1 // SPDX-License-Identifier: GPL-2.0
3  * linux/ipc/util.c
6  * Sep 1997 - Call suser() last after "normal" permission checks so we
8  *            Occurs in several places in the IPC code.
10  * Nov 1999 - ipc helper functions, unified SMP locking
12  * Oct 2002 - One lock per IPC id. RCU ipc_free for lock-free grow_ary().
14  * Mar 2006 - support for audit of ipc object properties
16  * Jun 2006 - namespaces ssupport
20  * General sysv ipc locking scheme:
22  *          obtain the ipc object (kern_ipc_perm) by looking up the id in an idr
24  *	    - perform initial checks (capabilities, auditing and permission,
26  *	    - perform read-only operations, such as INFO command, that
28  *	      acquire the ipc lock (kern_ipc_perm.lock) through
30  *		- perform read-only operations that demand atomicity,
32  *		- perform data updates, such as SET, RMID commands and
33  *		  mechanism-specific operations (semop/semtimedop,
35  *	    drop the ipc lock, through ipc_unlock_object().
38  *  The ids->rwsem must be taken when:
39  *	- creating, removing and iterating the existing entries in ipc
41  *	- iterating through files under /proc/sysvipc/
43  *  Note that sems have a special fast path that avoids kern_ipc_perm.lock -
81  * ipc_init - initialise ipc subsystem
83  * The various sysv ipc resources (semaphores, messages and shared
109  * ipc_init_ids	- initialise ipc identifiers
110  * @ids: ipc identifier set
112  * Set up the sequence range to use for the ipc identifier range (limited
117 	ids->in_use = 0;  in ipc_init_ids()
118 	ids->seq = 0;  in ipc_init_ids()
119 	init_rwsem(&ids->rwsem);  in ipc_init_ids()
120 	rhashtable_init(&ids->key_ht, &ipc_kht_params);  in ipc_init_ids()
121 	idr_init(&ids->ipcs_idr);  in ipc_init_ids()
122 	ids->max_idx = -1;  in ipc_init_ids()
123 	ids->last_idx = -1;  in ipc_init_ids()
125 	ids->next_id = -1;  in ipc_init_ids()
132  * ipc_init_proc_interface -  create a proc interface for sysipc types using a seq_file interface.
135  * @ids: ipc id table to iterate.
147 	iface->path	= path;  in ipc_init_proc_interface()
148 	iface->header	= header;  in ipc_init_proc_interface()
149 	iface->ids	= ids;  in ipc_init_proc_interface()
150 	iface->show	= show;  in ipc_init_proc_interface()
163  * ipc_findkey	- find a key in an ipc identifier set
164  * @ids: ipc identifier set
167  * Returns the locked pointer to the ipc structure if found or NULL
168  * otherwise. If key is found ipc points to the owning ipc structure
176 	ipcp = rhashtable_lookup_fast(&ids->key_ht, &key,  in ipc_findkey()
187  * Insert new IPC object into idr tree, and set sequence number and id
190  * - the sequence number must be set before inserting the object into the idr,
192  * - the id can/must be set after inserting the object into the idr.
