1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20#include <linux/mm.h>
21#include <linux/shm.h>
22#include <linux/init.h>
23#include <linux/msg.h>
24#include <linux/vmalloc.h>
25#include <linux/slab.h>
26#include <linux/notifier.h>
27#include <linux/capability.h>
28#include <linux/highuid.h>
29#include <linux/security.h>
30#include <linux/rcupdate.h>
31#include <linux/workqueue.h>
32#include <linux/seq_file.h>
33#include <linux/proc_fs.h>
34#include <linux/audit.h>
35#include <linux/nsproxy.h>
36#include <linux/rwsem.h>
37#include <linux/memory.h>
38#include <linux/ipc_namespace.h>
39
40#include <asm/unistd.h>
41
42#include "util.h"
43
44struct ipc_proc_iface {
45 const char *path;
46 const char *header;
47 int ids;
48 int (*show)(struct seq_file *, void *);
49};
50
51static void ipc_memory_notifier(struct work_struct *work)
52{
53 ipcns_notify(IPCNS_MEMCHANGED);
54}
55
56static int ipc_memory_callback(struct notifier_block *self,
57 unsigned long action, void *arg)
58{
59 static DECLARE_WORK(ipc_memory_wq, ipc_memory_notifier);
60
61 switch (action) {
62 case MEM_ONLINE:
63 case MEM_OFFLINE:
64
65
66
67
68
69
70
71
72 if (!work_pending(&ipc_memory_wq))
73 schedule_work(&ipc_memory_wq);
74 break;
75 case MEM_GOING_ONLINE:
76 case MEM_GOING_OFFLINE:
77 case MEM_CANCEL_ONLINE:
78 case MEM_CANCEL_OFFLINE:
79 default:
80 break;
81 }
82
83 return NOTIFY_OK;
84}
85
86static struct notifier_block ipc_memory_nb = {
87 .notifier_call = ipc_memory_callback,
88 .priority = IPC_CALLBACK_PRI,
89};
90
91
92
93
94
95
96
97
98
99
100
101static int __init ipc_init(void)
102{
103 sem_init();
104 msg_init();
105 shm_init();
106 register_hotmemory_notifier(&ipc_memory_nb);
107 register_ipcns_notifier(&init_ipc_ns);
108 return 0;
109}
110__initcall(ipc_init);
111
112
113
114
115
116
117
118
119
120void ipc_init_ids(struct ipc_ids *ids)
121{
122 init_rwsem(&ids->rw_mutex);
123
124 ids->in_use = 0;
125 ids->seq = 0;
126 ids->next_id = -1;
127 {
128 int seq_limit = INT_MAX/SEQ_MULTIPLIER;
129 if (seq_limit > USHRT_MAX)
130 ids->seq_max = USHRT_MAX;
131 else
132 ids->seq_max = seq_limit;
133 }
134
135 idr_init(&ids->ipcs_idr);
136}
137
138#ifdef CONFIG_PROC_FS
139static const struct file_operations sysvipc_proc_fops;
140
141
142
143
144
145
146
147void __init ipc_init_proc_interface(const char *path, const char *header,
148 int ids, int (*show)(struct seq_file *, void *))
149{
150 struct proc_dir_entry *pde;
151 struct ipc_proc_iface *iface;
152
153 iface = kmalloc(sizeof(*iface), GFP_KERNEL);
154 if (!iface)
155 return;
156 iface->path = path;
157 iface->header = header;
158 iface->ids = ids;
159 iface->show = show;
160
161 pde = proc_create_data(path,
162 S_IRUGO,
163 NULL,
164 &sysvipc_proc_fops,
165 iface);
166 if (!pde) {
167 kfree(iface);
168 }
169}
170#endif
171
172
173
174
175
176
177
178
179
180
181
182
183static struct kern_ipc_perm *ipc_findkey(struct ipc_ids *ids, key_t key)
184{
185 struct kern_ipc_perm *ipc;
186 int next_id;
187 int total;
188
189 for (total = 0, next_id = 0; total < ids->in_use; next_id++) {
190 ipc = idr_find(&ids->ipcs_idr, next_id);
191
192 if (ipc == NULL)
193 continue;
194
195 if (ipc->key != key) {
196 total++;
197 continue;
198 }
199
200 ipc_lock_by_ptr(ipc);
