6 files changed, 175 insertions, 54 deletions

diff --git a/ipc/Makefile b/ipc/Makefile
index 4e1955ea815d..9075e172e52c 100644
--- a/ipc/Makefile
+++ b/ipc/Makefile
@@ -3,7 +3,7 @@
 #
 
 obj-$(CONFIG_SYSVIPC_COMPAT) += compat.o
-obj-$(CONFIG_SYSVIPC) += util.o msgutil.o msg.o sem.o shm.o ipcns_notifier.o
+obj-$(CONFIG_SYSVIPC) += util.o msgutil.o msg.o sem.o shm.o ipcns_notifier.o syscall.o
 obj-$(CONFIG_SYSVIPC_SYSCTL) += ipc_sysctl.o
 obj_mq-$(CONFIG_COMPAT) += compat_mq.o
 obj-$(CONFIG_POSIX_MQUEUE) += mqueue.o msgutil.o $(obj_mq-y)
diff --git a/ipc/compat.c b/ipc/compat.c
index ab76fb0ef844..9dc2c7d3c9e6 100644
--- a/ipc/compat.c
+++ b/ipc/compat.c
@@ -26,7 +26,6 @@
 #include <linux/init.h>
 #include <linux/msg.h>
 #include <linux/shm.h>
-#include <linux/slab.h>
 #include <linux/syscalls.h>
 
 #include <linux/mutex.h>
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index c79bd57353e7..722b0130aa94 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -32,6 +32,7 @@
 #include <linux/nsproxy.h>
 #include <linux/pid.h>
 #include <linux/ipc_namespace.h>
+#include <linux/slab.h>
 
 #include <net/sock.h>
 #include "util.h"
@@ -134,7 +135,6 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
                         init_waitqueue_head(&info->wait_q);
                         INIT_LIST_HEAD(&info->e_wait_q[0].list);
                         INIT_LIST_HEAD(&info->e_wait_q[1].list);
-                        info->messages = NULL;
                         info->notify_owner = NULL;
                         info->qsize = 0;
                         info->user = NULL;      /* set when all is ok */
@@ -146,26 +146,24 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
                                 info->attr.mq_msgsize = attr->mq_msgsize;
                         }
                         mq_msg_tblsz = info->attr.mq_maxmsg * sizeof(struct msg_msg *);
+                        info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL);
+                        if (!info->messages)
+                                goto out_inode;
+
                         mq_bytes = (mq_msg_tblsz +
                                 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
 
                         spin_lock(&mq_lock);
                         if (u->mq_bytes + mq_bytes < u->mq_bytes ||
                             u->mq_bytes + mq_bytes >
-                            p->signal->rlim[RLIMIT_MSGQUEUE].rlim_cur) {
+                            task_rlimit(p, RLIMIT_MSGQUEUE)) {
                                 spin_unlock(&mq_lock);
+                                kfree(info->messages);
                                 goto out_inode;
                         }
                         u->mq_bytes += mq_bytes;
                         spin_unlock(&mq_lock);
 
-                        info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL);
-                        if (!info->messages) {
-                                spin_lock(&mq_lock);
-                                u->mq_bytes -= mq_bytes;
-                                spin_unlock(&mq_lock);
-                                goto out_inode;
-                        }
                         /* all is ok */
                         info->user = get_uid(u);
                 } else if (S_ISDIR(mode)) {
@@ -187,7 +185,7 @@ static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct inode *inode;
         struct ipc_namespace *ns = data;
-        int error = 0;
+        int error;
 
         sb->s_blocksize = PAGE_CACHE_SIZE;
         sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
@@ -205,7 +203,9 @@ static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
         if (!sb->s_root) {
                 iput(inode);
                 error = -ENOMEM;
+                goto out;
         }
+        error = 0;
 
 out:
         return error;
@@ -264,8 +264,9 @@ static void mqueue_delete_inode(struct inode *inode)
 
         clear_inode(inode);
 
