315 	struct msqid_kernel *msqkptr;  in msgunload()  local
327 		msqkptr = &msqids[msqid];  in msgunload()
328 		if (msqkptr->u.msg_qbytes != 0 ||  in msgunload()
329 		    (msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0)  in msgunload()
410 msq_remove(struct msqid_kernel *msqkptr)  in msq_remove()  argument
414 	racct_sub_cred(msqkptr->cred, RACCT_NMSGQ, 1);  in msq_remove()
415 	racct_sub_cred(msqkptr->cred, RACCT_MSGQQUEUED, msqkptr->u.msg_qnum);  in msq_remove()
416 	racct_sub_cred(msqkptr->cred, RACCT_MSGQSIZE, msqkptr->u.msg_cbytes);  in msq_remove()
417 	crfree(msqkptr->cred);  in msq_remove()
418 	msqkptr->cred = NULL;  in msq_remove()
421 	msghdr = msqkptr->u.__msg_first;  in msq_remove()
426 		msqkptr->u.msg_cbytes -= msghdr->msg_ts;  in msq_remove()
427 		msqkptr->u.msg_qnum--;  in msq_remove()
433 	if (msqkptr->u.msg_cbytes != 0)  in msq_remove()
435 	if (msqkptr->u.msg_qnum != 0)  in msq_remove()
438 	msqkptr->u.msg_qbytes = 0;	/* Mark it as free */  in msq_remove()
441 	mac_sysvmsq_cleanup(msqkptr);  in msq_remove()
444 	wakeup(msqkptr);  in msq_remove()
460 msq_prison_cansee(struct prison *rpr, struct msqid_kernel *msqkptr)  in msq_prison_cansee()  argument
463 	if (msqkptr->cred == NULL ||  in msq_prison_cansee()
464 	    !(rpr == msqkptr->cred->cr_prison ||  in msq_prison_cansee()
465 	      prison_ischild(rpr, msqkptr->cred->cr_prison)))  in msq_prison_cansee()
499 	struct msqid_kernel *msqkptr;  in kern_msgctl()  local
516 	msqkptr = &msqids[msqix];  in kern_msgctl()
519 	if (msqkptr->u.msg_qbytes == 0) {  in kern_msgctl()
524 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {  in kern_msgctl()
530 	error = msq_prison_cansee(rpr, msqkptr);  in kern_msgctl()
537 	error = mac_sysvmsq_check_msqctl(td->td_ucred, msqkptr, cmd);  in kern_msgctl()
551 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M)))  in kern_msgctl()
564 		for (msghdr = msqkptr->u.__msg_first; msghdr != NULL;  in kern_msgctl()
572 		msq_remove(msqkptr);  in kern_msgctl()
579 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M)))  in kern_msgctl()
581 		if (msqbuf->msg_qbytes > msqkptr->u.msg_qbytes) {  in kern_msgctl()
596 		msqkptr->u.msg_perm.uid = msqbuf->msg_perm.uid;	/* change the owner */  in kern_msgctl()
597 		msqkptr->u.msg_perm.gid = msqbuf->msg_perm.gid;	/* change the owner */  in kern_msgctl()
598 		msqkptr->u.msg_perm.mode = (msqkptr->u.msg_perm.mode & ~0777) |  in kern_msgctl()
600 		msqkptr->u.msg_qbytes = msqbuf->msg_qbytes;  in kern_msgctl()
601 		msqkptr->u.msg_ctime = time_second;  in kern_msgctl()
605 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) {  in kern_msgctl()
609 		*msqbuf = msqkptr->u;  in kern_msgctl()
610 		if (td->td_ucred->cr_prison != msqkptr->cred->cr_prison)  in kern_msgctl()
648 	struct msqid_kernel *msqkptr = NULL;  in sys_msgget()  local
658 			msqkptr = &msqids[msqid];  in sys_msgget()
659 			if (msqkptr->u.msg_qbytes != 0 &&  in sys_msgget()
660 			    msqkptr->cred != NULL &&  in sys_msgget()
661 			    msqkptr->cred->cr_prison == cred->cr_prison &&  in sys_msgget()
662 			    msqkptr->u.msg_perm.key == key)  in sys_msgget()
673 			    msqkptr->u.msg_perm));  in sys_msgget()
674 			if ((error = ipcperm(td, &msqkptr->u.msg_perm,  in sys_msgget()
681 			error = mac_sysvmsq_check_msqget(cred, msqkptr);  in sys_msgget()
