xref: /linux/ipc/mqueue.c (revision 50069a5851323ba5def0e414a21e234345016870)
1 /*
2  * POSIX message queues filesystem for Linux.
3  *
4  * Copyright (C) 2003,2004  Krzysztof Benedyczak    (golbi@mat.uni.torun.pl)
5  *                          Michal Wronski          (michal.wronski@gmail.com)
6  *
7  * Spinlocks:               Mohamed Abbas           (abbas.mohamed@intel.com)
8  * Lockless receive & send, fd based notify:
9  * 			    Manfred Spraul	    (manfred@colorfullife.com)
10  *
11  * Audit:                   George Wilson           (ltcgcw@us.ibm.com)
12  *
13  * This file is released under the GPL.
14  */
15 
16 #include <linux/capability.h>
17 #include <linux/init.h>
18 #include <linux/pagemap.h>
19 #include <linux/file.h>
20 #include <linux/mount.h>
21 #include <linux/namei.h>
22 #include <linux/sysctl.h>
23 #include <linux/poll.h>
24 #include <linux/mqueue.h>
25 #include <linux/msg.h>
26 #include <linux/skbuff.h>
27 #include <linux/vmalloc.h>
28 #include <linux/netlink.h>
29 #include <linux/syscalls.h>
30 #include <linux/audit.h>
31 #include <linux/signal.h>
32 #include <linux/mutex.h>
33 #include <linux/nsproxy.h>
34 #include <linux/pid.h>
35 #include <linux/ipc_namespace.h>
36 #include <linux/user_namespace.h>
37 #include <linux/slab.h>
38 
39 #include <net/sock.h>
40 #include "util.h"
41 
42 #define MQUEUE_MAGIC	0x19800202
43 #define DIRENT_SIZE	20
44 #define FILENT_SIZE	80
45 
46 #define SEND		0
47 #define RECV		1
48 
49 #define STATE_NONE	0
50 #define STATE_PENDING	1
51 #define STATE_READY	2
52 
53 struct ext_wait_queue {		/* queue of sleeping tasks */
54 	struct task_struct *task;
55 	struct list_head list;
56 	struct msg_msg *msg;	/* ptr of loaded message */
57 	int state;		/* one of STATE_* values */
58 };
59 
60 struct mqueue_inode_info {
61 	spinlock_t lock;
62 	struct inode vfs_inode;
63 	wait_queue_head_t wait_q;
64 
65 	struct msg_msg **messages;
66 	struct mq_attr attr;
67 
68 	struct sigevent notify;
69 	struct pid* notify_owner;
70 	struct user_namespace *notify_user_ns;
71 	struct user_struct *user;	/* user who created, for accounting */
72 	struct sock *notify_sock;
73 	struct sk_buff *notify_cookie;
74 
75 	/* for tasks waiting for free space and messages, respectively */
76 	struct ext_wait_queue e_wait_q[2];
77 
78 	unsigned long qsize; /* size of queue in memory (sum of all msgs) */
79 };
80 
81 static const struct inode_operations mqueue_dir_inode_operations;
82 static const struct file_operations mqueue_file_operations;
83 static const struct super_operations mqueue_super_ops;
84 static void remove_notification(struct mqueue_inode_info *info);
85 
86 static struct kmem_cache *mqueue_inode_cachep;
87 
88 static struct ctl_table_header * mq_sysctl_table;
89 
90 static inline struct mqueue_inode_info *MQUEUE_I(struct inode *inode)
91 {
92 	return container_of(inode, struct mqueue_inode_info, vfs_inode);
93 }
94 
95 /*
96  * This routine should be called with the mq_lock held.
97  */
98 static inline struct ipc_namespace *__get_ns_from_inode(struct inode *inode)
99 {
100 	return get_ipc_ns(inode->i_sb->s_fs_info);
101 }
102 
103 static struct ipc_namespace *get_ns_from_inode(struct inode *inode)
104 {
105 	struct ipc_namespace *ns;
106 
107 	spin_lock(&mq_lock);
108 	ns = __get_ns_from_inode(inode);
109 	spin_unlock(&mq_lock);
110 	return ns;
111 }
112 
113 static struct inode *mqueue_get_inode(struct super_block *sb,
114 		struct ipc_namespace *ipc_ns, umode_t mode,
115 		struct mq_attr *attr)
116 {
117 	struct user_struct *u = current_user();
118 	struct inode *inode;
119 	int ret = -ENOMEM;
120 
121 	inode = new_inode(sb);
122 	if (!inode)
123 		goto err;
124 
125 	inode->i_ino = get_next_ino();
126 	inode->i_mode = mode;
127 	inode->i_uid = current_fsuid();
128 	inode->i_gid = current_fsgid();
129 	inode->i_mtime = inode->i_ctime = inode->i_atime = CURRENT_TIME;
130 
131 	if (S_ISREG(mode)) {
132 		struct mqueue_inode_info *info;
133 		unsigned long mq_bytes, mq_msg_tblsz;
134 
135 		inode->i_fop = &mqueue_file_operations;
136 		inode->i_size = FILENT_SIZE;
137 		/* mqueue specific info */
138 		info = MQUEUE_I(inode);
139 		spin_lock_init(&info->lock);
140 		init_waitqueue_head(&info->wait_q);
141 		INIT_LIST_HEAD(&info->e_wait_q[0].list);
142 		INIT_LIST_HEAD(&info->e_wait_q[1].list);
143 		info->notify_owner = NULL;