201 return ipc;
202 }
203
204 return NULL;
205}
206
207
208
209
210
211
212
213
214int ipc_get_maxid(struct ipc_ids *ids)
215{
216 struct kern_ipc_perm *ipc;
217 int max_id = -1;
218 int total, id;
219
220 if (ids->in_use == 0)
221 return -1;
222
223 if (ids->in_use == IPCMNI)
224 return IPCMNI - 1;
225
226
227 total = 0;
228 for (id = 0; id < IPCMNI && total < ids->in_use; id++) {
229 ipc = idr_find(&ids->ipcs_idr, id);
230 if (ipc != NULL) {
231 max_id = id;
232 total++;
233 }
234 }
235 return max_id;
236}
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
253{
254 kuid_t euid;
255 kgid_t egid;
256 int id;
257 int next_id = ids->next_id;
258
259 if (size > IPCMNI)
260 size = IPCMNI;
261
262 if (ids->in_use >= size)
263 return -ENOSPC;
264
265 idr_preload(GFP_KERNEL);
266
267 spin_lock_init(&new->lock);
268 new->deleted = 0;
269 rcu_read_lock();
270 spin_lock(&new->lock);
271
272 id = idr_alloc(&ids->ipcs_idr, new,
273 (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,
274 GFP_NOWAIT);
275 idr_preload_end();
276 if (id < 0) {
277 spin_unlock(&new->lock);
278 rcu_read_unlock();
279 return id;
280 }
281
282 ids->in_use++;
283
284 current_euid_egid(&euid, &egid);
285 new->cuid = new->uid = euid;
286 new->gid = new->cgid = egid;
287
288 if (next_id < 0) {
289 new->seq = ids->seq++;
290 if (ids->seq > ids->seq_max)
291 ids->seq = 0;
292 } else {
293 new->seq = ipcid_to_seqx(next_id);
294 ids->next_id = -1;
295 }
296
297 new->id = ipc_buildid(id, new->seq);
298 return id;
299}
300
301
302
303
304
305
306
307
308
309
310
311static int ipcget_new(struct ipc_namespace *ns, struct ipc_ids *ids,
312 struct ipc_ops *ops, struct ipc_params *params)
313{
314 int err;
315
316 down_write(&ids->rw_mutex);
317 err = ops->getnew(ns, params);
318 up_write(&ids->rw_mutex);
319 return err;
320}
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337static int ipc_check_perms(struct ipc_namespace *ns,
338 struct kern_ipc_perm *ipcp,
339 struct ipc_ops *ops,
340 struct ipc_params *params)
341{
342 int err;
343
344 if (ipcperms(ns, ipcp, params->flg))
345 err = -EACCES;
346 else {
347 err = ops->associate(ipcp, params->flg);
348 if (!err)
349 err = ipcp->id;
350 }
351
352 return err;
353}
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369static int ipcget_public(struct ipc_namespace *ns, struct ipc_ids *ids,
370 struct ipc_ops *ops, struct ipc_params *params)
371{
372 struct kern_ipc_perm *ipcp;
373 int flg = params->flg;
374 int err;
375
376
377
378
379
380 down_write(&ids->rw_mutex);
381 ipcp = ipc_findkey(ids, params->key);
382 if (ipcp == NULL) {
383
384 if (!(flg & IPC_CREAT))
385 err = -ENOENT;
386 else
387 err = ops->getnew(ns, params);
388 } else {
389
390
391 if (flg & IPC_CREAT && flg & IPC_EXCL)
392 err = -EEXIST;
393 else {
394 err = 0;
395 if (ops->more_checks)
396 err = ops->more_checks(ipcp, params);
397 if (!err)
398
399
400
401
402 err = ipc_check_perms(ns, ipcp, ops, params);
403 }
404 ipc_unlock(ipcp);
405 }
406 up_write(&ids->rw_mutex);
407
408 return err;
409}
410
411
412
413
414
415
416
417
418
419
420
421void ipc_rmid(struct ipc_ids *ids, struct kern_ipc_perm *ipcp)
422{
423 int lid = ipcid_to_idx(ipcp->id);
424
425 idr_remove(&ids->ipcs_idr, lid);
426
427 ids->in_use--;
428
