105 static void msg_freehdr(struct msg *msghdr);
384 msg_freehdr(struct msg *msghdr)  in msg_freehdr()  argument
386 	while (msghdr->msg_ts > 0) {  in msg_freehdr()
388 		if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg)  in msg_freehdr()
390 		next = msgmaps[msghdr->msg_spot].next;  in msg_freehdr()
391 		msgmaps[msghdr->msg_spot].next = free_msgmaps;  in msg_freehdr()
392 		free_msgmaps = msghdr->msg_spot;  in msg_freehdr()
394 		msghdr->msg_spot = next;  in msg_freehdr()
395 		if (msghdr->msg_ts >= msginfo.msgssz)  in msg_freehdr()
396 			msghdr->msg_ts -= msginfo.msgssz;  in msg_freehdr()
398 			msghdr->msg_ts = 0;  in msg_freehdr()
400 	if (msghdr->msg_spot != -1)  in msg_freehdr()
402 	msghdr->msg_next = free_msghdrs;  in msg_freehdr()
403 	free_msghdrs = msghdr;  in msg_freehdr()
405 	mac_sysvmsg_cleanup(msghdr);  in msg_freehdr()
412 	struct msg *msghdr;  in msq_remove()  local
421 	msghdr = msqkptr->u.__msg_first;  in msq_remove()
422 	while (msghdr != NULL) {  in msq_remove()
426 		msqkptr->u.msg_cbytes -= msghdr->msg_ts;  in msq_remove()
428 		msghdr_tmp = msghdr;  in msq_remove()
429 		msghdr = msghdr->msg_next;  in msq_remove()
549 		struct msg *msghdr;  in kern_msgctl()  local
564 		for (msghdr = msqkptr->u.__msg_first; msghdr != NULL;  in kern_msgctl()
565 		    msghdr = msghdr->msg_next) {  in kern_msgctl()
566 			error = mac_sysvmsq_check_msgrmid(td->td_ucred, msghdr);  in kern_msgctl()
771 	struct msg *msghdr;  in kern_msgsnd()  local
954 	msghdr = free_msghdrs;  in kern_msgsnd()
955 	free_msghdrs = msghdr->msg_next;  in kern_msgsnd()
956 	msghdr->msg_spot = -1;  in kern_msgsnd()
957 	msghdr->msg_ts = msgsz;  in kern_msgsnd()
958 	msghdr->msg_type = mtype;  in kern_msgsnd()
965 	mac_sysvmsg_create(td->td_ucred, msqkptr, msghdr);  in kern_msgsnd()
985 		msgmaps[next].next = msghdr->msg_spot;  in kern_msgsnd()
986 		msghdr->msg_spot = next;  in kern_msgsnd()
994 	if (msghdr->msg_type < 1) {  in kern_msgsnd()
995 		msg_freehdr(msghdr);  in kern_msgsnd()
998 		DPRINTF(("mtype (%ld) < 1\n", msghdr->msg_type));  in kern_msgsnd()
1007 	next = msghdr->msg_spot;  in kern_msgsnd()
1024 			msg_freehdr(msghdr);  in kern_msgsnd()
1048 		msg_freehdr(msghdr);  in kern_msgsnd()
1066 	error = mac_sysvmsq_check_msgmsq(td->td_ucred, msghdr, msqkptr);  in kern_msgsnd()
1068 		msg_freehdr(msghdr);  in kern_msgsnd()
1078 		msqkptr->u.__msg_first = msghdr;  in kern_msgsnd()
1079 		msqkptr->u.__msg_last = msghdr;  in kern_msgsnd()
1081 		msqkptr->u.__msg_last->msg_next = msghdr;  in kern_msgsnd()
1082 		msqkptr->u.__msg_last = msghdr;  in kern_msgsnd()
1086 	msqkptr->u.msg_cbytes += msghdr->msg_ts;  in kern_msgsnd()
1141 	struct msg *msghdr;  in kern_msgrcv()  local
1189 	msghdr = NULL;  in kern_msgrcv()
1190 	while (msghdr == NULL) {  in kern_msgrcv()
1192 			msghdr = msqkptr->u.__msg_first;  in kern_msgrcv()
1193 			if (msghdr != NULL) {  in kern_msgrcv()
1194 				if (msgsz < msghdr->msg_ts &&  in kern_msgrcv()
1198 					    msgsz, msghdr->msg_ts));  in kern_msgrcv()
1204 				    msghdr);  in kern_msgrcv()
1213 					msqkptr->u.__msg_first = msghdr->msg_next;  in kern_msgrcv()
1224 			while ((msghdr = *prev) != NULL) {  in kern_msgrcv()
1234 				if (msgtyp == msghdr->msg_type ||  in kern_msgrcv()
1235 				    msghdr->msg_type <= -msgtyp) {  in kern_msgrcv()
1238 					    msghdr->msg_type, msgtyp));  in kern_msgrcv()
1239 					if (msgsz < msghdr->msg_ts &&  in kern_msgrcv()
1244 						    msgsz, msghdr->msg_ts));  in kern_msgrcv()
1250 					    td->td_ucred, msghdr);  in kern_msgrcv()
1254 					*prev = msghdr->msg_next;  in kern_msgrcv()
1255 					if (msghdr == msqkptr->u.__msg_last) {  in kern_msgrcv()
1274 				previous = msghdr;  in kern_msgrcv()
1275 				prev = &(msghdr->msg_next);  in kern_msgrcv()
1285 		if (msghdr != NULL)  in kern_msgrcv()
1333 	msqkptr->u.msg_cbytes -= msghdr->msg_ts;  in kern_msgrcv()
1339 	racct_sub_cred(msqkptr->cred, RACCT_MSGQSIZE, msghdr->msg_ts);  in kern_msgrcv()
1348 	    msghdr->msg_ts));  in kern_msgrcv()
1349 	if (msgsz > msghdr->msg_ts)  in kern_msgrcv()
1350 		msgsz = msghdr->msg_ts;  in kern_msgrcv()
1351 	*mtype = msghdr->msg_type;  in kern_msgrcv()
1357 	next = msghdr->msg_spot;  in kern_msgrcv()
1375 			msg_freehdr(msghdr);  in kern_msgrcv()
1387 	msg_freehdr(msghdr);  in kern_msgrcv()