2 * POSIX message queues filesystem for Linux.
4 * Copyright (C) 2003,2004 Krzysztof Benedyczak (golbi@mat.uni.torun.pl)
5 * Michal Wronski (michal.wronski@gmail.com)
7 * Spinlocks: Mohamed Abbas (abbas.mohamed@intel.com)
8 * Lockless receive & send, fd based notify:
9 * Manfred Spraul (manfred@colorfullife.com)
11 * Audit: George Wilson (ltcgcw@us.ibm.com)
13 * This file is released under the GPL.
16 #include <linux/capability.h>
17 #include <linux/init.h>
18 #include <linux/pagemap.h>
19 #include <linux/file.h>
20 #include <linux/mount.h>
21 #include <linux/namei.h>
22 #include <linux/sysctl.h>
23 #include <linux/poll.h>
24 #include <linux/mqueue.h>
25 #include <linux/msg.h>
26 #include <linux/skbuff.h>
27 #include <linux/vmalloc.h>
28 #include <linux/netlink.h>
29 #include <linux/syscalls.h>
30 #include <linux/audit.h>
31 #include <linux/signal.h>
32 #include <linux/mutex.h>
33 #include <linux/nsproxy.h>
34 #include <linux/pid.h>
35 #include <linux/ipc_namespace.h>
36 #include <linux/user_namespace.h>
37 #include <linux/slab.h>
42 #define MQUEUE_MAGIC 0x19800202
43 #define DIRENT_SIZE 20
44 #define FILENT_SIZE 80
52 struct posix_msg_tree_node
{
53 struct rb_node rb_node
;
54 struct list_head msg_list
;
58 struct ext_wait_queue
{ /* queue of sleeping tasks */
59 struct task_struct
*task
;
60 struct list_head list
;
61 struct msg_msg
*msg
; /* ptr of loaded message */
62 int state
; /* one of STATE_* values */
65 struct mqueue_inode_info
{
67 struct inode vfs_inode
;
68 wait_queue_head_t wait_q
;
70 struct rb_root msg_tree
;
71 struct posix_msg_tree_node
*node_cache
;
74 struct sigevent notify
;
75 struct pid
*notify_owner
;
76 struct user_namespace
*notify_user_ns
;
77 struct user_struct
*user
; /* user who created, for accounting */
78 struct sock
*notify_sock
;
79 struct sk_buff
*notify_cookie
;
81 /* for tasks waiting for free space and messages, respectively */
82 struct ext_wait_queue e_wait_q
[2];
84 unsigned long qsize
; /* size of queue in memory (sum of all msgs) */
87 static const struct inode_operations mqueue_dir_inode_operations
;
88 static const struct file_operations mqueue_file_operations
;
89 static const struct super_operations mqueue_super_ops
;
90 static void remove_notification(struct mqueue_inode_info
*info
);
92 static struct kmem_cache
*mqueue_inode_cachep
;
94 static struct ctl_table_header
*mq_sysctl_table
;
96 static inline struct mqueue_inode_info
*MQUEUE_I(struct inode
*inode
)
98 return container_of(inode
, struct mqueue_inode_info
, vfs_inode
);
102 * This routine should be called with the mq_lock held.
104 static inline struct ipc_namespace
*__get_ns_from_inode(struct inode
*inode
)
106 return get_ipc_ns(inode
->i_sb
->s_fs_info
);
109 static struct ipc_namespace
*get_ns_from_inode(struct inode
*inode
)
111 struct ipc_namespace
*ns
;
114 ns
= __get_ns_from_inode(inode
);
115 spin_unlock(&mq_lock
);
119 /* Auxiliary functions to manipulate messages' list */
120 static int msg_insert(struct msg_msg
*msg
, struct mqueue_inode_info
*info
)
122 struct rb_node
**p
, *parent
= NULL
;
123 struct posix_msg_tree_node
*leaf
;
125 p
= &info
->msg_tree
.rb_node
;
128 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
130 if (likely(leaf
->priority
== msg
->m_type
))
132 else if (msg
->m_type
< leaf
->priority
)
137 if (info
->node_cache
) {
138 leaf
= info
->node_cache
;
139 info
->node_cache
= NULL
;
141 leaf
= kmalloc(sizeof(*leaf
), GFP_ATOMIC
);
144 INIT_LIST_HEAD(&leaf
->msg_list
);
146 leaf
->priority
= msg
->m_type
;
147 rb_link_node(&leaf
->rb_node
, parent
, p
);
148 rb_insert_color(&leaf
->rb_node
, &info
->msg_tree
);
150 info
->attr
.mq_curmsgs
++;
151 info
->qsize
+= msg
->m_ts
;
152 list_add_tail(&msg
->m_list
, &leaf
->msg_list
);
156 static inline struct msg_msg
*msg_get(struct mqueue_inode_info
*info
)
158 struct rb_node
**p
, *parent
= NULL
;
159 struct posix_msg_tree_node
*leaf
;
163 p
= &info
->msg_tree
.rb_node
;
167 * During insert, low priorities go to the left and high to the
168 * right. On receive, we want the highest priorities first, so
169 * walk all the way to the right.