429 ipcp->deleted = 1;
430
431 return;
432}
433
434
435
436
437
438
439
440
441
442void *ipc_alloc(int size)
443{
444 void *out;
445 if(size > PAGE_SIZE)
446 out = vmalloc(size);
447 else
448 out = kmalloc(size, GFP_KERNEL);
449 return out;
450}
451
452
453
454
455
456
457
458
459
460
461void ipc_free(void* ptr, int size)
462{
463 if(size > PAGE_SIZE)
464 vfree(ptr);
465 else
466 kfree(ptr);
467}
468
469struct ipc_rcu {
470 struct rcu_head rcu;
471 atomic_t refcount;
472
473 void *data[0];
474};
475
476
477
478
479
480
481
482
483void *ipc_rcu_alloc(int size)
484{
485
486
487
488 struct ipc_rcu *out = ipc_alloc(sizeof(struct ipc_rcu) + size);
489 if (unlikely(!out))
490 return NULL;
491 atomic_set(&out->refcount, 1);
492 return out->data;
493}
494
495int ipc_rcu_getref(void *ptr)
496{
497 return atomic_inc_not_zero(&container_of(ptr, struct ipc_rcu, data)->refcount);
498}
499
500
501
502
503
504static void ipc_schedule_free(struct rcu_head *head)
505{
506 vfree(container_of(head, struct ipc_rcu, rcu));
507}
508
509void ipc_rcu_putref(void *ptr)
510{
511 struct ipc_rcu *p = container_of(ptr, struct ipc_rcu, data);
512
513 if (!atomic_dec_and_test(&p->refcount))
514 return;
515
516 if (is_vmalloc_addr(ptr)) {
517 call_rcu(&p->rcu, ipc_schedule_free);
518 } else {
519 kfree_rcu(p, rcu);
520 }
521}
522
523
524
525
526
527
528
529
530
531
532
533
534
535int ipcperms(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, short flag)
536{
537 kuid_t euid = current_euid();
538 int requested_mode, granted_mode;
539
540 audit_ipc_obj(ipcp);
541 requested_mode = (flag >> 6) | (flag >> 3) | flag;
542 granted_mode = ipcp->mode;
543 if (uid_eq(euid, ipcp->cuid) ||
544 uid_eq(euid, ipcp->uid))
545 granted_mode >>= 6;
546 else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid))
547 granted_mode >>= 3;
548
549 if ((requested_mode & ~granted_mode & 0007) &&
550 !ns_capable(ns->user_ns, CAP_IPC_OWNER))
551 return -1;
552
553 return security_ipc_permission(ipcp, flag);
554}
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571void kernel_to_ipc64_perm (struct kern_ipc_perm *in, struct ipc64_perm *out)
572{
573 out->key = in->key;
574 out->uid = from_kuid_munged(current_user_ns(), in->uid);
575 out->gid = from_kgid_munged(current_user_ns(), in->gid);
576 out->cuid = from_kuid_munged(current_user_ns(), in->cuid);
577 out->cgid = from_kgid_munged(current_user_ns(), in->cgid);
578 out->mode = in->mode;
579 out->seq = in->seq;
580}
581
582
583
584
585
586
587
588
589
590
591void ipc64_perm_to_ipc_perm (struct ipc64_perm *in, struct ipc_perm *out)
592{
593 out->key = in->key;
594 SET_UID(out->uid, in->uid);
595 SET_GID(out->gid, in->gid);
596 SET_UID(out->cuid, in->cuid);
597 SET_GID(out->cgid, in->cgid);
598 out->mode = in->mode;
599 out->seq = in->seq;
600}
601
602
603
604
605
606
607
608
609
610
611
612struct kern_ipc_perm *ipc_obtain_object(struct ipc_ids *ids, int id)
613{
614 struct kern_ipc_perm *out;
615 int lid = ipcid_to_idx(id);
616
617 out = idr_find(&ids->ipcs_idr, lid);
618 if (!out)
619 return ERR_PTR(-EINVAL);
620
621 return out;
622}
623
624
625
626
627
628
629
630
631
632
633struct kern_ipc_perm *ipc_lock(struct ipc_ids *ids, int id)
634{
635 struct kern_ipc_perm *out;
636
637 rcu_read_lock();