144 		info->notify_user_ns = NULL;
145 		info->qsize = 0;
146 		info->user = NULL;	/* set when all is ok */
147 		memset(&info->attr, 0, sizeof(info->attr));
148 		info->attr.mq_maxmsg = min(ipc_ns->mq_msg_max,
149 					   ipc_ns->mq_msg_default);
150 		info->attr.mq_msgsize = min(ipc_ns->mq_msgsize_max,
151 					    ipc_ns->mq_msgsize_default);
152 		if (attr) {
153 			info->attr.mq_maxmsg = attr->mq_maxmsg;
154 			info->attr.mq_msgsize = attr->mq_msgsize;
155 		}
156 		mq_msg_tblsz = info->attr.mq_maxmsg * sizeof(struct msg_msg *);
157 		if (mq_msg_tblsz > PAGE_SIZE)
158 			info->messages = vmalloc(mq_msg_tblsz);
159 		else
160 			info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL);
161 		if (!info->messages)
162 			goto out_inode;
163 
164 		mq_bytes = (mq_msg_tblsz +
165 			(info->attr.mq_maxmsg * info->attr.mq_msgsize));
166 
167 		spin_lock(&mq_lock);
168 		if (u->mq_bytes + mq_bytes < u->mq_bytes ||
169 		    u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE)) {
170 			spin_unlock(&mq_lock);
171 			/* mqueue_evict_inode() releases info->messages */
172 			ret = -EMFILE;
173 			goto out_inode;
174 		}
175 		u->mq_bytes += mq_bytes;
176 		spin_unlock(&mq_lock);
177 
178 		/* all is ok */
179 		info->user = get_uid(u);
180 	} else if (S_ISDIR(mode)) {
181 		inc_nlink(inode);
182 		/* Some things misbehave if size == 0 on a directory */
183 		inode->i_size = 2 * DIRENT_SIZE;
184 		inode->i_op = &mqueue_dir_inode_operations;
185 		inode->i_fop = &simple_dir_operations;
186 	}
187 
188 	return inode;
189 out_inode:
190 	iput(inode);
191 err:
192 	return ERR_PTR(ret);
193 }
194 
195 static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
196 {
197 	struct inode *inode;
198 	struct ipc_namespace *ns = data;
199 
200 	sb->s_blocksize = PAGE_CACHE_SIZE;
201 	sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
202 	sb->s_magic = MQUEUE_MAGIC;
203 	sb->s_op = &mqueue_super_ops;
204 
205 	inode = mqueue_get_inode(sb, ns, S_IFDIR | S_ISVTX | S_IRWXUGO, NULL);
206 	if (IS_ERR(inode))
207 		return PTR_ERR(inode);
208 
209 	sb->s_root = d_make_root(inode);
210 	if (!sb->s_root)
211 		return -ENOMEM;
212 	return 0;
213 }
214 
215 static struct dentry *mqueue_mount(struct file_system_type *fs_type,
216 			 int flags, const char *dev_name,
217 			 void *data)
218 {
219 	if (!(flags & MS_KERNMOUNT))
220 		data = current->nsproxy->ipc_ns;
221 	return mount_ns(fs_type, flags, data, mqueue_fill_super);
222 }
223 
224 static void init_once(void *foo)
225 {
226 	struct mqueue_inode_info *p = (struct mqueue_inode_info *) foo;
227 
228 	inode_init_once(&p->vfs_inode);
229 }
230 
231 static struct inode *mqueue_alloc_inode(struct super_block *sb)
232 {
233 	struct mqueue_inode_info *ei;
234 
235 	ei = kmem_cache_alloc(mqueue_inode_cachep, GFP_KERNEL);
236 	if (!ei)
237 		return NULL;
238 	return &ei->vfs_inode;
239 }
240 
241 static void mqueue_i_callback(struct rcu_head *head)
242 {
243 	struct inode *inode = container_of(head, struct inode, i_rcu);
244 	kmem_cache_free(mqueue_inode_cachep, MQUEUE_I(inode));
245 }
246 
247 static void mqueue_destroy_inode(struct inode *inode)
248 {
249 	call_rcu(&inode->i_rcu, mqueue_i_callback);
250 }
251 
252 static void mqueue_evict_inode(struct inode *inode)
253 {
254 	struct mqueue_inode_info *info;
255 	struct user_struct *user;
256 	unsigned long mq_bytes;
257 	int i;
258 	struct ipc_namespace *ipc_ns;
259 
260 	clear_inode(inode);
261 
262 	if (S_ISDIR(inode->i_mode))
263 		return;
264 
265 	ipc_ns = get_ns_from_inode(inode);
266 	info = MQUEUE_I(inode);
267 	spin_lock(&info->lock);
268 	for (i = 0; i < info->attr.mq_curmsgs; i++)
269 		free_msg(info->messages[i]);
270 	if (is_vmalloc_addr(info->messages))
271 		vfree(info->messages);
272 	else
273 		kfree(info->messages);
274 	spin_unlock(&info->lock);
275 
276 	/* Total amount of bytes accounted for the mqueue */
277 	mq_bytes = info->attr.mq_maxmsg * (sizeof(struct msg_msg *)
278 	    + info->attr.mq_msgsize);
279 	user = info->user;
280 	if (user) {
281 		spin_lock(&mq_lock);
282 		user->mq_bytes -= mq_bytes;
283 		/*
284 		 * get_ns_from_inode() ensures that the
285 		 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
286 		 * to which we now hold a reference, or it is NULL.
287 		 * We can't put it here under mq_lock, though.
