• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * 32 bit compatibility code for System V IPC
3  *
4  * Copyright (C) 1997,1998	Jakub Jelinek (jj@sunsite.mff.cuni.cz)
5  * Copyright (C) 1997		David S. Miller (davem@caip.rutgers.edu)
6  * Copyright (C) 1999		Arun Sharma <arun.sharma@intel.com>
7  * Copyright (C) 2000		VA Linux Co
8  * Copyright (C) 2000		Don Dugger <n0ano@valinux.com>
9  * Copyright (C) 2000           Hewlett-Packard Co.
10  * Copyright (C) 2000           David Mosberger-Tang <davidm@hpl.hp.com>
11  * Copyright (C) 2000           Gerhard Tonn (ton@de.ibm.com)
12  * Copyright (C) 2000-2002      Andi Kleen, SuSE Labs (x86-64 port)
13  * Copyright (C) 2000		Silicon Graphics, Inc.
14  * Copyright (C) 2001		IBM
15  * Copyright (C) 2004		IBM Deutschland Entwicklung GmbH, IBM Corporation
16  * Copyright (C) 2004		Arnd Bergmann (arnd@arndb.de)
17  *
18  * This code is collected from the versions for sparc64, mips64, s390x, ia64,
19  * ppc64 and x86_64, all of which are based on the original sparc64 version
20  * by Jakub Jelinek.
21  *
22  */
23 #include <linux/compat.h>
24 #include <linux/errno.h>
25 #include <linux/highuid.h>
26 #include <linux/init.h>
27 #include <linux/msg.h>
28 #include <linux/shm.h>
29 #include <linux/syscalls.h>
30 #include <linux/ptrace.h>
31 
32 #include <linux/mutex.h>
33 #include <asm/uaccess.h>
34 
35 #include "util.h"
36 
37 struct compat_msgbuf {
38 	compat_long_t mtype;
39 	char mtext[1];
40 };
41 
42 struct compat_ipc_perm {
43 	key_t key;
44 	__compat_uid_t uid;
45 	__compat_gid_t gid;
46 	__compat_uid_t cuid;
47 	__compat_gid_t cgid;
48 	compat_mode_t mode;
49 	unsigned short seq;
50 };
51 
52 struct compat_semid_ds {
53 	struct compat_ipc_perm sem_perm;
54 	compat_time_t sem_otime;
55 	compat_time_t sem_ctime;
56 	compat_uptr_t sem_base;
57 	compat_uptr_t sem_pending;
58 	compat_uptr_t sem_pending_last;
59 	compat_uptr_t undo;
60 	unsigned short sem_nsems;
61 };
62 
63 struct compat_msqid_ds {
64 	struct compat_ipc_perm msg_perm;
65 	compat_uptr_t msg_first;
66 	compat_uptr_t msg_last;
67 	compat_time_t msg_stime;
68 	compat_time_t msg_rtime;
69 	compat_time_t msg_ctime;
70 	compat_ulong_t msg_lcbytes;
71 	compat_ulong_t msg_lqbytes;
72 	unsigned short msg_cbytes;
73 	unsigned short msg_qnum;
74 	unsigned short msg_qbytes;
75 	compat_ipc_pid_t msg_lspid;
76 	compat_ipc_pid_t msg_lrpid;
77 };
78 
79 struct compat_shmid_ds {
80 	struct compat_ipc_perm shm_perm;
81 	int shm_segsz;
82 	compat_time_t shm_atime;
83 	compat_time_t shm_dtime;
84 	compat_time_t shm_ctime;
85 	compat_ipc_pid_t shm_cpid;
86 	compat_ipc_pid_t shm_lpid;
87 	unsigned short shm_nattch;
88 	unsigned short shm_unused;
89 	compat_uptr_t shm_unused2;
90 	compat_uptr_t shm_unused3;
91 };
92 
93 struct compat_ipc_kludge {
94 	compat_uptr_t msgp;
95 	compat_long_t msgtyp;
96 };
97 
98 struct compat_shminfo64 {
99 	compat_ulong_t shmmax;
100 	compat_ulong_t shmmin;
101 	compat_ulong_t shmmni;
102 	compat_ulong_t shmseg;
103 	compat_ulong_t shmall;
104 	compat_ulong_t __unused1;
105 	compat_ulong_t __unused2;
106 	compat_ulong_t __unused3;
107 	compat_ulong_t __unused4;