204 	int idx, next_id = -1;  in ipc_idr_alloc()
207 	next_id = ids->next_id;  in ipc_idr_alloc()
208 	ids->next_id = -1;  in ipc_idr_alloc()
214 	 * and the lockless preparations for ipc operations can start.  in ipc_idr_alloc()
219 	 * then the full tear-down sequence must be followed.  in ipc_idr_alloc()
220 	 * (i.e.: set new->deleted, reduce refcount, call_rcu())  in ipc_idr_alloc()
226 		max_idx = max(ids->in_use*3/2, ipc_min_cycle);  in ipc_idr_alloc()
230 		idx = idr_alloc_cyclic(&ids->ipcs_idr, NULL, 0, max_idx,  in ipc_idr_alloc()
239 			if (idx <= ids->last_idx) {  in ipc_idr_alloc()
240 				ids->seq++;  in ipc_idr_alloc()
241 				if (ids->seq >= ipcid_seq_max())  in ipc_idr_alloc()
242 					ids->seq = 0;  in ipc_idr_alloc()
244 			ids->last_idx = idx;  in ipc_idr_alloc()
246 			new->seq = ids->seq;  in ipc_idr_alloc()
251 			idr_replace(&ids->ipcs_idr, new, idx);  in ipc_idr_alloc()
254 		new->seq = ipcid_to_seqx(next_id);  in ipc_idr_alloc()
255 		idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id),  in ipc_idr_alloc()
259 		new->id = (new->seq << ipcmni_seq_shift()) + idx;  in ipc_idr_alloc()
264  * ipc_addid - add an ipc identifier
265  * @ids: ipc identifier set
266  * @new: new ipc permission set
269  * Add an entry 'new' to the ipc ids idr. The permissions object is
273  * On failure the entry is not locked and a negative err-code is returned.
285 	refcount_set(&new->refcount, 1);  in ipc_addid()
290 	if (ids->in_use >= limit)  in ipc_addid()
291 		return -ENOSPC;  in ipc_addid()
295 	spin_lock_init(&new->lock);  in ipc_addid()
297 	spin_lock(&new->lock);  in ipc_addid()
300 	new->cuid = new->uid = euid;  in ipc_addid()
301 	new->gid = new->cgid = egid;  in ipc_addid()
303 	new->deleted = false;  in ipc_addid()
308 	if (idx >= 0 && new->key != IPC_PRIVATE) {  in ipc_addid()
309 		err = rhashtable_insert_fast(&ids->key_ht, &new->khtnode,  in ipc_addid()
312 			idr_remove(&ids->ipcs_idr, idx);  in ipc_addid()
317 		new->deleted = true;  in ipc_addid()
318 		spin_unlock(&new->lock);  in ipc_addid()
323 	ids->in_use++;  in ipc_addid()
324 	if (idx > ids->max_idx)  in ipc_addid()
325 		ids->max_idx = idx;  in ipc_addid()
330  * ipcget_new -	create a new ipc object
331  * @ns: ipc namespace
332  * @ids: ipc identifier set
344 	down_write(&ids->rwsem);  in ipcget_new()
345 	err = ops->getnew(ns, params);  in ipcget_new()
346 	up_write(&ids->rwsem);  in ipcget_new()
351  * ipc_check_perms - check security and permissions for an ipc object
352  * @ns: ipc namespace
353  * @ipcp: ipc permission set
361  * On success, the ipc id is returned.
363  * It is called with ipc_ids.rwsem and ipcp->lock held.
372 	if (ipcperms(ns, ipcp, params->flg))  in ipc_check_perms()
373 		err = -EACCES;  in ipc_check_perms()
375 		err = ops->associate(ipcp, params->flg);  in ipc_check_perms()
377 			err = ipcp->id;  in ipc_check_perms()
384  * ipcget_public - get an ipc object or create a new one
385  * @ns: ipc namespace
386  * @ids: ipc identifier set
395  * On success, the ipc id is returned.
401 	int flg = params->flg;  in ipcget_public()
408 	down_write(&ids->rwsem);  in ipcget_public()
409 	ipcp = ipc_findkey(ids, params->key);  in ipcget_public()
413 			err = -ENOENT;  in ipcget_public()
415 			err = ops->getnew(ns, params);  in ipcget_public()
417 		/* ipc object has been locked by ipc_findkey() */  in ipcget_public()
420 			err = -EEXIST;  in ipcget_public()
423 			if (ops->more_checks)  in ipcget_public()
424 				err = ops->more_checks(ipcp, params);  in ipcget_public()
427 				 * ipc_check_perms returns the IPC id on  in ipcget_public()
434 	up_write(&ids->rwsem);  in ipcget_public()
440  * ipc_kht_remove - remove an ipc from the key hashtable
441  * @ids: ipc identifier set
442  * @ipcp: ipc perm structure containing the key to remove
449 	if (ipcp->key != IPC_PRIVATE)  in ipc_kht_remove()
450 		WARN_ON_ONCE(rhashtable_remove_fast(&ids->key_ht, &ipcp->khtnode,  in ipc_kht_remove()
455  * ipc_search_maxidx - search for the highest assigned index
456  * @ids: ipc identifier set
460  * to be called when ids->max_idx needs to be updated.