288 		 */
289 		if (ipc_ns)
290 			ipc_ns->mq_queues_count--;
291 		spin_unlock(&mq_lock);
292 		free_uid(user);
293 	}
294 	if (ipc_ns)
295 		put_ipc_ns(ipc_ns);
296 }
297 
298 static int mqueue_create(struct inode *dir, struct dentry *dentry,
299 				umode_t mode, struct nameidata *nd)
300 {
301 	struct inode *inode;
302 	struct mq_attr *attr = dentry->d_fsdata;
303 	int error;
304 	struct ipc_namespace *ipc_ns;
305 
306 	spin_lock(&mq_lock);
307 	ipc_ns = __get_ns_from_inode(dir);
308 	if (!ipc_ns) {
309 		error = -EACCES;
310 		goto out_unlock;
311 	}
312 	if (ipc_ns->mq_queues_count >= HARD_QUEUESMAX ||
313 	    (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&
314 	     !capable(CAP_SYS_RESOURCE))) {
315 		error = -ENOSPC;
316 		goto out_unlock;
317 	}
318 	ipc_ns->mq_queues_count++;
319 	spin_unlock(&mq_lock);
320 
321 	inode = mqueue_get_inode(dir->i_sb, ipc_ns, mode, attr);
322 	if (IS_ERR(inode)) {
323 		error = PTR_ERR(inode);
324 		spin_lock(&mq_lock);
325 		ipc_ns->mq_queues_count--;
326 		goto out_unlock;
327 	}
328 
329 	put_ipc_ns(ipc_ns);
330 	dir->i_size += DIRENT_SIZE;
331 	dir->i_ctime = dir->i_mtime = dir->i_atime = CURRENT_TIME;
332 
333 	d_instantiate(dentry, inode);
334 	dget(dentry);
335 	return 0;
336 out_unlock:
337 	spin_unlock(&mq_lock);
338 	if (ipc_ns)
339 		put_ipc_ns(ipc_ns);
340 	return error;
341 }
342 
343 static int mqueue_unlink(struct inode *dir, struct dentry *dentry)
344 {
345   	struct inode *inode = dentry->d_inode;
346 
347 	dir->i_ctime = dir->i_mtime = dir->i_atime = CURRENT_TIME;
348 	dir->i_size -= DIRENT_SIZE;
349   	drop_nlink(inode);
350   	dput(dentry);
351   	return 0;
352 }
353 
354 /*
355 *	This is routine for system read from queue file.
356 *	To avoid mess with doing here some sort of mq_receive we allow
357 *	to read only queue size & notification info (the only values
358 *	that are interesting from user point of view and aren't accessible
359 *	through std routines)
360 */
361 static ssize_t mqueue_read_file(struct file *filp, char __user *u_data,
362 				size_t count, loff_t *off)
363 {
364 	struct mqueue_inode_info *info = MQUEUE_I(filp->f_path.dentry->d_inode);
365 	char buffer[FILENT_SIZE];
366 	ssize_t ret;
367 
368 	spin_lock(&info->lock);
369 	snprintf(buffer, sizeof(buffer),
370 			"QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",
371 			info->qsize,
372 			info->notify_owner ? info->notify.sigev_notify : 0,
373 			(info->notify_owner &&
374 			 info->notify.sigev_notify == SIGEV_SIGNAL) ?
375 				info->notify.sigev_signo : 0,
376 			pid_vnr(info->notify_owner));
377 	spin_unlock(&info->lock);
378 	buffer[sizeof(buffer)-1] = '\0';
379 
380 	ret = simple_read_from_buffer(u_data, count, off, buffer,
381 				strlen(buffer));
382 	if (ret <= 0)
383 		return ret;
384 
385 	filp->f_path.dentry->d_inode->i_atime = filp->f_path.dentry->d_inode->i_ctime = CURRENT_TIME;
386 	return ret;
387 }
388 
389 static int mqueue_flush_file(struct file *filp, fl_owner_t id)
390 {
391 	struct mqueue_inode_info *info = MQUEUE_I(filp->f_path.dentry->d_inode);
392 
393 	spin_lock(&info->lock);
394 	if (task_tgid(current) == info->notify_owner)
395 		remove_notification(info);
396 
397 	spin_unlock(&info->lock);
398 	return 0;
399 }
400 
401 static unsigned int mqueue_poll_file(struct file *filp, struct poll_table_struct *poll_tab)
402 {
403 	struct mqueue_inode_info *info = MQUEUE_I(filp->f_path.dentry->d_inode);
404 	int retval = 0;
405 
406 	poll_wait(filp, &info->wait_q, poll_tab);
407 
408 	spin_lock(&info->lock);
409 	if (info->attr.mq_curmsgs)
410 		retval = POLLIN | POLLRDNORM;
411 
412 	if (info->attr.mq_curmsgs < info->attr.mq_maxmsg)
413 		retval |= POLLOUT | POLLWRNORM;
414 	spin_unlock(&info->lock);
415 
416 	return retval;
417 }
418 
419 /* Adds current to info->e_wait_q[sr] before element with smaller prio */
420 static void wq_add(struct mqueue_inode_info *info, int sr,
421 			struct ext_wait_queue *ewp)
422 {
423 	struct ext_wait_queue *walk;
424 
425 	ewp->task = current;
426 
427 	list_for_each_entry(walk, &info->e_wait_q[sr].list, list) {
428 		if (walk->task->static_prio <= current->static_prio) {
429 			list_add_tail(&ewp->list, &walk->list);
430 			return;
431 		}
432 	}
433 	list_add_tail(&ewp->list, &info->e_wait_q[sr].list);
434 }
435 
436 /*
437  * Puts current task to sleep. Caller must hold queue lock. After return
438  * lock isn't held.
