #define SYSV_MSG_SUBSYS_UNLOCK() lck_mtx_unlock(&sysv_msg_subsys_mutex)
111
112 #ifdef __APPLE_API_PRIVATE
113 int msgmax, /* max chars in a message */
114 msgmni, /* max message queue identifiers */
115 msgmnb, /* max chars in a queue */
116 msgtql, /* max messages in system */
117 msgssz, /* size of a message segment (see notes above) */
118 msgseg; /* number of message segments */
119 struct msginfo msginfo = {
120 .msgmax = MSGMAX, /* = (MSGSSZ*MSGSEG) : max chars in a message */
121 .msgmni = MSGMNI, /* = 40 : max message queue identifiers */
122 .msgmnb = MSGMNB, /* = 2048 : max chars in a queue */
123 .msgtql = MSGTQL, /* = 40 : max messages in system */
124 .msgssz = MSGSSZ, /* = 8 : size of a message segment (2^N long) */
125 .msgseg = MSGSEG /* = 2048 : number of message segments */
126 };
127 #endif /* __APPLE_API_PRIVATE */
128
129 static __inline__ user_time_t
130 sysv_msgtime(void)
131 {
132 struct timeval tv;
133 microtime(&tv);
134 return tv.tv_sec;
135 }
136
137 /*
138 * NOTE: Source and target may *NOT* overlap! (target is smaller)
139 */
140 static void
141 msqid_ds_kerneltouser32(struct user_msqid_ds *in, struct user32_msqid_ds *out)
142 {
143 out->msg_perm = in->msg_perm;
144 out->msg_qnum = in->msg_qnum;
145 out->msg_cbytes = in->msg_cbytes; /* for ipcs */
146 out->msg_qbytes = in->msg_qbytes;
147 out->msg_lspid = in->msg_lspid;
148 out->msg_lrpid = in->msg_lrpid;
149 out->msg_stime = in->msg_stime; /* XXX loss of range */
150 out->msg_rtime = in->msg_rtime; /* XXX loss of range */
151 out->msg_ctime = in->msg_ctime; /* XXX loss of range */
152 }
153
154 static void
155 msqid_ds_kerneltouser64(struct user_msqid_ds *in, struct user64_msqid_ds *out)
156 {
157 out->msg_perm = in->msg_perm;
158 out->msg_qnum = in->msg_qnum;
159 out->msg_cbytes = in->msg_cbytes; /* for ipcs */
160 out->msg_qbytes = in->msg_qbytes;
161 out->msg_lspid = in->msg_lspid;
162 out->msg_lrpid = in->msg_lrpid;
163 out->msg_stime = in->msg_stime; /* XXX loss of range */
164 out->msg_rtime = in->msg_rtime; /* XXX loss of range */
165 out->msg_ctime = in->msg_ctime; /* XXX loss of range */
166 }
167
168 /*
169 * NOTE: Source and target may are permitted to overlap! (source is smaller);
170 * this works because we copy fields in order from the end of the struct to
171 * the beginning.
172 */
173 static void
174 msqid_ds_user32tokernel(struct user32_msqid_ds *in, struct user_msqid_ds *out)
175 {
176 out->msg_ctime = in->msg_ctime;
177 out->msg_rtime = in->msg_rtime;
178 out->msg_stime = in->msg_stime;
179 out->msg_lrpid = in->msg_lrpid;
180 out->msg_lspid = in->msg_lspid;
181 out->msg_qbytes = in->msg_qbytes;
182 out->msg_cbytes = in->msg_cbytes; /* for ipcs */
183 out->msg_qnum = in->msg_qnum;
184 out->msg_perm = in->msg_perm;
185 }
186
187 static void
188 msqid_ds_user64tokernel(struct user64_msqid_ds *in, struct user_msqid_ds *out)
189 {
190 out->msg_ctime = in->msg_ctime;
191 out->msg_rtime = in->msg_rtime;
192 out->msg_stime = in->msg_stime;
193 out->msg_lrpid = in->msg_lrpid;
194 out->msg_lspid = in->msg_lspid;
195 out->msg_qbytes = in->msg_qbytes;
196 out->msg_cbytes = in->msg_cbytes; /* for ipcs */
197 out->msg_qnum = in->msg_qnum;
198 out->msg_perm = in->msg_perm;
199 }
200
201 /* This routine assumes the system is locked prior to calling this routine */
202 static int
203 msginit(__unused void *dummy)
204 {
205 static int initted = 0;
206 int i;
207
208 /* Lazy initialization on first system call; we don't have SYSINIT(). */
209 if (initted) {
210 return initted;
211 }
212
213 /*
214 * msginfo.msgssz should be a power of two for efficiency reasons.
215 * It is also pretty silly if msginfo.msgssz is less than 8
216 * or greater than about 256 so ...
217 */
218 i = 8;
219 while (i < 1024 && i != msginfo.msgssz) {
220 i <<= 1;
221 }
222 if (i != msginfo.msgssz) {
223 printf("msginfo.msgssz=%d (0x%x) not a small power of 2; resetting to %d\n", msginfo.msgssz, msginfo.msgssz, MSGSSZ);
224 msginfo.msgssz = MSGSSZ;
225 }
226
227 if (msginfo.msgseg > 32767) {
228 printf("msginfo.msgseg=%d (> 32767); resetting to %d\n", msginfo.msgseg, MSGSEG);
229 msginfo.msgseg = MSGSEG;
230 }
231
232
233 /*
234 * Allocate memory for message pool, maps, headers, and queue IDs;
235 * if this fails, fail safely and leave it uninitialized (related
236 * system calls will fail).