108 };
109 
110 struct compat_shm_info {
111 	compat_int_t used_ids;
112 	compat_ulong_t shm_tot, shm_rss, shm_swp;
113 	compat_ulong_t swap_attempts, swap_successes;
114 };
115 
116 extern int sem_ctls[];
117 #define sc_semopm	(sem_ctls[2])
118 
compat_ipc_parse_version(int * cmd)119 static inline int compat_ipc_parse_version(int *cmd)
120 {
121 #ifdef	CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION
122 	int version = *cmd & IPC_64;
123 
124 	/* this is tricky: architectures that have support for the old
125 	 * ipc structures in 64 bit binaries need to have IPC_64 set
126 	 * in cmd, the others need to have it cleared */
127 #ifndef ipc_parse_version
128 	*cmd |= IPC_64;
129 #else
130 	*cmd &= ~IPC_64;
131 #endif
132 	return version;
133 #else
134 	/* With the asm-generic APIs, we always use the 64-bit versions. */
135 	return IPC_64;
136 #endif
137 }
138 
__get_compat_ipc64_perm(struct ipc64_perm * p64,struct compat_ipc64_perm __user * up64)139 static inline int __get_compat_ipc64_perm(struct ipc64_perm *p64,
140 					  struct compat_ipc64_perm __user *up64)
141 {
142 	int err;
143 
144 	err  = __get_user(p64->uid, &up64->uid);
145 	err |= __get_user(p64->gid, &up64->gid);
146 	err |= __get_user(p64->mode, &up64->mode);
147 	return err;
148 }
149 
__get_compat_ipc_perm(struct ipc64_perm * p,struct compat_ipc_perm __user * up)150 static inline int __get_compat_ipc_perm(struct ipc64_perm *p,
151 					struct compat_ipc_perm __user *up)
152 {
153 	int err;
154 
155 	err  = __get_user(p->uid, &up->uid);
156 	err |= __get_user(p->gid, &up->gid);
157 	err |= __get_user(p->mode, &up->mode);
158 	return err;
159 }
160 
__put_compat_ipc64_perm(struct ipc64_perm * p64,struct compat_ipc64_perm __user * up64)161 static inline int __put_compat_ipc64_perm(struct ipc64_perm *p64,
162 					  struct compat_ipc64_perm __user *up64)
163 {
164 	int err;
165 
166 	err  = __put_user(p64->key, &up64->key);
167 	err |= __put_user(p64->uid, &up64->uid);
168 	err |= __put_user(p64->gid, &up64->gid);
169 	err |= __put_user(p64->cuid, &up64->cuid);
170 	err |= __put_user(p64->cgid, &up64->cgid);
171 	err |= __put_user(p64->mode, &up64->mode);
172 	err |= __put_user(p64->seq, &up64->seq);
173 	return err;
174 }
175 
__put_compat_ipc_perm(struct ipc64_perm * p,struct compat_ipc_perm __user * up)176 static inline int __put_compat_ipc_perm(struct ipc64_perm *p,
177 					struct compat_ipc_perm __user *up)
178 {
179 	int err;
180 	__compat_uid_t u;
181 	__compat_gid_t g;
182 
183 	err  = __put_user(p->key, &up->key);
184 	SET_UID(u, p->uid);
185 	err |= __put_user(u, &up->uid);
186 	SET_GID(g, p->gid);
187 	err |= __put_user(g, &up->gid);
188 	SET_UID(u, p->cuid);
189 	err |= __put_user(u, &up->cuid);
190 	SET_GID(g, p->cgid);
191 	err |= __put_user(g, &up->cgid);
192 	err |= __put_user(p->mode, &up->mode);
193 	err |= __put_user(p->seq, &up->seq);
194 	return err;
195 }
196 
get_compat_semid64_ds(struct semid64_ds * s64,struct compat_semid64_ds __user * up64)197 static inline int get_compat_semid64_ds(struct semid64_ds *s64,
198 					struct compat_semid64_ds __user *up64)
199 {