439  * sr: SEND or RECV
440  */
441 static int wq_sleep(struct mqueue_inode_info *info, int sr,
442 		    ktime_t *timeout, struct ext_wait_queue *ewp)
443 {
444 	int retval;
445 	signed long time;
446 
447 	wq_add(info, sr, ewp);
448 
449 	for (;;) {
450 		set_current_state(TASK_INTERRUPTIBLE);
451 
452 		spin_unlock(&info->lock);
453 		time = schedule_hrtimeout_range_clock(timeout, 0,
454 			HRTIMER_MODE_ABS, CLOCK_REALTIME);
455 
456 		while (ewp->state == STATE_PENDING)
457 			cpu_relax();
458 
459 		if (ewp->state == STATE_READY) {
460 			retval = 0;
461 			goto out;
462 		}
463 		spin_lock(&info->lock);
464 		if (ewp->state == STATE_READY) {
465 			retval = 0;
466 			goto out_unlock;
467 		}
468 		if (signal_pending(current)) {
469 			retval = -ERESTARTSYS;
470 			break;
471 		}
472 		if (time == 0) {
473 			retval = -ETIMEDOUT;
474 			break;
475 		}
476 	}
477 	list_del(&ewp->list);
478 out_unlock:
479 	spin_unlock(&info->lock);
480 out:
481 	return retval;
482 }
483 
484 /*
485  * Returns waiting task that should be serviced first or NULL if none exists
486  */
487 static struct ext_wait_queue *wq_get_first_waiter(
488 		struct mqueue_inode_info *info, int sr)
489 {
490 	struct list_head *ptr;
491 
492 	ptr = info->e_wait_q[sr].list.prev;
493 	if (ptr == &info->e_wait_q[sr].list)
494 		return NULL;
495 	return list_entry(ptr, struct ext_wait_queue, list);
496 }
497 
498 /* Auxiliary functions to manipulate messages' list */
499 static void msg_insert(struct msg_msg *ptr, struct mqueue_inode_info *info)
500 {
501 	int k;
502 
503 	k = info->attr.mq_curmsgs - 1;
504 	while (k >= 0 && info->messages[k]->m_type >= ptr->m_type) {
505 		info->messages[k + 1] = info->messages[k];
506 		k--;
507 	}
508 	info->attr.mq_curmsgs++;
509 	info->qsize += ptr->m_ts;
510 	info->messages[k + 1] = ptr;
511 }
512 
513 static inline struct msg_msg *msg_get(struct mqueue_inode_info *info)
514 {
515 	info->qsize -= info->messages[--info->attr.mq_curmsgs]->m_ts;
516 	return info->messages[info->attr.mq_curmsgs];
517 }
518 
519 static inline void set_cookie(struct sk_buff *skb, char code)
520 {
521 	((char*)skb->data)[NOTIFY_COOKIE_LEN-1] = code;
522 }
523 
524 /*
525  * The next function is only to split too long sys_mq_timedsend
526  */
527 static void __do_notify(struct mqueue_inode_info *info)
528 {
529 	/* notification
530 	 * invoked when there is registered process and there isn't process
531 	 * waiting synchronously for message AND state of queue changed from
532 	 * empty to not empty. Here we are sure that no one is waiting
533 	 * synchronously. */
534 	if (info->notify_owner &&
535 	    info->attr.mq_curmsgs == 1) {
536 		struct siginfo sig_i;
537 		switch (info->notify.sigev_notify) {
538 		case SIGEV_NONE:
539 			break;
540 		case SIGEV_SIGNAL:
541 			/* sends signal */
542 
543 			sig_i.si_signo = info->notify.sigev_signo;
544 			sig_i.si_errno = 0;
545 			sig_i.si_code = SI_MESGQ;
546 			sig_i.si_value = info->notify.sigev_value;
547 			/* map current pid/uid into info->owner's namespaces */
548 			rcu_read_lock();
549 			sig_i.si_pid = task_tgid_nr_ns(current,
550 						ns_of_pid(info->notify_owner));
551 			sig_i.si_uid = from_kuid_munged(info->notify_user_ns, current_uid());
552 			rcu_read_unlock();
553 
554 			kill_pid_info(info->notify.sigev_signo,
555 				      &sig_i, info->notify_owner);
556 			break;
557 		case SIGEV_THREAD:
558 			set_cookie(info->notify_cookie, NOTIFY_WOKENUP);
559 			netlink_sendskb(info->notify_sock, info->notify_cookie);
560 			break;
561 		}
562 		/* after notification unregisters process */
563 		put_pid(info->notify_owner);
564 		put_user_ns(info->notify_user_ns);
565 		info->notify_owner = NULL;
566 		info->notify_user_ns = NULL;
567 	}
568 	wake_up(&info->wait_q);
569 }
570 
571 static int prepare_timeout(const struct timespec __user *u_abs_timeout,
572 			   ktime_t *expires, struct timespec *ts)
573 {
574 	if (copy_from_user(ts, u_abs_timeout, sizeof(struct timespec)))
575 		return -EFAULT;
576 	if (!timespec_valid(ts))
577 		return -EINVAL;
578 
579 	*expires = timespec_to_ktime(*ts);
580 	return 0;
581 }
582 
583 static void remove_notification(struct mqueue_inode_info *info)
584 {
585 	if (info->notify_owner != NULL &&
586 	    info->notify.sigev_notify == SIGEV_THREAD) {
587 		set_cookie(info->notify_cookie, NOTIFY_REMOVED);
588 		netlink_sendskb(info->notify_sock, info->notify_cookie);
589 	}
590 	put_pid(info->notify_owner);
591 	put_user_ns(info->notify_user_ns);
592 	info->notify_owner = NULL;
593 	info->notify_user_ns = NULL;
594 }
595 
596 static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
597 {
598 	if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0)
599 		return 0;
600 	if (capable(CAP_SYS_RESOURCE)) {
601 		if (attr->mq_maxmsg > HARD_MSGMAX ||
602 		    attr->mq_msgsize > HARD_MSGSIZEMAX)
603 			return 0;
604 	} else {
605 		if (attr->mq_maxmsg > ipc_ns->mq_msg_max ||
606 				attr->mq_msgsize > ipc_ns->mq_msgsize_max)
607 			return 0;
608 	}
609 	/* check for overflow */
610 	if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg)
611 		return 0;
612 	if ((unsigned long)(attr->mq_maxmsg * (attr->mq_msgsize
613 	    + sizeof (struct msg_msg *))) <
614 	    (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize))
615 		return 0;
616 	return 1;
617 }
618 
619 /*
620  * Invoked when creating a new queue via sys_mq_open
621  */
622 static struct file *do_create(struct ipc_namespace *ipc_ns, struct dentry *dir,
623 			struct dentry *dentry, int oflag, umode_t mode,
624 			struct mq_attr *attr)
625 {
626 	const struct cred *cred = current_cred();
627 	struct file *result;
628 	int ret;
629 
630 	if (attr) {
631 		if (!mq_attr_ok(ipc_ns, attr)) {
632 			ret = -EINVAL;
633 			goto out;
634 		}
635 		/* store for use during create */
636 		dentry->d_fsdata = attr;
637 	}
638 
639 	mode &= ~current_umask();
640 	ret = mnt_want_write(ipc_ns->mq_mnt);
641 	if (ret)
642 		goto out;
643 	ret = vfs_create(dir->d_inode, dentry, mode, NULL);
644 	dentry->d_fsdata = NULL;
645 	if (ret)
646 		goto out_drop_write;
647 
648 	result = dentry_open(dentry, ipc_ns->mq_mnt, oflag, cred);
649 	/*
650 	 * dentry_open() took a persistent mnt_want_write(),
651 	 * so we can now drop this one.