237 */
238 msgpool = kheap_alloc(KHEAP_DATA_BUFFERS, msginfo.msgmax, Z_WAITOK);
239 if (msgpool == NULL) {
240 printf("msginit: can't allocate msgpool");
241 goto bad;
242 }
243 msgmaps = kheap_alloc(KM_SHM, sizeof(struct msgmap) * msginfo.msgseg,
244 Z_WAITOK);
245 if (msgmaps == NULL) {
246 printf("msginit: can't allocate msgmaps");
247 goto bad;
248 }
249
250 msghdrs = kheap_alloc(KM_SHM, sizeof(struct msg) * msginfo.msgtql,
251 Z_WAITOK);
252 if (msghdrs == NULL) {
253 printf("msginit: can't allocate msghdrs");
254 goto bad;
255 }
256
257 msqids = kheap_alloc(KM_SHM,
258 sizeof(struct msqid_kernel) * msginfo.msgmni, Z_WAITOK);
259 if (msqids == NULL) {
260 printf("msginit: can't allocate msqids");
261 goto bad;
262 }
263
264
265 /* init msgmaps */
266 for (i = 0; i < msginfo.msgseg; i++) {
267 if (i > 0) {
268 msgmaps[i - 1].next = i;
269 }
270 msgmaps[i].next = -1; /* implies entry is available */
271 }
272 free_msgmaps = 0;
273 nfree_msgmaps = msginfo.msgseg;
274
275
276 /* init msghdrs */
277 for (i = 0; i < msginfo.msgtql; i++) {
278 msghdrs[i].msg_type = 0;
279 if (i > 0) {
280 msghdrs[i - 1].msg_next = &msghdrs[i];
281 }
282 msghdrs[i].msg_next = NULL;
283 #if CONFIG_MACF
284 mac_sysvmsg_label_init(&msghdrs[i]);
285 #endif
286 }
287 free_msghdrs = &msghdrs[0];
288
289 /* init msqids */
290 for (i = 0; i < msginfo.msgmni; i++) {
291 msqids[i].u.msg_qbytes = 0; /* implies entry is available */
292 msqids[i].u.msg_perm._seq = 0; /* reset to a known value */
293 msqids[i].u.msg_perm.mode = 0;
294 #if CONFIG_MACF
295 mac_sysvmsq_label_init(&msqids[i]);
296 #endif
297 }
298
299 initted = 1;
300 bad:
301 if (!initted) {
302 kheap_free(KHEAP_DATA_BUFFERS, msgpool,
303 sizeof(struct msgmap) * msginfo.msgseg);
304 kheap_free(KM_SHM, msgmaps,
305 sizeof(struct msgmap) * msginfo.msgseg);
306 kheap_free(KM_SHM, msghdrs,
307 sizeof(struct msg) * msginfo.msgtql);
308 kheap_free(KM_SHM, msqids,
309 sizeof(struct msqid_kernel) * msginfo.msgmni);
310 }
311 return initted;
312 }
313
314 /*
315 * msgsys
316 *
317 * Entry point for all MSG calls: msgctl, msgget, msgsnd, msgrcv
318 *
319 * Parameters: p Process requesting the call
320 * uap User argument descriptor (see below)
321 * retval Return value of the selected msg call
322 *
323 * Indirect parameters: uap->which msg call to invoke (index in array of msg calls)
324 * uap->a2 User argument descriptor
325 *
326 * Returns: 0 Success
327 * !0 Not success
328 *
329 * Implicit returns: retval Return value of the selected msg call
330 *
331 * DEPRECATED: This interface should not be used to call the other MSG
332 * functions (msgctl, msgget, msgsnd, msgrcv). The correct
333 * usage is to call the other MSG functions directly.
334 *
335 */
336 int
337 msgsys(struct proc *p, struct msgsys_args *uap, int32_t *retval)
338 {
339 if (uap->which >= sizeof(msgcalls) / sizeof(msgcalls[0])) {
340 return EINVAL;
341 }
342 return (*msgcalls[uap->which])(p, &uap->a2, retval);
343 }
344
345 static void
346 msg_freehdr(struct msg *msghdr)
347 {
348 while (msghdr->msg_ts > 0) {
349 short next;
350 if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) {
351 panic("msghdr->msg_spot out of range");
352 }
353 next = msgmaps[msghdr->msg_spot].next;
354 msgmaps[msghdr->msg_spot].next = free_msgmaps;
355 free_msgmaps = msghdr->msg_spot;
356 nfree_msgmaps++;
357 msghdr->msg_spot = next;
358 if (msghdr->msg_ts >= msginfo.msgssz) {
359 msghdr->msg_ts -= msginfo.msgssz;
360 } else {
361 msghdr->msg_ts = 0;
362 }
363 }
364 if (msghdr->msg_spot != -1) {
365 panic("msghdr->msg_spot != -1");
366 }
367 msghdr->msg_next = free_msghdrs;
368 free_msghdrs = msghdr;
369 #if CONFIG_MACF
370 mac_sysvmsg_label_recycle(msghdr);
371 #endif
372 /*
373 * Notify waiters that there are free message headers and segments
374 * now available.
375 */
376 wakeup((caddr_t)&free_msghdrs);
377 }
378
379 int
380 msgctl(struct proc *p, struct msgctl_args *uap, int32_t *retval)
381 {
382 int msqid = uap->msqid;
383 int cmd = uap->cmd;
384 kauth_cred_t cred = kauth_cred_get();
385 int rval, eval;
386 struct user_msqid_ds msqbuf;
387 struct msqid_kernel *msqptr;
388
389 SYSV_MSG_SUBSYS_LOCK();
390
391 if (!msginit(0)) {
392 eval = ENOMEM;
393 goto msgctlout;
394 }
395
396 #ifdef MSG_DEBUG_OK
397 printf("call to msgctl(%d, %d, 0x%qx)\n", msqid, cmd, uap->buf);
398 #endif
399
400 AUDIT_ARG(svipc_cmd, cmd);
401 AUDIT_ARG(svipc_id, msqid);
402 msqid = IPCID_TO_IX(msqid);
403
404 if (msqid < 0 || msqid >= msginfo.msgmni) {
405 #ifdef MSG_DEBUG_OK
406 printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
407 msginfo.msgmni);
408 #endif
409 eval = EINVAL;
410 goto msgctlout;
411 }
412
413 msqptr = &msqids[msqid];
414
415 if (msqptr->u.msg_qbytes == 0) {
416 #ifdef MSG_DEBUG_OK
417 printf("no such msqid\n");
418 #endif
419 eval = EINVAL;
420 goto msgctlout;
421 }
422 if (msqptr->u.msg_perm._seq != IPCID_TO_SEQ(uap->msqid)) {
423 #ifdef MSG_DEBUG_OK
424 printf("wrong sequence number\n");
425 #endif
426 eval = EINVAL;
427 goto msgctlout;
428 }
429 #if CONFIG_MACF
430 eval = mac_sysvmsq_check_msqctl(kauth_cred_get(), msqptr, cmd);
431 if (eval) {
432 goto msgctlout;
433 }
434 #endif
435
436 eval = 0;
437 rval = 0;
438
439 switch (cmd) {
440 case IPC_RMID:
441 {
442 struct msg *msghdr;
443 if ((eval = ipcperm(cred, &msqptr->u.msg_perm, IPC_M))) {
444 goto msgctlout;
445 }
446 #if CONFIG_MACF
447 /*
448 * Check that the thread has MAC access permissions to
449 * individual msghdrs. Note: We need to do this in a
450 * separate loop because the actual loop alters the
451 * msq/msghdr info as it progresses, and there is no going
452 * back if half the way through we discover that the
453 * thread cannot free a certain msghdr. The msq will get
454 * into an inconsistent state.