-        mq_bytes = (info->attr.mq_maxmsg * sizeof(struct msg_msg *) +
-                   (info->attr.mq_maxmsg * info->attr.mq_msgsize));
+        /* Total amount of bytes accounted for the mqueue */
+        mq_bytes = info->attr.mq_maxmsg * (sizeof(struct msg_msg *)
+            + info->attr.mq_msgsize);
         user = info->user;
         if (user) {
                 spin_lock(&mq_lock);
@@ -604,8 +605,8 @@ static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
         /* check for overflow */
         if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg)
                 return 0;
-        if ((unsigned long)(attr->mq_maxmsg * attr->mq_msgsize) +
-            (attr->mq_maxmsg * sizeof (struct msg_msg *)) <
+        if ((unsigned long)(attr->mq_maxmsg * (attr->mq_msgsize
+            + sizeof (struct msg_msg *))) <
             (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize))
                 return 0;
         return 1;
@@ -623,9 +624,10 @@ static struct file *do_create(struct ipc_namespace *ipc_ns, struct dentry *dir,
         int ret;
 
         if (attr) {
-                ret = -EINVAL;
-                if (!mq_attr_ok(ipc_ns, attr))
+                if (!mq_attr_ok(ipc_ns, attr)) {
+                        ret = -EINVAL;
                         goto out;
+                }
                 /* store for use during create */
                 dentry->d_fsdata = attr;
         }
@@ -659,24 +661,28 @@ out:
 static struct file *do_open(struct ipc_namespace *ipc_ns,
                                 struct dentry *dentry, int oflag)
 {
+        int ret;
         const struct cred *cred = current_cred();
 
         static const int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
                                                   MAY_READ | MAY_WRITE };
 
         if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) {
-                dput(dentry);
-                mntput(ipc_ns->mq_mnt);
-                return ERR_PTR(-EINVAL);
+                ret = -EINVAL;
+                goto err;
         }
 
         if (inode_permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE])) {
-                dput(dentry);
-                mntput(ipc_ns->mq_mnt);
-                return ERR_PTR(-EACCES);
+                ret = -EACCES;
+                goto err;
         }
 
         return dentry_open(dentry, ipc_ns->mq_mnt, oflag, cred);
+
+err:
+        dput(dentry);
+        mntput(ipc_ns->mq_mnt);
+        return ERR_PTR(ret);
 }
 
 SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode,
@@ -705,16 +711,17 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode,
         dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));
         if (IS_ERR(dentry)) {
                 error = PTR_ERR(dentry);
-                goto out_err;
+                goto out_putfd;
         }
         mntget(ipc_ns->mq_mnt);
 
         if (oflag & O_CREAT) {
                 if (dentry->d_inode) {  /* entry already exists */
                         audit_inode(name, dentry);
-                        error = -EEXIST;
-                        if (oflag & O_EXCL)
+                        if (oflag & O_EXCL) {
+                                error = -EEXIST;
                                 goto out;
+                        }
                         filp = do_open(ipc_ns, dentry, oflag);
                 } else {
                         filp = do_create(ipc_ns, ipc_ns->mq_mnt->mnt_root,
@@ -722,9 +729,10 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode,
                                                 u_attr ? &attr : NULL);
                 }
         } else {
-                error = -ENOENT;
-                if (!dentry->d_inode)
+                if (!dentry->d_inode) {
+                        error = -ENOENT;
                         goto out;
+                }
                 audit_inode(name, dentry);
                 filp = do_open(ipc_ns, dentry, oflag);
         }
@@ -742,7 +750,6 @@ out:
         mntput(ipc_ns->mq_mnt);
 out_putfd:
         put_unused_fd(fd);
-out_err:
         fd = error;
 out_upsem:
         mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
@@ -872,19 +879,24 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr,
         audit_mq_sendrecv(mqdes, msg_len, msg_prio, p);
         timeout = prepare_timeout(p);
 
-        ret = -EBADF;
         filp = fget(mqdes);
-        if (unlikely(!filp))
+        if (unlikely(!filp)) {
+                ret = -EBADF;
                 goto out;
+        }
 
         inode = filp->f_path.dentry->d_inode;
-        if (unlikely(filp->f_op != &mqueue_file_operations))
+        if (unlikely(filp->f_op != &mqueue_file_operations)) {
+                ret = -EBADF;
                 goto out_fput;
+        }
         info = MQUEUE_I(inode);
         audit_inode(NULL, filp->f_path.dentry);
 