200 	if (!access_ok (VERIFY_READ, up64, sizeof(*up64)))
201 		return -EFAULT;
202 	return __get_compat_ipc64_perm(&s64->sem_perm, &up64->sem_perm);
203 }
204 
get_compat_semid_ds(struct semid64_ds * s,struct compat_semid_ds __user * up)205 static inline int get_compat_semid_ds(struct semid64_ds *s,
206 				      struct compat_semid_ds __user *up)
207 {
208 	if (!access_ok (VERIFY_READ, up, sizeof(*up)))
209 		return -EFAULT;
210 	return __get_compat_ipc_perm(&s->sem_perm, &up->sem_perm);
211 }
212 
put_compat_semid64_ds(struct semid64_ds * s64,struct compat_semid64_ds __user * up64)213 static inline int put_compat_semid64_ds(struct semid64_ds *s64,
214 					struct compat_semid64_ds __user *up64)
215 {
216 	int err;
217 
218 	if (!access_ok (VERIFY_WRITE, up64, sizeof(*up64)))
219 		return -EFAULT;
220 	err  = __put_compat_ipc64_perm(&s64->sem_perm, &up64->sem_perm);
221 	err |= __put_user(s64->sem_otime, &up64->sem_otime);
222 	err |= __put_user(s64->sem_ctime, &up64->sem_ctime);
223 	err |= __put_user(s64->sem_nsems, &up64->sem_nsems);
224 	return err;
225 }
226 
put_compat_semid_ds(struct semid64_ds * s,struct compat_semid_ds __user * up)227 static inline int put_compat_semid_ds(struct semid64_ds *s,
228 				      struct compat_semid_ds __user *up)
229 {
230 	int err;
231 
232 	if (!access_ok (VERIFY_WRITE, up, sizeof(*up)))
233 		return -EFAULT;
234 	err  = __put_compat_ipc_perm(&s->sem_perm, &up->sem_perm);
235 	err |= __put_user(s->sem_otime, &up->sem_otime);
236 	err |= __put_user(s->sem_ctime, &up->sem_ctime);
237 	err |= __put_user(s->sem_nsems, &up->sem_nsems);
238 	return err;
239 }
240 
do_compat_semctl(int first,int second,int third,u32 pad)241 static long do_compat_semctl(int first, int second, int third, u32 pad)
242 {
243 	unsigned long fourth;
244 	int err, err2;
245 	struct semid64_ds s64;
246 	struct semid64_ds __user *up64;
247 	int version = compat_ipc_parse_version(&third);
248 
249 	memset(&s64, 0, sizeof(s64));
250 
251 	if ((third & (~IPC_64)) == SETVAL)
252 #ifdef __BIG_ENDIAN
253 		fourth = (unsigned long)pad << 32;
254 #else
255 		fourth = pad;
256 #endif
257 	else
258 		fourth = (unsigned long)compat_ptr(pad);
259 	switch (third & (~IPC_64)) {
260 	case IPC_INFO:
261 	case IPC_RMID:
262 	case SEM_INFO:
263 	case GETVAL:
264 	case GETPID:
265 	case GETNCNT:
266 	case GETZCNT:
267 	case GETALL:
268 	case SETVAL:
269 	case SETALL:
270 		err = sys_semctl(first, second, third, fourth);
271 		break;
272 
273 	case IPC_STAT:
274 	case SEM_STAT:
275 		up64 = compat_alloc_user_space(sizeof(s64));
276 		fourth = (unsigned long)up64;
277 		err = sys_semctl(first, second, third, fourth);
278 		if (err < 0)
279 			break;
280 		if (copy_from_user(&s64, up64, sizeof(s64)))
281 			err2 = -EFAULT;
282 		else if (version == IPC_64)
283 			err2 = put_compat_semid64_ds(&s64, compat_ptr(pad));
284 		else
285 			err2 = put_compat_semid_ds(&s64, compat_ptr(pad));
286 		if (err2)
287 			err = -EFAULT;
288 		break;
289 
290 	case IPC_SET:
291 		if (version == IPC_64) {
292 			err = get_compat_semid64_ds(&s64, compat_ptr(pad));
293 		} else {
294 			err = get_compat_semid_ds(&s64, compat_ptr(pad));