455 */
456 for (msghdr = msqptr->u.msg_first; msghdr != NULL;
457 msghdr = msghdr->msg_next) {
458 eval = mac_sysvmsq_check_msgrmid(kauth_cred_get(), msghdr);
459 if (eval) {
460 goto msgctlout;
461 }
462 }
463 #endif
464 /* Free the message headers */
465 msghdr = msqptr->u.msg_first;
466 while (msghdr != NULL) {
467 struct msg *msghdr_tmp;
468
469 /* Free the segments of each message */
470 msqptr->u.msg_cbytes -= msghdr->msg_ts;
471 msqptr->u.msg_qnum--;
472 msghdr_tmp = msghdr;
473 msghdr = msghdr->msg_next;
474 msg_freehdr(msghdr_tmp);
475 }
476
477 if (msqptr->u.msg_cbytes != 0) {
478 panic("msg_cbytes is messed up");
479 }
480 if (msqptr->u.msg_qnum != 0) {
481 panic("msg_qnum is messed up");
482 }
483
484 msqptr->u.msg_qbytes = 0; /* Mark it as free */
485 #if CONFIG_MACF
486 mac_sysvmsq_label_recycle(msqptr);
487 #endif
488
489 wakeup((caddr_t)msqptr);
490 }
491
492 break;
493
494 case IPC_SET:
495 if ((eval = ipcperm(cred, &msqptr->u.msg_perm, IPC_M))) {
496 goto msgctlout;
497 }
498
499 SYSV_MSG_SUBSYS_UNLOCK();
500
501 if (IS_64BIT_PROCESS(p)) {
502 struct user64_msqid_ds tmpds;
503 eval = copyin(uap->buf, &tmpds, sizeof(tmpds));
504
505 msqid_ds_user64tokernel(&tmpds, &msqbuf);
506 } else {
507 struct user32_msqid_ds tmpds;
508
509 eval = copyin(uap->buf, &tmpds, sizeof(tmpds));
510
511 msqid_ds_user32tokernel(&tmpds, &msqbuf);
512 }
513 if (eval) {
514 return eval;
515 }
516
517 SYSV_MSG_SUBSYS_LOCK();
518
519 if (msqbuf.msg_qbytes > msqptr->u.msg_qbytes) {
520 eval = suser(cred, &p->p_acflag);
521 if (eval) {
522 goto msgctlout;
523 }
524 }
525
526
527 /* compare (msglen_t) value against restrict (int) value */
528 if (msqbuf.msg_qbytes > (user_msglen_t)msginfo.msgmnb) {
529 #ifdef MSG_DEBUG_OK
530 printf("can't increase msg_qbytes beyond %d (truncating)\n",
531 msginfo.msgmnb);
532 #endif
533 msqbuf.msg_qbytes = msginfo.msgmnb; /* silently restrict qbytes to system limit */
534 }
535 if (msqbuf.msg_qbytes == 0) {
536 #ifdef MSG_DEBUG_OK
537 printf("can't reduce msg_qbytes to 0\n");
538 #endif
539 eval = EINVAL;
540 goto msgctlout;
541 }
542 msqptr->u.msg_perm.uid = msqbuf.msg_perm.uid; /* change the owner */
543 msqptr->u.msg_perm.gid = msqbuf.msg_perm.gid; /* change the owner */
544 msqptr->u.msg_perm.mode = (msqptr->u.msg_perm.mode & ~0777) |
545 (msqbuf.msg_perm.mode & 0777);
546 msqptr->u.msg_qbytes = msqbuf.msg_qbytes;
547 msqptr->u.msg_ctime = sysv_msgtime();
548 break;
549
550 case IPC_STAT:
551 if ((eval = ipcperm(cred, &msqptr->u.msg_perm, IPC_R))) {
552 #ifdef MSG_DEBUG_OK
553 printf("requester doesn't have read access\n");
554 #endif
555 goto msgctlout;
556 }
557
558 SYSV_MSG_SUBSYS_UNLOCK();
559 if (IS_64BIT_PROCESS(p)) {
560 struct user64_msqid_ds msqid_ds64 = {};
561 msqid_ds_kerneltouser64(&msqptr->u, &msqid_ds64);
562 eval = copyout(&msqid_ds64, uap->buf, sizeof(msqid_ds64));
563 } else {
564 struct user32_msqid_ds msqid_ds32 = {};
565 msqid_ds_kerneltouser32(&msqptr->u, &msqid_ds32);
566 eval = copyout(&msqid_ds32, uap->buf, sizeof(msqid_ds32));
567 }
568 SYSV_MSG_SUBSYS_LOCK();
569 break;
570
571 default:
572 #ifdef MSG_DEBUG_OK
573 printf("invalid command %d\n", cmd);
574 #endif
575 eval = EINVAL;
576 goto msgctlout;
577 }
578
579 if (eval == 0) {
580 *retval = rval;
581 }
582 msgctlout:
583 SYSV_MSG_SUBSYS_UNLOCK();
584 return eval;
585 }
586
587 int
588 msgget(__unused struct proc *p, struct msgget_args *uap, int32_t *retval)
589 {
590 int msqid, eval;
591 int key = uap->key;
592 int msgflg = uap->msgflg;
593 kauth_cred_t cred = kauth_cred_get();
594 struct msqid_kernel *msqptr = NULL;
595
596 SYSV_MSG_SUBSYS_LOCK();
597
598 if (!msginit(0)) {
599 eval = ENOMEM;
600 goto msggetout;
601 }
602
603 #ifdef MSG_DEBUG_OK
604 printf("msgget(0x%x, 0%o)\n", key, msgflg);
605 #endif
606
607 if (key != IPC_PRIVATE) {
608 for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
609 msqptr = &msqids[msqid];
610 if (msqptr->u.msg_qbytes != 0 &&
611 msqptr->u.msg_perm._key == key) {
612 break;
613 }
614 }
615 if (msqid < msginfo.msgmni) {
616 #ifdef MSG_DEBUG_OK
617 printf("found public key\n");
618 #endif
619 if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) {
620 #ifdef MSG_DEBUG_OK
621 printf("not exclusive\n");
622 #endif
623 eval = EEXIST;
624 goto msggetout;
625 }
626 if ((eval = ipcperm(cred, &msqptr->u.msg_perm, msgflg & 0700 ))) {
627 #ifdef MSG_DEBUG_OK
628 printf("requester doesn't have 0%o access\n",
629 msgflg & 0700);
630 #endif
631 goto msggetout;
632 }
633 #if CONFIG_MACF
634 eval = mac_sysvmsq_check_msqget(cred, msqptr);
635 if (eval) {
636 goto msggetout;
637 }
638 #endif
639 goto found;
640 }
641 }
642
643 #ifdef MSG_DEBUG_OK
644 printf("need to allocate the user_msqid_ds\n");
645 #endif
646 if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) {
647 for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
648 /*
649 * Look for an unallocated and unlocked user_msqid_ds.
650 * user_msqid_ds's can be locked by msgsnd or msgrcv
651 * while they are copying the message in/out. We
652 * can't re-use the entry until they release it.