-        if (unlikely(!(filp->f_mode & FMODE_WRITE)))
+        if (unlikely(!(filp->f_mode & FMODE_WRITE))) {
+                ret = -EBADF;
                 goto out_fput;
+        }
 
         if (unlikely(msg_len > info->attr.mq_msgsize)) {
                 ret = -EMSGSIZE;
@@ -961,19 +973,24 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr,
         audit_mq_sendrecv(mqdes, msg_len, 0, p);
         timeout = prepare_timeout(p);
 
-        ret = -EBADF;
         filp = fget(mqdes);
-        if (unlikely(!filp))
+        if (unlikely(!filp)) {
+                ret = -EBADF;
                 goto out;
+        }
 
         inode = filp->f_path.dentry->d_inode;
-        if (unlikely(filp->f_op != &mqueue_file_operations))
+        if (unlikely(filp->f_op != &mqueue_file_operations)) {
+                ret = -EBADF;
                 goto out_fput;
+        }
         info = MQUEUE_I(inode);
         audit_inode(NULL, filp->f_path.dentry);
 
-        if (unlikely(!(filp->f_mode & FMODE_READ)))
+        if (unlikely(!(filp->f_mode & FMODE_READ))) {
+                ret = -EBADF;
                 goto out_fput;
+        }
 
         /* checks if buffer is big enough */
         if (unlikely(msg_len < info->attr.mq_msgsize)) {
@@ -1063,13 +1080,14 @@ SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
 
                         /* create the notify skb */
                         nc = alloc_skb(NOTIFY_COOKIE_LEN, GFP_KERNEL);
-                        ret = -ENOMEM;
-                        if (!nc)
+                        if (!nc) {
+                                ret = -ENOMEM;
                                 goto out;
-                        ret = -EFAULT;
+                        }
                         if (copy_from_user(nc->data,
                                         notification.sigev_value.sival_ptr,
                                         NOTIFY_COOKIE_LEN)) {
+                                ret = -EFAULT;
                                 goto out;
                         }
 
@@ -1078,9 +1096,10 @@ SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
                         /* and attach it to the socket */
 retry:
                         filp = fget(notification.sigev_signo);
-                        ret = -EBADF;
-                        if (!filp)
+                        if (!filp) {
+                                ret = -EBADF;
                                 goto out;
+                        }
                         sock = netlink_getsockbyfilp(filp);
                         fput(filp);
                         if (IS_ERR(sock)) {
@@ -1092,7 +1111,7 @@ retry:
                         timeo = MAX_SCHEDULE_TIMEOUT;
                         ret = netlink_attachskb(sock, nc, &timeo, NULL);
                         if (ret == 1)
-                                goto retry;
+                                goto retry;
                         if (ret) {
                                 sock = NULL;
                                 nc = NULL;
@@ -1101,14 +1120,17 @@ retry:
                 }
         }
 
-        ret = -EBADF;
         filp = fget(mqdes);
-        if (!filp)
+        if (!filp) {
+                ret = -EBADF;
                 goto out;
+        }
 
         inode = filp->f_path.dentry->d_inode;
-        if (unlikely(filp->f_op != &mqueue_file_operations))
+        if (unlikely(filp->f_op != &mqueue_file_operations)) {
+                ret = -EBADF;
                 goto out_fput;
+        }
         info = MQUEUE_I(inode);
 
         ret = 0;
@@ -1171,14 +1193,17 @@ SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mqdes,
                         return -EINVAL;
         }
 
-        ret = -EBADF;
         filp = fget(mqdes);
-        if (!filp)
+        if (!filp) {
+                ret = -EBADF;
                 goto out;
+        }
 
         inode = filp->f_path.dentry->d_inode;
-        if (unlikely(filp->f_op != &mqueue_file_operations))
+        if (unlikely(filp->f_op != &mqueue_file_operations)) {
+                ret = -EBADF;
                 goto out_fput;
+        }
         info = MQUEUE_I(inode);
 
         spin_lock(&info->lock);
@@ -1272,7 +1297,7 @@ static int __init init_mqueue_fs(void)
         if (mqueue_inode_cachep == NULL)
                 return -ENOMEM;
 