174 if (info
->attr
.mq_curmsgs
) {
175 pr_warn_once("Inconsistency in POSIX message queue, "
176 "no tree element, but supposedly messages "
178 info
->attr
.mq_curmsgs
= 0;
182 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
183 if (unlikely(list_empty(&leaf
->msg_list
))) {
184 pr_warn_once("Inconsistency in POSIX message queue, "
185 "empty leaf node but we haven't implemented "
186 "lazy leaf delete!\n");
187 rb_erase(&leaf
->rb_node
, &info
->msg_tree
);
188 if (info
->node_cache
) {
191 info
->node_cache
= leaf
;
195 msg
= list_first_entry(&leaf
->msg_list
,
196 struct msg_msg
, m_list
);
197 list_del(&msg
->m_list
);
198 if (list_empty(&leaf
->msg_list
)) {
199 rb_erase(&leaf
->rb_node
, &info
->msg_tree
);
200 if (info
->node_cache
) {
203 info
->node_cache
= leaf
;
207 info
->attr
.mq_curmsgs
--;
208 info
->qsize
-= msg
->m_ts
;
212 static struct inode
*mqueue_get_inode(struct super_block
*sb
,
213 struct ipc_namespace
*ipc_ns
, umode_t mode
,
214 struct mq_attr
*attr
)
216 struct user_struct
*u
= current_user();
220 inode
= new_inode(sb
);
224 inode
->i_ino
= get_next_ino();
225 inode
->i_mode
= mode
;
226 inode
->i_uid
= current_fsuid();
227 inode
->i_gid
= current_fsgid();
228 inode
->i_mtime
= inode
->i_ctime
= inode
->i_atime
= current_time(inode
);
231 struct mqueue_inode_info
*info
;
232 unsigned long mq_bytes
, mq_treesize
;
234 inode
->i_fop
= &mqueue_file_operations
;
235 inode
->i_size
= FILENT_SIZE
;
236 /* mqueue specific info */
237 info
= MQUEUE_I(inode
);
238 spin_lock_init(&info
->lock
);
239 init_waitqueue_head(&info
->wait_q
);
240 INIT_LIST_HEAD(&info
->e_wait_q
[0].list
);
241 INIT_LIST_HEAD(&info
->e_wait_q
[1].list
);
242 info
->notify_owner
= NULL
;
243 info
->notify_user_ns
= NULL
;
245 info
->user
= NULL
; /* set when all is ok */
246 info
->msg_tree
= RB_ROOT
;
247 info
->node_cache
= NULL
;
248 memset(&info
->attr
, 0, sizeof(info
->attr
));
249 info
->attr
.mq_maxmsg
= min(ipc_ns
->mq_msg_max
,
250 ipc_ns
->mq_msg_default
);
251 info
->attr
.mq_msgsize
= min(ipc_ns
->mq_msgsize_max
,
252 ipc_ns
->mq_msgsize_default
);
254 info
->attr
.mq_maxmsg
= attr
->mq_maxmsg
;
255 info
->attr
.mq_msgsize
= attr
->mq_msgsize
;
258 * We used to allocate a static array of pointers and account
259 * the size of that array as well as one msg_msg struct per
260 * possible message into the queue size. That's no longer
261 * accurate as the queue is now an rbtree and will grow and
262 * shrink depending on usage patterns. We can, however, still
263 * account one msg_msg struct per message, but the nodes are
264 * allocated depending on priority usage, and most programs
265 * only use one, or a handful, of priorities. However, since
266 * this is pinned memory, we need to assume worst case, so
267 * that means the min(mq_maxmsg, max_priorities) * struct
268 * posix_msg_tree_node.