653 */
654 msqptr = &msqids[msqid];
655 if (msqptr->u.msg_qbytes == 0 &&
656 (msqptr->u.msg_perm.mode & MSG_LOCKED) == 0) {
657 break;
658 }
659 }
660 if (msqid == msginfo.msgmni) {
661 #ifdef MSG_DEBUG_OK
662 printf("no more user_msqid_ds's available\n");
663 #endif
664 eval = ENOSPC;
665 goto msggetout;
666 }
667 #ifdef MSG_DEBUG_OK
668 printf("msqid %d is available\n", msqid);
669 #endif
670 msqptr->u.msg_perm._key = key;
671 msqptr->u.msg_perm.cuid = kauth_cred_getuid(cred);
672 msqptr->u.msg_perm.uid = kauth_cred_getuid(cred);
673 msqptr->u.msg_perm.cgid = kauth_cred_getgid(cred);
674 msqptr->u.msg_perm.gid = kauth_cred_getgid(cred);
675 msqptr->u.msg_perm.mode = (msgflg & 0777);
676 /* Make sure that the returned msqid is unique */
677 msqptr->u.msg_perm._seq++;
678 msqptr->u.msg_first = NULL;
679 msqptr->u.msg_last = NULL;
680 msqptr->u.msg_cbytes = 0;
681 msqptr->u.msg_qnum = 0;
682 msqptr->u.msg_qbytes = msginfo.msgmnb;
683 msqptr->u.msg_lspid = 0;
684 msqptr->u.msg_lrpid = 0;
685 msqptr->u.msg_stime = 0;
686 msqptr->u.msg_rtime = 0;
687 msqptr->u.msg_ctime = sysv_msgtime();
688 #if CONFIG_MACF
689 mac_sysvmsq_label_associate(cred, msqptr);
690 #endif
691 } else {
692 #ifdef MSG_DEBUG_OK
693 printf("didn't find it and wasn't asked to create it\n");
694 #endif
695 eval = ENOENT;
696 goto msggetout;
697 }
698
699 found:
700 /* Construct the unique msqid */
701 *retval = IXSEQ_TO_IPCID(msqid, msqptr->u.msg_perm);
702 AUDIT_ARG(svipc_id, *retval);
703 eval = 0;
704 msggetout:
705 SYSV_MSG_SUBSYS_UNLOCK();
706 return eval;
707 }
708
709
710 int
711 msgsnd(struct proc *p, struct msgsnd_args *uap, int32_t *retval)
712 {
713 __pthread_testcancel(1);
714 return msgsnd_nocancel(p, (struct msgsnd_nocancel_args *)uap, retval);
715 }
716
717 int
718 msgsnd_nocancel(struct proc *p, struct msgsnd_nocancel_args *uap, int32_t *retval)
719 {
720 int msqid = uap->msqid;
721 user_addr_t user_msgp = uap->msgp;
722 size_t msgsz = (size_t)uap->msgsz; /* limit to 4G */
723 int msgflg = uap->msgflg;
724 int segs_needed, eval;
725 struct msqid_kernel *msqptr;
726 struct msg *msghdr;
727 short next;
728 user_long_t msgtype;
729
730
731 SYSV_MSG_SUBSYS_LOCK();
732
733 if (!msginit(0)) {
734 eval = ENOMEM;
735 goto msgsndout;
736 }
737
738 #ifdef MSG_DEBUG_OK
739 printf("call to msgsnd(%d, 0x%qx, %ld, %d)\n", msqid, user_msgp, msgsz,
740 msgflg);
741 #endif
742
743 AUDIT_ARG(svipc_id, msqid);
744 msqid = IPCID_TO_IX(msqid);
745
746 if (msqid < 0 || msqid >= msginfo.msgmni) {
747 #ifdef MSG_DEBUG_OK
748 printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
749 msginfo.msgmni);
750 #endif
751 eval = EINVAL;
752 goto msgsndout;
753 }
754
755 msqptr = &msqids[msqid];
756 if (msqptr->u.msg_qbytes == 0) {
757 #ifdef MSG_DEBUG_OK
758 printf("no such message queue id\n");
759 #endif
760 eval = EINVAL;
761 goto msgsndout;
762 }
763 if (msqptr->u.msg_perm._seq != IPCID_TO_SEQ(uap->msqid)) {
764 #ifdef MSG_DEBUG_OK
765 printf("wrong sequence number\n");
766 #endif
767 eval = EINVAL;
768 goto msgsndout;
769 }
770
771 if ((eval = ipcperm(kauth_cred_get(), &msqptr->u.msg_perm, IPC_W))) {
772 #ifdef MSG_DEBUG_OK
773 printf("requester doesn't have write access\n");
774 #endif
775 goto msgsndout;
776 }
777
778 #if CONFIG_MACF
779 eval = mac_sysvmsq_check_msqsnd(kauth_cred_get(), msqptr);
780 if (eval) {
781 goto msgsndout;
782 }
783 #endif
784 segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz;
785 #ifdef MSG_DEBUG_OK
786 printf("msgsz=%ld, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz,
787 segs_needed);
788 #endif
789
790 /*
791 * If we suffer resource starvation, we will sleep in this loop and
792 * wait for more resources to become available. This is a loop to
793 * ensure reacquisition of the mutex following any sleep, since there
794 * are multiple resources under contention.
795 */
796 for (;;) {
797 void *blocking_resource = NULL;
798
799 /*
800 * Check that we have not had the maximum message size change
801 * out from under us and render our message invalid while we
802 * slept waiting for some resource.
803 */
804 if (msgsz > msqptr->u.msg_qbytes) {
805 #ifdef MSG_DEBUG_OK
806 printf("msgsz > msqptr->msg_qbytes\n");
807 #endif
808 eval = EINVAL;
809 goto msgsndout;
810 }
811
812 /*
813 * If the user_msqid_ds is already locked, we need to sleep on
814 * the queue until it's unlocked.
815 */
816 if (msqptr->u.msg_perm.mode & MSG_LOCKED) {
817 #ifdef MSG_DEBUG_OK
818 printf("msqid is locked\n");
819 #endif
820 blocking_resource = msqptr;
821 }
822
823 /*
824 * If our message plus the messages already in the queue would
825 * cause us to exceed the maximum number of bytes wer are
826 * permitted to queue, then block on the queue until it drains.
827 */
828 if (msgsz + msqptr->u.msg_cbytes > msqptr->u.msg_qbytes) {
829 #ifdef MSG_DEBUG_OK
830 printf("msgsz + msg_cbytes > msg_qbytes\n");
831 #endif
832 blocking_resource = msqptr;
833 }
834
835 /*
836 * Both message maps and message headers are protected by
837 * sleeping on the address of the pointer to the list of free
838 * message headers, since they are allocated and freed in
839 * tandem.
