ipc: implement MSG_COPY as a new receive mode

Teach the helper routines about MSG_COPY so that msgtyp is preserved as
the message number to copy.

The security functions affected by this change were audited and no
additional changes are necessary.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/ipc/msg.c b/ipc/msg.c
index b46473074662e05543572d1199bfadd2fbb35674..7c209b4f5e389d335b857270d21976e1fda974b1 100644 (file)
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -66,6 +66,7 @@ struct msg_sender {
 #define SEARCH_EQUAL           2
 #define SEARCH_NOTEQUAL                3
 #define SEARCH_LESSEQUAL       4
+#define SEARCH_NUMBER          5
 
 #define msg_ids(ns)    ((ns)->ids[IPC_MSG_IDS])
 
@@ -583,6 +584,7 @@ static int testmsg(struct msg_msg *msg, long type, int mode)
        switch(mode)
        {
                case SEARCH_ANY:
+               case SEARCH_NUMBER:
                        return 1;
                case SEARCH_LESSEQUAL:
                        if (msg->m_type <=type)
@@ -738,6 +740,8 @@ SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
 
 static inline int convert_mode(long *msgtyp, int msgflg)
 {
+       if (msgflg & MSG_COPY)
+               return SEARCH_NUMBER;
        /*
         *  find message of correct type.
         *  msgtyp = 0 => get first.
@@ -774,14 +778,10 @@ static long do_msg_fill(void __user *dest, struct msg_msg *msg, size_t bufsz)
  * This function creates new kernel message structure, large enough to store
  * bufsz message bytes.
  */
-static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz,
-                                          int msgflg, long *msgtyp,
-                                          unsigned long *copy_number)
+static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
 {
        struct msg_msg *copy;
 
-       *copy_number = *msgtyp;
-       *msgtyp = 0;
        /*
         * Create dummy message to copy real message to.
         */
@@ -797,9 +797,7 @@ static inline void free_copy(struct msg_msg *copy)
                free_msg(copy);
 }
 #else
-static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz,
-                                          int msgflg, long *msgtyp,
-                                          unsigned long *copy_number)
+static inline struct msg_msg *prepare_copy(void __user *buf, size_t bufsz)
 {
        return ERR_PTR(-ENOSYS);
 }
@@ -818,15 +816,13 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp,
        int mode;
        struct ipc_namespace *ns;
        struct msg_msg *copy = NULL;
-       unsigned long copy_number = 0;
 
        ns = current->nsproxy->ipc_ns;
 
        if (msqid < 0 || (long) bufsz < 0)
                return -EINVAL;
        if (msgflg & MSG_COPY) {
-               copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax),
-                                   msgflg, &msgtyp, &copy_number);
+               copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
                if (IS_ERR(copy))
                        return PTR_ERR(copy);
        }
@@ -861,8 +857,8 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp,
                                if (mode == SEARCH_LESSEQUAL &&
                                                walk_msg->m_type != 1) {
                                        msgtyp = walk_msg->m_type - 1;
-                               } else if (msgflg & MSG_COPY) {
-                                       if (copy_number == msg_counter)
+                               } else if (mode == SEARCH_NUMBER) {
+                                       if (msgtyp == msg_counter)
                                                break;
                                        msg = ERR_PTR(-EAGAIN);
                                } else