270 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
271 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
272 sizeof(struct posix_msg_tree_node
);
274 mq_bytes
= mq_treesize
+ (info
->attr
.mq_maxmsg
*
275 info
->attr
.mq_msgsize
);
278 if (u
->mq_bytes
+ mq_bytes
< u
->mq_bytes
||
279 u
->mq_bytes
+ mq_bytes
> rlimit(RLIMIT_MSGQUEUE
)) {
280 spin_unlock(&mq_lock
);
281 /* mqueue_evict_inode() releases info->messages */
285 u
->mq_bytes
+= mq_bytes
;
286 spin_unlock(&mq_lock
);
289 info
->user
= get_uid(u
);
290 } else if (S_ISDIR(mode
)) {
292 /* Some things misbehave if size == 0 on a directory */
293 inode
->i_size
= 2 * DIRENT_SIZE
;
294 inode
->i_op
= &mqueue_dir_inode_operations
;
295 inode
->i_fop
= &simple_dir_operations
;
305 static int mqueue_fill_super(struct super_block
*sb
, void *data
, int silent
)
308 struct ipc_namespace
*ns
= sb
->s_fs_info
;
310 sb
->s_iflags
|= SB_I_NOEXEC
| SB_I_NODEV
;
311 sb
->s_blocksize
= PAGE_SIZE
;
312 sb
->s_blocksize_bits
= PAGE_SHIFT
;
313 sb
->s_magic
= MQUEUE_MAGIC
;
314 sb
->s_op
= &mqueue_super_ops
;
316 inode
= mqueue_get_inode(sb
, ns
, S_IFDIR
| S_ISVTX
| S_IRWXUGO
, NULL
);
318 return PTR_ERR(inode
);
320 sb
->s_root
= d_make_root(inode
);
326 static struct dentry
*mqueue_mount(struct file_system_type
*fs_type
,
327 int flags
, const char *dev_name
,
330 struct ipc_namespace
*ns
;
331 if (flags
& MS_KERNMOUNT
) {
335 ns
= current
->nsproxy
->ipc_ns
;
337 return mount_ns(fs_type
, flags
, data
, ns
, ns
->user_ns
, mqueue_fill_super
);
340 static void init_once(void *foo
)
342 struct mqueue_inode_info
*p
= (struct mqueue_inode_info
*) foo
;
344 inode_init_once(&p
->vfs_inode
);
347 static struct inode
*mqueue_alloc_inode(struct super_block
*sb
)
349 struct mqueue_inode_info
*ei
;
351 ei
= kmem_cache_alloc(mqueue_inode_cachep
, GFP_KERNEL
);
354 return &ei
->vfs_inode
;
357 static void mqueue_i_callback(struct rcu_head
*head
)
359 struct inode
*inode
= container_of(head
, struct inode
, i_rcu
);
360 kmem_cache_free(mqueue_inode_cachep
, MQUEUE_I(inode
));
363 static void mqueue_destroy_inode(struct inode
*inode
)
365 call_rcu(&inode
->i_rcu
, mqueue_i_callback
);
368 static void mqueue_evict_inode(struct inode
*inode
)
370 struct mqueue_inode_info
*info
;
371 struct user_struct
*user
;
372 unsigned long mq_bytes
, mq_treesize
;
373 struct ipc_namespace
*ipc_ns
;
378 if (S_ISDIR(inode
->i_mode
))
381 ipc_ns
= get_ns_from_inode(inode
);
382 info
= MQUEUE_I(inode
);
383 spin_lock(&info
->lock
);
384 while ((msg
= msg_get(info
)) != NULL
)
386 kfree(info
->node_cache
);
387 spin_unlock(&info
->lock
);
389 /* Total amount of bytes accounted for the mqueue */
390 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
391 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
392 sizeof(struct posix_msg_tree_node
);
394 mq_bytes
= mq_treesize
+ (info
->attr
.mq_maxmsg
*
395 info
->attr
.mq_msgsize
);
400 user
->mq_bytes
-= mq_bytes
;
402 * get_ns_from_inode() ensures that the
403 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
404 * to which we now hold a reference, or it is NULL.
405 * We can't put it here under mq_lock, though.
