1 // SPDX-License-Identifier: GPL-2.0
3  * linux/ipc/util.c
6  * Sep 1997 - Call suser() last after "normal" permission checks so we
8  *            Occurs in several places in the IPC code.
10  * Nov 1999 - ipc helper functions, unified SMP locking
12  * Oct 2002 - One lock per IPC id. RCU ipc_free for lock-free grow_ary().
14  * Mar 2006 - support for audit of ipc object properties
16  * Jun 2006 - namespaces ssupport
20  * General sysv ipc locking scheme:
22  *          obtain the ipc object (kern_ipc_perm) by looking up the id in an idr
24  *	    - perform initial checks (capabilities, auditing and permission,
26  *	    - perform read-only operations, such as INFO command, that
28  *	      acquire the ipc lock (kern_ipc_perm.lock) through
30  *		- perform read-only operations that demand atomicity,
32  *		- perform data updates, such as SET, RMID commands and
33  *		  mechanism-specific operations (semop/semtimedop,
35  *	    drop the ipc lock, through ipc_unlock_object().
38  *  The ids->rwsem must be taken when:
39  *	- creating, removing and iterating the existing entries in ipc
41  *	- iterating through files under /proc/sysvipc/
43  *  Note that sems have a special fast path that avoids kern_ipc_perm.lock -
80  * ipc_init - initialise ipc subsystem
82  * The various sysv ipc resources (semaphores, messages and shared
108  * ipc_init_ids	- initialise ipc identifiers
109  * @ids: ipc identifier set
111  * Set up the sequence range to use for the ipc identifier range (limited
116 	ids->in_use = 0;  in ipc_init_ids()
117 	ids->seq = 0;  in ipc_init_ids()
118 	init_rwsem(&ids->rwsem);  in ipc_init_ids()
119 	rhashtable_init(&ids->key_ht, &ipc_kht_params);  in ipc_init_ids()
120 	idr_init(&ids->ipcs_idr);  in ipc_init_ids()
121 	ids->max_idx = -1;  in ipc_init_ids()
122 	ids->last_idx = -1;  in ipc_init_ids()
124 	ids->next_id = -1;  in ipc_init_ids()
131  * ipc_init_proc_interface -  create a proc interface for sysipc types using a seq_file interface.
134  * @ids: ipc id table to iterate.
146 	iface->path	= path;  in ipc_init_proc_interface()
147 	iface->header	= header;  in ipc_init_proc_interface()
148 	iface->ids	= ids;  in ipc_init_proc_interface()
149 	iface->show	= show;  in ipc_init_proc_interface()
162  * ipc_findkey	- find a key in an ipc identifier set
163  * @ids: ipc identifier set
166  * Returns the locked pointer to the ipc structure if found or NULL
167  * otherwise. If key is found ipc points to the owning ipc structure
175 	ipcp = rhashtable_lookup_fast(&ids->key_ht, &key,  in ipc_findkey()
186  * Insert new IPC object into idr tree, and set sequence number and id
189  * - the sequence number must be set before inserting the object into the idr,
191  * - the id can/must be set after inserting the object into the idr.
203 	int idx, next_id = -1;  in ipc_idr_alloc()
206 	next_id = ids->next_id;  in ipc_idr_alloc()
207 	ids->next_id = -1;  in ipc_idr_alloc()
213 	 * and the lockless preparations for ipc operations can start.  in ipc_idr_alloc()
218 	 * then the full tear-down sequence must be followed.  in ipc_idr_alloc()
219 	 * (i.e.: set new->deleted, reduce refcount, call_rcu())  in ipc_idr_alloc()
225 		max_idx = max(ids->in_use*3/2, ipc_min_cycle);  in ipc_idr_alloc()
229 		idx = idr_alloc_cyclic(&ids->ipcs_idr, NULL, 0, max_idx,  in ipc_idr_alloc()
238 			if (idx <= ids->last_idx) {  in ipc_idr_alloc()
239 				ids->seq++;  in ipc_idr_alloc()
240 				if (ids->seq >= ipcid_seq_max())  in ipc_idr_alloc()
241 					ids->seq = 0;  in ipc_idr_alloc()
243 			ids->last_idx = idx;  in ipc_idr_alloc()
245 			new->seq = ids->seq;  in ipc_idr_alloc()
250 			idr_replace(&ids->ipcs_idr, new, idx);  in ipc_idr_alloc()
253 		new->seq = ipcid_to_seqx(next_id);  in ipc_idr_alloc()
254 		idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id),  in ipc_idr_alloc()
258 		new->id = (new->seq << ipcmni_seq_shift()) + idx;  in ipc_idr_alloc()
263  * ipc_addid - add an ipc identifier
264  * @ids: ipc identifier set
265  * @new: new ipc permission set
268  * Add an entry 'new' to the ipc ids idr. The permissions object is
272  * On failure the entry is not locked and a negative err-code is returned.