295 		}
296 		up64 = compat_alloc_user_space(sizeof(s64));
297 		if (copy_to_user(up64, &s64, sizeof(s64)))
298 			err = -EFAULT;
299 		if (err)
300 			break;
301 
302 		fourth = (unsigned long)up64;
303 		err = sys_semctl(first, second, third, fourth);
304 		break;
305 
306 	default:
307 		err = -EINVAL;
308 		break;
309 	}
310 	return err;
311 }
312 
compat_do_msg_fill(void __user * dest,struct msg_msg * msg,size_t bufsz)313 static long compat_do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
314 {
315 	struct compat_msgbuf __user *msgp = dest;
316 	size_t msgsz;
317 
318 	if (put_user(msg->m_type, &msgp->mtype))
319 		return -EFAULT;
320 
321 	msgsz = (bufsz > msg->m_ts) ? msg->m_ts : bufsz;
322 	if (store_msg(msgp->mtext, msg, msgsz))
323 		return -EFAULT;
324 	return msgsz;
325 }
326 
327 #ifndef COMPAT_SHMLBA
328 #define COMPAT_SHMLBA	SHMLBA
329 #endif
330 
331 #ifdef CONFIG_ARCH_WANT_OLD_COMPAT_IPC
COMPAT_SYSCALL_DEFINE6(ipc,u32,call,int,first,int,second,u32,third,compat_uptr_t,ptr,u32,fifth)332 COMPAT_SYSCALL_DEFINE6(ipc, u32, call, int, first, int, second,
333 	u32, third, compat_uptr_t, ptr, u32, fifth)
334 {
335 	int version;
336 	u32 pad;
337 
338 	version = call >> 16; /* hack for backward compatibility */
339 	call &= 0xffff;
340 
341 	switch (call) {
342 	case SEMOP:
343 		/* struct sembuf is the same on 32 and 64bit :)) */
344 		return sys_semtimedop(first, compat_ptr(ptr), second, NULL);
345 	case SEMTIMEDOP:
346 		return compat_sys_semtimedop(first, compat_ptr(ptr), second,
347 						compat_ptr(fifth));
348 	case SEMGET:
349 		return sys_semget(first, second, third);
350 	case SEMCTL:
351 		if (!ptr)
352 			return -EINVAL;
353 		if (get_user(pad, (u32 __user *) compat_ptr(ptr)))
354 			return -EFAULT;
355 		return do_compat_semctl(first, second, third, pad);
356 
357 	case MSGSND: {
358 		struct compat_msgbuf __user *up = compat_ptr(ptr);
359 		compat_long_t type;
360 
361 		if (first < 0 || second < 0)
362 			return -EINVAL;
363 
364 		if (get_user(type, &up->mtype))
365 			return -EFAULT;
366 
367 		return do_msgsnd(first, type, up->mtext, second, third);
368 	}
369 	case MSGRCV: {
370 		void __user *uptr = compat_ptr(ptr);
371 
372 		if (first < 0 || second < 0)
373 			return -EINVAL;
374 
375 		if (!version) {
376 			struct compat_ipc_kludge ipck;
377 			if (!uptr)
378 				return -EINVAL;
379 			if (copy_from_user (&ipck, uptr, sizeof(ipck)))
380 				return -EFAULT;
381 			uptr = compat_ptr(ipck.msgp);
382 			fifth = ipck.msgtyp;
383 		}
384 		return do_msgrcv(first, uptr, second, fifth, third,
385 				 compat_do_msg_fill);
386 	}
387 	case MSGGET:
388 		return sys_msgget(first, second);
389 	case MSGCTL:
390 		return compat_sys_msgctl(first, second, compat_ptr(ptr));
391 
392 	case SHMAT: {
393 		int err;
394 		unsigned long raddr;
395 
396 		if (version == 1)
397 			return -EINVAL;
398 		err = do_shmat(first, compat_ptr(ptr), second, &raddr,
399 			       COMPAT_SHMLBA);
400 		if (err < 0)
401 			return err;
402 		return put_user(raddr, (compat_ulong_t *)compat_ptr(third));
403 	}
404 	case SHMDT:
405 		return sys_shmdt(compat_ptr(ptr));
