Commit 17dec0a9 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'userns-linus' of...

Merge branch 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

Pull namespace updates from Eric Biederman:
 "There was a lot of work this cycle fixing bugs that were discovered
  after the merge window and getting everything ready where we can
  reasonably support fully unprivileged fuse. The bug fixes you already
  have and much of the unprivileged fuse work is coming in via other
  trees.

  Still left for fully unprivileged fuse is figuring out how to cleanly
  handle .set_acl and .get_acl in the legacy case, and properly handling
  of evm xattrs on unprivileged mounts.

  Included in the tree is a cleanup from Alexely that replaced a linked
  list with a statically allocated fix sized array for the pid caches,
  which simplifies and speeds things up.

  Then there is are some cleanups and fixes for the ipc namespace. The
  motivation was that in reviewing other code it was discovered that
  access ipc objects from different pid namespaces recorded pids in such
  a way that when asked the wrong pids were returned. In the worst case
  there has been a measured 30% performance impact for sysvipc
  semaphores. Other test cases showed no measurable performance impact.
  Manfred Spraul and Davidlohr Bueso who tend to work on sysvipc
  performance both gave the nod that this is good enough.

  Casey Schaufler and James Morris have given their approval to the LSM
  side of the changes.

  I simplified the types and the code dealing with sysvipc to pass just
  kern_ipc_perm for all three types of ipc. Which reduced the header
  dependencies throughout the kernel and simplified the lsm code.

  Which let me work on the pid fixes without having to worry about
  trivial changes causing complete kernel recompiles"

* 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  ipc/shm: Fix pid freeing.
  ipc/shm: fix up for struct file no longer being available in shm.h
  ipc/smack: Tidy up from the change in type of the ipc security hooks
  ipc: Directly call the security hook in ipc_ops.associate
  ipc/sem: Fix semctl(..., GETPID, ...) between pid namespaces
  ipc/msg: Fix msgctl(..., IPC_STAT, ...) between pid namespaces
  ipc/shm: Fix shmctl(..., IPC_STAT, ...) between pid namespaces.
  ipc/util: Helpers for making the sysvipc operations pid namespace aware
  ipc: Move IPCMNI from include/ipc.h into ipc/util.h
  msg: Move struct msg_queue into ipc/msg.c
  shm: Move struct shmid_kernel into ipc/shm.c
  sem: Move struct sem and struct sem_array into ipc/sem.c
  msg/security: Pass kern_ipc_perm not msg_queue into the msg_queue security hooks
  shm/security: Pass kern_ipc_perm not shmid_kernel into the shm security hooks
  sem/security: Pass kern_ipc_perm not sem_array into the sem security hooks
  pidns: simpler allocation of pid_* caches
parents d92cd810 2236d4d3
...@@ -8,8 +8,6 @@ ...@@ -8,8 +8,6 @@
#include <uapi/linux/ipc.h> #include <uapi/linux/ipc.h>
#include <linux/refcount.h> #include <linux/refcount.h>
#define IPCMNI 32768 /* <= MAX_INT limit for ipc arrays (including sysctl changes) */
/* used by in-kernel data structures */ /* used by in-kernel data structures */
struct kern_ipc_perm { struct kern_ipc_perm {
spinlock_t lock; spinlock_t lock;
......
