1 files changed, 118 insertions, 121 deletions

diff --git a/ipc/msg.c b/ipc/msg.c
index 46585a05473e..32494e8cc7a5 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -27,6 +27,7 @@
 #include <linux/msg.h>
 #include <linux/spinlock.h>
 #include <linux/init.h>
+#include <linux/mm.h>
 #include <linux/proc_fs.h>
 #include <linux/list.h>
 #include <linux/security.h>
@@ -70,7 +71,6 @@ struct msg_sender {
 #define msg_ids(ns)     ((ns)->ids[IPC_MSG_IDS])
 
 #define msg_unlock(msq)         ipc_unlock(&(msq)->q_perm)
-#define msg_buildid(id, seq)    ipc_buildid(id, seq)
 
 static void freeque(struct ipc_namespace *, struct kern_ipc_perm *);
 static int newque(struct ipc_namespace *, struct ipc_params *);
@@ -78,11 +78,49 @@ static int newque(struct ipc_namespace *, struct ipc_params *);
 static int sysvipc_msg_proc_show(struct seq_file *s, void *it);
 #endif
 
+/*
+ * Scale msgmni with the available lowmem size: the memory dedicated to msg
+ * queues should occupy at most 1/MSG_MEM_SCALE of lowmem.
+ * Also take into account the number of nsproxies created so far.
+ * This should be done staying within the (MSGMNI , IPCMNI/nr_ipc_ns) range.
+ */
+void recompute_msgmni(struct ipc_namespace *ns)
+{
+        struct sysinfo i;
+        unsigned long allowed;
+        int nb_ns;
+
+        si_meminfo(&i);
+        allowed = (((i.totalram - i.totalhigh) / MSG_MEM_SCALE) * i.mem_unit)
+                / MSGMNB;
+        nb_ns = atomic_read(&nr_ipc_ns);
+        allowed /= nb_ns;
+
+        if (allowed < MSGMNI) {
+                ns->msg_ctlmni = MSGMNI;
+                goto out_callback;
+        }
+
+        if (allowed > IPCMNI / nb_ns) {
+                ns->msg_ctlmni = IPCMNI / nb_ns;
+                goto out_callback;
+        }
+
+        ns->msg_ctlmni = allowed;
+
+out_callback:
+
+        printk(KERN_INFO "msgmni has been set to %d for ipc namespace %p\n",
+                ns->msg_ctlmni, ns);
+}
+
 void msg_init_ns(struct ipc_namespace *ns)
 {
         ns->msg_ctlmax = MSGMAX;
         ns->msg_ctlmnb = MSGMNB;
-        ns->msg_ctlmni = MSGMNI;
+
+        recompute_msgmni(ns);
+
         atomic_set(&ns->msg_bytes, 0);
         atomic_set(&ns->msg_hdrs, 0);
         ipc_init_ids(&ns->ids[IPC_MSG_IDS]);
@@ -104,21 +142,6 @@ void __init msg_init(void)
 }
 
 /*
- * This routine is called in the paths where the rw_mutex is held to protect
- * access to the idr tree.
- */
-static inline struct msg_queue *msg_lock_check_down(struct ipc_namespace *ns,
-                                                int id)
-{
-        struct kern_ipc_perm *ipcp = ipc_lock_check_down(&msg_ids(ns), id);
-
-        if (IS_ERR(ipcp))
-                return (struct msg_queue *)ipcp;
-
-        return container_of(ipcp, struct msg_queue, q_perm);
-}
-
-/*
  * msg_lock_(check_) routines are called in the paths where the rw_mutex
  * is not held.
  */
@@ -186,7 +209,6 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
                 return id;
         }
 
-        msq->q_perm.id = msg_buildid(id, msq->q_perm.seq);
         msq->q_stime = msq->q_rtime = 0;
         msq->q_ctime = get_seconds();
         msq->q_cbytes = msq->q_qnum = 0;
@@ -324,19 +346,19 @@ copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
                 out.msg_rtime           = in->msg_rtime;
                 out.msg_ctime           = in->msg_ctime;
 