698 			msqkptr = &msqids[msqid];  in sys_msgget()
699 			if (msqkptr->u.msg_qbytes == 0 &&  in sys_msgget()
700 			    (msqkptr->u.msg_perm.mode & MSG_LOCKED) == 0)  in sys_msgget()
720 		msqkptr->u.msg_perm.key = key;  in sys_msgget()
721 		msqkptr->u.msg_perm.cuid = cred->cr_uid;  in sys_msgget()
722 		msqkptr->u.msg_perm.uid = cred->cr_uid;  in sys_msgget()
723 		msqkptr->u.msg_perm.cgid = cred->cr_gid;  in sys_msgget()
724 		msqkptr->u.msg_perm.gid = cred->cr_gid;  in sys_msgget()
725 		msqkptr->u.msg_perm.mode = (msgflg & 0777);  in sys_msgget()
726 		msqkptr->cred = crhold(cred);  in sys_msgget()
728 		msqkptr->u.msg_perm.seq = (msqkptr->u.msg_perm.seq + 1) & 0x7fff;  in sys_msgget()
729 		msqkptr->u.__msg_first = NULL;  in sys_msgget()
730 		msqkptr->u.__msg_last = NULL;  in sys_msgget()
731 		msqkptr->u.msg_cbytes = 0;  in sys_msgget()
732 		msqkptr->u.msg_qnum = 0;  in sys_msgget()
733 		msqkptr->u.msg_qbytes = msginfo.msgmnb;  in sys_msgget()
734 		msqkptr->u.msg_lspid = 0;  in sys_msgget()
735 		msqkptr->u.msg_lrpid = 0;  in sys_msgget()
736 		msqkptr->u.msg_stime = 0;  in sys_msgget()
737 		msqkptr->u.msg_rtime = 0;  in sys_msgget()
738 		msqkptr->u.msg_ctime = time_second;  in sys_msgget()
740 		mac_sysvmsq_create(cred, msqkptr);  in sys_msgget()
742 		AUDIT_ARG_SVIPC_PERM(&msqkptr->u.msg_perm);  in sys_msgget()
751 	td->td_retval[0] = IXSEQ_TO_IPCID(msqid, msqkptr->u.msg_perm);  in sys_msgget()
770 	struct msqid_kernel *msqkptr;  in kern_msgsnd()  local
793 	msqkptr = &msqids[msqix];  in kern_msgsnd()
794 	AUDIT_ARG_SVIPC_PERM(&msqkptr->u.msg_perm);  in kern_msgsnd()
795 	if (msqkptr->u.msg_qbytes == 0) {  in kern_msgsnd()
800 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {  in kern_msgsnd()
806 	if ((error = msq_prison_cansee(rpr, msqkptr))) {  in kern_msgsnd()
811 	if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_W))) {  in kern_msgsnd()
817 	error = mac_sysvmsq_check_msqsnd(td->td_ucred, msqkptr);  in kern_msgsnd()
852 		if (msgsz > msqkptr->u.msg_qbytes) {  in kern_msgsnd()
858 		if (msqkptr->u.msg_perm.mode & MSG_LOCKED) {  in kern_msgsnd()
862 		if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes) {  in kern_msgsnd()
885 			if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0) {  in kern_msgsnd()
892 				msqkptr->u.msg_perm.mode |= MSG_LOCKED;  in kern_msgsnd()
896 			error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH,  in kern_msgsnd()
900 				msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;  in kern_msgsnd()
915 			if (msqkptr->u.msg_qbytes == 0) {  in kern_msgsnd()
932 	if (msqkptr->u.msg_perm.mode & MSG_LOCKED)  in kern_msgsnd()
936 	if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes)  in kern_msgsnd()
946 	if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0)  in kern_msgsnd()
948 	msqkptr->u.msg_perm.mode |= MSG_LOCKED;  in kern_msgsnd()
965 	mac_sysvmsg_create(td->td_ucred, msqkptr, msghdr);  in kern_msgsnd()
996 		msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;  in kern_msgsnd()
997 		wakeup(msqkptr);  in kern_msgsnd()
1025 			msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;  in kern_msgsnd()
1026 			wakeup(msqkptr);  in kern_msgsnd()
1041 	msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;  in kern_msgsnd()