284 	refcount_set(&new->refcount, 1);  in ipc_addid()
289 	if (ids->in_use >= limit)  in ipc_addid()
290 		return -ENOSPC;  in ipc_addid()
294 	spin_lock_init(&new->lock);  in ipc_addid()
296 	spin_lock(&new->lock);  in ipc_addid()
299 	new->cuid = new->uid = euid;  in ipc_addid()
300 	new->gid = new->cgid = egid;  in ipc_addid()
302 	new->deleted = false;  in ipc_addid()
307 	if (idx >= 0 && new->key != IPC_PRIVATE) {  in ipc_addid()
308 		err = rhashtable_insert_fast(&ids->key_ht, &new->khtnode,  in ipc_addid()
311 			idr_remove(&ids->ipcs_idr, idx);  in ipc_addid()
316 		new->deleted = true;  in ipc_addid()
317 		spin_unlock(&new->lock);  in ipc_addid()
322 	ids->in_use++;  in ipc_addid()
323 	if (idx > ids->max_idx)  in ipc_addid()
324 		ids->max_idx = idx;  in ipc_addid()
329  * ipcget_new -	create a new ipc object
330  * @ns: ipc namespace
331  * @ids: ipc identifier set
343 	down_write(&ids->rwsem);  in ipcget_new()
344 	err = ops->getnew(ns, params);  in ipcget_new()
345 	up_write(&ids->rwsem);  in ipcget_new()
350  * ipc_check_perms - check security and permissions for an ipc object
351  * @ns: ipc namespace
352  * @ipcp: ipc permission set
360  * On success, the ipc id is returned.
362  * It is called with ipc_ids.rwsem and ipcp->lock held.
371 	if (ipcperms(ns, ipcp, params->flg))  in ipc_check_perms()
372 		err = -EACCES;  in ipc_check_perms()
374 		err = ops->associate(ipcp, params->flg);  in ipc_check_perms()
376 			err = ipcp->id;  in ipc_check_perms()
383  * ipcget_public - get an ipc object or create a new one
384  * @ns: ipc namespace
385  * @ids: ipc identifier set
394  * On success, the ipc id is returned.
400 	int flg = params->flg;  in ipcget_public()
407 	down_write(&ids->rwsem);  in ipcget_public()
408 	ipcp = ipc_findkey(ids, params->key);  in ipcget_public()
412 			err = -ENOENT;  in ipcget_public()
414 			err = ops->getnew(ns, params);  in ipcget_public()
416 		/* ipc object has been locked by ipc_findkey() */  in ipcget_public()
419 			err = -EEXIST;  in ipcget_public()
422 			if (ops->more_checks)  in ipcget_public()
423 				err = ops->more_checks(ipcp, params);  in ipcget_public()
426 				 * ipc_check_perms returns the IPC id on  in ipcget_public()
433 	up_write(&ids->rwsem);  in ipcget_public()
439  * ipc_kht_remove - remove an ipc from the key hashtable
440  * @ids: ipc identifier set
441  * @ipcp: ipc perm structure containing the key to remove
448 	if (ipcp->key != IPC_PRIVATE)  in ipc_kht_remove()
449 		WARN_ON_ONCE(rhashtable_remove_fast(&ids->key_ht, &ipcp->khtnode,  in ipc_kht_remove()
454  * ipc_rmid - remove an ipc identifier
455  * @ids: ipc identifier set
456  * @ipcp: ipc perm structure containing the identifier to remove
463 	int idx = ipcid_to_idx(ipcp->id);  in ipc_rmid()
465 	WARN_ON_ONCE(idr_remove(&ids->ipcs_idr, idx) != ipcp);  in ipc_rmid()
467 	ids->in_use--;  in ipc_rmid()
468 	ipcp->deleted = true;  in ipc_rmid()
470 	if (unlikely(idx == ids->max_idx)) {  in ipc_rmid()
472 			idx--;  in ipc_rmid()
473 			if (idx == -1)  in ipc_rmid()
475 		} while (!idr_find(&ids->ipcs_idr, idx));  in ipc_rmid()
476 		ids->max_idx = idx;  in ipc_rmid()
481  * ipc_set_key_private - switch the key of an existing ipc to IPC_PRIVATE
482  * @ids: ipc identifier set
483  * @ipcp: ipc perm structure containing the key to modify
491 	ipcp->key = IPC_PRIVATE;  in ipc_set_key_private()
496 	return refcount_inc_not_zero(&ptr->refcount);  in ipc_rcu_getref()