-                if (in->msg_cbytes > USHRT_MAX)
-                        out.msg_cbytes  = USHRT_MAX;
+                if (in->msg_cbytes > USHORT_MAX)
+                        out.msg_cbytes  = USHORT_MAX;
                 else
                         out.msg_cbytes  = in->msg_cbytes;
                 out.msg_lcbytes         = in->msg_cbytes;
 
-                if (in->msg_qnum > USHRT_MAX)
-                        out.msg_qnum    = USHRT_MAX;
+                if (in->msg_qnum > USHORT_MAX)
+                        out.msg_qnum    = USHORT_MAX;
                 else
                         out.msg_qnum    = in->msg_qnum;
 
-                if (in->msg_qbytes > USHRT_MAX)
-                        out.msg_qbytes  = USHRT_MAX;
+                if (in->msg_qbytes > USHORT_MAX)
+                        out.msg_qbytes  = USHORT_MAX;
                 else
                         out.msg_qbytes  = in->msg_qbytes;
                 out.msg_lqbytes         = in->msg_qbytes;
@@ -351,31 +373,14 @@ copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
         }
 }
 
-struct msq_setbuf {
-        unsigned long   qbytes;
-        uid_t           uid;
-        gid_t           gid;
-        mode_t          mode;
-};
-
 static inline unsigned long
-copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
+copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
 {
         switch(version) {
         case IPC_64:
-        {
-                struct msqid64_ds tbuf;
-
-                if (copy_from_user(&tbuf, buf, sizeof(tbuf)))
+                if (copy_from_user(out, buf, sizeof(*out)))
                         return -EFAULT;
-
-                out->qbytes             = tbuf.msg_qbytes;
-                out->uid                = tbuf.msg_perm.uid;
-                out->gid                = tbuf.msg_perm.gid;
-                out->mode               = tbuf.msg_perm.mode;
-
                 return 0;
-        }
         case IPC_OLD:
         {
                 struct msqid_ds tbuf_old;
@@ -383,14 +388,14 @@ copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
                 if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
                         return -EFAULT;
 
-                out->uid                = tbuf_old.msg_perm.uid;
-                out->gid                = tbuf_old.msg_perm.gid;
-                out->mode               = tbuf_old.msg_perm.mode;
+                out->msg_perm.uid       = tbuf_old.msg_perm.uid;
+                out->msg_perm.gid       = tbuf_old.msg_perm.gid;
+                out->msg_perm.mode      = tbuf_old.msg_perm.mode;
 
                 if (tbuf_old.msg_qbytes == 0)
-                        out->qbytes     = tbuf_old.msg_lqbytes;
+                        out->msg_qbytes = tbuf_old.msg_lqbytes;
                 else
-                        out->qbytes     = tbuf_old.msg_qbytes;
+                        out->msg_qbytes = tbuf_old.msg_qbytes;
 
                 return 0;
         }
@@ -399,10 +404,71 @@ copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
         }
 }
 
