120 	struct msg_queue *msq = container_of(p, struct msg_queue, q_perm);  in msg_rcu_free()  local
122 	security_msg_queue_free(&msq->q_perm);  in msg_rcu_free()
123 	kvfree(msq);  in msg_rcu_free()
135 	struct msg_queue *msq;  in newque()  local
140 	msq = kvmalloc(sizeof(*msq), GFP_KERNEL);  in newque()
141 	if (unlikely(!msq))  in newque()
144 	msq->q_perm.mode = msgflg & S_IRWXUGO;  in newque()
145 	msq->q_perm.key = key;  in newque()
147 	msq->q_perm.security = NULL;  in newque()
148 	retval = security_msg_queue_alloc(&msq->q_perm);  in newque()
150 		kvfree(msq);  in newque()
154 	msq->q_stime = msq->q_rtime = 0;  in newque()
155 	msq->q_ctime = ktime_get_real_seconds();  in newque()
156 	msq->q_cbytes = msq->q_qnum = 0;  in newque()
157 	msq->q_qbytes = ns->msg_ctlmnb;  in newque()
158 	msq->q_lspid = msq->q_lrpid = NULL;  in newque()
159 	INIT_LIST_HEAD(&msq->q_messages);  in newque()
160 	INIT_LIST_HEAD(&msq->q_receivers);  in newque()
161 	INIT_LIST_HEAD(&msq->q_senders);  in newque()
164 	retval = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);  in newque()
166 		ipc_rcu_putref(&msq->q_perm, msg_rcu_free);  in newque()
170 	ipc_unlock_object(&msq->q_perm);  in newque()
173 	return msq->q_perm.id;  in newque()
176 static inline bool msg_fits_inqueue(struct msg_queue *msq, size_t msgsz)  in msg_fits_inqueue()  argument
178 	return msgsz + msq->q_cbytes <= msq->q_qbytes &&  in msg_fits_inqueue()
179 		1 + msq->q_qnum <= msq->q_qbytes;  in msg_fits_inqueue()
182 static inline void ss_add(struct msg_queue *msq,  in ss_add()  argument
188 	list_add_tail(&mss->list, &msq->q_senders);  in ss_add()
197 static void ss_wakeup(struct msg_queue *msq,  in ss_wakeup()  argument
202 	struct list_head *h = &msq->q_senders;  in ss_wakeup()
222 		else if (!msg_fits_inqueue(msq, mss->msgsz)) {  in ss_wakeup()
226 			list_move_tail(&mss->list, &msq->q_senders);  in ss_wakeup()
234 static void expunge_all(struct msg_queue *msq, int res,  in expunge_all()  argument
239 	list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {  in expunge_all()
256 	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);  in freeque()  local
259 	expunge_all(msq, -EIDRM, &wake_q);  in freeque()
260 	ss_wakeup(msq, &wake_q, true);  in freeque()
261 	msg_rmid(ns, msq);  in freeque()
262 	ipc_unlock_object(&msq->q_perm);  in freeque()
266 	list_for_each_entry_safe(msg, t, &msq->q_messages, m_list) {  in freeque()
270 	atomic_sub(msq->q_cbytes, &ns->msg_bytes);  in freeque()
271 	ipc_update_pid(&msq->q_lspid, NULL);  in freeque()
272 	ipc_update_pid(&msq->q_lrpid, NULL);  in freeque()
273 	ipc_rcu_putref(&msq->q_perm, msg_rcu_free);  in freeque()
383 	struct msg_queue *msq;  in msgctl_down()  local
396 	msq = container_of(ipcp, struct msg_queue, q_perm);  in msgctl_down()
398 	err = security_msg_queue_msgctl(&msq->q_perm, cmd);  in msgctl_down()
404 		ipc_lock_object(&msq->q_perm);  in msgctl_down()