502 	if (!refcount_dec_and_test(&ptr->refcount))  in ipc_rcu_putref()
505 	call_rcu(&ptr->rcu, func);  in ipc_rcu_putref()
509  * ipcperms - check ipc permissions
510  * @ns: ipc namespace
511  * @ipcp: ipc permission set
515  * to ipc resources. return 0 if allowed
525 	requested_mode = (flag >> 6) | (flag >> 3) | flag;  in ipcperms()
526 	granted_mode = ipcp->mode;  in ipcperms()
527 	if (uid_eq(euid, ipcp->cuid) ||  in ipcperms()
528 	    uid_eq(euid, ipcp->uid))  in ipcperms()
530 	else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid))  in ipcperms()
531 		granted_mode >>= 3;  in ipcperms()
534 	    !ns_capable(ns->user_ns, CAP_IPC_OWNER))  in ipcperms()
535 		return -1;  in ipcperms()
546  * kernel_to_ipc64_perm	- convert kernel ipc permissions to user
548  * @out: new style ipc permissions
555 	out->key	= in->key;  in kernel_to_ipc64_perm()
556 	out->uid	= from_kuid_munged(current_user_ns(), in->uid);  in kernel_to_ipc64_perm()
557 	out->gid	= from_kgid_munged(current_user_ns(), in->gid);  in kernel_to_ipc64_perm()
558 	out->cuid	= from_kuid_munged(current_user_ns(), in->cuid);  in kernel_to_ipc64_perm()
559 	out->cgid	= from_kgid_munged(current_user_ns(), in->cgid);  in kernel_to_ipc64_perm()
560 	out->mode	= in->mode;  in kernel_to_ipc64_perm()
561 	out->seq	= in->seq;  in kernel_to_ipc64_perm()
565  * ipc64_perm_to_ipc_perm - convert new ipc permissions to old
566  * @in: new style ipc permissions
567  * @out: old style ipc permissions
574 	out->key	= in->key;  in ipc64_perm_to_ipc_perm()
575 	SET_UID(out->uid, in->uid);  in ipc64_perm_to_ipc_perm()
576 	SET_GID(out->gid, in->gid);  in ipc64_perm_to_ipc_perm()
577 	SET_UID(out->cuid, in->cuid);  in ipc64_perm_to_ipc_perm()
578 	SET_GID(out->cgid, in->cgid);  in ipc64_perm_to_ipc_perm()
579 	out->mode	= in->mode;  in ipc64_perm_to_ipc_perm()
580 	out->seq	= in->seq;  in ipc64_perm_to_ipc_perm()
585  * @ids: ipc identifier set
586  * @id: ipc id to look for
588  * Look for an id in the ipc ids idr and return associated ipc object.
591  * The ipc object is *not* locked on exit.
598 	out = idr_find(&ids->ipcs_idr, idx);  in ipc_obtain_object_idr()
600 		return ERR_PTR(-EINVAL);  in ipc_obtain_object_idr()
607  * @ids: ipc identifier set
608  * @id: ipc id to look for
610  * Similar to ipc_obtain_object_idr() but also checks the ipc object
614  * The ipc object is *not* locked on exit.
624 		return ERR_PTR(-EINVAL);  in ipc_obtain_object_check()
630  * ipcget - Common sys_*get() code
632  * @ids: ipc identifier set
633  * @ops: operations to be called on ipc object creation, permission checks
642 	if (params->key == IPC_PRIVATE)  in ipcget()
649  * ipc_update_perm - update the permissions of an ipc object
651  * @out: the permission of the ipc to set.
655 	kuid_t uid = make_kuid(current_user_ns(), in->uid);  in ipc_update_perm()
656 	kgid_t gid = make_kgid(current_user_ns(), in->gid);  in ipc_update_perm()
658 		return -EINVAL;  in ipc_update_perm()
660 	out->uid = uid;  in ipc_update_perm()
661 	out->gid = gid;  in ipc_update_perm()
662 	out->mode = (out->mode & ~S_IRWXUGO)  in ipc_update_perm()
663 		| (in->mode & S_IRWXUGO);  in ipc_update_perm()
669  * ipcctl_obtain_check - retrieve an ipc object and check permissions
670  * @ns:  ipc namespace
671  * @ids:  the table of ids where to look for the ipc
672  * @id:   the id of the ipc to retrieve
681  *   - retrieves the ipc object with the given id in the given table.