652 	 */
653 	mnt_drop_write(ipc_ns->mq_mnt);
654 	return result;
655 
656 out_drop_write:
657 	mnt_drop_write(ipc_ns->mq_mnt);
658 out:
659 	dput(dentry);
660 	mntput(ipc_ns->mq_mnt);
661 	return ERR_PTR(ret);
662 }
663 
664 /* Opens existing queue */
665 static struct file *do_open(struct ipc_namespace *ipc_ns,
666 				struct dentry *dentry, int oflag)
667 {
668 	int ret;
669 	const struct cred *cred = current_cred();
670 
671 	static const int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
672 						  MAY_READ | MAY_WRITE };
673 
674 	if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) {
675 		ret = -EINVAL;
676 		goto err;
677 	}
678 
679 	if (inode_permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE])) {
680 		ret = -EACCES;
681 		goto err;
682 	}
683 
684 	return dentry_open(dentry, ipc_ns->mq_mnt, oflag, cred);
685 
686 err:
687 	dput(dentry);
688 	mntput(ipc_ns->mq_mnt);
689 	return ERR_PTR(ret);
690 }
691 
692 SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode,
693 		struct mq_attr __user *, u_attr)
694 {
695 	struct dentry *dentry;
696 	struct file *filp;
697 	char *name;
698 	struct mq_attr attr;
699 	int fd, error;
700 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
701 
702 	if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
703 		return -EFAULT;
704 
705 	audit_mq_open(oflag, mode, u_attr ? &attr : NULL);
706 
707 	if (IS_ERR(name = getname(u_name)))
708 		return PTR_ERR(name);
709 
710 	fd = get_unused_fd_flags(O_CLOEXEC);
711 	if (fd < 0)
712 		goto out_putname;
713 
714 	mutex_lock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
715 	dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));
716 	if (IS_ERR(dentry)) {
717 		error = PTR_ERR(dentry);
718 		goto out_putfd;
719 	}
720 	mntget(ipc_ns->mq_mnt);
721 
722 	if (oflag & O_CREAT) {
723 		if (dentry->d_inode) {	/* entry already exists */
724 			audit_inode(name, dentry);
725 			if (oflag & O_EXCL) {
726 				error = -EEXIST;
727 				goto out;
728 			}
729 			filp = do_open(ipc_ns, dentry, oflag);
730 		} else {
731 			filp = do_create(ipc_ns, ipc_ns->mq_mnt->mnt_root,
732 						dentry, oflag, mode,
733 						u_attr ? &attr : NULL);
734 		}
735 	} else {
736 		if (!dentry->d_inode) {
737 			error = -ENOENT;
738 			goto out;
739 		}
740 		audit_inode(name, dentry);
741 		filp = do_open(ipc_ns, dentry, oflag);
742 	}
743 
744 	if (IS_ERR(filp)) {
745 		error = PTR_ERR(filp);
746 		goto out_putfd;
747 	}
748 
749 	fd_install(fd, filp);
750 	goto out_upsem;
751 
752 out:
753 	dput(dentry);
754 	mntput(ipc_ns->mq_mnt);
755 out_putfd:
756 	put_unused_fd(fd);
757 	fd = error;
758 out_upsem:
759 	mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
760 out_putname:
761 	putname(name);
762 	return fd;
763 }
764 
765 SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
766 {
767 	int err;
768 	char *name;
769 	struct dentry *dentry;
770 	struct inode *inode = NULL;
771 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
772 
773 	name = getname(u_name);
774 	if (IS_ERR(name))
775 		return PTR_ERR(name);
776 
777 	mutex_lock_nested(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex,
778 			I_MUTEX_PARENT);
779 	dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));
780 	if (IS_ERR(dentry)) {
781 		err = PTR_ERR(dentry);
782 		goto out_unlock;
783 	}
784 
785 	if (!dentry->d_inode) {
786 		err = -ENOENT;
787 		goto out_err;
788 	}
789 
790 	inode = dentry->d_inode;
791 	if (inode)
792 		ihold(inode);
793 	err = mnt_want_write(ipc_ns->mq_mnt);
794 	if (err)
795 		goto out_err;
796 	err = vfs_unlink(dentry->d_parent->d_inode, dentry);
797 	mnt_drop_write(ipc_ns->mq_mnt);
798 out_err:
799 	dput(dentry);
800 
801 out_unlock:
802 	mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
803 	putname(name);
804 	if (inode)
805 		iput(inode);
806 
807 	return err;
808 }
809 
810 /* Pipelined send and receive functions.
811  *
812  * If a receiver finds no waiting message, then it registers itself in the
813  * list of waiting receivers. A sender checks that list before adding the new
814  * message into the message array. If there is a waiting receiver, then it
815  * bypasses the message array and directly hands the message over to the
816  * receiver.
817  * The receiver accepts the message and returns without grabbing the queue
818  * spinlock. Therefore an intermediate STATE_PENDING state and memory barriers
819  * are necessary. The same algorithm is used for sysv semaphores, see
820  * ipc/sem.c for more details.
821  *
822  * The same algorithm is used for senders.
823  */
824 
825 /* pipelined_send() - send a message directly to the task waiting in
826  * sys_mq_timedreceive() (without inserting message into a queue).