...@@ -1575,28 +1575,28 @@ union security_list_options { ...@@ -1575,28 +1575,28 @@ union security_list_options {
int (*msg_msg_alloc_security)(struct msg_msg *msg); int (*msg_msg_alloc_security)(struct msg_msg *msg);
void (*msg_msg_free_security)(struct msg_msg *msg); void (*msg_msg_free_security)(struct msg_msg *msg);
int (*msg_queue_alloc_security)(struct msg_queue *msq); int (*msg_queue_alloc_security)(struct kern_ipc_perm *msq);
void (*msg_queue_free_security)(struct msg_queue *msq); void (*msg_queue_free_security)(struct kern_ipc_perm *msq);
int (*msg_queue_associate)(struct msg_queue *msq, int msqflg); int (*msg_queue_associate)(struct kern_ipc_perm *msq, int msqflg);
int (*msg_queue_msgctl)(struct msg_queue *msq, int cmd); int (*msg_queue_msgctl)(struct kern_ipc_perm *msq, int cmd);
int (*msg_queue_msgsnd)(struct msg_queue *msq, struct msg_msg *msg, int (*msg_queue_msgsnd)(struct kern_ipc_perm *msq, struct msg_msg *msg,
int msqflg); int msqflg);
int (*msg_queue_msgrcv)(struct msg_queue *msq, struct msg_msg *msg, int (*msg_queue_msgrcv)(struct kern_ipc_perm *msq, struct msg_msg *msg,
struct task_struct *target, long type, struct task_struct *target, long type,
int mode); int mode);
int (*shm_alloc_security)(struct shmid_kernel *shp); int (*shm_alloc_security)(struct kern_ipc_perm *shp);
void (*shm_free_security)(struct shmid_kernel *shp); void (*shm_free_security)(struct kern_ipc_perm *shp);
int (*shm_associate)(struct shmid_kernel *shp, int shmflg); int (*shm_associate)(struct kern_ipc_perm *shp, int shmflg);
int (*shm_shmctl)(struct shmid_kernel *shp, int cmd); int (*shm_shmctl)(struct kern_ipc_perm *shp, int cmd);
int (*shm_shmat)(struct shmid_kernel *shp, char __user *shmaddr, int (*shm_shmat)(struct kern_ipc_perm *shp, char __user *shmaddr,
int shmflg); int shmflg);
int (*sem_alloc_security)(struct sem_array *sma); int (*sem_alloc_security)(struct kern_ipc_perm *sma);
void (*sem_free_security)(struct sem_array *sma); void (*sem_free_security)(struct kern_ipc_perm *sma);
int (*sem_associate)(struct sem_array *sma, int semflg); int (*sem_associate)(struct kern_ipc_perm *sma, int semflg);
int (*sem_semctl)(struct sem_array *sma, int cmd); int (*sem_semctl)(struct kern_ipc_perm *sma, int cmd);
int (*sem_semop)(struct sem_array *sma, struct sembuf *sops, int (*sem_semop)(struct kern_ipc_perm *sma, struct sembuf *sops,
unsigned nsops, int alter); unsigned nsops, int alter);
int (*netlink_send)(struct sock *sk, struct sk_buff *skb); int (*netlink_send)(struct sock *sk, struct sk_buff *skb);
......
...@@ -3,7 +3,6 @@ ...@@ -3,7 +3,6 @@
#define _LINUX_MSG_H #define _LINUX_MSG_H
#include <linux/list.h> #include <linux/list.h>
#include <linux/time64.h>
#include <uapi/linux/msg.h> #include <uapi/linux/msg.h>
/* one msg_msg structure for each message */ /* one msg_msg structure for each message */
...@@ -16,21 +15,4 @@ struct msg_msg { ...@@ -16,21 +15,4 @@ struct msg_msg {
/* the actual message follows immediately */ /* the actual message follows immediately */
}; };
/* one msq_queue structure for each present queue on the system */
struct msg_queue {
struct kern_ipc_perm q_perm;
time64_t q_stime; /* last msgsnd time */
time64_t q_rtime; /* last msgrcv time */
time64_t q_ctime; /* last change time */
unsigned long q_cbytes; /* current number of bytes on queue */
unsigned long q_qnum; /* number of messages in queue */
unsigned long q_qbytes; /* max number of bytes on queue */
pid_t q_lspid; /* pid of last msgsnd */
pid_t q_lrpid; /* last receive pid */
struct list_head q_messages;
struct list_head q_receivers;
struct list_head q_senders;
} __randomize_layout;
#endif /* _LINUX_MSG_H */ #endif /* _LINUX_MSG_H */
...@@ -36,7 +36,6 @@ struct linux_binprm; ...@@ -36,7 +36,6 @@ struct linux_binprm;
struct cred; struct cred;
struct rlimit; struct rlimit;
struct siginfo; struct siginfo;
struct sem_array;
struct sembuf; struct sembuf;
struct kern_ipc_perm; struct kern_ipc_perm;
struct audit_context; struct audit_context;
...@@ -50,9 +49,7 @@ struct qstr; ...@@ -50,9 +49,7 @@ struct qstr;
struct iattr; struct iattr;
struct fown_struct; struct fown_struct;
struct file_operations; struct file_operations;
struct shmid_kernel;
struct msg_msg; struct msg_msg;
struct msg_queue;
struct xattr; struct xattr;
struct xfrm_sec_ctx; struct xfrm_sec_ctx;
struct mm_struct; struct mm_struct;