461  * Updating ids->max_idx is necessary when the current highest index ipc
463  * If no ipc object is allocated, then -1 is returned.
476 	for (; i >= 0; i--) {  in ipc_search_maxidx()
480 		 * e.g. 15,7,3,1,0 instead of 16,8,4,2,1.  in ipc_search_maxidx()
482 		tmpidx = tmpidx-1;  in ipc_search_maxidx()
483 		if (idr_get_next(&ids->ipcs_idr, &tmpidx))  in ipc_search_maxidx()
486 	return retval - 1;  in ipc_search_maxidx()
490  * ipc_rmid - remove an ipc identifier
491  * @ids: ipc identifier set
492  * @ipcp: ipc perm structure containing the identifier to remove
499 	int idx = ipcid_to_idx(ipcp->id);  in ipc_rmid()
501 	WARN_ON_ONCE(idr_remove(&ids->ipcs_idr, idx) != ipcp);  in ipc_rmid()
503 	ids->in_use--;  in ipc_rmid()
504 	ipcp->deleted = true;  in ipc_rmid()
506 	if (unlikely(idx == ids->max_idx)) {  in ipc_rmid()
507 		idx = ids->max_idx-1;  in ipc_rmid()
510 		ids->max_idx = idx;  in ipc_rmid()
515  * ipc_set_key_private - switch the key of an existing ipc to IPC_PRIVATE
516  * @ids: ipc identifier set
517  * @ipcp: ipc perm structure containing the key to modify
525 	ipcp->key = IPC_PRIVATE;  in ipc_set_key_private()
530 	return refcount_inc_not_zero(&ptr->refcount);  in ipc_rcu_getref()
536 	if (!refcount_dec_and_test(&ptr->refcount))  in ipc_rcu_putref()
539 	call_rcu(&ptr->rcu, func);  in ipc_rcu_putref()
543  * ipcperms - check ipc permissions
544  * @ns: ipc namespace
545  * @ipcp: ipc permission set
549  * to ipc resources. return 0 if allowed
559 	requested_mode = (flag >> 6) | (flag >> 3) | flag;  in ipcperms()
560 	granted_mode = ipcp->mode;  in ipcperms()
561 	if (uid_eq(euid, ipcp->cuid) ||  in ipcperms()
562 	    uid_eq(euid, ipcp->uid))  in ipcperms()
564 	else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid))  in ipcperms()
565 		granted_mode >>= 3;  in ipcperms()
568 	    !ns_capable(ns->user_ns, CAP_IPC_OWNER))  in ipcperms()
569 		return -1;  in ipcperms()
580  * kernel_to_ipc64_perm	- convert kernel ipc permissions to user
582  * @out: new style ipc permissions
589 	out->key	= in->key;  in kernel_to_ipc64_perm()
590 	out->uid	= from_kuid_munged(current_user_ns(), in->uid);  in kernel_to_ipc64_perm()
591 	out->gid	= from_kgid_munged(current_user_ns(), in->gid);  in kernel_to_ipc64_perm()
592 	out->cuid	= from_kuid_munged(current_user_ns(), in->cuid);  in kernel_to_ipc64_perm()
593 	out->cgid	= from_kgid_munged(current_user_ns(), in->cgid);  in kernel_to_ipc64_perm()
594 	out->mode	= in->mode;  in kernel_to_ipc64_perm()
595 	out->seq	= in->seq;  in kernel_to_ipc64_perm()
599  * ipc64_perm_to_ipc_perm - convert new ipc permissions to old
600  * @in: new style ipc permissions
601  * @out: old style ipc permissions
608 	out->key	= in->key;  in ipc64_perm_to_ipc_perm()
609 	SET_UID(out->uid, in->uid);  in ipc64_perm_to_ipc_perm()
610 	SET_GID(out->gid, in->gid);  in ipc64_perm_to_ipc_perm()
611 	SET_UID(out->cuid, in->cuid);  in ipc64_perm_to_ipc_perm()
612 	SET_GID(out->cgid, in->cgid);  in ipc64_perm_to_ipc_perm()
613 	out->mode	= in->mode;  in ipc64_perm_to_ipc_perm()
614 	out->seq	= in->seq;  in ipc64_perm_to_ipc_perm()
619  * @ids: ipc identifier set
620  * @id: ipc id to look for
622  * Look for an id in the ipc ids idr and return associated ipc object.