638 out = ipc_obtain_object(ids, id);
639 if (IS_ERR(out))
640 goto err1;
641
642 spin_lock(&out->lock);
643
644
645
646
647 if (!out->deleted)
648 return out;
649
650 spin_unlock(&out->lock);
651 out = ERR_PTR(-EINVAL);
652err1:
653 rcu_read_unlock();
654 return out;
655}
656
657
658
659
660
661
662
663
664
665
666
667
668struct kern_ipc_perm *ipc_obtain_object_check(struct ipc_ids *ids, int id)
669{
670 struct kern_ipc_perm *out = ipc_obtain_object(ids, id);
671
672 if (IS_ERR(out))
673 goto out;
674
675 if (ipc_checkid(out, id))
676 return ERR_PTR(-EIDRM);
677out:
678 return out;
679}
680
681struct kern_ipc_perm *ipc_lock_check(struct ipc_ids *ids, int id)
682{
683 struct kern_ipc_perm *out;
684
685 out = ipc_lock(ids, id);
686 if (IS_ERR(out))
687 return out;
688
689 if (ipc_checkid(out, id)) {
690 ipc_unlock(out);
691 return ERR_PTR(-EIDRM);
692 }
693
694 return out;
695}
696
697
698
699
700
701
702
703
704
705
706
707int ipcget(struct ipc_namespace *ns, struct ipc_ids *ids,
708 struct ipc_ops *ops, struct ipc_params *params)
709{
710 if (params->key == IPC_PRIVATE)
711 return ipcget_new(ns, ids, ops, params);
712 else
713 return ipcget_public(ns, ids, ops, params);
714}
715
716
717
718
719
720
721int ipc_update_perm(struct ipc64_perm *in, struct kern_ipc_perm *out)
722{
723 kuid_t uid = make_kuid(current_user_ns(), in->uid);
724 kgid_t gid = make_kgid(current_user_ns(), in->gid);
725 if (!uid_valid(uid) || !gid_valid(gid))
726 return -EINVAL;
727
728 out->uid = uid;
729 out->gid = gid;
730 out->mode = (out->mode & ~S_IRWXUGO)
731 | (in->mode & S_IRWXUGO);
732
733 return 0;
734}
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753struct kern_ipc_perm *ipcctl_pre_down(struct ipc_namespace *ns,
754 struct ipc_ids *ids, int id, int cmd,
755 struct ipc64_perm *perm, int extra_perm)
756{
757 struct kern_ipc_perm *ipcp;
758
759 ipcp = ipcctl_pre_down_nolock(ns, ids, id, cmd, perm, extra_perm);
760 if (IS_ERR(ipcp))
761 goto out;
762
763 spin_lock(&ipcp->lock);
764out:
765 return ipcp;
766}
767
768struct kern_ipc_perm *ipcctl_pre_down_nolock(struct ipc_namespace *ns,
769 struct ipc_ids *ids, int id, int cmd,
770 struct ipc64_perm *perm, int extra_perm)
771{
772 kuid_t euid;
773 int err = -EPERM;
774 struct kern_ipc_perm *ipcp;
775
776 down_write(&ids->rw_mutex);
777 rcu_read_lock();
778
779 ipcp = ipc_obtain_object_check(ids, id);
780 if (IS_ERR(ipcp)) {
781 err = PTR_ERR(ipcp);
782 goto out_up;
783 }
784
785 audit_ipc_obj(ipcp);
786 if (cmd == IPC_SET)
787 audit_ipc_set_perm(extra_perm, perm->uid,
788 perm->gid, perm->mode);
789
790 euid = current_euid();
791 if (uid_eq(euid, ipcp->cuid) || uid_eq(euid, ipcp->uid) ||
792 ns_capable(ns->user_ns, CAP_SYS_ADMIN))
793 return ipcp;
794
795out_up:
796
797
798
799
800 rcu_read_unlock();
801 up_write(&ids->rw_mutex);
802
803 return ERR_PTR(err);
804}
805
806#ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
807
808
809
810
811
812
813
814
815
816
817
818int ipc_parse_version (int *cmd)
819{
820 if (*cmd & IPC_64) {
821 *cmd ^= IPC_64;
822 return IPC_64;
823 } else {
824 return IPC_OLD;
825 }
826}
827
828#endif
829
830#ifdef CONFIG_PROC_FS
831struct ipc_proc_iter {
832 struct ipc_namespace *ns;
833 struct ipc_proc_iface *iface;
834};
835