682  *   - performs some audit and permission check, depending on the given cmd
683  *   - returns a pointer to the ipc object or otherwise, the corresponding
693 	int err = -EPERM;  in ipcctl_obtain_check()
704 		audit_ipc_set_perm(extra_perm, perm->uid,  in ipcctl_obtain_check()
705 				   perm->gid, perm->mode);  in ipcctl_obtain_check()
708 	if (uid_eq(euid, ipcp->cuid) || uid_eq(euid, ipcp->uid)  ||  in ipcctl_obtain_check()
709 	    ns_capable(ns->user_ns, CAP_SYS_ADMIN))  in ipcctl_obtain_check()
719  * ipc_parse_version - ipc call version
722  * Return IPC_64 for new style IPC and IPC_OLD for old style IPC.
747 	struct ipc_proc_iter *iter = s->private;  in ipc_seq_pid_ns()
748 	return iter->pid_ns;  in ipc_seq_pid_ns()
752  * This routine locks the ipc structure found at least at position pos.
757 	struct kern_ipc_perm *ipc = NULL;  in sysvipc_find_ipc()  local
760 	if (max_idx == -1 || pos > max_idx)  in sysvipc_find_ipc()
764 		ipc = idr_find(&ids->ipcs_idr, pos);  in sysvipc_find_ipc()
765 		if (ipc != NULL) {  in sysvipc_find_ipc()
767 			ipc_lock_object(ipc);  in sysvipc_find_ipc()
773 	return ipc;  in sysvipc_find_ipc()
778 	struct ipc_proc_iter *iter = s->private;  in sysvipc_proc_next()
779 	struct ipc_proc_iface *iface = iter->iface;  in sysvipc_proc_next()
780 	struct kern_ipc_perm *ipc = it;  in sysvipc_proc_next()  local
782 	/* If we had an ipc id locked before, unlock it */  in sysvipc_proc_next()
783 	if (ipc && ipc != SEQ_START_TOKEN)  in sysvipc_proc_next()
784 		ipc_unlock(ipc);  in sysvipc_proc_next()
786 	return sysvipc_find_ipc(&iter->ns->ids[iface->ids], *pos, pos);  in sysvipc_proc_next()
790  * File positions: pos 0 -> header, pos n -> ipc id = n - 1.
791  * SeqFile iterator: iterator value locked ipc pointer or SEQ_TOKEN_START.
795 	struct ipc_proc_iter *iter = s->private;  in sysvipc_proc_start()
796 	struct ipc_proc_iface *iface = iter->iface;  in sysvipc_proc_start()
799 	ids = &iter->ns->ids[iface->ids];  in sysvipc_proc_start()
802 	 * Take the lock - this will be released by the corresponding  in sysvipc_proc_start()
805 	down_read(&ids->rwsem);  in sysvipc_proc_start()
815 	/* Find the (pos-1)th ipc */  in sysvipc_proc_start()
816 	return sysvipc_find_ipc(ids, *pos - 1, pos);  in sysvipc_proc_start()
821 	struct kern_ipc_perm *ipc = it;  in sysvipc_proc_stop()  local
822 	struct ipc_proc_iter *iter = s->private;  in sysvipc_proc_stop()
823 	struct ipc_proc_iface *iface = iter->iface;  in sysvipc_proc_stop()
827 	if (ipc && ipc != SEQ_START_TOKEN)  in sysvipc_proc_stop()
828 		ipc_unlock(ipc);  in sysvipc_proc_stop()
830 	ids = &iter->ns->ids[iface->ids];  in sysvipc_proc_stop()
832 	up_read(&ids->rwsem);  in sysvipc_proc_stop()
837 	struct ipc_proc_iter *iter = s->private;  in sysvipc_proc_show()
838 	struct ipc_proc_iface *iface = iter->iface;  in sysvipc_proc_show()
841 		seq_puts(s, iface->header);  in sysvipc_proc_show()
845 	return iface->show(s, it);  in sysvipc_proc_show()
861 		return -ENOMEM;  in sysvipc_proc_open()
863 	iter->iface = PDE_DATA(inode);  in sysvipc_proc_open()
864 	iter->ns    = get_ipc_ns(current->nsproxy->ipc_ns);  in sysvipc_proc_open()
865 	iter->pid_ns = get_pid_ns(task_active_pid_ns(current));  in sysvipc_proc_open()
872 	struct seq_file *seq = file->private_data;  in sysvipc_proc_release()
873 	struct ipc_proc_iter *iter = seq->private;  in sysvipc_proc_release()
874 	put_ipc_ns(iter->ns);  in sysvipc_proc_release()
875 	put_pid_ns(iter->pid_ns);  in sysvipc_proc_release()