625  * The ipc object is *not* locked on exit.
632 	out = idr_find(&ids->ipcs_idr, idx);  in ipc_obtain_object_idr()
634 		return ERR_PTR(-EINVAL);  in ipc_obtain_object_idr()
641  * @ids: ipc identifier set
642  * @id: ipc id to look for
644  * Similar to ipc_obtain_object_idr() but also checks the ipc object
648  * The ipc object is *not* locked on exit.
658 		return ERR_PTR(-EINVAL);  in ipc_obtain_object_check()
664  * ipcget - Common sys_*get() code
666  * @ids: ipc identifier set
667  * @ops: operations to be called on ipc object creation, permission checks
676 	if (params->key == IPC_PRIVATE)  in ipcget()
683  * ipc_update_perm - update the permissions of an ipc object
685  * @out: the permission of the ipc to set.
689 	kuid_t uid = make_kuid(current_user_ns(), in->uid);  in ipc_update_perm()
690 	kgid_t gid = make_kgid(current_user_ns(), in->gid);  in ipc_update_perm()
692 		return -EINVAL;  in ipc_update_perm()
694 	out->uid = uid;  in ipc_update_perm()
695 	out->gid = gid;  in ipc_update_perm()
696 	out->mode = (out->mode & ~S_IRWXUGO)  in ipc_update_perm()
697 		| (in->mode & S_IRWXUGO);  in ipc_update_perm()
703  * ipcctl_obtain_check - retrieve an ipc object and check permissions
704  * @ns:  ipc namespace
705  * @ids:  the table of ids where to look for the ipc
706  * @id:   the id of the ipc to retrieve
715  *   - retrieves the ipc object with the given id in the given table.
716  *   - performs some audit and permission check, depending on the given cmd
717  *   - returns a pointer to the ipc object or otherwise, the corresponding
727 	int err = -EPERM;  in ipcctl_obtain_check()
738 		audit_ipc_set_perm(extra_perm, perm->uid,  in ipcctl_obtain_check()
739 				   perm->gid, perm->mode);  in ipcctl_obtain_check()
742 	if (uid_eq(euid, ipcp->cuid) || uid_eq(euid, ipcp->uid)  ||  in ipcctl_obtain_check()
743 	    ns_capable(ns->user_ns, CAP_SYS_ADMIN))  in ipcctl_obtain_check()
753  * ipc_parse_version - ipc call version
756  * Return IPC_64 for new style IPC and IPC_OLD for old style IPC.
781 	struct ipc_proc_iter *iter = s->private;  in ipc_seq_pid_ns()
782 	return iter->pid_ns;  in ipc_seq_pid_ns()
786  * sysvipc_find_ipc - Find and lock the ipc structure based on seq pos
787  * @ids: ipc identifier set
790  * The function finds an ipc structure, based on the sequence file
791  * position @pos. If there is no ipc structure at position @pos, then
795  * the found ipc structure.