840 */
841 if (segs_needed > nfree_msgmaps) {
842 #ifdef MSG_DEBUG_OK
843 printf("segs_needed > nfree_msgmaps\n");
844 #endif
845 blocking_resource = &free_msghdrs;
846 }
847 if (free_msghdrs == NULL) {
848 #ifdef MSG_DEBUG_OK
849 printf("no more msghdrs\n");
850 #endif
851 blocking_resource = &free_msghdrs;
852 }
853
854 if (blocking_resource != NULL) {
855 int we_own_it;
856
857 if ((msgflg & IPC_NOWAIT) != 0) {
858 #ifdef MSG_DEBUG_OK
859 printf("need more resources but caller doesn't want to wait\n");
860 #endif
861 eval = EAGAIN;
862 goto msgsndout;
863 }
864
865 if ((msqptr->u.msg_perm.mode & MSG_LOCKED) != 0) {
866 #ifdef MSG_DEBUG_OK
867 printf("we don't own the user_msqid_ds\n");
868 #endif
869 we_own_it = 0;
870 } else {
871 /* Force later arrivals to wait for our
872 * request */
873 #ifdef MSG_DEBUG_OK
874 printf("we own the user_msqid_ds\n");
875 #endif
876 msqptr->u.msg_perm.mode |= MSG_LOCKED;
877 we_own_it = 1;
878 }
879 #ifdef MSG_DEBUG_OK
880 printf("goodnight\n");
881 #endif
882 eval = msleep(blocking_resource, &sysv_msg_subsys_mutex, (PZERO - 4) | PCATCH,
883 "msgwait", 0);
884 #ifdef MSG_DEBUG_OK
885 printf("good morning, eval=%d\n", eval);
886 #endif
887 if (we_own_it) {
888 msqptr->u.msg_perm.mode &= ~MSG_LOCKED;
889 }
890 if (eval != 0) {
891 #ifdef MSG_DEBUG_OK
892 printf("msgsnd: interrupted system call\n");
893 #endif
894 eval = EINTR;
895 goto msgsndout;
896 }
897
898 /*
899 * Make sure that the msq queue still exists
900 */
901
902 if (msqptr->u.msg_qbytes == 0) {
903 #ifdef MSG_DEBUG_OK
904 printf("msqid deleted\n");
905 #endif
906 eval = EIDRM;
907 goto msgsndout;
908 }
909 } else {
910 #ifdef MSG_DEBUG_OK
911 printf("got all the resources that we need\n");
912 #endif
913 break;
914 }
915 }
916
917 /*
918 * We have the resources that we need.
919 * Make sure!
920 */
921
922 if (msqptr->u.msg_perm.mode & MSG_LOCKED) {
923 panic("msg_perm.mode & MSG_LOCKED");
924 }
925 if (segs_needed > nfree_msgmaps) {
926 panic("segs_needed > nfree_msgmaps");
927 }
928 if (msgsz + msqptr->u.msg_cbytes > msqptr->u.msg_qbytes) {
929 panic("msgsz + msg_cbytes > msg_qbytes");
930 }
931 if (free_msghdrs == NULL) {
932 panic("no more msghdrs");
933 }
934
935 /*
936 * Re-lock the user_msqid_ds in case we page-fault when copying in
937 * the message
938 */
939 if ((msqptr->u.msg_perm.mode & MSG_LOCKED) != 0) {
940 panic("user_msqid_ds is already locked");
941 }
942 msqptr->u.msg_perm.mode |= MSG_LOCKED;
943
944 /*
945 * Allocate a message header
946 */
947 msghdr = free_msghdrs;
948 free_msghdrs = msghdr->msg_next;
949 msghdr->msg_spot = -1;
950 msghdr->msg_ts = msgsz;
951
952 #if CONFIG_MACF
953 mac_sysvmsg_label_associate(kauth_cred_get(), msqptr, msghdr);
954 #endif
955 /*
956 * Allocate space for the message
957 */
958
959 while (segs_needed > 0) {
960 if (nfree_msgmaps <= 0) {
961 panic("not enough msgmaps");
962 }
963 if (free_msgmaps == -1) {
964 panic("nil free_msgmaps");
965 }
966 next = free_msgmaps;
967 if (next <= -1) {
968 panic("next too low #1");
969 }
970 if (next >= msginfo.msgseg) {
971 panic("next out of range #1");
972 }
973 #ifdef MSG_DEBUG_OK
974 printf("allocating segment %d to message\n", next);
975 #endif
976 free_msgmaps = msgmaps[next].next;
977 nfree_msgmaps--;
978 msgmaps[next].next = msghdr->msg_spot;
979 msghdr->msg_spot = next;
980 segs_needed--;
981 }
982
983 /*
984 * Copy in the message type. For a 64 bit process, this is 64 bits,
985 * but we only ever use the low 32 bits, so the cast is OK.
986 */
987 if (IS_64BIT_PROCESS(p)) {
988 SYSV_MSG_SUBSYS_UNLOCK();
989 eval = copyin(user_msgp, &msgtype, sizeof(msgtype));
990 SYSV_MSG_SUBSYS_LOCK();
991 msghdr->msg_type = CAST_DOWN(long, msgtype);
992 user_msgp = user_msgp + sizeof(msgtype); /* ptr math */
993 } else {
994 SYSV_MSG_SUBSYS_UNLOCK();
995 int32_t msg_type32;
996 eval = copyin(user_msgp, &msg_type32, sizeof(msg_type32));
997 msghdr->msg_type = msg_type32;
998 SYSV_MSG_SUBSYS_LOCK();
999 user_msgp = user_msgp + sizeof(msg_type32); /* ptr math */
1000 }
1001
1002 if (eval != 0) {
1003 #ifdef MSG_DEBUG_OK
1004 printf("error %d copying the message type\n", eval);
1005 #endif
1006 msg_freehdr(msghdr);
1007 msqptr->u.msg_perm.mode &= ~MSG_LOCKED;
1008 wakeup((caddr_t)msqptr);
1009 goto msgsndout;
1010 }
1011
1012
1013 /*
1014 * Validate the message type
1015 */
1016 if (msghdr->msg_type < 1) {
1017 msg_freehdr(msghdr);
1018 msqptr->u.msg_perm.mode &= ~MSG_LOCKED;
1019 wakeup((caddr_t)msqptr);
1020 #ifdef MSG_DEBUG_OK
1021 printf("mtype (%ld) < 1\n", msghdr->msg_type);
1022 #endif
1023 eval = EINVAL;
1024 goto msgsndout;
1025 }
1026
1027 /*
1028 * Copy in the message body
1029 */
1030 next = msghdr->msg_spot;
1031 while (msgsz > 0) {
1032 size_t tlen;
1033 /* compare input (size_t) value against restrict (int) value */
1034 if (msgsz > (size_t)msginfo.msgssz) {
1035 tlen = msginfo.msgssz;
1036 } else {
1037 tlen = msgsz;
1038 }
1039 if (next <= -1) {
1040 panic("next too low #2");
1041 }
1042 if (next >= msginfo.msgseg) {
1043 panic("next out of range #2");
1044 }
1045
1046 SYSV_MSG_SUBSYS_UNLOCK();
1047 eval = copyin(user_msgp, &msgpool[next * msginfo.msgssz], tlen);
1048 SYSV_MSG_SUBSYS_LOCK();
1049
1050 if (eval != 0) {
1051 #ifdef MSG_DEBUG_OK
1052 printf("error %d copying in message segment\n", eval);
1053 #endif
1054 msg_freehdr(msghdr);
1055 msqptr->u.msg_perm.mode &= ~MSG_LOCKED;
1056 wakeup((caddr_t)msqptr);
1057
1058 goto msgsndout;
1059 }
1060 msgsz -= tlen;
1061 user_msgp = user_msgp + tlen; /* ptr math */
1062 next = msgmaps[next].next;
1063 }
1064 if (next != -1) {
1065 panic("didn't use all the msg segments");
1066 }
1067
1068 /*
1069 * We've got the message. Unlock the user_msqid_ds.
