Function sysctl_msqids

freebsd/kern/sysv_msg.c:1416–1480

}

static int
sysctl_msqids(SYSCTL_HANDLER_ARGS)
{
	struct msqid_kernel tmsqk;
#ifdef COMPAT_FREEBSD32
	struct msqid_kernel32 tmsqk32;
#endif
	struct prison *pr, *rpr;
	void *outaddr;
	size_t outsize;
	int error, i;

	pr = req->td->td_ucred->cr_prison;
	rpr = msg_find_prison(req->td->td_ucred);
	error = 0;
	for (i = 0; i < msginfo.msgmni; i++) {
		mtx_lock(&msq_mtx);
		if (msqids[i].u.msg_qbytes == 0 || rpr == NULL ||
		    msq_prison_cansee(rpr, &msqids[i]) != 0)
			bzero(&tmsqk, sizeof(tmsqk));
		else {
			tmsqk = msqids[i];
			if (tmsqk.cred->cr_prison != pr)
				tmsqk.u.msg_perm.key = IPC_PRIVATE;
		}
		mtx_unlock(&msq_mtx);
#ifdef COMPAT_FREEBSD32
		if (SV_CURPROC_FLAG(SV_ILP32)) {
			bzero(&tmsqk32, sizeof(tmsqk32));
			freebsd32_ipcperm_out(&tmsqk.u.msg_perm,
			    &tmsqk32.u.msg_perm);
			/* Don't copy u.msg_first or u.msg_last */
			CP(tmsqk, tmsqk32, u.msg_cbytes);
			CP(tmsqk, tmsqk32, u.msg_qnum);
			CP(tmsqk, tmsqk32, u.msg_qbytes);
			CP(tmsqk, tmsqk32, u.msg_lspid);
			CP(tmsqk, tmsqk32, u.msg_lrpid);
			CP(tmsqk, tmsqk32, u.msg_stime);
			CP(tmsqk, tmsqk32, u.msg_rtime);
			CP(tmsqk, tmsqk32, u.msg_ctime);
			/* Don't copy label or cred */
			outaddr = &tmsqk32;
			outsize = sizeof(tmsqk32);
		} else
#endif
		{
			/* Don't leak kernel pointers */
			tmsqk.u.__msg_first = NULL;
			tmsqk.u.__msg_last = NULL;
			tmsqk.label = NULL;
			tmsqk.cred = NULL;
			/*
			 * XXX: some padding also exists, but we take care to
			 * allocate our pool of msqid_kernel structs with
			 * zeroed memory so this should be OK.
			 */
			outaddr = &tmsqk;
			outsize = sizeof(tmsqk);