...@@ -355,24 +352,24 @@ int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag); ...@@ -355,24 +352,24 @@ int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid); void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid);
int security_msg_msg_alloc(struct msg_msg *msg); int security_msg_msg_alloc(struct msg_msg *msg);
void security_msg_msg_free(struct msg_msg *msg); void security_msg_msg_free(struct msg_msg *msg);
int security_msg_queue_alloc(struct msg_queue *msq); int security_msg_queue_alloc(struct kern_ipc_perm *msq);
void security_msg_queue_free(struct msg_queue *msq); void security_msg_queue_free(struct kern_ipc_perm *msq);
int security_msg_queue_associate(struct msg_queue *msq, int msqflg); int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg);
int security_msg_queue_msgctl(struct msg_queue *msq, int cmd); int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd);
int security_msg_queue_msgsnd(struct msg_queue *msq, int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
struct msg_msg *msg, int msqflg); struct msg_msg *msg, int msqflg);
int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
struct task_struct *target, long type, int mode); struct task_struct *target, long type, int mode);
int security_shm_alloc(struct shmid_kernel *shp); int security_shm_alloc(struct kern_ipc_perm *shp);
void security_shm_free(struct shmid_kernel *shp); void security_shm_free(struct kern_ipc_perm *shp);
int security_shm_associate(struct shmid_kernel *shp, int shmflg); int security_shm_associate(struct kern_ipc_perm *shp, int shmflg);
int security_shm_shmctl(struct shmid_kernel *shp, int cmd); int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd);
int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg); int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg);
int security_sem_alloc(struct sem_array *sma); int security_sem_alloc(struct kern_ipc_perm *sma);
void security_sem_free(struct sem_array *sma); void security_sem_free(struct kern_ipc_perm *sma);
int security_sem_associate(struct sem_array *sma, int semflg); int security_sem_associate(struct kern_ipc_perm *sma, int semflg);
int security_sem_semctl(struct sem_array *sma, int cmd); int security_sem_semctl(struct kern_ipc_perm *sma, int cmd);
int security_sem_semop(struct sem_array *sma, struct sembuf *sops, int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
unsigned nsops, int alter); unsigned nsops, int alter);
void security_d_instantiate(struct dentry *dentry, struct inode *inode); void security_d_instantiate(struct dentry *dentry, struct inode *inode);
int security_getprocattr(struct task_struct *p, char *name, char **value); int security_getprocattr(struct task_struct *p, char *name, char **value);
...@@ -1045,32 +1042,32 @@ static inline int security_msg_msg_alloc(struct msg_msg *msg) ...@@ -1045,32 +1042,32 @@ static inline int security_msg_msg_alloc(struct msg_msg *msg)
static inline void security_msg_msg_free(struct msg_msg *msg) static inline void security_msg_msg_free(struct msg_msg *msg)
{ } { }
static inline int security_msg_queue_alloc(struct msg_queue *msq) static inline int security_msg_queue_alloc(struct kern_ipc_perm *msq)
{ {
return 0; return 0;
} }
static inline void security_msg_queue_free(struct msg_queue *msq) static inline void security_msg_queue_free(struct kern_ipc_perm *msq)
{ } { }
static inline int security_msg_queue_associate(struct msg_queue *msq, static inline int security_msg_queue_associate(struct kern_ipc_perm *msq,
int msqflg) int msqflg)
{ {
return 0; return 0;
} }
static inline int security_msg_queue_msgctl(struct msg_queue *msq, int cmd) static inline int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
{ {
return 0; return 0;
} }
static inline int security_msg_queue_msgsnd(struct msg_queue *msq, static inline int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
struct msg_msg *msg, int msqflg) struct msg_msg *msg, int msqflg)
{ {
return 0; return 0;
} }
static inline int security_msg_queue_msgrcv(struct msg_queue *msq, static inline int security_msg_queue_msgrcv(struct kern_ipc_perm *msq,
struct msg_msg *msg, struct msg_msg *msg,
struct task_struct *target, struct task_struct *target,
long type, int mode) long type, int mode)
...@@ -1078,50 +1075,50 @@ static inline int security_msg_queue_msgrcv(struct msg_queue *msq, ...@@ -1078,50 +1075,50 @@ static inline int security_msg_queue_msgrcv(struct msg_queue *msq,
