5 files changed, 66 insertions, 119 deletions

diff --git a/ipc/msg.c b/ipc/msg.c
index 87d8b3852300..4a858f98a760 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -142,21 +142,6 @@ void __init msg_init(void)
 }
 
 /*
- * This routine is called in the paths where the rw_mutex is held to protect
- * access to the idr tree.
- */
-static inline struct msg_queue *msg_lock_check_down(struct ipc_namespace *ns,
-                                                int id)
-{
-        struct kern_ipc_perm *ipcp = ipc_lock_check_down(&msg_ids(ns), id);
-
-        if (IS_ERR(ipcp))
-                return (struct msg_queue *)ipcp;
-
-        return container_of(ipcp, struct msg_queue, q_perm);
-}
-
-/*
  * msg_lock_(check_) routines are called in the paths where the rw_mutex
  * is not held.
  */
@@ -437,35 +422,12 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
                         return -EFAULT;
         }
 
-        down_write(&msg_ids(ns).rw_mutex);
-        msq = msg_lock_check_down(ns, msqid);
-        if (IS_ERR(msq)) {
-                err = PTR_ERR(msq);
-                goto out_up;
-        }
-
-        ipcp = &msq->q_perm;
-
-        err = audit_ipc_obj(ipcp);
-        if (err)
-                goto out_unlock;
-
-        if (cmd == IPC_SET) {
-                err = audit_ipc_set_perm(msqid64.msg_qbytes,
-                                         msqid64.msg_perm.uid,
-                                         msqid64.msg_perm.gid,
-                                         msqid64.msg_perm.mode);
-                if (err)
-                        goto out_unlock;
-        }
+        ipcp = ipcctl_pre_down(&msg_ids(ns), msqid, cmd,
+                               &msqid64.msg_perm, msqid64.msg_qbytes);
+        if (IS_ERR(ipcp))
+                return PTR_ERR(ipcp);
 
-        if (current->euid != ipcp->cuid &&
-            current->euid != ipcp->uid &&
-            !capable(CAP_SYS_ADMIN)) {
-                /* We _could_ check for CAP_CHOWN above, but we don't */
-                err = -EPERM;
-                goto out_unlock;
-        }
+        msq = container_of(ipcp, struct msg_queue, q_perm);
 
         err = security_msg_queue_msgctl(msq, cmd);
         if (err)
diff --git a/ipc/sem.c b/ipc/sem.c
index e803abec2b08..d56d3ab6bb8a 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -141,21 +141,6 @@ void __init sem_init (void)
 }
 
 /*
- * This routine is called in the paths where the rw_mutex is held to protect
- * access to the idr tree.
- */
-static inline struct sem_array *sem_lock_check_down(struct ipc_namespace *ns,
-                                                int id)
-{
-        struct kern_ipc_perm *ipcp = ipc_lock_check_down(&sem_ids(ns), id);
-
-        if (IS_ERR(ipcp))
-                return (struct sem_array *)ipcp;
-
-        return container_of(ipcp, struct sem_array, sem_perm);
-}
-
-/*
  * sem_lock_(check_) routines are called in the paths where the rw_mutex
  * is not held.
  */
@@ -878,31 +863,12 @@ static int semctl_down(struct ipc_namespace *ns, int semid,
                 if (copy_semid_from_user(&semid64, arg.buf, version))
                         return -EFAULT;
         }
-        down_write(&sem_ids(ns).rw_mutex);
-        sma = sem_lock_check_down(ns, semid);
-        if (IS_ERR(sma)) {
-                err = PTR_ERR(sma);
-                goto out_up;
-        }
-
-        ipcp = &sma->sem_perm;
 
-        err = audit_ipc_obj(ipcp);
-        if (err)
-                goto out_unlock;
+        ipcp = ipcctl_pre_down(&sem_ids(ns), semid, cmd, &semid64.sem_perm, 0);
+        if (IS_ERR(ipcp))
+                return PTR_ERR(ipcp);
 
-        if (cmd == IPC_SET) {
-                err = audit_ipc_set_perm(0, semid64.sem_perm.uid,
-                                         semid64.sem_perm.gid,
-                                         semid64.sem_perm.mode);
-                if (err)
-                        goto out_unlock;
-        }
-        if (current->euid != ipcp->cuid && 
-            current->euid != ipcp->uid && !capable(CAP_SYS_ADMIN)) {
-                err=-EPERM;
-                goto out_unlock;
-        }
+        sma = container_of(ipcp, struct sem_array, sem_perm);
 
         err = security_sem_semctl(sma, cmd);
         if (err)
diff --git a/ipc/shm.c b/ipc/shm.c
index 20e03dfc6adb..554429ade079 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -126,18 +126,6 @@ static inline struct shmid_kernel *shm_lock_down(struct ipc_namespace *ns,
         return container_of(ipcp, struct shmid_kernel, shm_perm);
 }
 
-static inline struct shmid_kernel *shm_lock_check_down(
-                                                struct ipc_namespace *ns,
-                                                int id)
-{
-        struct kern_ipc_perm *ipcp = ipc_lock_check_down(&shm_ids(ns), id);
-
-        if (IS_ERR(ipcp))
-                return (struct shmid_kernel *)ipcp;
-
-        return container_of(ipcp, struct shmid_kernel, shm_perm);
-}
-
 /*
  * shm_lock_(check_) routines are called in the paths where the rw_mutex
  * is not held.
@@ -620,33 +608,11 @@ static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd,
                         return -EFAULT;
         }
 
-        down_write(&shm_ids(ns).rw_mutex);
-        shp = shm_lock_check_down(ns, shmid);
-        if (IS_ERR(shp)) {
-                err = PTR_ERR(shp);
-                goto out_up;
-        }
-
-        ipcp = &shp->shm_perm;
-
-        err = audit_ipc_obj(ipcp);
-        if (err)
-                goto out_unlock;
-
-        if (cmd == IPC_SET) {
-                err = audit_ipc_set_perm(0, shmid64.shm_perm.uid,
-                                         shmid64.shm_perm.gid,
-                                         shmid64.shm_perm.mode);
-                if (err)
-                        goto out_unlock;
-        }
+        ipcp = ipcctl_pre_down(&shm_ids(ns), shmid, cmd, &shmid64.shm_perm, 0);
+        if (IS_ERR(ipcp))
+                return PTR_ERR(ipcp);
 
-        if (current->euid != ipcp->uid &&
-            current->euid != ipcp->cuid &&
-            !capable(CAP_SYS_ADMIN)) {
-                err = -EPERM;
-                goto out_unlock;
-        }
+        shp = container_of(ipcp, struct shmid_kernel, shm_perm);
 
         err = security_shm_shmctl(shp, cmd);
         if (err)
diff --git a/ipc/util.c b/ipc/util.c
index dc8943aa9719..c4f1d33b89e4 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -824,6 +824,57 @@ void ipc_update_perm(struct ipc64_perm *in, struct kern_ipc_perm *out)
                 | (in->mode & S_IRWXUGO);
 }
 
+/**
+ * ipcctl_pre_down - retrieve an ipc and check permissions for some IPC_XXX cmd
+ * @ids:  the table of ids where to look for the ipc
+ * @id:   the id of the ipc to retrieve
+ * @cmd:  the cmd to check
+ * @perm: the permission to set