1070 */
1071
1072 msqptr->u.msg_perm.mode &= ~MSG_LOCKED;
1073
1074 /*
1075 * Make sure that the user_msqid_ds is still allocated.
1076 */
1077
1078 if (msqptr->u.msg_qbytes == 0) {
1079 msg_freehdr(msghdr);
1080 wakeup((caddr_t)msqptr);
1081 /* The SVID says to return EIDRM. */
1082 #ifdef EIDRM
1083 eval = EIDRM;
1084 #else
1085 /* Unfortunately, BSD doesn't define that code yet! */
1086 eval = EINVAL;
1087 #endif
1088 goto msgsndout;
1089 }
1090
1091 #if CONFIG_MACF
1092 /*
1093 * Note: Since the task/thread allocates the msghdr and usually
1094 * primes it with its own MAC label, for a majority of policies, it
1095 * won't be necessary to check whether the msghdr has access
1096 * permissions to the msgq. The mac_sysvmsq_check_msqsnd check would
1097 * suffice in that case. However, this hook may be required where
1098 * individual policies derive a non-identical label for the msghdr
1099 * from the current thread label and may want to check the msghdr
1100 * enqueue permissions, along with read/write permissions to the
1101 * msgq.
1102 */
1103 eval = mac_sysvmsq_check_enqueue(kauth_cred_get(), msghdr, msqptr);
1104 if (eval) {
1105 msg_freehdr(msghdr);
1106 wakeup((caddr_t) msqptr);
1107 goto msgsndout;
1108 }
1109 #endif
1110 /*
1111 * Put the message into the queue
1112 */
1113
1114 if (msqptr->u.msg_first == NULL) {
1115 msqptr->u.msg_first = msghdr;
1116 msqptr->u.msg_last = msghdr;
1117 } else {
1118 msqptr->u.msg_last->msg_next = msghdr;
1119 msqptr->u.msg_last = msghdr;
1120 }
1121 msqptr->u.msg_last->msg_next = NULL;
1122
1123 msqptr->u.msg_cbytes += msghdr->msg_ts;
1124 msqptr->u.msg_qnum++;
1125 msqptr->u.msg_lspid = p->p_pid;
1126 msqptr->u.msg_stime = sysv_msgtime();
1127
1128 wakeup((caddr_t)msqptr);
1129 *retval = 0;
1130 eval = 0;
1131
1132 msgsndout:
1133 SYSV_MSG_SUBSYS_UNLOCK();
1134 return eval;
1135 }
1136
1137
1138 int
1139 msgrcv(struct proc *p, struct msgrcv_args *uap, user_ssize_t *retval)
1140 {
1141 __pthread_testcancel(1);
1142 return msgrcv_nocancel(p, (struct msgrcv_nocancel_args *)uap, retval);
1143 }
1144
1145 int
1146 msgrcv_nocancel(struct proc *p, struct msgrcv_nocancel_args *uap, user_ssize_t *retval)
1147 {
1148 int msqid = uap->msqid;
1149 user_addr_t user_msgp = uap->msgp;
1150 size_t msgsz = (size_t)uap->msgsz; /* limit to 4G */
1151 long msgtyp = (long)uap->msgtyp; /* limit to 32 bits */
1152 int msgflg = uap->msgflg;
1153 size_t len;
1154 struct msqid_kernel *msqptr;
1155 struct msg *msghdr;
1156 int eval;
1157 short next;
1158 user_long_t msgtype;
1159 int32_t msg_type32;
1160
1161 SYSV_MSG_SUBSYS_LOCK();
1162
1163 if (!msginit(0)) {
1164 eval = ENOMEM;
1165 goto msgrcvout;
1166 }
1167
1168 #ifdef MSG_DEBUG_OK
1169 printf("call to msgrcv(%d, 0x%qx, %ld, %ld, %d)\n", msqid, user_msgp,
1170 msgsz, msgtyp, msgflg);
1171 #endif
1172
1173 AUDIT_ARG(svipc_id, msqid);
1174 msqid = IPCID_TO_IX(msqid);
1175
1176 if (msqid < 0 || msqid >= msginfo.msgmni) {
1177 #ifdef MSG_DEBUG_OK
1178 printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
1179 msginfo.msgmni);
1180 #endif
1181 eval = EINVAL;
1182 goto msgrcvout;
1183 }
1184
1185 msqptr = &msqids[msqid];
1186 if (msqptr->u.msg_qbytes == 0) {
1187 #ifdef MSG_DEBUG_OK
1188 printf("no such message queue id\n");
1189 #endif
1190 eval = EINVAL;
1191 goto msgrcvout;
1192 }
1193 if (msqptr->u.msg_perm._seq != IPCID_TO_SEQ(uap->msqid)) {
1194 #ifdef MSG_DEBUG_OK
1195 printf("wrong sequence number\n");
1196 #endif
1197 eval = EINVAL;
1198 goto msgrcvout;
1199 }
1200
1201 if ((eval = ipcperm(kauth_cred_get(), &msqptr->u.msg_perm, IPC_R))) {
1202 #ifdef MSG_DEBUG_OK
1203 printf("requester doesn't have read access\n");
1204 #endif
1205 goto msgrcvout;
1206 }
1207
1208 #if CONFIG_MACF
1209 eval = mac_sysvmsq_check_msqrcv(kauth_cred_get(), msqptr);
1210 if (eval) {
1211 goto msgrcvout;
1212 }
1213 #endif
1214 msghdr = NULL;
1215 while (msghdr == NULL) {
1216 if (msgtyp == 0) {
1217 msghdr = msqptr->u.msg_first;
1218 if (msghdr != NULL) {
1219 if (msgsz < msghdr->msg_ts &&
1220 (msgflg & MSG_NOERROR) == 0) {
1221 #ifdef MSG_DEBUG_OK
1222 printf("first message on the queue is too big (want %ld, got %d)\n",
1223 msgsz, msghdr->msg_ts);
1224 #endif
1225 eval = E2BIG;
1226 goto msgrcvout;
1227 }
1228 #if CONFIG_MACF
1229 eval = mac_sysvmsq_check_msgrcv(kauth_cred_get(),
1230 msghdr);
1231 if (eval) {
1232 goto msgrcvout;
1233 }
1234 #endif
1235 if (msqptr->u.msg_first == msqptr->u.msg_last) {
1236 msqptr->u.msg_first = NULL;
1237 msqptr->u.msg_last = NULL;
1238 } else {
1239 msqptr->u.msg_first = msghdr->msg_next;
1240 if (msqptr->u.msg_first == NULL) {
1241 panic("msg_first/last messed up #1");
1242 }
1243 }
1244 }
1245 } else {
1246 struct msg *previous;
1247 struct msg **prev;
1248
1249 previous = NULL;
1250 prev = &(msqptr->u.msg_first);
1251 while ((msghdr = *prev) != NULL) {
1252 /*
1253 * Is this message's type an exact match or is
1254 * this message's type less than or equal to
1255 * the absolute value of a negative msgtyp?