408 ipc_ns
->mq_queues_count
--;
409 spin_unlock(&mq_lock
);
416 static int mqueue_create(struct inode
*dir
, struct dentry
*dentry
,
417 umode_t mode
, bool excl
)
420 struct mq_attr
*attr
= dentry
->d_fsdata
;
422 struct ipc_namespace
*ipc_ns
;
425 ipc_ns
= __get_ns_from_inode(dir
);
431 if (ipc_ns
->mq_queues_count
>= ipc_ns
->mq_queues_max
&&
432 !capable(CAP_SYS_RESOURCE
)) {
436 ipc_ns
->mq_queues_count
++;
437 spin_unlock(&mq_lock
);
439 inode
= mqueue_get_inode(dir
->i_sb
, ipc_ns
, mode
, attr
);
441 error
= PTR_ERR(inode
);
443 ipc_ns
->mq_queues_count
--;
448 dir
->i_size
+= DIRENT_SIZE
;
449 dir
->i_ctime
= dir
->i_mtime
= dir
->i_atime
= current_time(dir
);
451 d_instantiate(dentry
, inode
);
455 spin_unlock(&mq_lock
);
461 static int mqueue_unlink(struct inode
*dir
, struct dentry
*dentry
)
463 struct inode
*inode
= d_inode(dentry
);
465 dir
->i_ctime
= dir
->i_mtime
= dir
->i_atime
= current_time(dir
);
466 dir
->i_size
-= DIRENT_SIZE
;
473 * This is routine for system read from queue file.
474 * To avoid mess with doing here some sort of mq_receive we allow
475 * to read only queue size & notification info (the only values
476 * that are interesting from user point of view and aren't accessible
477 * through std routines)
479 static ssize_t
mqueue_read_file(struct file
*filp
, char __user
*u_data
,
480 size_t count
, loff_t
*off
)
482 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
483 char buffer
[FILENT_SIZE
];
486 spin_lock(&info
->lock
);
487 snprintf(buffer
, sizeof(buffer
),
488 "QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",
490 info
->notify_owner
? info
->notify
.sigev_notify
: 0,
491 (info
->notify_owner
&&
492 info
->notify
.sigev_notify
== SIGEV_SIGNAL
) ?
493 info
->notify
.sigev_signo
: 0,
494 pid_vnr(info
->notify_owner
));
495 spin_unlock(&info
->lock
);
496 buffer
[sizeof(buffer
)-1] = '\0';
498 ret
= simple_read_from_buffer(u_data
, count
, off
, buffer
,
503 file_inode(filp
)->i_atime
= file_inode(filp
)->i_ctime
= current_time(file_inode(filp
));
507 static int mqueue_flush_file(struct file
*filp
, fl_owner_t id
)
509 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
511 spin_lock(&info
->lock
);
512 if (task_tgid(current
) == info
->notify_owner
)
513 remove_notification(info
);
515 spin_unlock(&info
->lock
);
519 static unsigned int mqueue_poll_file(struct file
*filp
, struct poll_table_struct
*poll_tab
)
521 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
524 poll_wait(filp
, &info
->wait_q
, poll_tab
);
526 spin_lock(&info
->lock
);
527 if (info
->attr
.mq_curmsgs
)
528 retval
= POLLIN
| POLLRDNORM
;
530 if (info
->attr
.mq_curmsgs
< info
->attr
.mq_maxmsg
)
531 retval
|= POLLOUT
| POLLWRNORM
;
532 spin_unlock(&info
->lock
);
537 /* Adds current to info->e_wait_q[sr] before element with smaller prio */
538 static void wq_add(struct mqueue_inode_info
*info
, int sr
,
539 struct ext_wait_queue
*ewp
)
541 struct ext_wait_queue
*walk
;
545 list_for_each_entry(walk
, &info
->e_wait_q
[sr
].list
, list
) {
546 if (walk
->task
->static_prio
<= current
->static_prio
) {
547 list_add_tail(&ewp
->list
, &walk
->list
);
551 list_add_tail(&ewp
->list
, &info
->e_wait_q
[sr
].list
);
555 * Puts current task to sleep. Caller must hold queue lock. After return
559 static int wq_sleep(struct mqueue_inode_info
*info
, int sr
,
560 ktime_t
*timeout
, struct ext_wait_queue
*ewp
)
561 __releases(&info
->lock
)
566 wq_add(info
, sr
, ewp
);