827  */
828 static inline void pipelined_send(struct mqueue_inode_info *info,
829 				  struct msg_msg *message,
830 				  struct ext_wait_queue *receiver)
831 {
832 	receiver->msg = message;
833 	list_del(&receiver->list);
834 	receiver->state = STATE_PENDING;
835 	wake_up_process(receiver->task);
836 	smp_wmb();
837 	receiver->state = STATE_READY;
838 }
839 
840 /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
841  * gets its message and put to the queue (we have one free place for sure). */
842 static inline void pipelined_receive(struct mqueue_inode_info *info)
843 {
844 	struct ext_wait_queue *sender = wq_get_first_waiter(info, SEND);
845 
846 	if (!sender) {
847 		/* for poll */
848 		wake_up_interruptible(&info->wait_q);
849 		return;
850 	}
851 	msg_insert(sender->msg, info);
852 	list_del(&sender->list);
853 	sender->state = STATE_PENDING;
854 	wake_up_process(sender->task);
855 	smp_wmb();
856 	sender->state = STATE_READY;
857 }
858 
859 SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr,
860 		size_t, msg_len, unsigned int, msg_prio,
861 		const struct timespec __user *, u_abs_timeout)
862 {
863 	struct file *filp;
864 	struct inode *inode;
865 	struct ext_wait_queue wait;
866 	struct ext_wait_queue *receiver;
867 	struct msg_msg *msg_ptr;
868 	struct mqueue_inode_info *info;
869 	ktime_t expires, *timeout = NULL;
870 	struct timespec ts;
871 	int ret;
872 
873 	if (u_abs_timeout) {
874 		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
875 		if (res)
876 			return res;
877 		timeout = &expires;
878 	}
879 
880 	if (unlikely(msg_prio >= (unsigned long) MQ_PRIO_MAX))
881 		return -EINVAL;
882 
883 	audit_mq_sendrecv(mqdes, msg_len, msg_prio, timeout ? &ts : NULL);
884 
885 	filp = fget(mqdes);
886 	if (unlikely(!filp)) {
887 		ret = -EBADF;
888 		goto out;
889 	}
890 
891 	inode = filp->f_path.dentry->d_inode;
892 	if (unlikely(filp->f_op != &mqueue_file_operations)) {
893 		ret = -EBADF;
894 		goto out_fput;
895 	}
896 	info = MQUEUE_I(inode);
897 	audit_inode(NULL, filp->f_path.dentry);
898 
899 	if (unlikely(!(filp->f_mode & FMODE_WRITE))) {
900 		ret = -EBADF;
901 		goto out_fput;
902 	}
903 
904 	if (unlikely(msg_len > info->attr.mq_msgsize)) {
905 		ret = -EMSGSIZE;
906 		goto out_fput;
907 	}
908 
909 	/* First try to allocate memory, before doing anything with
910 	 * existing queues. */
911 	msg_ptr = load_msg(u_msg_ptr, msg_len);
912 	if (IS_ERR(msg_ptr)) {
913 		ret = PTR_ERR(msg_ptr);
914 		goto out_fput;
915 	}
916 	msg_ptr->m_ts = msg_len;
917 	msg_ptr->m_type = msg_prio;
918 
919 	spin_lock(&info->lock);
920 
921 	if (info->attr.mq_curmsgs == info->attr.mq_maxmsg) {
922 		if (filp->f_flags & O_NONBLOCK) {
923 			spin_unlock(&info->lock);
924 			ret = -EAGAIN;
925 		} else {
926 			wait.task = current;
927 			wait.msg = (void *) msg_ptr;
928 			wait.state = STATE_NONE;
929 			ret = wq_sleep(info, SEND, timeout, &wait);
930 		}
931 		if (ret < 0)
932 			free_msg(msg_ptr);
933 	} else {
934 		receiver = wq_get_first_waiter(info, RECV);
935 		if (receiver) {
936 			pipelined_send(info, msg_ptr, receiver);
937 		} else {
938 			/* adds message to the queue */
939 			msg_insert(msg_ptr, info);
940 			__do_notify(info);
941 		}
942 		inode->i_atime = inode->i_mtime = inode->i_ctime =
943 				CURRENT_TIME;
944 		spin_unlock(&info->lock);
945 		ret = 0;
946 	}
947 out_fput:
948 	fput(filp);
949 out:
950 	return ret;
951 }
952 
953 SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr,
954 		size_t, msg_len, unsigned int __user *, u_msg_prio,
955 		const struct timespec __user *, u_abs_timeout)
956 {
957 	ssize_t ret;
958 	struct msg_msg *msg_ptr;
959 	struct file *filp;
960 	struct inode *inode;
961 	struct mqueue_inode_info *info;
962 	struct ext_wait_queue wait;
963 	ktime_t expires, *timeout = NULL;
964 	struct timespec ts;
965 
966 	if (u_abs_timeout) {
967 		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
968 		if (res)
969 			return res;
970 		timeout = &expires;
971 	}
972 
973 	audit_mq_sendrecv(mqdes, msg_len, 0, timeout ? &ts : NULL);
974 
975 	filp = fget(mqdes);
976 	if (unlikely(!filp)) {
977 		ret = -EBADF;
978 		goto out;
979 	}
980 
981 	inode = filp->f_path.dentry->d_inode;
982 	if (unlikely(filp->f_op != &mqueue_file_operations)) {
983 		ret = -EBADF;
984 		goto out_fput;
985 	}
986 	info = MQUEUE_I(inode);
987 	audit_inode(NULL, filp->f_path.dentry);
988 
989 	if (unlikely(!(filp->f_mode & FMODE_READ))) {
990 		ret = -EBADF;
991 		goto out_fput;
992 	}
993 
994 	/* checks if buffer is big enough */
995 	if (unlikely(msg_len < info->attr.mq_msgsize)) {
996 		ret = -EMSGSIZE;
997 		goto out_fput;
998 	}
999 
1000 	spin_lock(&info->lock);
1001 	if (info->attr.mq_curmsgs == 0) {
1002 		if (filp->f_flags & O_NONBLOCK) {
1003 			spin_unlock(&info->lock);
1004 			ret = -EAGAIN;
1005 		} else {
1006 			wait.task = current;
1007 			wait.state = STATE_NONE;
1008 			ret = wq_sleep(info, RECV, timeout, &wait);
1009 			msg_ptr = wait.msg;
1010 		}
1011 	} else {
1012 		msg_ptr = msg_get(info);
1013 
1014 		inode->i_atime = inode->i_mtime = inode->i_ctime =
1015 				CURRENT_TIME;
1016 
1017 		/* There is now free space in queue. */
1018 		pipelined_receive(info);
1019 		spin_unlock(&info->lock);
1020 		ret = 0;
1021 	}
1022 	if (ret == 0) {
1023 		ret = msg_ptr->m_ts;
1024 
1025 		if ((u_msg_prio && put_user(msg_ptr->m_type, u_msg_prio)) ||
1026 			store_msg(u_msg_ptr, msg_ptr, msg_ptr->m_ts)) {
1027 			ret = -EFAULT;
1028 		}
1029 		free_msg(msg_ptr);
1030 	}
1031 out_fput:
1032 	fput(filp);
1033 out:
1034 	return ret;
1035 }
1036 
1037 /*
1038  * Notes: the case when user wants us to deregister (with NULL as pointer)
1039  * and he isn't currently owner of notification, will be silently discarded.