406 	case SHMGET:
407 		return sys_shmget(first, (unsigned)second, third);
408 	case SHMCTL:
409 		return compat_sys_shmctl(first, second, compat_ptr(ptr));
410 	}
411 
412 	return -ENOSYS;
413 }
414 #endif
415 
COMPAT_SYSCALL_DEFINE4(semctl,int,semid,int,semnum,int,cmd,int,arg)416 COMPAT_SYSCALL_DEFINE4(semctl, int, semid, int, semnum, int, cmd, int, arg)
417 {
418 	return do_compat_semctl(semid, semnum, cmd, arg);
419 }
420 
COMPAT_SYSCALL_DEFINE4(msgsnd,int,msqid,compat_uptr_t,msgp,compat_ssize_t,msgsz,int,msgflg)421 COMPAT_SYSCALL_DEFINE4(msgsnd, int, msqid, compat_uptr_t, msgp,
422 		       compat_ssize_t, msgsz, int, msgflg)
423 {
424 	struct compat_msgbuf __user *up = compat_ptr(msgp);
425 	compat_long_t mtype;
426 
427 	if (get_user(mtype, &up->mtype))
428 		return -EFAULT;
429 	return do_msgsnd(msqid, mtype, up->mtext, (ssize_t)msgsz, msgflg);
430 }
431 
COMPAT_SYSCALL_DEFINE5(msgrcv,int,msqid,compat_uptr_t,msgp,compat_ssize_t,msgsz,long,msgtyp,int,msgflg)432 COMPAT_SYSCALL_DEFINE5(msgrcv, int, msqid, compat_uptr_t, msgp,
433 		       compat_ssize_t, msgsz, long, msgtyp, int, msgflg)
434 {
435 	return do_msgrcv(msqid, compat_ptr(msgp), (ssize_t)msgsz, msgtyp,
436 			 msgflg, compat_do_msg_fill);
437 }
438 
get_compat_msqid64(struct msqid64_ds * m64,struct compat_msqid64_ds __user * up64)439 static inline int get_compat_msqid64(struct msqid64_ds *m64,
440 				     struct compat_msqid64_ds __user *up64)
441 {
442 	int err;
443 
444 	if (!access_ok(VERIFY_READ, up64, sizeof(*up64)))
445 		return -EFAULT;
446 	err  = __get_compat_ipc64_perm(&m64->msg_perm, &up64->msg_perm);
447 	err |= __get_user(m64->msg_qbytes, &up64->msg_qbytes);
448 	return err;
449 }
450 
get_compat_msqid(struct msqid64_ds * m,struct compat_msqid_ds __user * up)451 static inline int get_compat_msqid(struct msqid64_ds *m,
452 				   struct compat_msqid_ds __user *up)
453 {
454 	int err;
455 
456 	if (!access_ok(VERIFY_READ, up, sizeof(*up)))
457 		return -EFAULT;
458 	err  = __get_compat_ipc_perm(&m->msg_perm, &up->msg_perm);
459 	err |= __get_user(m->msg_qbytes, &up->msg_qbytes);
460 	return err;
461 }
462 
put_compat_msqid64_ds(struct msqid64_ds * m64,struct compat_msqid64_ds __user * up64)463 static inline int put_compat_msqid64_ds(struct msqid64_ds *m64,
464 				 struct compat_msqid64_ds __user *up64)
465 {
466 	int err;
467 
468 	if (!access_ok(VERIFY_WRITE, up64, sizeof(*up64)))
469 		return -EFAULT;
470 	err  = __put_compat_ipc64_perm(&m64->msg_perm, &up64->msg_perm);
471 	err |= __put_user(m64->msg_stime, &up64->msg_stime);
472 	err |= __put_user(m64->msg_rtime, &up64->msg_rtime);
473 	err |= __put_user(m64->msg_ctime, &up64->msg_ctime);
474 	err |= __put_user(m64->msg_cbytes, &up64->msg_cbytes);
475 	err |= __put_user(m64->msg_qnum, &up64->msg_qnum);
476 	err |= __put_user(m64->msg_qbytes, &up64->msg_qbytes);
477 	err |= __put_user(m64->msg_lspid, &up64->msg_lspid);
478 	err |= __put_user(m64->msg_lrpid, &up64->msg_lrpid);
479 	return err;
480 }
481 
put_compat_msqid_ds(struct msqid64_ds * m,struct compat_msqid_ds __user * up)482 static inline int put_compat_msqid_ds(struct msqid64_ds *m,