836
837
838
839static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
840 loff_t *new_pos)
841{
842 struct kern_ipc_perm *ipc;
843 int total, id;
844
845 total = 0;
846 for (id = 0; id < pos && total < ids->in_use; id++) {
847 ipc = idr_find(&ids->ipcs_idr, id);
848 if (ipc != NULL)
849 total++;
850 }
851
852 if (total >= ids->in_use)
853 return NULL;
854
855 for ( ; pos < IPCMNI; pos++) {
856 ipc = idr_find(&ids->ipcs_idr, pos);
857 if (ipc != NULL) {
858 *new_pos = pos + 1;
859 ipc_lock_by_ptr(ipc);
860 return ipc;
861 }
862 }
863
864
865 return NULL;
866}
867
868static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos)
869{
870 struct ipc_proc_iter *iter = s->private;
871 struct ipc_proc_iface *iface = iter->iface;
872 struct kern_ipc_perm *ipc = it;
873
874
875 if (ipc && ipc != SEQ_START_TOKEN)
876 ipc_unlock(ipc);
877
878 return sysvipc_find_ipc(&iter->ns->ids[iface->ids], *pos, pos);
879}
880
881
882
883
884
885static void *sysvipc_proc_start(struct seq_file *s, loff_t *pos)
886{
887 struct ipc_proc_iter *iter = s->private;
888 struct ipc_proc_iface *iface = iter->iface;
889 struct ipc_ids *ids;
890
891 ids = &iter->ns->ids[iface->ids];
892
893
894
895
896
897 down_read(&ids->rw_mutex);
898
899
900 if (*pos < 0)
901 return NULL;
902
903
904 if (*pos == 0)
905 return SEQ_START_TOKEN;
906
907
908 return sysvipc_find_ipc(ids, *pos - 1, pos);
909}
910
911static void sysvipc_proc_stop(struct seq_file *s, void *it)
912{
913 struct kern_ipc_perm *ipc = it;
914 struct ipc_proc_iter *iter = s->private;
915 struct ipc_proc_iface *iface = iter->iface;
916 struct ipc_ids *ids;
917
918
919 if (ipc && ipc != SEQ_START_TOKEN)
920 ipc_unlock(ipc);
921
922 ids = &iter->ns->ids[iface->ids];
923
924 up_read(&ids->rw_mutex);
925}
926
927static int sysvipc_proc_show(struct seq_file *s, void *it)
928{
929 struct ipc_proc_iter *iter = s->private;
930 struct ipc_proc_iface *iface = iter->iface;
931
932 if (it == SEQ_START_TOKEN)
933 return seq_puts(s, iface->header);
934
935 return iface->show(s, it);
936}
937
938static const struct seq_operations sysvipc_proc_seqops = {
939 .start = sysvipc_proc_start,
940 .stop = sysvipc_proc_stop,
941 .next = sysvipc_proc_next,
942 .show = sysvipc_proc_show,
943};
944
945static int sysvipc_proc_open(struct inode *inode, struct file *file)
946{
947 int ret;
948 struct seq_file *seq;
949 struct ipc_proc_iter *iter;
950
951 ret = -ENOMEM;
952 iter = kmalloc(sizeof(*iter), GFP_KERNEL);
953 if (!iter)
954 goto out;
955
956 ret = seq_open(file, &sysvipc_proc_seqops);
957 if (ret)
958 goto out_kfree;
959
960 seq = file->private_data;
961 seq->private = iter;
962
963 iter->iface = PDE_DATA(inode);
964 iter->ns = get_ipc_ns(current->nsproxy->ipc_ns);
965out:
966 return ret;
967out_kfree:
968 kfree(iter);
969 goto out;
970}
971
972static int sysvipc_proc_release(struct inode *inode, struct file *file)
973{
974 struct seq_file *seq = file->private_data;
975 struct ipc_proc_iter *iter = seq->private;
976 put_ipc_ns(iter->ns);
977 return seq_release_private(inode, file);
978}
979
980static const struct file_operations sysvipc_proc_fops = {
981 .open = sysvipc_proc_open,
982 .read = seq_read,
983 .llseek = seq_lseek,
984 .release = sysvipc_proc_release,
985};
986#endif
987