return 0; return 0;
} }
static inline int security_shm_alloc(struct shmid_kernel *shp) static inline int security_shm_alloc(struct kern_ipc_perm *shp)
{ {
return 0; return 0;
} }
static inline void security_shm_free(struct shmid_kernel *shp) static inline void security_shm_free(struct kern_ipc_perm *shp)
{ } { }
static inline int security_shm_associate(struct shmid_kernel *shp, static inline int security_shm_associate(struct kern_ipc_perm *shp,
int shmflg) int shmflg)
{ {
return 0; return 0;
} }
static inline int security_shm_shmctl(struct shmid_kernel *shp, int cmd) static inline int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
{ {
return 0; return 0;
} }
static inline int security_shm_shmat(struct shmid_kernel *shp, static inline int security_shm_shmat(struct kern_ipc_perm *shp,
char __user *shmaddr, int shmflg) char __user *shmaddr, int shmflg)
{ {
return 0; return 0;
} }
static inline int security_sem_alloc(struct sem_array *sma) static inline int security_sem_alloc(struct kern_ipc_perm *sma)
{ {
return 0; return 0;
} }
static inline void security_sem_free(struct sem_array *sma) static inline void security_sem_free(struct kern_ipc_perm *sma)
{ } { }
static inline int security_sem_associate(struct sem_array *sma, int semflg) static inline int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
{ {
return 0; return 0;
} }
static inline int security_sem_semctl(struct sem_array *sma, int cmd) static inline int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
{ {
return 0; return 0;
} }
static inline int security_sem_semop(struct sem_array *sma, static inline int security_sem_semop(struct kern_ipc_perm *sma,
struct sembuf *sops, unsigned nsops, struct sembuf *sops, unsigned nsops,
int alter) int alter)
{ {
......
...@@ -2,48 +2,10 @@ ...@@ -2,48 +2,10 @@
#ifndef _LINUX_SEM_H #ifndef _LINUX_SEM_H
#define _LINUX_SEM_H #define _LINUX_SEM_H
#include <linux/atomic.h>
#include <linux/rcupdate.h>
#include <linux/cache.h>
#include <linux/time64.h>
#include <uapi/linux/sem.h> #include <uapi/linux/sem.h>
struct task_struct; struct task_struct;
struct sem_undo_list;
/* One semaphore structure for each semaphore in the system. */
struct sem {
int semval; /* current value */
/*
* PID of the process that last modified the semaphore. For
* Linux, specifically these are:
* - semop
* - semctl, via SETVAL and SETALL.
* - at task exit when performing undo adjustments (see exit_sem).
*/
int sempid;
spinlock_t lock; /* spinlock for fine-grained semtimedop */
struct list_head pending_alter; /* pending single-sop operations */
/* that alter the semaphore */
struct list_head pending_const; /* pending single-sop operations */
/* that do not alter the semaphore*/
time_t sem_otime; /* candidate for sem_otime */
} ____cacheline_aligned_in_smp;
/* One sem_array data structure for each set of semaphores in the system. */
struct sem_array {
struct kern_ipc_perm sem_perm; /* permissions .. see ipc.h */
time64_t sem_ctime; /* create/last semctl() time */
struct list_head pending_alter; /* pending operations */
/* that alter the array */
struct list_head pending_const; /* pending complex operations */
/* that do not alter semvals */
struct list_head list_id; /* undo requests on this array */
int sem_nsems; /* no. of semaphores in array */
int complex_count; /* pending complex operations */
unsigned int use_global_lock;/* >0: global lock required */
struct sem sems[];
} __randomize_layout;
#ifdef CONFIG_SYSVIPC #ifdef CONFIG_SYSVIPC
......
...@@ -7,27 +7,7 @@ ...@@ -7,27 +7,7 @@
#include <uapi/linux/shm.h> #include <uapi/linux/shm.h>
#include <asm/shmparam.h> #include <asm/shmparam.h>
struct shmid_kernel /* private to the kernel */ struct file;
{
struct kern_ipc_perm shm_perm;
struct file *shm_file;
unsigned long shm_nattch;
unsigned long shm_segsz;
time64_t shm_atim;
time64_t shm_dtim;
time64_t shm_ctim;
pid_t shm_cprid;
pid_t shm_lprid;
struct user_struct *mlock_user;
/* The task created the shm object. NULL if the task is dead. */
struct task_struct *shm_creator;
struct list_head shm_clist; /* list by creator */
} __randomize_layout;
/* shm_mode upper byte flags */
#define SHM_DEST 01000 /* segment will be destroyed on last detach */
#define SHM_LOCKED 02000 /* segment will not be swapped */
#ifdef CONFIG_SYSVIPC #ifdef CONFIG_SYSVIPC
struct sysv_shm { struct sysv_shm {
......