1040  * It isn't explicitly defined in the POSIX.
1041  */
1042 SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
1043 		const struct sigevent __user *, u_notification)
1044 {
1045 	int ret;
1046 	struct file *filp;
1047 	struct sock *sock;
1048 	struct inode *inode;
1049 	struct sigevent notification;
1050 	struct mqueue_inode_info *info;
1051 	struct sk_buff *nc;
1052 
1053 	if (u_notification) {
1054 		if (copy_from_user(&notification, u_notification,
1055 					sizeof(struct sigevent)))
1056 			return -EFAULT;
1057 	}
1058 
1059 	audit_mq_notify(mqdes, u_notification ? &notification : NULL);
1060 
1061 	nc = NULL;
1062 	sock = NULL;
1063 	if (u_notification != NULL) {
1064 		if (unlikely(notification.sigev_notify != SIGEV_NONE &&
1065 			     notification.sigev_notify != SIGEV_SIGNAL &&
1066 			     notification.sigev_notify != SIGEV_THREAD))
1067 			return -EINVAL;
1068 		if (notification.sigev_notify == SIGEV_SIGNAL &&
1069 			!valid_signal(notification.sigev_signo)) {
1070 			return -EINVAL;
1071 		}
1072 		if (notification.sigev_notify == SIGEV_THREAD) {
1073 			long timeo;
1074 
1075 			/* create the notify skb */
1076 			nc = alloc_skb(NOTIFY_COOKIE_LEN, GFP_KERNEL);
1077 			if (!nc) {
1078 				ret = -ENOMEM;
1079 				goto out;
1080 			}
1081 			if (copy_from_user(nc->data,
1082 					notification.sigev_value.sival_ptr,
1083 					NOTIFY_COOKIE_LEN)) {
1084 				ret = -EFAULT;
1085 				goto out;
1086 			}
1087 
1088 			/* TODO: add a header? */
1089 			skb_put(nc, NOTIFY_COOKIE_LEN);
1090 			/* and attach it to the socket */
1091 retry:
1092 			filp = fget(notification.sigev_signo);
1093 			if (!filp) {
1094 				ret = -EBADF;
1095 				goto out;
1096 			}
1097 			sock = netlink_getsockbyfilp(filp);
1098 			fput(filp);
1099 			if (IS_ERR(sock)) {
1100 				ret = PTR_ERR(sock);
1101 				sock = NULL;
1102 				goto out;
1103 			}
1104 
1105 			timeo = MAX_SCHEDULE_TIMEOUT;
1106 			ret = netlink_attachskb(sock, nc, &timeo, NULL);
1107 			if (ret == 1)
1108 				goto retry;
1109 			if (ret) {
1110 				sock = NULL;
1111 				nc = NULL;
1112 				goto out;
1113 			}
1114 		}
1115 	}
1116 
1117 	filp = fget(mqdes);
1118 	if (!filp) {
1119 		ret = -EBADF;
1120 		goto out;
1121 	}
1122 
1123 	inode = filp->f_path.dentry->d_inode;
1124 	if (unlikely(filp->f_op != &mqueue_file_operations)) {
1125 		ret = -EBADF;
1126 		goto out_fput;
1127 	}
1128 	info = MQUEUE_I(inode);
1129 
1130 	ret = 0;
1131 	spin_lock(&info->lock);
1132 	if (u_notification == NULL) {
1133 		if (info->notify_owner == task_tgid(current)) {
1134 			remove_notification(info);
1135 			inode->i_atime = inode->i_ctime = CURRENT_TIME;
1136 		}
1137 	} else if (info->notify_owner != NULL) {
1138 		ret = -EBUSY;
1139 	} else {
1140 		switch (notification.sigev_notify) {
1141 		case SIGEV_NONE:
1142 			info->notify.sigev_notify = SIGEV_NONE;
1143 			break;
1144 		case SIGEV_THREAD:
1145 			info->notify_sock = sock;
1146 			info->notify_cookie = nc;
1147 			sock = NULL;
1148 			nc = NULL;
1149 			info->notify.sigev_notify = SIGEV_THREAD;
1150 			break;
1151 		case SIGEV_SIGNAL:
1152 			info->notify.sigev_signo = notification.sigev_signo;
1153 			info->notify.sigev_value = notification.sigev_value;
1154 			info->notify.sigev_notify = SIGEV_SIGNAL;
1155 			break;
1156 		}
1157 
1158 		info->notify_owner = get_pid(task_tgid(current));
1159 		info->notify_user_ns = get_user_ns(current_user_ns());
1160 		inode->i_atime = inode->i_ctime = CURRENT_TIME;
1161 	}
1162 	spin_unlock(&info->lock);
1163 out_fput:
1164 	fput(filp);
1165 out:
1166 	if (sock) {
1167 		netlink_detachskb(sock, nc);
1168 	} else if (nc) {
1169 		dev_kfree_skb(nc);
1170 	}
1171 	return ret;
1172 }
1173 
1174 SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mqdes,
1175 		const struct mq_attr __user *, u_mqstat,
1176 		struct mq_attr __user *, u_omqstat)
