[PATCH] ipc/msg: align compat version-0 msqid_ds with native IPC_OLD

[PATCH] ipc/msg: align compat version-0 msqid_ds with native IPC_OLD

[Cheng Yongkang]

The compat version-0 IPC_STAT path copies the 64-bit counters into the
16-bit msg_cbytes/msg_qnum/msg_qbytes fields without clamping, and leaves
msg_lcbytes/msg_lqbytes zero.  A queue with 65536 bytes, 8 messages and
q_qbytes=200000 is reported as cbytes=0, qnum=8, qbytes=3392,
lcbytes=lqbytes=0, while the native IPC_OLD path reports the clamped
counters and the full values in the l fields.

The compat version-0 IPC_SET path reads only the 16-bit msg_qbytes and
ignores msg_lqbytes.  A caller following the old ABI with msg_qbytes=0
and msg_lqbytes=131072 gets q_qbytes=0 and the queue stops accepting
messages, while the native IPC_OLD path falls back to msg_lqbytes.

Mirror the native IPC_OLD handling in both compat version-0 branches:
clamp the counters to USHRT_MAX and fill the l fields on stat, and fall
back to msg_lqbytes when the 16-bit qbytes is zero on set.  The compat
IPC_64 branches and the native paths are unchanged.

Fixes: 4693916846269d ("msgctl(): move compat to native")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
---
 ipc/msg.c | 29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/ipc/msg.c b/ipc/msg.c
index 62996b9..71ededc 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -686,10 +686,17 @@ static int copy_compat_msqid_from_user(struct msqid64_ds *out, void __user *buf,
 			return -EFAULT;
 	} else {
 		struct compat_msqid_ds __user *p = buf;
+		compat_ulong_t qbytes;
+
 		if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm))
 			return -EFAULT;
-		if (get_user(out->msg_qbytes, &p->msg_qbytes))
+		if (get_user(qbytes, &p->msg_qbytes))
 			return -EFAULT;
+		if (qbytes == 0) {
+			if (get_user(qbytes, &p->msg_lqbytes))
+				return -EFAULT;
+		}
+		out->msg_qbytes = qbytes;
 	}
 	return 0;
 }
@@ -720,9 +727,23 @@ static int copy_compat_msqid_to_user(void __user *buf, struct msqid64_ds *in,
 		v.msg_stime = in->msg_stime;
 		v.msg_rtime = in->msg_rtime;
 		v.msg_ctime = in->msg_ctime;
-		v.msg_cbytes = in->msg_cbytes;
-		v.msg_qnum = in->msg_qnum;
-		v.msg_qbytes = in->msg_qbytes;
+		if (in->msg_cbytes > USHRT_MAX)
+			v.msg_cbytes = USHRT_MAX;
+		else
+			v.msg_cbytes = in->msg_cbytes;
+		v.msg_lcbytes = in->msg_cbytes;
+
+		if (in->msg_qnum > USHRT_MAX)
+			v.msg_qnum = USHRT_MAX;
+		else
+			v.msg_qnum = in->msg_qnum;
+
+		if (in->msg_qbytes > USHRT_MAX)
+			v.msg_qbytes = USHRT_MAX;
+		else
+			v.msg_qbytes = in->msg_qbytes;
+		v.msg_lqbytes = in->msg_qbytes;
+
 		v.msg_lspid = in->msg_lspid;
 		v.msg_lrpid = in->msg_lrpid;
 		return copy_to_user(buf, &v, sizeof(v));
-- 
2.34.1

Re: [PATCH] ipc/msg: align compat version-0 msqid_ds with native IPC_OLD

[Andrew Morton]

On Thu, 29 Oct 2026 07:12:20 -0700 Cheng Yongkang <teel4res@gmail.com> wrote:

> The compat version-0 IPC_STAT path copies the 64-bit counters into the
> 16-bit msg_cbytes/msg_qnum/msg_qbytes fields without clamping, and leaves
> msg_lcbytes/msg_lqbytes zero.  A queue with 65536 bytes, 8 messages and
> q_qbytes=200000 is reported as cbytes=0, qnum=8, qbytes=3392,
> lcbytes=lqbytes=0, while the native IPC_OLD path reports the clamped
> counters and the full values in the l fields.
> 
> The compat version-0 IPC_SET path reads only the 16-bit msg_qbytes and
> ignores msg_lqbytes.  A caller following the old ABI with msg_qbytes=0
> and msg_lqbytes=131072 gets q_qbytes=0 and the queue stops accepting
> messages, while the native IPC_OLD path falls back to msg_lqbytes.
> 
> Mirror the native IPC_OLD handling in both compat version-0 branches:
> clamp the counters to USHRT_MAX and fill the l fields on stat, and fall
> back to msg_lqbytes when the 16-bit qbytes is zero on set.  The compat
> IPC_64 branches and the native paths are unchanged.
> 

Thanks.  I had LLM poke at this and it had things to say:

: The conversion changes look right, but the Fixes tag needs correcting.
: 4693916846269d only moved the compat code. Both omissions are already
: present in 1da177e4c3f4 ("Linux-2.6.12-rc2"), the initial Git import.
: Please drop the incorrect attribution; the actual introduction predates
: that history. Keep the stable CC.
: 
: Please also coordinate this with the unsigned-long msgctl_down() fix
: from Shubhang Kaushik's "[PATCH v2] ipc/msg: prevent msg_qbytes limit
: bypass in IPC_SET".
: (https://lore.kernel.org/20261027-ipc-msg-qbytes-v2-1-48d8f72f1359@gentwo.org)
: On the current base, your new fallback lets a
: privileged old-ABI caller supply msg_lqbytes=UINT_MAX, but msgctl_down()
: still narrows that to int and installs ULONG_MAX on a 64-bit kernel.
: That downstream bug already affects other interfaces; this patch makes
: it reachable through the repaired fallback too.
: 
: The original bugs give legacy 32-bit programs wrapped queue statistics
: or unexpectedly set the queue capacity to zero. Subsequent sends then
: block or return EAGAIN with IPC_NOWAIT, even for zero-length messages.
: The ordinary capacity permission checks still apply to the long value.


> --- a/ipc/msg.c
> +++ b/ipc/msg.c
> @@ -686,10 +686,17 @@ static int copy_compat_msqid_from_user(struct msqid64_ds *out, void __user *buf,
>  			return -EFAULT;
>  	} else {
>  		struct compat_msqid_ds __user *p = buf;
> +		compat_ulong_t qbytes;
> +
>  		if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm))
>  			return -EFAULT;
> -		if (get_user(out->msg_qbytes, &p->msg_qbytes))
> +		if (get_user(qbytes, &p->msg_qbytes))
>  			return -EFAULT;
> +		if (qbytes == 0) {
> +			if (get_user(qbytes, &p->msg_lqbytes))
> +				return -EFAULT;
> +		}
> +		out->msg_qbytes = qbytes;
>  	}
>  	return 0;
>  }
> @@ -720,9 +727,23 @@ static int copy_compat_msqid_to_user(void __user *buf, struct msqid64_ds *in,
>  		v.msg_stime = in->msg_stime;
>  		v.msg_rtime = in->msg_rtime;
>  		v.msg_ctime = in->msg_ctime;
> -		v.msg_cbytes = in->msg_cbytes;
> -		v.msg_qnum = in->msg_qnum;
> -		v.msg_qbytes = in->msg_qbytes;
> +		if (in->msg_cbytes > USHRT_MAX)
> +			v.msg_cbytes = USHRT_MAX;
> +		else
> +			v.msg_cbytes = in->msg_cbytes;
> +		v.msg_lcbytes = in->msg_cbytes;
> +
> +		if (in->msg_qnum > USHRT_MAX)
> +			v.msg_qnum = USHRT_MAX;
> +		else
> +			v.msg_qnum = in->msg_qnum;
> +
> +		if (in->msg_qbytes > USHRT_MAX)
> +			v.msg_qbytes = USHRT_MAX;
> +		else
> +			v.msg_qbytes = in->msg_qbytes;
> +		v.msg_lqbytes = in->msg_qbytes;
> +
>  		v.msg_lspid = in->msg_lspid;
>  		v.msg_lrpid = in->msg_lrpid;
>  		return copy_to_user(buf, &v, sizeof(v));
> -- 
> 2.34.1

Re: [PATCH] ipc/msg: align compat version-0 msqid_ds with native IPC_OLD

[Cheng Yongkang]

Hi Andrew,

Thanks for the review.

I'll fix the Fixes tag: 4693916846269d only moved the compat code, so I'll
drop that attribution.  Both omissions are present from the initial import
(1da177e4c3f4) and predate git history.  I'll keep the stable Cc.

For the dependency, I'll hold the v2 and rebase it on Shubhang's
unsigned-long msgctl_down() fix once that lands, so the repaired compat
fallback cannot reach the int truncation.  If you would rather queue them
together, I can send the v2 on top of his patch with an explicit
dependency note.

Shubhang, please keep the unsigned-long correction in your respin.

Thanks,
Cheng Yongkang

Re: [PATCH] ipc/msg: align compat version-0 msqid_ds with native IPC_OLD

[Shubhang]

Hi Cheng Yongkang,

On Fri, 30 Oct 2026, Cheng Yongkang wrote:

> Hi Andrew,
>
> Thanks for the review.
>
> I'll fix the Fixes tag: 4693916846269d only moved the compat code, so I'll
> drop that attribution.  Both omissions are present from the initial import
> (1da177e4c3f4) and predate git history.  I'll keep the stable Cc.
>
> For the dependency, I'll hold the v2 and rebase it on Shubhang's
> unsigned-long msgctl_down() fix once that lands, so the repaired compat
> fallback cannot reach the int truncation.  If you would rather queue them
> together, I can send the v2 on top of his patch with an explicit
> dependency note.
>
> Shubhang, please keep the unsigned-long correction in your respin.
>
> Thanks,
> Cheng Yongkang
>

The unsigned-long msg_qbytes correction is retained in v3:

https://lore.kernel.org/lkml/20261029-ipc-msg-qbytes-v3-1-fc3f4307c85b@gentwo.org/

Thanks,
Shubhang Kaushik