-asmlinkage long sys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
+/*
+ * This function handles some msgctl commands which require the rw_mutex
+ * to be held in write mode.
+ * NOTE: no locks must be held, the rw_mutex is taken inside this function.
+ */
+static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
+                       struct msqid_ds __user *buf, int version)
 {
         struct kern_ipc_perm *ipcp;
-        struct msq_setbuf uninitialized_var(setbuf);
+        struct msqid64_ds msqid64;
+        struct msg_queue *msq;
+        int err;
+
+        if (cmd == IPC_SET) {
+                if (copy_msqid_from_user(&msqid64, buf, version))
+                        return -EFAULT;
+        }
+
+        ipcp = ipcctl_pre_down(&msg_ids(ns), msqid, cmd,
+                               &msqid64.msg_perm, msqid64.msg_qbytes);
+        if (IS_ERR(ipcp))
+                return PTR_ERR(ipcp);
+
+        msq = container_of(ipcp, struct msg_queue, q_perm);
+
+        err = security_msg_queue_msgctl(msq, cmd);
+        if (err)
+                goto out_unlock;
+
+        switch (cmd) {
+        case IPC_RMID:
+                freeque(ns, ipcp);
+                goto out_up;
+        case IPC_SET:
+                if (msqid64.msg_qbytes > ns->msg_ctlmnb &&
+                    !capable(CAP_SYS_RESOURCE)) {
+                        err = -EPERM;
+                        goto out_unlock;
+                }
+
+                msq->q_qbytes = msqid64.msg_qbytes;
+
+                ipc_update_perm(&msqid64.msg_perm, ipcp);
+                msq->q_ctime = get_seconds();
+                /* sleeping receivers might be excluded by
+                 * stricter permissions.
+                 */
+                expunge_all(msq, -EAGAIN);
+                /* sleeping senders might be able to send
+                 * due to a larger queue size.
+                 */
+                ss_wakeup(&msq->q_senders, 0);
+                break;
+        default:
+                err = -EINVAL;
+        }
+out_unlock:
+        msg_unlock(msq);
+out_up:
+        up_write(&msg_ids(ns).rw_mutex);
+        return err;
+}
+
+asmlinkage long sys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
+{
         struct msg_queue *msq;
         int err, version;
         struct ipc_namespace *ns;
@@ -498,82 +564,13 @@ asmlinkage long sys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
                 return success_return;
         }
         case IPC_SET:
-                if (!buf)
-                        return -EFAULT;
-                if (copy_msqid_from_user(&setbuf, buf, version))
-                        return -EFAULT;
-                break;
         case IPC_RMID:
-                break;
+                err = msgctl_down(ns, msqid, cmd, buf, version);
+                return err;
         default:
                 return  -EINVAL;
         }
 
-        down_write(&msg_ids(ns).rw_mutex);
-        msq = msg_lock_check_down(ns, msqid);
-        if (IS_ERR(msq)) {
-                err = PTR_ERR(msq);
-                goto out_up;
-        }
-
-        ipcp = &msq->q_perm;
-
-        err = audit_ipc_obj(ipcp);
-        if (err)
-                goto out_unlock_up;
-        if (cmd == IPC_SET) {
-                err = audit_ipc_set_perm(setbuf.qbytes, setbuf.uid, setbuf.gid,
-                                         setbuf.mode);
-                if (err)
-                        goto out_unlock_up;
-        }
-
-        err = -EPERM;
-        if (current->euid != ipcp->cuid &&
-            current->euid != ipcp->uid && !capable(CAP_SYS_ADMIN))
-                /* We _could_ check for CAP_CHOWN above, but we don't */
-                goto out_unlock_up;
-
-        err = security_msg_queue_msgctl(msq, cmd);
-        if (err)
-                goto out_unlock_up;
-
-        switch (cmd) {
-        case IPC_SET:
-        {
-                err = -EPERM;
-                if (setbuf.qbytes > ns->msg_ctlmnb && !capable(CAP_SYS_RESOURCE))
-                        goto out_unlock_up;
-
-                msq->q_qbytes = setbuf.qbytes;
-
-                ipcp->uid = setbuf.uid;
-                ipcp->gid = setbuf.gid;
-                ipcp->mode = (ipcp->mode & ~S_IRWXUGO) |
-                             (S_IRWXUGO & setbuf.mode);
-                msq->q_ctime = get_seconds();
-                /* sleeping receivers might be excluded by
-                 * stricter permissions.
-                 */
-                expunge_all(msq, -EAGAIN);
-                /* sleeping senders might be able to send
-                 * due to a larger queue size.
-                 */
-                ss_wakeup(&msq->q_senders, 0);
-                msg_unlock(msq);
-                break;
-        }
-        case IPC_RMID:
-                freeque(ns, &msq->q_perm);
-                break;
-        }
-        err = 0;
-out_up:
-        up_write(&msg_ids(ns).rw_mutex);
-        return err;
-out_unlock_up:
-        msg_unlock(msq);
-        goto out_up;
 out_unlock:
         msg_unlock(msq);
         return err;