569 __set_current_state(TASK_INTERRUPTIBLE
);
571 spin_unlock(&info
->lock
);
572 time
= schedule_hrtimeout_range_clock(timeout
, 0,
573 HRTIMER_MODE_ABS
, CLOCK_REALTIME
);
575 if (ewp
->state
== STATE_READY
) {
579 spin_lock(&info
->lock
);
580 if (ewp
->state
== STATE_READY
) {
584 if (signal_pending(current
)) {
585 retval
= -ERESTARTSYS
;
593 list_del(&ewp
->list
);
595 spin_unlock(&info
->lock
);
601 * Returns waiting task that should be serviced first or NULL if none exists
603 static struct ext_wait_queue
*wq_get_first_waiter(
604 struct mqueue_inode_info
*info
, int sr
)
606 struct list_head
*ptr
;
608 ptr
= info
->e_wait_q
[sr
].list
.prev
;
609 if (ptr
== &info
->e_wait_q
[sr
].list
)
611 return list_entry(ptr
, struct ext_wait_queue
, list
);
615 static inline void set_cookie(struct sk_buff
*skb
, char code
)
617 ((char *)skb
->data
)[NOTIFY_COOKIE_LEN
-1] = code
;
621 * The next function is only to split too long sys_mq_timedsend
623 static void __do_notify(struct mqueue_inode_info
*info
)
626 * invoked when there is registered process and there isn't process
627 * waiting synchronously for message AND state of queue changed from
628 * empty to not empty. Here we are sure that no one is waiting
630 if (info
->notify_owner
&&
631 info
->attr
.mq_curmsgs
== 1) {
632 struct siginfo sig_i
;
633 switch (info
->notify
.sigev_notify
) {
639 sig_i
.si_signo
= info
->notify
.sigev_signo
;
641 sig_i
.si_code
= SI_MESGQ
;
642 sig_i
.si_value
= info
->notify
.sigev_value
;
643 /* map current pid/uid into info->owner's namespaces */
645 sig_i
.si_pid
= task_tgid_nr_ns(current
,
646 ns_of_pid(info
->notify_owner
));
647 sig_i
.si_uid
= from_kuid_munged(info
->notify_user_ns
, current_uid());
650 kill_pid_info(info
->notify
.sigev_signo
,
651 &sig_i
, info
->notify_owner
);
654 set_cookie(info
->notify_cookie
, NOTIFY_WOKENUP
);
655 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
658 /* after notification unregisters process */
659 put_pid(info
->notify_owner
);
660 put_user_ns(info
->notify_user_ns
);
661 info
->notify_owner
= NULL
;
662 info
->notify_user_ns
= NULL
;
664 wake_up(&info
->wait_q
);
667 static int prepare_timeout(const struct timespec __user
*u_abs_timeout
,
668 ktime_t
*expires
, struct timespec
*ts
)
670 if (copy_from_user(ts
, u_abs_timeout
, sizeof(struct timespec
)))
672 if (!timespec_valid(ts
))
675 *expires
= timespec_to_ktime(*ts
);
679 static void remove_notification(struct mqueue_inode_info
*info
)
681 if (info
->notify_owner
!= NULL
&&
682 info
->notify
.sigev_notify
== SIGEV_THREAD
) {
683 set_cookie(info
->notify_cookie
, NOTIFY_REMOVED
);
684 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
686 put_pid(info
->notify_owner
);
687 put_user_ns(info
->notify_user_ns
);
688 info
->notify_owner
= NULL
;
689 info
->notify_user_ns
= NULL
;
692 static int mq_attr_ok(struct ipc_namespace
*ipc_ns
, struct mq_attr
*attr
)
695 unsigned long total_size
;
697 if (attr
->mq_maxmsg
<= 0 || attr
->mq_msgsize
<= 0)
699 if (capable(CAP_SYS_RESOURCE
)) {
700 if (attr
->mq_maxmsg
> HARD_MSGMAX
||
701 attr
->mq_msgsize
> HARD_MSGSIZEMAX
)
704 if (attr
->mq_maxmsg
> ipc_ns
->mq_msg_max
||
705 attr
->mq_msgsize
> ipc_ns
->mq_msgsize_max
)
708 /* check for overflow */
709 if (attr
->mq_msgsize
> ULONG_MAX
/attr
->mq_maxmsg
)
711 mq_treesize
= attr
->mq_maxmsg
* sizeof(struct msg_msg
) +
712 min_t(unsigned int, attr
->mq_maxmsg
, MQ_PRIO_MAX
) *
713 sizeof(struct posix_msg_tree_node
);
714 total_size
= attr
->mq_maxmsg