1256 * Note that the second half of this test can
1257 * NEVER be true if msgtyp is positive since
1258 * msg_type is always positive!
1259 */
1260
1261 if (msgtyp == msghdr->msg_type ||
1262 msghdr->msg_type <= -msgtyp) {
1263 #ifdef MSG_DEBUG_OK
1264 printf("found message type %ld, requested %ld\n",
1265 msghdr->msg_type, msgtyp);
1266 #endif
1267 if (msgsz < msghdr->msg_ts &&
1268 (msgflg & MSG_NOERROR) == 0) {
1269 #ifdef MSG_DEBUG_OK
1270 printf("requested message on the queue is too big (want %ld, got %d)\n",
1271 msgsz, msghdr->msg_ts);
1272 #endif
1273 eval = E2BIG;
1274 goto msgrcvout;
1275 }
1276 #if CONFIG_MACF
1277 eval = mac_sysvmsq_check_msgrcv(
1278 kauth_cred_get(), msghdr);
1279 if (eval) {
1280 goto msgrcvout;
1281 }
1282 #endif
1283 *prev = msghdr->msg_next;
1284 if (msghdr == msqptr->u.msg_last) {
1285 if (previous == NULL) {
1286 if (prev !=
1287 &msqptr->u.msg_first) {
1288 panic("msg_first/last messed up #2");
1289 }
1290 msqptr->u.msg_first =
1291 NULL;
1292 msqptr->u.msg_last =
1293 NULL;
1294 } else {
1295 if (prev ==
1296 &msqptr->u.msg_first) {
1297 panic("msg_first/last messed up #3");
1298 }
1299 msqptr->u.msg_last =
1300 previous;
1301 }
1302 }
1303 break;
1304 }
1305 previous = msghdr;
1306 prev = &(msghdr->msg_next);
1307 }
1308 }
1309
1310 /*
1311 * We've either extracted the msghdr for the appropriate
1312 * message or there isn't one.
1313 * If there is one then bail out of this loop.
1314 */
1315
1316 if (msghdr != NULL) {
1317 break;
1318 }
1319
1320 /*
1321 * Hmph! No message found. Does the user want to wait?
1322 */
1323
1324 if ((msgflg & IPC_NOWAIT) != 0) {
1325 #ifdef MSG_DEBUG_OK
1326 printf("no appropriate message found (msgtyp=%ld)\n",
1327 msgtyp);
1328 #endif
1329 /* The SVID says to return ENOMSG. */
1330 #ifdef ENOMSG
1331 eval = ENOMSG;
1332 #else
1333 /* Unfortunately, BSD doesn't define that code yet! */
1334 eval = EAGAIN;
1335 #endif
1336 goto msgrcvout;
1337 }
1338
1339 /*
1340 * Wait for something to happen
1341 */
1342
1343 #ifdef MSG_DEBUG_OK
1344 printf("msgrcv: goodnight\n");
1345 #endif
1346 eval = msleep((caddr_t)msqptr, &sysv_msg_subsys_mutex, (PZERO - 4) | PCATCH, "msgwait",
1347 0);
1348 #ifdef MSG_DEBUG_OK
1349 printf("msgrcv: good morning (eval=%d)\n", eval);
1350 #endif
1351
1352 if (eval != 0) {
1353 #ifdef MSG_DEBUG_OK
1354 printf("msgsnd: interrupted system call\n");
1355 #endif
1356 eval = EINTR;
1357 goto msgrcvout;
1358 }
1359
1360 /*
1361 * Make sure that the msq queue still exists
1362 */
1363
1364 if (msqptr->u.msg_qbytes == 0 ||
1365 msqptr->u.msg_perm._seq != IPCID_TO_SEQ(uap->msqid)) {
1366 #ifdef MSG_DEBUG_OK
1367 printf("msqid deleted\n");
1368 #endif
1369 /* The SVID says to return EIDRM. */
1370 #ifdef EIDRM
1371 eval = EIDRM;
1372 #else
1373 /* Unfortunately, BSD doesn't define that code yet! */
1374 eval = EINVAL;
1375 #endif
1376 goto msgrcvout;
1377 }
1378 }
1379
1380 /*
1381 * Return the message to the user.
1382 *
1383 * First, do the bookkeeping (before we risk being interrupted).
1384 */
1385
1386 msqptr->u.msg_cbytes -= msghdr->msg_ts;
1387 msqptr->u.msg_qnum--;
1388 msqptr->u.msg_lrpid = p->p_pid;
1389 msqptr->u.msg_rtime = sysv_msgtime();
1390
1391 /*
1392 * Make msgsz the actual amount that we'll be returning.
1393 * Note that this effectively truncates the message if it is too long
1394 * (since msgsz is never increased).
1395 */
1396
1397 #ifdef MSG_DEBUG_OK
1398 printf("found a message, msgsz=%ld, msg_ts=%d\n", msgsz,
1399 msghdr->msg_ts);
1400 #endif
1401 if (msgsz > msghdr->msg_ts) {
1402 msgsz = msghdr->msg_ts;
1403 }
1404
1405 /*
1406 * Return the type to the user.
1407 */
1408
1409 /*
1410 * Copy out the message type. For a 64 bit process, this is 64 bits,
1411 * but we only ever use the low 32 bits, so the cast is OK.