483 				      struct compat_msqid_ds __user *up)
484 {
485 	int err;
486 
487 	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)))
488 		return -EFAULT;
489 	err  = __put_compat_ipc_perm(&m->msg_perm, &up->msg_perm);
490 	err |= __put_user(m->msg_stime, &up->msg_stime);
491 	err |= __put_user(m->msg_rtime, &up->msg_rtime);
492 	err |= __put_user(m->msg_ctime, &up->msg_ctime);
493 	err |= __put_user(m->msg_cbytes, &up->msg_cbytes);
494 	err |= __put_user(m->msg_qnum, &up->msg_qnum);
495 	err |= __put_user(m->msg_qbytes, &up->msg_qbytes);
496 	err |= __put_user(m->msg_lspid, &up->msg_lspid);
497 	err |= __put_user(m->msg_lrpid, &up->msg_lrpid);
498 	return err;
499 }
500 
compat_sys_msgctl(int first,int second,void __user * uptr)501 long compat_sys_msgctl(int first, int second, void __user *uptr)
502 {
503 	int err, err2;
504 	struct msqid64_ds m64;
505 	int version = compat_ipc_parse_version(&second);
506 	void __user *p;
507 
508 	memset(&m64, 0, sizeof(m64));
509 
510 	switch (second & (~IPC_64)) {
511 	case IPC_INFO:
512 	case IPC_RMID:
513 	case MSG_INFO:
514 		err = sys_msgctl(first, second, uptr);
515 		break;
516 
517 	case IPC_SET:
518 		if (version == IPC_64) {
519 			err = get_compat_msqid64(&m64, uptr);
520 		} else {
521 			err = get_compat_msqid(&m64, uptr);
522 		}
523 		if (err)
524 			break;
525 		p = compat_alloc_user_space(sizeof(m64));
526 		if (copy_to_user(p, &m64, sizeof(m64)))
527 			err = -EFAULT;
528 		else
529 			err = sys_msgctl(first, second, p);
530 		break;
531 
532 	case IPC_STAT:
533 	case MSG_STAT:
534 		p = compat_alloc_user_space(sizeof(m64));
535 		err = sys_msgctl(first, second, p);
536 		if (err < 0)
537 			break;
538 		if (copy_from_user(&m64, p, sizeof(m64)))
539 			err2 = -EFAULT;
540 		else if (version == IPC_64)
541 			err2 = put_compat_msqid64_ds(&m64, uptr);
542 		else
543 			err2 = put_compat_msqid_ds(&m64, uptr);
544 		if (err2)
545 			err = -EFAULT;
546 		break;
547 
548 	default:
549 		err = -EINVAL;
550 		break;
551 	}
552 	return err;
553 }
554 
COMPAT_SYSCALL_DEFINE3(shmat,int,shmid,compat_uptr_t,shmaddr,int,shmflg)555 COMPAT_SYSCALL_DEFINE3(shmat, int, shmid, compat_uptr_t, shmaddr, int, shmflg)
556 {
557 	unsigned long ret;
558 	long err;
559 
560 	err = do_shmat(shmid, compat_ptr(shmaddr), shmflg, &ret, COMPAT_SHMLBA);
561 	if (err)
562 		return err;
563 	force_successful_syscall_return();
564 	return (long)ret;
565 }
566 
get_compat_shmid64_ds(struct shmid64_ds * s64,struct compat_shmid64_ds __user * up64)567 static inline int get_compat_shmid64_ds(struct shmid64_ds *s64,
568 					struct compat_shmid64_ds __user *up64)
569 {
570 	if (!access_ok(VERIFY_READ, up64, sizeof(*up64)))
571 		return -EFAULT;
572 	return __get_compat_ipc64_perm(&s64->shm_perm, &up64->shm_perm);
573 }
574 
get_compat_shmid_ds(struct shmid64_ds * s,struct compat_shmid_ds __user * up)575 static inline int get_compat_shmid_ds(struct shmid64_ds *s,
576 				      struct compat_shmid_ds __user *up)
577 {
578 	if (!access_ok(VERIFY_READ, up, sizeof(*up)))
579 		return -EFAULT;
580 	return __get_compat_ipc_perm(&s->shm_perm, &up->shm_perm);
581 }