* attr
->mq_msgsize
;
715 if (total_size
+ mq_treesize
< total_size
)
721 * Invoked when creating a new queue via sys_mq_open
723 static struct file
*do_create(struct ipc_namespace
*ipc_ns
, struct inode
*dir
,
724 struct path
*path
, int oflag
, umode_t mode
,
725 struct mq_attr
*attr
)
727 const struct cred
*cred
= current_cred();
731 ret
= mq_attr_ok(ipc_ns
, attr
);
734 /* store for use during create */
735 path
->dentry
->d_fsdata
= attr
;
737 struct mq_attr def_attr
;
739 def_attr
.mq_maxmsg
= min(ipc_ns
->mq_msg_max
,
740 ipc_ns
->mq_msg_default
);
741 def_attr
.mq_msgsize
= min(ipc_ns
->mq_msgsize_max
,
742 ipc_ns
->mq_msgsize_default
);
743 ret
= mq_attr_ok(ipc_ns
, &def_attr
);
748 mode
&= ~current_umask();
749 ret
= vfs_create(dir
, path
->dentry
, mode
, true);
750 path
->dentry
->d_fsdata
= NULL
;
753 return dentry_open(path
, oflag
, cred
);
756 /* Opens existing queue */
757 static struct file
*do_open(struct path
*path
, int oflag
)
759 static const int oflag2acc
[O_ACCMODE
] = { MAY_READ
, MAY_WRITE
,
760 MAY_READ
| MAY_WRITE
};
762 if ((oflag
& O_ACCMODE
) == (O_RDWR
| O_WRONLY
))
763 return ERR_PTR(-EINVAL
);
764 acc
= oflag2acc
[oflag
& O_ACCMODE
];
765 if (inode_permission(d_inode(path
->dentry
), acc
))
766 return ERR_PTR(-EACCES
);
767 return dentry_open(path
, oflag
, current_cred());
770 SYSCALL_DEFINE4(mq_open
, const char __user
*, u_name
, int, oflag
, umode_t
, mode
,
771 struct mq_attr __user
*, u_attr
)
775 struct filename
*name
;
778 struct ipc_namespace
*ipc_ns
= current
->nsproxy
->ipc_ns
;
779 struct vfsmount
*mnt
= ipc_ns
->mq_mnt
;
780 struct dentry
*root
= mnt
->mnt_root
;
783 if (u_attr
&& copy_from_user(&attr
, u_attr
, sizeof(struct mq_attr
)))
786 audit_mq_open(oflag
, mode
, u_attr
? &attr
: NULL
);
788 if (IS_ERR(name
= getname(u_name
)))
789 return PTR_ERR(name
);
791 fd
= get_unused_fd_flags(O_CLOEXEC
);
795 ro
= mnt_want_write(mnt
); /* we'll drop it in any case */
797 inode_lock(d_inode(root
));
798 path
.dentry
= lookup_one_len(name
->name
, root
, strlen(name
->name
));
799 if (IS_ERR(path
.dentry
)) {
800 error
= PTR_ERR(path
.dentry
);
803 path
.mnt
= mntget(mnt
);
805 if (oflag
& O_CREAT
) {
806 if (d_really_is_positive(path
.dentry
)) { /* entry already exists */
807 audit_inode(name
, path
.dentry
, 0);
808 if (oflag
& O_EXCL
) {
812 filp
= do_open(&path
, oflag
);
818 audit_inode_parent_hidden(name
, root
);
819 filp
= do_create(ipc_ns
, d_inode(root
),
821 u_attr
? &attr
: NULL
);
824 if (d_really_is_negative(path
.dentry
)) {
828 audit_inode(name
, path
.dentry
, 0);
829 filp
= do_open(&path
, oflag
);
833 fd_install(fd
, filp
);
835 error
= PTR_ERR(filp
);
843 inode_unlock(d_inode(root
));
851 SYSCALL_DEFINE1(mq_unlink
, const char __user
*, u_name
)
854 struct filename
*name
;
855 struct dentry
*dentry
;
856 struct inode
*inode
= NULL
;
857 struct ipc_namespace
*ipc_ns
= current
->nsproxy
->ipc_ns
;
858 struct vfsmount
*mnt
= ipc_ns
->mq_mnt
;
860 name
= getname(u_name
);
862 return PTR_ERR(name
);
864 audit_inode_parent_hidden(name
, mnt
->mnt_root
);
865 err
= mnt_want_write(mnt
);
868 inode_lock_nested(d_inode(mnt
->mnt_root
), I_MUTEX_PARENT
);
869 dentry
= lookup_one_len(name
->name
, mnt
->mnt_root
,
871 if (IS_ERR(dentry
)) {
872 err
= PTR_ERR(dentry
);
876 inode
= d_inode(dentry
);
881 err
= vfs_unlink(d_inode(dentry
->d_parent
), dentry
, NULL
);
886 inode_unlock(d_inode(mnt
->mnt_root
));
896 /* Pipelined send and receive functions.