-        /* ignore failues - they are not fatal */
+        /* ignore failures - they are not fatal */
         mq_sysctl_table = mq_register_sysctl_table();
 
         error = register_filesystem(&mqueue_fs_type);
diff --git a/ipc/msg.c b/ipc/msg.c
index af42ef8900a6..9547cb7ac313 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -23,7 +23,6 @@
  */
 
 #include <linux/capability.h>
-#include <linux/slab.h>
 #include <linux/msg.h>
 #include <linux/spinlock.h>
 #include <linux/init.h>
diff --git a/ipc/shm.c b/ipc/shm.c
index 23256b855819..1a314c89f93c 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -764,8 +764,7 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
                         if (euid != shp->shm_perm.uid &&
                             euid != shp->shm_perm.cuid)
                                 goto out_unlock;
-                        if (cmd == SHM_LOCK &&
-                            !current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur)
+                        if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))
                                 goto out_unlock;
                 }
 
diff --git a/ipc/syscall.c b/ipc/syscall.c
new file mode 100644
index 000000000000..1d6f53f6b562
--- /dev/null
+++ b/ipc/syscall.c
@@ -0,0 +1,99 @@
+/*
+ * sys_ipc() is the old de-multiplexer for the SysV IPC calls.
+ *
+ * This is really horribly ugly, and new architectures should just wire up
+ * the individual syscalls instead.
+ */
+#include <linux/unistd.h>
+
+#ifdef __ARCH_WANT_SYS_IPC
+#include <linux/errno.h>
+#include <linux/ipc.h>
+#include <linux/shm.h>
+#include <linux/syscalls.h>
+#include <linux/uaccess.h>
+
+SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, unsigned long, second,
+                unsigned long, third, void __user *, ptr, long, fifth)
+{
+        int version, ret;
+
+        version = call >> 16; /* hack for backward compatibility */
+        call &= 0xffff;
+
+        switch (call) {
+        case SEMOP:
+                return sys_semtimedop(first, (struct sembuf __user *)ptr,
+                                      second, NULL);
+        case SEMTIMEDOP:
+                return sys_semtimedop(first, (struct sembuf __user *)ptr,
+                                      second,
+                                      (const struct timespec __user *)fifth);
+
+        case SEMGET:
+                return sys_semget(first, second, third);
+        case SEMCTL: {
+                union semun fourth;
+                if (!ptr)
+                        return -EINVAL;
+                if (get_user(fourth.__pad, (void __user * __user *) ptr))
+                        return -EFAULT;
+                return sys_semctl(first, second, third, fourth);
+        }
+
+        case MSGSND:
+                return sys_msgsnd(first, (struct msgbuf __user *) ptr,
+                                  second, third);
+        case MSGRCV:
+                switch (version) {
+                case 0: {
+                        struct ipc_kludge tmp;
+                        if (!ptr)
+                                return -EINVAL;
+
+                        if (copy_from_user(&tmp,
+                                           (struct ipc_kludge __user *) ptr,
+                                           sizeof(tmp)))
+                                return -EFAULT;
+                        return sys_msgrcv(first, tmp.msgp, second,
+                                           tmp.msgtyp, third);
+                }
+                default:
+                        return sys_msgrcv(first,
+                                           (struct msgbuf __user *) ptr,
+                                           second, fifth, third);
+                }
+        case MSGGET:
+                return sys_msgget((key_t) first, second);
+        case MSGCTL:
+                return sys_msgctl(first, second, (struct msqid_ds __user *)ptr);
+
+        case SHMAT:
+                switch (version) {
+                default: {
+                        unsigned long raddr;
+                        ret = do_shmat(first, (char __user *)ptr,
+                                       second, &raddr);
+                        if (ret)
+                                return ret;
+                        return put_user(raddr, (unsigned long __user *) third);
+                }
+                case 1:
+                        /*
+                         * This was the entry point for kernel-originating calls
+                         * from iBCS2 in 2.2 days.
+                         */
+                        return -EINVAL;
+                }
+        case SHMDT:
+                return sys_shmdt((char __user *)ptr);
+        case SHMGET:
+                return sys_shmget(first, second, third);
+        case SHMCTL:
+                return sys_shmctl(first, second,
+                                   (struct shmid_ds __user *) ptr);
+        default:
+                return -ENOSYS;
+        }
+}
+#endif