798  * The function returns the found ipc structure, or NULL at EOF.
803 	struct kern_ipc_perm *ipc;  in sysvipc_find_ipc()  local
805 	/* convert from position to idr index -> "-1" */  in sysvipc_find_ipc()
806 	tmpidx = *pos - 1;  in sysvipc_find_ipc()
808 	ipc = idr_get_next(&ids->ipcs_idr, &tmpidx);  in sysvipc_find_ipc()
809 	if (ipc != NULL) {  in sysvipc_find_ipc()
811 		ipc_lock_object(ipc);  in sysvipc_find_ipc()
813 		/* convert from idr index to position  -> "+1" */  in sysvipc_find_ipc()
816 	return ipc;  in sysvipc_find_ipc()
821 	struct ipc_proc_iter *iter = s->private;  in sysvipc_proc_next()
822 	struct ipc_proc_iface *iface = iter->iface;  in sysvipc_proc_next()
823 	struct kern_ipc_perm *ipc = it;  in sysvipc_proc_next()  local
825 	/* If we had an ipc id locked before, unlock it */  in sysvipc_proc_next()
826 	if (ipc && ipc != SEQ_START_TOKEN)  in sysvipc_proc_next()
827 		ipc_unlock(ipc);  in sysvipc_proc_next()
829 	/* Next -> search for *pos+1 */  in sysvipc_proc_next()
831 	return sysvipc_find_ipc(&iter->ns->ids[iface->ids], pos);  in sysvipc_proc_next()
835  * File positions: pos 0 -> header, pos n -> ipc idx = n - 1.
836  * SeqFile iterator: iterator value locked ipc pointer or SEQ_TOKEN_START.
840 	struct ipc_proc_iter *iter = s->private;  in sysvipc_proc_start()
841 	struct ipc_proc_iface *iface = iter->iface;  in sysvipc_proc_start()
844 	ids = &iter->ns->ids[iface->ids];  in sysvipc_proc_start()
847 	 * Take the lock - this will be released by the corresponding  in sysvipc_proc_start()
850 	down_read(&ids->rwsem);  in sysvipc_proc_start()
860 	/* Otherwise return the correct ipc structure */  in sysvipc_proc_start()
866 	struct kern_ipc_perm *ipc = it;  in sysvipc_proc_stop()  local
867 	struct ipc_proc_iter *iter = s->private;  in sysvipc_proc_stop()
868 	struct ipc_proc_iface *iface = iter->iface;  in sysvipc_proc_stop()
872 	if (ipc && ipc != SEQ_START_TOKEN)  in sysvipc_proc_stop()
873 		ipc_unlock(ipc);  in sysvipc_proc_stop()
875 	ids = &iter->ns->ids[iface->ids];  in sysvipc_proc_stop()
877 	up_read(&ids->rwsem);  in sysvipc_proc_stop()
882 	struct ipc_proc_iter *iter = s->private;  in sysvipc_proc_show()
883 	struct ipc_proc_iface *iface = iter->iface;  in sysvipc_proc_show()
886 		seq_puts(s, iface->header);  in sysvipc_proc_show()
890 	return iface->show(s, it);  in sysvipc_proc_show()
906 		return -ENOMEM;  in sysvipc_proc_open()
908 	iter->iface = pde_data(inode);  in sysvipc_proc_open()
909 	iter->ns    = get_ipc_ns(current->nsproxy->ipc_ns);  in sysvipc_proc_open()
910 	iter->pid_ns = get_pid_ns(task_active_pid_ns(current));  in sysvipc_proc_open()
917 	struct seq_file *seq = file->private_data;  in sysvipc_proc_release()
918 	struct ipc_proc_iter *iter = seq->private;  in sysvipc_proc_release()
919 	put_ipc_ns(iter->ns);  in sysvipc_proc_release()
920 	put_pid_ns(iter->pid_ns);  in sysvipc_proc_release()