898 * If a receiver finds no waiting message, then it registers itself in the
899 * list of waiting receivers. A sender checks that list before adding the new
900 * message into the message array. If there is a waiting receiver, then it
901 * bypasses the message array and directly hands the message over to the
902 * receiver. The receiver accepts the message and returns without grabbing the
905 * - Set pointer to message.
906 * - Queue the receiver task for later wakeup (without the info->lock).
907 * - Update its state to STATE_READY. Now the receiver can continue.
908 * - Wake up the process after the lock is dropped. Should the process wake up
909 * before this wakeup (due to a timeout or a signal) it will either see
910 * STATE_READY and continue or acquire the lock to check the state again.
912 * The same algorithm is used for senders.
915 /* pipelined_send() - send a message directly to the task waiting in
916 * sys_mq_timedreceive() (without inserting message into a queue).
918 static inline void pipelined_send(struct wake_q_head
*wake_q
,
919 struct mqueue_inode_info
*info
,
920 struct msg_msg
*message
,
921 struct ext_wait_queue
*receiver
)
923 receiver
->msg
= message
;
924 list_del(&receiver
->list
);
925 wake_q_add(wake_q
, receiver
->task
);
927 * Rely on the implicit cmpxchg barrier from wake_q_add such
928 * that we can ensure that updating receiver->state is the last
929 * write operation: As once set, the receiver can continue,
930 * and if we don't have the reference count from the wake_q,
931 * yet, at that point we can later have a use-after-free
932 * condition and bogus wakeup.
934 receiver
->state
= STATE_READY
;
937 /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
938 * gets its message and put to the queue (we have one free place for sure). */
939 static inline void pipelined_receive(struct wake_q_head
*wake_q
,
940 struct mqueue_inode_info
*info
)
942 struct ext_wait_queue
*sender
= wq_get_first_waiter(info
, SEND
);
946 wake_up_interruptible(&info
->wait_q
);
949 if (msg_insert(sender
->msg
, info
))
952 list_del(&sender
->list
);
953 wake_q_add(wake_q
, sender
->task
);
954 sender
->state
= STATE_READY
;
957 SYSCALL_DEFINE5(mq_timedsend
, mqd_t
, mqdes
, const char __user
*, u_msg_ptr
,
958 size_t, msg_len
, unsigned int, msg_prio
,
959 const struct timespec __user
*, u_abs_timeout
)
963 struct ext_wait_queue wait
;
964 struct ext_wait_queue
*receiver
;
965 struct msg_msg
*msg_ptr
;
966 struct mqueue_inode_info
*info
;
967 ktime_t expires
, *timeout
= NULL
;
969 struct posix_msg_tree_node
*new_leaf
= NULL
;
971 DEFINE_WAKE_Q(wake_q
);
974 int res
= prepare_timeout(u_abs_timeout
, &expires
, &ts
);
980 if (unlikely(msg_prio
>= (unsigned long) MQ_PRIO_MAX
))
983 audit_mq_sendrecv(mqdes
, msg_len
, msg_prio
, timeout
? &ts
: NULL
);
986 if (unlikely(!f
.file
)) {
991 inode
= file_inode(f
.file
);
992 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
996 info
= MQUEUE_I(inode
);
999 if (unlikely(!(f
.file
->f_mode
& FMODE_WRITE
))) {
1004 if (unlikely(msg_len
> info
->attr
.mq_msgsize
)) {
1009 /* First try to allocate memory, before doing anything with
1010 * existing queues. */
1011 msg_ptr
= load_msg(u_msg_ptr
, msg_len
);
1012 if (IS_ERR(msg_ptr
)) {
1013 ret
= PTR_ERR(msg_ptr
);
1016 msg_ptr
->m_ts
= msg_len
;
1017 msg_ptr
->m_type
= msg_prio
;
1020 * msg_insert really wants us to have a valid, spare node struct so
1021 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
1022 * fall back to that if necessary.