418 		ipc_lock_object(&msq->q_perm);  in msgctl_down()
423 		msq->q_qbytes = msqid64->msg_qbytes;  in msgctl_down()
425 		msq->q_ctime = ktime_get_real_seconds();  in msgctl_down()
430 		expunge_all(msq, -EAGAIN, &wake_q);  in msgctl_down()
435 		ss_wakeup(msq, &wake_q, false);  in msgctl_down()
436 		ipc_unlock_object(&msq->q_perm);  in msgctl_down()
447 	ipc_unlock_object(&msq->q_perm);  in msgctl_down()
494 	struct msg_queue *msq;  in msgctl_stat()  local
501 		msq = msq_obtain_object(ns, msqid);  in msgctl_stat()
502 		if (IS_ERR(msq)) {  in msgctl_stat()
503 			err = PTR_ERR(msq);  in msgctl_stat()
507 		msq = msq_obtain_object_check(ns, msqid);  in msgctl_stat()
508 		if (IS_ERR(msq)) {  in msgctl_stat()
509 			err = PTR_ERR(msq);  in msgctl_stat()
516 		audit_ipc_obj(&msq->q_perm);  in msgctl_stat()
519 		if (ipcperms(ns, &msq->q_perm, S_IRUGO))  in msgctl_stat()
523 	err = security_msg_queue_msgctl(&msq->q_perm, cmd);  in msgctl_stat()
527 	ipc_lock_object(&msq->q_perm);  in msgctl_stat()
529 	if (!ipc_valid_object(&msq->q_perm)) {  in msgctl_stat()
530 		ipc_unlock_object(&msq->q_perm);  in msgctl_stat()
535 	kernel_to_ipc64_perm(&msq->q_perm, &p->msg_perm);  in msgctl_stat()
536 	p->msg_stime  = msq->q_stime;  in msgctl_stat()
537 	p->msg_rtime  = msq->q_rtime;  in msgctl_stat()
538 	p->msg_ctime  = msq->q_ctime;  in msgctl_stat()
540 	p->msg_stime_high = msq->q_stime >> 32;  in msgctl_stat()
541 	p->msg_rtime_high = msq->q_rtime >> 32;  in msgctl_stat()
542 	p->msg_ctime_high = msq->q_ctime >> 32;  in msgctl_stat()
544 	p->msg_cbytes = msq->q_cbytes;  in msgctl_stat()
545 	p->msg_qnum   = msq->q_qnum;  in msgctl_stat()
546 	p->msg_qbytes = msq->q_qbytes;  in msgctl_stat()
547 	p->msg_lspid  = pid_vnr(msq->q_lspid);  in msgctl_stat()
548 	p->msg_lrpid  = pid_vnr(msq->q_lrpid);  in msgctl_stat()
561 		err = msq->q_perm.id;  in msgctl_stat()
564 	ipc_unlock_object(&msq->q_perm);  in msgctl_stat()
788 static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg,  in pipelined_send()  argument
793 	list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) {  in pipelined_send()
795 		    !security_msg_queue_msgrcv(&msq->q_perm, msg, msr->r_tsk,  in pipelined_send()
803 				ipc_update_pid(&msq->q_lrpid, task_pid(msr->r_tsk));  in pipelined_send()
804 				msq->q_rtime = ktime_get_real_seconds();  in pipelined_send()
819 	struct msg_queue *msq;  in do_msgsnd()  local
840 	msq = msq_obtain_object_check(ns, msqid);  in do_msgsnd()
841 	if (IS_ERR(msq)) {  in do_msgsnd()
842 		err = PTR_ERR(msq);  in do_msgsnd()
846 	ipc_lock_object(&msq->q_perm);  in do_msgsnd()
852 		if (ipcperms(ns, &msq->q_perm, S_IWUGO))  in do_msgsnd()
856 		if (!ipc_valid_object(&msq->q_perm)) {  in do_msgsnd()
861 		err = security_msg_queue_msgsnd(&msq->q_perm, msg, msgflg);  in do_msgsnd()
865 		if (msg_fits_inqueue(msq, msgsz))  in do_msgsnd()
875 		ss_add(msq, &s, msgsz);  in do_msgsnd()