582 
put_compat_shmid64_ds(struct shmid64_ds * s64,struct compat_shmid64_ds __user * up64)583 static inline int put_compat_shmid64_ds(struct shmid64_ds *s64,
584 					struct compat_shmid64_ds __user *up64)
585 {
586 	int err;
587 
588 	if (!access_ok(VERIFY_WRITE, up64, sizeof(*up64)))
589 		return -EFAULT;
590 	err  = __put_compat_ipc64_perm(&s64->shm_perm, &up64->shm_perm);
591 	err |= __put_user(s64->shm_atime, &up64->shm_atime);
592 	err |= __put_user(s64->shm_dtime, &up64->shm_dtime);
593 	err |= __put_user(s64->shm_ctime, &up64->shm_ctime);
594 	err |= __put_user(s64->shm_segsz, &up64->shm_segsz);
595 	err |= __put_user(s64->shm_nattch, &up64->shm_nattch);
596 	err |= __put_user(s64->shm_cpid, &up64->shm_cpid);
597 	err |= __put_user(s64->shm_lpid, &up64->shm_lpid);
598 	return err;
599 }
600 
put_compat_shmid_ds(struct shmid64_ds * s,struct compat_shmid_ds __user * up)601 static inline int put_compat_shmid_ds(struct shmid64_ds *s,
602 				      struct compat_shmid_ds __user *up)
603 {
604 	int err;
605 
606 	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)))
607 		return -EFAULT;
608 	err  = __put_compat_ipc_perm(&s->shm_perm, &up->shm_perm);
609 	err |= __put_user(s->shm_atime, &up->shm_atime);
610 	err |= __put_user(s->shm_dtime, &up->shm_dtime);
611 	err |= __put_user(s->shm_ctime, &up->shm_ctime);
612 	err |= __put_user(s->shm_segsz, &up->shm_segsz);
613 	err |= __put_user(s->shm_nattch, &up->shm_nattch);
614 	err |= __put_user(s->shm_cpid, &up->shm_cpid);
615 	err |= __put_user(s->shm_lpid, &up->shm_lpid);
616 	return err;
617 }
618 
put_compat_shminfo64(struct shminfo64 * smi,struct compat_shminfo64 __user * up64)619 static inline int put_compat_shminfo64(struct shminfo64 *smi,
620 				       struct compat_shminfo64 __user *up64)
621 {
622 	int err;
623 
624 	if (!access_ok(VERIFY_WRITE, up64, sizeof(*up64)))
625 		return -EFAULT;
626 	if (smi->shmmax > INT_MAX)
627 		smi->shmmax = INT_MAX;
628 	err  = __put_user(smi->shmmax, &up64->shmmax);
629 	err |= __put_user(smi->shmmin, &up64->shmmin);
630 	err |= __put_user(smi->shmmni, &up64->shmmni);
631 	err |= __put_user(smi->shmseg, &up64->shmseg);
632 	err |= __put_user(smi->shmall, &up64->shmall);
633 	return err;
634 }
635 
put_compat_shminfo(struct shminfo64 * smi,struct shminfo __user * up)636 static inline int put_compat_shminfo(struct shminfo64 *smi,
637 				     struct shminfo __user *up)
638 {
639 	int err;
640 
641 	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)))
642 		return -EFAULT;
643 	if (smi->shmmax > INT_MAX)
644 		smi->shmmax = INT_MAX;
645 	err  = __put_user(smi->shmmax, &up->shmmax);
646 	err |= __put_user(smi->shmmin, &up->shmmin);
647 	err |= __put_user(smi->shmmni, &up->shmmni);
648 	err |= __put_user(smi->shmseg, &up->shmseg);
649 	err |= __put_user(smi->shmall, &up->shmall);
650 	return err;
651 }
652 
put_compat_shm_info(struct shm_info __user * ip,struct compat_shm_info __user * uip)653 static inline int put_compat_shm_info(struct shm_info __user *ip,
654 				      struct compat_shm_info __user *uip)
655 {
656 	int err;
657 	struct shm_info si;
658 