1412 */
1413 if (IS_64BIT_PROCESS(p)) {
1414 msgtype = msghdr->msg_type;
1415 SYSV_MSG_SUBSYS_UNLOCK();
1416 eval = copyout(&msgtype, user_msgp, sizeof(msgtype));
1417 SYSV_MSG_SUBSYS_LOCK();
1418 user_msgp = user_msgp + sizeof(msgtype); /* ptr math */
1419 } else {
1420 msg_type32 = msghdr->msg_type;
1421 SYSV_MSG_SUBSYS_UNLOCK();
1422 eval = copyout(&msg_type32, user_msgp, sizeof(msg_type32));
1423 SYSV_MSG_SUBSYS_LOCK();
1424 user_msgp = user_msgp + sizeof(msg_type32); /* ptr math */
1425 }
1426
1427 if (eval != 0) {
1428 #ifdef MSG_DEBUG_OK
1429 printf("error (%d) copying out message type\n", eval);
1430 #endif
1431 msg_freehdr(msghdr);
1432 wakeup((caddr_t)msqptr);
1433
1434 goto msgrcvout;
1435 }
1436
1437
1438 /*
1439 * Return the segments to the user
1440 */
1441
1442 next = msghdr->msg_spot;
1443 for (len = 0; len < msgsz; len += msginfo.msgssz) {
1444 size_t tlen;
1445
1446 /*
1447 * copy the full segment, or less if we're at the end
1448 * of the message
1449 */
1450 tlen = MIN(msgsz - len, (size_t)msginfo.msgssz);
1451 if (next <= -1) {
1452 panic("next too low #3");
1453 }
1454 if (next >= msginfo.msgseg) {
1455 panic("next out of range #3");
1456 }
1457 SYSV_MSG_SUBSYS_UNLOCK();
1458 eval = copyout(&msgpool[next * msginfo.msgssz],
1459 user_msgp, tlen);
1460 SYSV_MSG_SUBSYS_LOCK();
1461 if (eval != 0) {
1462 #ifdef MSG_DEBUG_OK
1463 printf("error (%d) copying out message segment\n",
1464 eval);
1465 #endif
1466 msg_freehdr(msghdr);
1467 wakeup((caddr_t)msqptr);
1468 goto msgrcvout;
1469 }
1470 user_msgp = user_msgp + tlen; /* ptr math */
1471 next = msgmaps[next].next;
1472 }
1473
1474 /*
1475 * Done, return the actual number of bytes copied out.
1476 */
1477
1478 msg_freehdr(msghdr);
1479 wakeup((caddr_t)msqptr);
1480 *retval = msgsz;
1481 eval = 0;
1482 msgrcvout:
1483 SYSV_MSG_SUBSYS_UNLOCK();
1484 return eval;
1485 }
1486
1487 static int
1488 IPCS_msg_sysctl(__unused struct sysctl_oid *oidp, __unused void *arg1,
1489 __unused int arg2, struct sysctl_req *req)
1490 {
1491 int error;
1492 int cursor;
1493 union {
1494 struct user32_IPCS_command u32;
1495 struct user_IPCS_command u64;
1496 } ipcs = { };
1497 struct user32_msqid_ds msqid_ds32 = {}; /* post conversion, 32 bit version */
1498 struct user64_msqid_ds msqid_ds64 = {}; /* post conversion, 64 bit version */
1499 void *msqid_dsp;
1500 size_t ipcs_sz;
1501 size_t msqid_ds_sz;
1502 struct proc *p = current_proc();
1503
1504 if (IS_64BIT_PROCESS(p)) {
1505 ipcs_sz = sizeof(struct user_IPCS_command);
1506 msqid_ds_sz = sizeof(struct user64_msqid_ds);
1507 } else {
1508 ipcs_sz = sizeof(struct user32_IPCS_command);
1509 msqid_ds_sz = sizeof(struct user32_msqid_ds);
1510 }
1511
1512 /* Copy in the command structure */
1513 if ((error = SYSCTL_IN(req, &ipcs, ipcs_sz)) != 0) {
1514 return error;
1515 }
1516
1517 if (!IS_64BIT_PROCESS(p)) { /* convert in place */
1518 ipcs.u64.ipcs_data = CAST_USER_ADDR_T(ipcs.u32.ipcs_data);
1519 }
1520
1521 /* Let us version this interface... */
1522 if (ipcs.u64.ipcs_magic != IPCS_MAGIC) {
1523 return EINVAL;
1524 }
1525
1526 SYSV_MSG_SUBSYS_LOCK();
1527
1528 switch (ipcs.u64.ipcs_op) {
1529 case IPCS_MSG_CONF: /* Obtain global configuration data */
1530 if (ipcs.u64.ipcs_datalen != sizeof(struct msginfo)) {
1531 error = ERANGE;
1532 break;
1533 }
1534 if (ipcs.u64.ipcs_cursor != 0) { /* fwd. compat. */
1535 error = EINVAL;
1536 break;
1537 }
1538 SYSV_MSG_SUBSYS_UNLOCK();
1539 error = copyout(&msginfo, ipcs.u64.ipcs_data, ipcs.u64.ipcs_datalen);
1540 SYSV_MSG_SUBSYS_LOCK();
1541 break;
1542
1543 case IPCS_MSG_ITER: /* Iterate over existing segments */
1544 /* Not done up top so we can set limits via sysctl (later) */
1545 if (!msginit(0)) {
1546 error = ENOMEM;
1547 break;
1548 }
1549
1550 cursor = ipcs.u64.ipcs_cursor;
1551 if (cursor < 0 || cursor >= msginfo.msgmni) {
1552 error = ERANGE;
1553 break;
1554 }
1555 if (ipcs.u64.ipcs_datalen != (int)msqid_ds_sz) {
1556 error = EINVAL;
1557 break;
1558 }
1559 for (; cursor < msginfo.msgmni; cursor++) {
1560 if (msqids[cursor].u.msg_qbytes != 0) { /* allocated */
1561 break;
1562 }
1563 continue;
1564 }
1565 if (cursor == msginfo.msgmni) {
1566 error = ENOENT;
1567 break;
1568 }
1569
1570 msqid_dsp = &msqids[cursor]; /* default: 64 bit */
1571
1572 /*
1573 * If necessary, convert the 64 bit kernel segment
1574 * descriptor to a 32 bit user one.
1575 */
1576 if (IS_64BIT_PROCESS(p)) {
1577 msqid_ds_kerneltouser64(msqid_dsp, &msqid_ds64);
1578 msqid_dsp = &msqid_ds64;
1579 } else {
1580 msqid_ds_kerneltouser32(msqid_dsp, &msqid_ds32);
1581 msqid_dsp = &msqid_ds32;
1582 }
1583
1584 SYSV_MSG_SUBSYS_UNLOCK();
1585 error = copyout(msqid_dsp, ipcs.u64.ipcs_data, ipcs.u64.ipcs_datalen);
1586 if (!error) {
1587 /* update cursor */
1588 ipcs.u64.ipcs_cursor = cursor + 1;
1589
1590 if (!IS_64BIT_PROCESS(p)) { /* convert in place */
1591 ipcs.u32.ipcs_data = CAST_DOWN_EXPLICIT(user32_addr_t, ipcs.u64.ipcs_data);
1592 }
1593 error = SYSCTL_OUT(req, &ipcs, ipcs_sz);
1594 }
1595 SYSV_MSG_SUBSYS_LOCK();
1596 break;
1597
1598 default:
1599 error = EINVAL;
1600 break;
1601 }
1602
1603 SYSV_MSG_SUBSYS_UNLOCK();
1604 return error;
1605 }
1606
1607 SYSCTL_DECL(_kern_sysv_ipcs);
1608 SYSCTL_PROC(_kern_sysv_ipcs, OID_AUTO, msg, CTLFLAG_RW | CTLFLAG_ANYBODY | CTLFLAG_LOCKED,
1609 0, 0, IPCS_msg_sysctl,
1610 "S,IPCS_msg_command",
1611 "ipcs msg command interface");
1612
1613 #endif /* SYSV_MSG */