1047 	if (msqkptr->u.msg_qbytes == 0) {  in kern_msgsnd()
1049 		wakeup(msqkptr);  in kern_msgsnd()
1066 	error = mac_sysvmsq_check_msgmsq(td->td_ucred, msghdr, msqkptr);  in kern_msgsnd()
1069 		wakeup(msqkptr);  in kern_msgsnd()
1077 	if (msqkptr->u.__msg_first == NULL) {  in kern_msgsnd()
1078 		msqkptr->u.__msg_first = msghdr;  in kern_msgsnd()
1079 		msqkptr->u.__msg_last = msghdr;  in kern_msgsnd()
1081 		msqkptr->u.__msg_last->msg_next = msghdr;  in kern_msgsnd()
1082 		msqkptr->u.__msg_last = msghdr;  in kern_msgsnd()
1084 	msqkptr->u.__msg_last->msg_next = NULL;  in kern_msgsnd()
1086 	msqkptr->u.msg_cbytes += msghdr->msg_ts;  in kern_msgsnd()
1087 	msqkptr->u.msg_qnum++;  in kern_msgsnd()
1088 	msqkptr->u.msg_lspid = td->td_proc->p_pid;  in kern_msgsnd()
1089 	msqkptr->u.msg_stime = time_second;  in kern_msgsnd()
1091 	wakeup(msqkptr);  in kern_msgsnd()
1140 	struct msqid_kernel *msqkptr;  in kern_msgrcv()  local
1159 	msqkptr = &msqids[msqix];  in kern_msgrcv()
1161 	AUDIT_ARG_SVIPC_PERM(&msqkptr->u.msg_perm);  in kern_msgrcv()
1162 	if (msqkptr->u.msg_qbytes == 0) {  in kern_msgrcv()
1167 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {  in kern_msgrcv()
1173 	if ((error = msq_prison_cansee(rpr, msqkptr))) {  in kern_msgrcv()
1178 	if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) {  in kern_msgrcv()
1184 	error = mac_sysvmsq_check_msqrcv(td->td_ucred, msqkptr);  in kern_msgrcv()
1192 			msghdr = msqkptr->u.__msg_first;  in kern_msgrcv()
1208 				if (msqkptr->u.__msg_first ==  in kern_msgrcv()
1209 				    msqkptr->u.__msg_last) {  in kern_msgrcv()
1210 					msqkptr->u.__msg_first = NULL;  in kern_msgrcv()
1211 					msqkptr->u.__msg_last = NULL;  in kern_msgrcv()
1213 					msqkptr->u.__msg_first = msghdr->msg_next;  in kern_msgrcv()
1214 					if (msqkptr->u.__msg_first == NULL)  in kern_msgrcv()
1223 			prev = &(msqkptr->u.__msg_first);  in kern_msgrcv()
1255 					if (msghdr == msqkptr->u.__msg_last) {  in kern_msgrcv()
1258 							    &msqkptr->u.__msg_first)  in kern_msgrcv()
1260 							msqkptr->u.__msg_first =  in kern_msgrcv()
1262 							msqkptr->u.__msg_last =  in kern_msgrcv()
1266 							    &msqkptr->u.__msg_first)  in kern_msgrcv()
1268 							msqkptr->u.__msg_last =  in kern_msgrcv()
1305 		error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH,  in kern_msgrcv()
1319 		if (msqkptr->u.msg_qbytes == 0 ||  in kern_msgrcv()
1320 		    msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {  in kern_msgrcv()
1333 	msqkptr->u.msg_cbytes -= msghdr->msg_ts;  in kern_msgrcv()
1334 	msqkptr->u.msg_qnum--;  in kern_msgrcv()
1335 	msqkptr->u.msg_lrpid = td->td_proc->p_pid;  in kern_msgrcv()
1336 	msqkptr->u.msg_rtime = time_second;  in kern_msgrcv()
1338 	racct_sub_cred(msqkptr->cred, RACCT_MSGQQUEUED, 1);  in kern_msgrcv()
1339 	racct_sub_cred(msqkptr->cred, RACCT_MSGQSIZE, msghdr->msg_ts);  in kern_msgrcv()
1376 			wakeup(msqkptr);  in kern_msgrcv()
1388 	wakeup(msqkptr);  in kern_msgrcv()
1689 	struct msqid_kernel *msqkptr;  in msg_prison_cleanup()  local
1695 		msqkptr = &msqids[i];  in msg_prison_cleanup()
1696 		if (msqkptr->u.msg_qbytes != 0 &&  in msg_prison_cleanup()
1697 		    msqkptr->cred != NULL && msqkptr->cred->cr_prison == pr)  in msg_prison_cleanup()
1698 			msq_remove(msqkptr);  in msg_prison_cleanup()