...@@ -43,6 +43,23 @@ ...@@ -43,6 +43,23 @@
#include <linux/uaccess.h> #include <linux/uaccess.h>
#include "util.h" #include "util.h"
/* one msq_queue structure for each present queue on the system */
struct msg_queue {
struct kern_ipc_perm q_perm;
time64_t q_stime; /* last msgsnd time */
time64_t q_rtime; /* last msgrcv time */
time64_t q_ctime; /* last change time */
unsigned long q_cbytes; /* current number of bytes on queue */
unsigned long q_qnum; /* number of messages in queue */
unsigned long q_qbytes; /* max number of bytes on queue */
struct pid *q_lspid; /* pid of last msgsnd */
struct pid *q_lrpid; /* last receive pid */
struct list_head q_messages;
struct list_head q_receivers;
struct list_head q_senders;
} __randomize_layout;
/* one msg_receiver structure for each sleeping receiver */ /* one msg_receiver structure for each sleeping receiver */
struct msg_receiver { struct msg_receiver {
struct list_head r_list; struct list_head r_list;
...@@ -101,7 +118,7 @@ static void msg_rcu_free(struct rcu_head *head) ...@@ -101,7 +118,7 @@ static void msg_rcu_free(struct rcu_head *head)
struct kern_ipc_perm *p = container_of(head, struct kern_ipc_perm, rcu); struct kern_ipc_perm *p = container_of(head, struct kern_ipc_perm, rcu);
struct msg_queue *msq = container_of(p, struct msg_queue, q_perm); struct msg_queue *msq = container_of(p, struct msg_queue, q_perm);
security_msg_queue_free(msq); security_msg_queue_free(&msq->q_perm);
kvfree(msq); kvfree(msq);
} }
...@@ -127,7 +144,7 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params) ...@@ -127,7 +144,7 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
msq->q_perm.key = key; msq->q_perm.key = key;
msq->q_perm.security = NULL; msq->q_perm.security = NULL;
retval = security_msg_queue_alloc(msq); retval = security_msg_queue_alloc(&msq->q_perm);
if (retval) { if (retval) {
kvfree(msq); kvfree(msq);
return retval; return retval;
...@@ -137,7 +154,7 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params) ...@@ -137,7 +154,7 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
msq->q_ctime = ktime_get_real_seconds(); msq->q_ctime = ktime_get_real_seconds();
msq->q_cbytes = msq->q_qnum = 0; msq->q_cbytes = msq->q_qnum = 0;
msq->q_qbytes = ns->msg_ctlmnb; msq->q_qbytes = ns->msg_ctlmnb;
msq->q_lspid = msq->q_lrpid = 0; msq->q_lspid = msq->q_lrpid = NULL;
INIT_LIST_HEAD(&msq->q_messages); INIT_LIST_HEAD(&msq->q_messages);
INIT_LIST_HEAD(&msq->q_receivers); INIT_LIST_HEAD(&msq->q_receivers);
INIT_LIST_HEAD(&msq->q_senders); INIT_LIST_HEAD(&msq->q_senders);
...@@ -250,25 +267,17 @@ static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp) ...@@ -250,25 +267,17 @@ static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
free_msg(msg); free_msg(msg);
} }
atomic_sub(msq->q_cbytes, &ns->msg_bytes); atomic_sub(msq->q_cbytes, &ns->msg_bytes);
ipc_update_pid(&msq->q_lspid, NULL);
ipc_update_pid(&msq->q_lrpid, NULL);
ipc_rcu_putref(&msq->q_perm, msg_rcu_free); ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
} }
/*
* Called with msg_ids.rwsem and ipcp locked.