659 	if (!access_ok(VERIFY_WRITE, uip, sizeof(*uip)) ||
660 	    copy_from_user(&si, ip, sizeof(si)))
661 		return -EFAULT;
662 	err  = __put_user(si.used_ids, &uip->used_ids);
663 	err |= __put_user(si.shm_tot, &uip->shm_tot);
664 	err |= __put_user(si.shm_rss, &uip->shm_rss);
665 	err |= __put_user(si.shm_swp, &uip->shm_swp);
666 	err |= __put_user(si.swap_attempts, &uip->swap_attempts);
667 	err |= __put_user(si.swap_successes, &uip->swap_successes);
668 	return err;
669 }
670 
compat_sys_shmctl(int first,int second,void __user * uptr)671 long compat_sys_shmctl(int first, int second, void __user *uptr)
672 {
673 	void __user *p;
674 	struct shmid64_ds s64;
675 	struct shminfo64 smi;
676 	int err, err2;
677 	int version = compat_ipc_parse_version(&second);
678 
679 	memset(&s64, 0, sizeof(s64));
680 
681 	switch (second & (~IPC_64)) {
682 	case IPC_RMID:
683 	case SHM_LOCK:
684 	case SHM_UNLOCK:
685 		err = sys_shmctl(first, second, uptr);
686 		break;
687 
688 	case IPC_INFO:
689 		p = compat_alloc_user_space(sizeof(smi));
690 		err = sys_shmctl(first, second, p);
691 		if (err < 0)
692 			break;
693 		if (copy_from_user(&smi, p, sizeof(smi)))
694 			err2 = -EFAULT;
695 		else if (version == IPC_64)
696 			err2 = put_compat_shminfo64(&smi, uptr);
697 		else
698 			err2 = put_compat_shminfo(&smi, uptr);
699 		if (err2)
700 			err = -EFAULT;
701 		break;
702 
703 
704 	case IPC_SET:
705 		if (version == IPC_64) {
706 			err = get_compat_shmid64_ds(&s64, uptr);
707 		} else {
708 			err = get_compat_shmid_ds(&s64, uptr);
709 		}
710 		if (err)
711 			break;
712 		p = compat_alloc_user_space(sizeof(s64));
713 		if (copy_to_user(p, &s64, sizeof(s64)))
714 			err = -EFAULT;
715 		else
716 			err = sys_shmctl(first, second, p);
717 		break;
718 
719 	case IPC_STAT:
720 	case SHM_STAT:
721 		p = compat_alloc_user_space(sizeof(s64));
722 		err = sys_shmctl(first, second, p);
723 		if (err < 0)
724 			break;
725 		if (copy_from_user(&s64, p, sizeof(s64)))
726 			err2 = -EFAULT;
727 		else if (version == IPC_64)
728 			err2 = put_compat_shmid64_ds(&s64, uptr);
729 		else
730 			err2 = put_compat_shmid_ds(&s64, uptr);
731 		if (err2)
732 			err = -EFAULT;
733 		break;
734 
735 	case SHM_INFO:
736 		p = compat_alloc_user_space(sizeof(struct shm_info));
737 		err = sys_shmctl(first, second, p);
738 		if (err < 0)
739 			break;
740 		err2 = put_compat_shm_info(p, uptr);
741 		if (err2)
742 			err = -EFAULT;
743 		break;
744 
745 	default:
746 		err = -EINVAL;
747 		break;
748 	}
749 	return err;
750 }
751 
compat_sys_semtimedop(int semid,struct sembuf __user * tsems,unsigned nsops,const struct compat_timespec __user * timeout)752 long compat_sys_semtimedop(int semid, struct sembuf __user *tsems,
753 		unsigned nsops, const struct compat_timespec __user *timeout)
754 {
755 	struct timespec __user *ts64 = NULL;
756 	if (timeout) {
757 		struct timespec ts;
758 		ts64 = compat_alloc_user_space(sizeof(*ts64));
759 		if (get_compat_timespec(&ts, timeout))
760 			return -EFAULT;
761 		if (copy_to_user(ts64, &ts, sizeof(ts)))
762 			return -EFAULT;
763 	}
764 	return sys_semtimedop(semid, tsems, nsops, ts64);
765 }
766