108 static void msg_freehdr(struct msg *msghdr);
387 msg_freehdr(struct msg *msghdr)  in msg_freehdr()  argument
389 	while (msghdr->msg_ts > 0) {  in msg_freehdr()
391 		if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg)  in msg_freehdr()
393 		next = msgmaps[msghdr->msg_spot].next;  in msg_freehdr()
394 		msgmaps[msghdr->msg_spot].next = free_msgmaps;  in msg_freehdr()
395 		free_msgmaps = msghdr->msg_spot;  in msg_freehdr()
397 		msghdr->msg_spot = next;  in msg_freehdr()
398 		if (msghdr->msg_ts >= msginfo.msgssz)  in msg_freehdr()
399 			msghdr->msg_ts -= msginfo.msgssz;  in msg_freehdr()
401 			msghdr->msg_ts = 0;  in msg_freehdr()
403 	if (msghdr->msg_spot != -1)  in msg_freehdr()
405 	msghdr->msg_next = free_msghdrs;  in msg_freehdr()
406 	free_msghdrs = msghdr;  in msg_freehdr()
408 	mac_sysvmsg_cleanup(msghdr);  in msg_freehdr()
415 	struct msg *msghdr;  in msq_remove()  local
424 	msghdr = msqkptr->u.__msg_first;  in msq_remove()
425 	while (msghdr != NULL) {  in msq_remove()
429 		msqkptr->u.msg_cbytes -= msghdr->msg_ts;  in msq_remove()
431 		msghdr_tmp = msghdr;  in msq_remove()
432 		msghdr = msghdr->msg_next;  in msq_remove()
552 		struct msg *msghdr;  in kern_msgctl()  local
567 		for (msghdr = msqkptr->u.__msg_first; msghdr != NULL;  in kern_msgctl()
568 		    msghdr = msghdr->msg_next) {  in kern_msgctl()
569 			error = mac_sysvmsq_check_msgrmid(td->td_ucred, msghdr);  in kern_msgctl()
774 	struct msg *msghdr;  in kern_msgsnd()  local
957 	msghdr = free_msghdrs;  in kern_msgsnd()
958 	free_msghdrs = msghdr->msg_next;  in kern_msgsnd()
959 	msghdr->msg_spot = -1;  in kern_msgsnd()
960 	msghdr->msg_ts = msgsz;  in kern_msgsnd()
961 	msghdr->msg_type = mtype;  in kern_msgsnd()
968 	mac_sysvmsg_create(td->td_ucred, msqkptr, msghdr);  in kern_msgsnd()
988 		msgmaps[next].next = msghdr->msg_spot;  in kern_msgsnd()
989 		msghdr->msg_spot = next;  in kern_msgsnd()
997 	if (msghdr->msg_type < 1) {  in kern_msgsnd()
998 		msg_freehdr(msghdr);  in kern_msgsnd()
1001 		DPRINTF(("mtype (%ld) < 1\n", msghdr->msg_type));  in kern_msgsnd()
1010 	next = msghdr->msg_spot;  in kern_msgsnd()
1027 			msg_freehdr(msghdr);  in kern_msgsnd()
1051 		msg_freehdr(msghdr);  in kern_msgsnd()
1069 	error = mac_sysvmsq_check_msgmsq(td->td_ucred, msghdr, msqkptr);  in kern_msgsnd()
1071 		msg_freehdr(msghdr);  in kern_msgsnd()
1081 		msqkptr->u.__msg_first = msghdr;  in kern_msgsnd()
1082 		msqkptr->u.__msg_last = msghdr;  in kern_msgsnd()
1084 		msqkptr->u.__msg_last->msg_next = msghdr;  in kern_msgsnd()
1085 		msqkptr->u.__msg_last = msghdr;  in kern_msgsnd()
1089 	msqkptr->u.msg_cbytes += msghdr->msg_ts;  in kern_msgsnd()
1144 	struct msg *msghdr;  in kern_msgrcv()  local
1192 	msghdr = NULL;  in kern_msgrcv()
1193 	while (msghdr == NULL) {  in kern_msgrcv()
1195 			msghdr = msqkptr->u.__msg_first;  in kern_msgrcv()
1196 			if (msghdr != NULL) {  in kern_msgrcv()
1197 				if (msgsz < msghdr->msg_ts &&  in kern_msgrcv()
1201 					    msgsz, msghdr->msg_ts));  in kern_msgrcv()
1207 				    msghdr);  in kern_msgrcv()
1216 					msqkptr->u.__msg_first = msghdr->msg_next;  in kern_msgrcv()
1227 			while ((msghdr = *prev) != NULL) {  in kern_msgrcv()
1237 				if (msgtyp == msghdr->msg_type ||  in kern_msgrcv()
1238 				    msghdr->msg_type <= -msgtyp) {  in kern_msgrcv()
1241 					    msghdr->msg_type, msgtyp));  in kern_msgrcv()
1242 					if (msgsz < msghdr->msg_ts &&  in kern_msgrcv()
1247 						    msgsz, msghdr->msg_ts));  in kern_msgrcv()
1253 					    td->td_ucred, msghdr);  in kern_msgrcv()
1257 					*prev = msghdr->msg_next;  in kern_msgrcv()
1258 					if (msghdr == msqkptr->u.__msg_last) {  in kern_msgrcv()
1277 				previous = msghdr;  in kern_msgrcv()
1278 				prev = &(msghdr->msg_next);  in kern_msgrcv()
1288 		if (msghdr != NULL)  in kern_msgrcv()
1336 	msqkptr->u.msg_cbytes -= msghdr->msg_ts;  in kern_msgrcv()
1342 	racct_sub_cred(msqkptr->cred, RACCT_MSGQSIZE, msghdr->msg_ts);  in kern_msgrcv()
1351 	    msghdr->msg_ts));  in kern_msgrcv()
1352 	if (msgsz > msghdr->msg_ts)  in kern_msgrcv()
1353 		msgsz = msghdr->msg_ts;  in kern_msgrcv()
1354 	*mtype = msghdr->msg_type;  in kern_msgrcv()
1360 	next = msghdr->msg_spot;  in kern_msgrcv()
1378 			msg_freehdr(msghdr);  in kern_msgrcv()
1390 	msg_freehdr(msghdr);  in kern_msgrcv()