*/
static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
{
struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
return security_msg_queue_associate(msq, msgflg);
}
long ksys_msgget(key_t key, int msgflg) long ksys_msgget(key_t key, int msgflg)
{ {
struct ipc_namespace *ns; struct ipc_namespace *ns;
static const struct ipc_ops msg_ops = { static const struct ipc_ops msg_ops = {
.getnew = newque, .getnew = newque,
.associate = msg_security, .associate = security_msg_queue_associate,
}; };
struct ipc_params msg_params; struct ipc_params msg_params;
...@@ -385,7 +394,7 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd, ...@@ -385,7 +394,7 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
msq = container_of(ipcp, struct msg_queue, q_perm); msq = container_of(ipcp, struct msg_queue, q_perm);
err = security_msg_queue_msgctl(msq, cmd); err = security_msg_queue_msgctl(&msq->q_perm, cmd);
if (err) if (err)
goto out_unlock1; goto out_unlock1;
...@@ -507,7 +516,7 @@ static int msgctl_stat(struct ipc_namespace *ns, int msqid, ...@@ -507,7 +516,7 @@ static int msgctl_stat(struct ipc_namespace *ns, int msqid,
if (ipcperms(ns, &msq->q_perm, S_IRUGO)) if (ipcperms(ns, &msq->q_perm, S_IRUGO))
goto out_unlock; goto out_unlock;
err = security_msg_queue_msgctl(msq, cmd); err = security_msg_queue_msgctl(&msq->q_perm, cmd);
if (err) if (err)
goto out_unlock; goto out_unlock;
...@@ -526,8 +535,8 @@ static int msgctl_stat(struct ipc_namespace *ns, int msqid, ...@@ -526,8 +535,8 @@ static int msgctl_stat(struct ipc_namespace *ns, int msqid,
p->msg_cbytes = msq->q_cbytes; p->msg_cbytes = msq->q_cbytes;
p->msg_qnum = msq->q_qnum; p->msg_qnum = msq->q_qnum;
p->msg_qbytes = msq->q_qbytes; p->msg_qbytes = msq->q_qbytes;
p->msg_lspid = msq->q_lspid; p->msg_lspid = pid_vnr(msq->q_lspid);
p->msg_lrpid = msq->q_lrpid; p->msg_lrpid = pid_vnr(msq->q_lrpid);
ipc_unlock_object(&msq->q_perm); ipc_unlock_object(&msq->q_perm);
rcu_read_unlock(); rcu_read_unlock();
...@@ -733,7 +742,7 @@ static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg, ...@@ -733,7 +742,7 @@ static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg,
list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) { list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {
if (testmsg(msg, msr->r_msgtype, msr->r_mode) && if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
!security_msg_queue_msgrcv(msq, msg, msr->r_tsk, !security_msg_queue_msgrcv(&msq->q_perm, msg, msr->r_tsk,
msr->r_msgtype, msr->r_mode)) { msr->r_msgtype, msr->r_mode)) {
list_del(&msr->r_list); list_del(&msr->r_list);
...@@ -741,7 +750,7 @@ static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg, ...@@ -741,7 +750,7 @@ static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg,
wake_q_add(wake_q, msr->r_tsk); wake_q_add(wake_q, msr->r_tsk);
WRITE_ONCE(msr->r_msg, ERR_PTR(-E2BIG)); WRITE_ONCE(msr->r_msg, ERR_PTR(-E2BIG));
} else { } else {
msq->q_lrpid = task_pid_vnr(msr->r_tsk); ipc_update_pid(&msq->q_lrpid, task_pid(msr->r_tsk));
msq->q_rtime = get_seconds(); msq->q_rtime = get_seconds();
wake_q_add(wake_q, msr->r_tsk); wake_q_add(wake_q, msr->r_tsk);
...@@ -799,7 +808,7 @@ static long do_msgsnd(int msqid, long mtype, void __user *mtext, ...@@ -799,7 +808,7 @@ static long do_msgsnd(int msqid, long mtype, void __user *mtext,
goto out_unlock0; goto out_unlock0;
} }
err = security_msg_queue_msgsnd(msq, msg, msgflg); err = security_msg_queue_msgsnd(&msq->q_perm, msg, msgflg);
if (err) if (err)
goto out_unlock0; goto out_unlock0;
...@@ -842,7 +851,7 @@ static long do_msgsnd(int msqid, long mtype, void __user *mtext, ...@@ -842,7 +851,7 @@ static long do_msgsnd(int msqid, long mtype, void __user *mtext,
} }