1177 {
1178 	int ret;
1179 	struct mq_attr mqstat, omqstat;
1180 	struct file *filp;
1181 	struct inode *inode;
1182 	struct mqueue_inode_info *info;
1183 
1184 	if (u_mqstat != NULL) {
1185 		if (copy_from_user(&mqstat, u_mqstat, sizeof(struct mq_attr)))
1186 			return -EFAULT;
1187 		if (mqstat.mq_flags & (~O_NONBLOCK))
1188 			return -EINVAL;
1189 	}
1190 
1191 	filp = fget(mqdes);
1192 	if (!filp) {
1193 		ret = -EBADF;
1194 		goto out;
1195 	}
1196 
1197 	inode = filp->f_path.dentry->d_inode;
1198 	if (unlikely(filp->f_op != &mqueue_file_operations)) {
1199 		ret = -EBADF;
1200 		goto out_fput;
1201 	}
1202 	info = MQUEUE_I(inode);
1203 
1204 	spin_lock(&info->lock);
1205 
1206 	omqstat = info->attr;
1207 	omqstat.mq_flags = filp->f_flags & O_NONBLOCK;
1208 	if (u_mqstat) {
1209 		audit_mq_getsetattr(mqdes, &mqstat);
1210 		spin_lock(&filp->f_lock);
1211 		if (mqstat.mq_flags & O_NONBLOCK)
1212 			filp->f_flags |= O_NONBLOCK;
1213 		else
1214 			filp->f_flags &= ~O_NONBLOCK;
1215 		spin_unlock(&filp->f_lock);
1216 
1217 		inode->i_atime = inode->i_ctime = CURRENT_TIME;
1218 	}
1219 
1220 	spin_unlock(&info->lock);
1221 
1222 	ret = 0;
1223 	if (u_omqstat != NULL && copy_to_user(u_omqstat, &omqstat,
1224 						sizeof(struct mq_attr)))
1225 		ret = -EFAULT;
1226 
1227 out_fput:
1228 	fput(filp);
1229 out:
1230 	return ret;
1231 }
1232 
1233 static const struct inode_operations mqueue_dir_inode_operations = {
1234 	.lookup = simple_lookup,
1235 	.create = mqueue_create,
1236 	.unlink = mqueue_unlink,
1237 };
1238 
1239 static const struct file_operations mqueue_file_operations = {
1240 	.flush = mqueue_flush_file,
1241 	.poll = mqueue_poll_file,
1242 	.read = mqueue_read_file,
1243 	.llseek = default_llseek,
1244 };
1245 
1246 static const struct super_operations mqueue_super_ops = {
1247 	.alloc_inode = mqueue_alloc_inode,
1248 	.destroy_inode = mqueue_destroy_inode,
1249 	.evict_inode = mqueue_evict_inode,
1250 	.statfs = simple_statfs,
1251 };
1252 
1253 static struct file_system_type mqueue_fs_type = {
1254 	.name = "mqueue",
1255 	.mount = mqueue_mount,
1256 	.kill_sb = kill_litter_super,
1257 };
1258 
1259 int mq_init_ns(struct ipc_namespace *ns)
1260 {
1261 	ns->mq_queues_count  = 0;
1262 	ns->mq_queues_max    = DFLT_QUEUESMAX;
1263 	ns->mq_msg_max       = DFLT_MSGMAX;
1264 	ns->mq_msgsize_max   = DFLT_MSGSIZEMAX;
1265 	ns->mq_msg_default   = DFLT_MSG;
1266 	ns->mq_msgsize_default  = DFLT_MSGSIZE;
1267 
1268 	ns->mq_mnt = kern_mount_data(&mqueue_fs_type, ns);
1269 	if (IS_ERR(ns->mq_mnt)) {
1270 		int err = PTR_ERR(ns->mq_mnt);
1271 		ns->mq_mnt = NULL;
1272 		return err;
1273 	}
1274 	return 0;
1275 }
1276 
1277 void mq_clear_sbinfo(struct ipc_namespace *ns)
1278 {
1279 	ns->mq_mnt->mnt_sb->s_fs_info = NULL;
1280 }
1281 
1282 void mq_put_mnt(struct ipc_namespace *ns)
1283 {
1284 	kern_unmount(ns->mq_mnt);
1285 }
1286 
1287 static int __init init_mqueue_fs(void)
1288 {
1289 	int error;
1290 
1291 	mqueue_inode_cachep = kmem_cache_create("mqueue_inode_cache",
1292 				sizeof(struct mqueue_inode_info), 0,
1293 				SLAB_HWCACHE_ALIGN, init_once);
1294 	if (mqueue_inode_cachep == NULL)
1295 		return -ENOMEM;
1296 
1297 	/* ignore failures - they are not fatal */
1298 	mq_sysctl_table = mq_register_sysctl_table();
1299 
1300 	error = register_filesystem(&mqueue_fs_type);
1301 	if (error)
1302 		goto out_sysctl;
1303 
1304 	spin_lock_init(&mq_lock);
1305 
1306 	error = mq_init_ns(&init_ipc_ns);
1307 	if (error)
1308 		goto out_filesystem;
1309 
1310 	return 0;
1311 
1312 out_filesystem:
1313 	unregister_filesystem(&mqueue_fs_type);
1314 out_sysctl:
1315 	if (mq_sysctl_table)
1316 		unregister_sysctl_table(mq_sysctl_table);
1317 	kmem_cache_destroy(mqueue_inode_cachep);
1318 	return error;
1319 }
1320 
1321 __initcall(init_mqueue_fs);
1322