877 		if (!ipc_rcu_getref(&msq->q_perm)) {  in do_msgsnd()
882 		ipc_unlock_object(&msq->q_perm);  in do_msgsnd()
887 		ipc_lock_object(&msq->q_perm);  in do_msgsnd()
889 		ipc_rcu_putref(&msq->q_perm, msg_rcu_free);  in do_msgsnd()
891 		if (!ipc_valid_object(&msq->q_perm)) {  in do_msgsnd()
904 	ipc_update_pid(&msq->q_lspid, task_tgid(current));  in do_msgsnd()
905 	msq->q_stime = ktime_get_real_seconds();  in do_msgsnd()
907 	if (!pipelined_send(msq, msg, &wake_q)) {  in do_msgsnd()
909 		list_add_tail(&msg->m_list, &msq->q_messages);  in do_msgsnd()
910 		msq->q_cbytes += msgsz;  in do_msgsnd()
911 		msq->q_qnum++;  in do_msgsnd()
920 	ipc_unlock_object(&msq->q_perm);  in do_msgsnd()
1042 static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)  in find_msg()  argument
1047 	list_for_each_entry(msg, &msq->q_messages, m_list) {  in find_msg()
1049 		    !security_msg_queue_msgrcv(&msq->q_perm, msg, current,  in find_msg()
1070 	struct msg_queue *msq;  in do_msgrcv()  local
1090 	msq = msq_obtain_object_check(ns, msqid);  in do_msgrcv()
1091 	if (IS_ERR(msq)) {  in do_msgrcv()
1094 		return PTR_ERR(msq);  in do_msgrcv()
1101 		if (ipcperms(ns, &msq->q_perm, S_IRUGO))  in do_msgrcv()
1104 		ipc_lock_object(&msq->q_perm);  in do_msgrcv()
1107 		if (!ipc_valid_object(&msq->q_perm)) {  in do_msgrcv()
1112 		msg = find_msg(msq, &msgtyp, mode);  in do_msgrcv()
1132 			msq->q_qnum--;  in do_msgrcv()
1133 			msq->q_rtime = ktime_get_real_seconds();  in do_msgrcv()
1134 			ipc_update_pid(&msq->q_lrpid, task_tgid(current));  in do_msgrcv()
1135 			msq->q_cbytes -= msg->m_ts;  in do_msgrcv()
1138 			ss_wakeup(msq, &wake_q, false);  in do_msgrcv()
1149 		list_add_tail(&msr_d.r_list, &msq->q_receivers);  in do_msgrcv()
1160 		ipc_unlock_object(&msq->q_perm);  in do_msgrcv()
1193 		ipc_lock_object(&msq->q_perm);  in do_msgrcv()
1205 		ipc_unlock_object(&msq->q_perm);  in do_msgrcv()
1209 	ipc_unlock_object(&msq->q_perm);  in do_msgrcv()
1292 	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);  in sysvipc_msg_proc_show()  local
1296 		   msq->q_perm.key,  in sysvipc_msg_proc_show()
1297 		   msq->q_perm.id,  in sysvipc_msg_proc_show()
1298 		   msq->q_perm.mode,  in sysvipc_msg_proc_show()
1299 		   msq->q_cbytes,  in sysvipc_msg_proc_show()
1300 		   msq->q_qnum,  in sysvipc_msg_proc_show()
1301 		   pid_nr_ns(msq->q_lspid, pid_ns),  in sysvipc_msg_proc_show()
1302 		   pid_nr_ns(msq->q_lrpid, pid_ns),  in sysvipc_msg_proc_show()
1303 		   from_kuid_munged(user_ns, msq->q_perm.uid),  in sysvipc_msg_proc_show()
1304 		   from_kgid_munged(user_ns, msq->q_perm.gid),  in sysvipc_msg_proc_show()
1305 		   from_kuid_munged(user_ns, msq->q_perm.cuid),  in sysvipc_msg_proc_show()
1306 		   from_kgid_munged(user_ns, msq->q_perm.cgid),  in sysvipc_msg_proc_show()
1307 		   msq->q_stime,  in sysvipc_msg_proc_show()
1308 		   msq->q_rtime,  in sysvipc_msg_proc_show()
1309 		   msq->q_ctime);  in sysvipc_msg_proc_show()