diff options
| -rw-r--r-- | ipc/msg.c | 51 | ||||
| -rw-r--r-- | ipc/sem.c | 40 | ||||
| -rw-r--r-- | ipc/shm.c | 41 |
3 files changed, 46 insertions, 86 deletions
diff --git a/ipc/msg.c b/ipc/msg.c index 9d868b3d3329..80375bf43d7b 100644 --- a/ipc/msg.c +++ b/ipc/msg.c @@ -388,31 +388,14 @@ copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version) } } -struct msq_setbuf { - unsigned long qbytes; - uid_t uid; - gid_t gid; - mode_t mode; -}; - static inline unsigned long -copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version) +copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version) { switch(version) { case IPC_64: - { - struct msqid64_ds tbuf; - - if (copy_from_user(&tbuf, buf, sizeof(tbuf))) + if (copy_from_user(out, buf, sizeof(*out))) return -EFAULT; - - out->qbytes = tbuf.msg_qbytes; - out->uid = tbuf.msg_perm.uid; - out->gid = tbuf.msg_perm.gid; - out->mode = tbuf.msg_perm.mode; - return 0; - } case IPC_OLD: { struct msqid_ds tbuf_old; @@ -420,14 +403,14 @@ copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version) if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old))) return -EFAULT; - out->uid = tbuf_old.msg_perm.uid; - out->gid = tbuf_old.msg_perm.gid; - out->mode = tbuf_old.msg_perm.mode; + out->msg_perm.uid = tbuf_old.msg_perm.uid; + out->msg_perm.gid = tbuf_old.msg_perm.gid; + out->msg_perm.mode = tbuf_old.msg_perm.mode; if (tbuf_old.msg_qbytes == 0) - out->qbytes = tbuf_old.msg_lqbytes; + out->msg_qbytes = tbuf_old.msg_lqbytes; else - out->qbytes = tbuf_old.msg_qbytes; + out->msg_qbytes = tbuf_old.msg_qbytes; return 0; } @@ -445,12 +428,12 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd, struct msqid_ds __user *buf, int version) { struct kern_ipc_perm *ipcp; - struct msq_setbuf setbuf; + struct msqid64_ds msqid64; struct msg_queue *msq; int err; if (cmd == IPC_SET) { - if (copy_msqid_from_user(&setbuf, buf, version)) + if (copy_msqid_from_user(&msqid64, buf, version)) return -EFAULT; } @@ -468,8 +451,10 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd, goto out_unlock; if (cmd == IPC_SET) { - err = audit_ipc_set_perm(setbuf.qbytes, setbuf.uid, setbuf.gid, - setbuf.mode); + err = audit_ipc_set_perm(msqid64.msg_qbytes, + msqid64.msg_perm.uid, + msqid64.msg_perm.gid, + msqid64.msg_perm.mode); if (err) goto out_unlock; } @@ -491,18 +476,18 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd, freeque(ns, ipcp); goto out_up; case IPC_SET: - if (setbuf.qbytes > ns->msg_ctlmnb && + if (msqid64.msg_qbytes > ns->msg_ctlmnb && !capable(CAP_SYS_RESOURCE)) { err = -EPERM; goto out_unlock; } - msq->q_qbytes = setbuf.qbytes; + msq->q_qbytes = msqid64.msg_qbytes; - ipcp->uid = setbuf.uid; - ipcp->gid = setbuf.gid; + ipcp->uid = msqid64.msg_perm.uid; + ipcp->gid = msqid64.msg_perm.gid; ipcp->mode = (ipcp->mode & ~S_IRWXUGO) | - (S_IRWXUGO & setbuf.mode); + (S_IRWXUGO & msqid64.msg_perm.mode); msq->q_ctime = get_seconds(); /* sleeping receivers might be excluded by * stricter permissions. diff --git a/ipc/sem.c b/ipc/sem.c index db161decb764..df98de290475 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -835,28 +835,14 @@ out_free: return err; } -struct sem_setbuf { - uid_t uid; - gid_t gid; - mode_t mode; -}; - -static inline unsigned long copy_semid_from_user(struct sem_setbuf *out, void __user *buf, int version) +static inline unsigned long +copy_semid_from_user(struct semid64_ds *out, void __user *buf, int version) { switch(version) { case IPC_64: - { - struct semid64_ds tbuf; - - if(copy_from_user(&tbuf, buf, sizeof(tbuf))) + if (copy_from_user(out, buf, sizeof(*out))) return -EFAULT; - - out->uid = tbuf.sem_perm.uid; - out->gid = tbuf.sem_perm.gid; - out->mode = tbuf.sem_perm.mode; - return 0; - } case IPC_OLD: { struct semid_ds tbuf_old; @@ -864,9 +850,9 @@ static inline unsigned long copy_semid_from_user(struct sem_setbuf *out, void __ if(copy_from_user(&tbuf_old, buf, sizeof(tbuf_old))) return -EFAULT; - out->uid = tbuf_old.sem_perm.uid; - out->gid = tbuf_old.sem_perm.gid; - out->mode = tbuf_old.sem_perm.mode; + out->sem_perm.uid = tbuf_old.sem_perm.uid; + out->sem_perm.gid = tbuf_old.sem_perm.gid; + out->sem_perm.mode = tbuf_old.sem_perm.mode; return 0; } @@ -885,11 +871,11 @@ static int semctl_down(struct ipc_namespace *ns, int semid, { struct sem_array *sma; int err; - struct sem_setbuf uninitialized_var(setbuf); + struct semid64_ds semid64; struct kern_ipc_perm *ipcp; if(cmd == IPC_SET) { - if(copy_semid_from_user (&setbuf, arg.buf, version)) + if (copy_semid_from_user(&semid64, arg.buf, version)) return -EFAULT; } down_write(&sem_ids(ns).rw_mutex); @@ -906,7 +892,9 @@ static int semctl_down(struct ipc_namespace *ns, int semid, goto out_unlock; if (cmd == IPC_SET) { - err = audit_ipc_set_perm(0, setbuf.uid, setbuf.gid, setbuf.mode); + err = audit_ipc_set_perm(0, semid64.sem_perm.uid, + semid64.sem_perm.gid, + semid64.sem_perm.mode); if (err) goto out_unlock; } @@ -925,10 +913,10 @@ static int semctl_down(struct ipc_namespace *ns, int semid, freeary(ns, ipcp); goto out_up; case IPC_SET: - ipcp->uid = setbuf.uid; - ipcp->gid = setbuf.gid; + ipcp->uid = semid64.sem_perm.uid; + ipcp->gid = semid64.sem_perm.gid; ipcp->mode = (ipcp->mode & ~S_IRWXUGO) - | (setbuf.mode & S_IRWXUGO); + | (semid64.sem_perm.mode & S_IRWXUGO); sma->sem_ctime = get_seconds(); break; default: diff --git a/ipc/shm.c b/ipc/shm.c index 65a44bcc4ac2..5e296b04bd6b 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -511,28 +511,14 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ } } -struct shm_setbuf { - uid_t uid; - gid_t gid; - mode_t mode; -}; - -static inline unsigned long copy_shmid_from_user(struct shm_setbuf *out, void __user *buf, int version) +static inline unsigned long +copy_shmid_from_user(struct shmid64_ds *out, void __user *buf, int version) { switch(version) { case IPC_64: - { - struct shmid64_ds tbuf; - - if (copy_from_user(&tbuf, buf, sizeof(tbuf))) + if (copy_from_user(out, buf, sizeof(*out))) return -EFAULT; - - out->uid = tbuf.shm_perm.uid; - out->gid = tbuf.shm_perm.gid; - out->mode = tbuf.shm_perm.mode; - return 0; - } case IPC_OLD: { struct shmid_ds tbuf_old; @@ -540,9 +526,9 @@ static inline unsigned long copy_shmid_from_user(struct shm_setbuf *out, void __ if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old))) return -EFAULT; - out->uid = tbuf_old.shm_perm.uid; - out->gid = tbuf_old.shm_perm.gid; - out->mode = tbuf_old.shm_perm.mode; + out->shm_perm.uid = tbuf_old.shm_perm.uid; + out->shm_perm.gid = tbuf_old.shm_perm.gid; + out->shm_perm.mode = tbuf_old.shm_perm.mode; return 0; } @@ -625,12 +611,12 @@ static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd, struct shmid_ds __user *buf, int version) { struct kern_ipc_perm *ipcp; - struct shm_setbuf setbuf; + struct shmid64_ds shmid64; struct shmid_kernel *shp; int err; if (cmd == IPC_SET) { - if (copy_shmid_from_user(&setbuf, buf, version)) + if (copy_shmid_from_user(&shmid64, buf, version)) return -EFAULT; } @@ -648,8 +634,9 @@ static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd, goto out_unlock; if (cmd == IPC_SET) { - err = audit_ipc_set_perm(0, setbuf.uid, - setbuf.gid, setbuf.mode); + err = audit_ipc_set_perm(0, shmid64.shm_perm.uid, + shmid64.shm_perm.gid, + shmid64.shm_perm.mode); if (err) goto out_unlock; } @@ -669,10 +656,10 @@ static int shmctl_down(struct ipc_namespace *ns, int shmid, int cmd, do_shm_rmid(ns, ipcp); goto out_up; case IPC_SET: - ipcp->uid = setbuf.uid; - ipcp->gid = setbuf.gid; + ipcp->uid = shmid64.shm_perm.uid; + ipcp->gid = shmid64.shm_perm.gid; ipcp->mode = (ipcp->mode & ~S_IRWXUGO) - | (setbuf.mode & S_IRWXUGO); + | (shmid64.shm_perm.mode & S_IRWXUGO); shp->shm_ctim = get_seconds(); break; default: |