1024 if (!info
->node_cache
)
1025 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
1027 spin_lock(&info
->lock
);
1029 if (!info
->node_cache
&& new_leaf
) {
1030 /* Save our speculative allocation into the cache */
1031 INIT_LIST_HEAD(&new_leaf
->msg_list
);
1032 info
->node_cache
= new_leaf
;
1038 if (info
->attr
.mq_curmsgs
== info
->attr
.mq_maxmsg
) {
1039 if (f
.file
->f_flags
& O_NONBLOCK
) {
1042 wait
.task
= current
;
1043 wait
.msg
= (void *) msg_ptr
;
1044 wait
.state
= STATE_NONE
;
1045 ret
= wq_sleep(info
, SEND
, timeout
, &wait
);
1047 * wq_sleep must be called with info->lock held, and
1048 * returns with the lock released
1053 receiver
= wq_get_first_waiter(info
, RECV
);
1055 pipelined_send(&wake_q
, info
, msg_ptr
, receiver
);
1057 /* adds message to the queue */
1058 ret
= msg_insert(msg_ptr
, info
);
1063 inode
->i_atime
= inode
->i_mtime
= inode
->i_ctime
=
1064 current_time(inode
);
1067 spin_unlock(&info
->lock
);
1078 SYSCALL_DEFINE5(mq_timedreceive
, mqd_t
, mqdes
, char __user
*, u_msg_ptr
,
1079 size_t, msg_len
, unsigned int __user
*, u_msg_prio
,
1080 const struct timespec __user
*, u_abs_timeout
)
1083 struct msg_msg
*msg_ptr
;
1085 struct inode
*inode
;
1086 struct mqueue_inode_info
*info
;
1087 struct ext_wait_queue wait
;
1088 ktime_t expires
, *timeout
= NULL
;
1090 struct posix_msg_tree_node
*new_leaf
= NULL
;
1092 if (u_abs_timeout
) {
1093 int res
= prepare_timeout(u_abs_timeout
, &expires
, &ts
);
1099 audit_mq_sendrecv(mqdes
, msg_len
, 0, timeout
? &ts
: NULL
);
1102 if (unlikely(!f
.file
)) {
1107 inode
= file_inode(f
.file
);
1108 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1112 info
= MQUEUE_I(inode
);
1115 if (unlikely(!(f
.file
->f_mode
& FMODE_READ
))) {
1120 /* checks if buffer is big enough */
1121 if (unlikely(msg_len
< info
->attr
.mq_msgsize
)) {
1127 * msg_insert really wants us to have a valid, spare node struct so
1128 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
1129 * fall back to that if necessary.
1131 if (!info
->node_cache
)
1132 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
1134 spin_lock(&info
->lock
);
1136 if (!info
->node_cache
&& new_leaf
) {
1137 /* Save our speculative allocation into the cache */
1138 INIT_LIST_HEAD(&new_leaf
->msg_list
);
1139 info
->node_cache
= new_leaf
;
1144 if (info
->attr
.mq_curmsgs
== 0) {
1145 if (f
.file
->f_flags
& O_NONBLOCK
) {
1146 spin_unlock(&info
->lock
);
1149 wait
.task
= current
;
1150 wait
.state
= STATE_NONE
;
1151 ret
= wq_sleep(info
, RECV
, timeout
, &wait
);
1155 DEFINE_WAKE_Q(wake_q
);
1157 msg_ptr
= msg_get(info
);
1159 inode
->i_atime
= inode
->i_mtime
= inode
->i_ctime
=
1160 current_time(inode
);
1162 /* There is now free space in queue. */
1163 pipelined_receive(&wake_q
, info
);
1164 spin_unlock(&info
->lock
);
1169 ret
= msg_ptr
->m_ts
;
1171 if ((u_msg_prio
&& put_user(msg_ptr
->m_type
, u_msg_prio
)) ||
1172 store_msg(u_msg_ptr
, msg_ptr
, msg_ptr
->m_ts
)) {
1184 * Notes: the case when user wants us to deregister (with NULL as pointer)
1185 * and he isn't currently owner of notification, will be silently discarded.
1186 * It isn't explicitly defined in the POSIX.
1188 SYSCALL_DEFINE2(mq_notify
, mqd_t
, mqdes
,
1189 const struct sigevent __user
*, u_notification
)
1194 struct inode
*inode
;
1195 struct sigevent notification
;
1196 struct mqueue_inode_info
*info
;
1199 if (u_notification
) {
1200 if (copy_from_user(¬ification
, u_notification
,
1201 sizeof(struct sigevent
)))
1205 audit_mq_notify(mqdes
, u_notification
? ¬ification
: NULL
);
1209 if (u_notification
!= NULL
) {
1210 if (unlikely(notification
.sigev_notify
!= SIGEV_NONE
&&
1211 notification
.sigev_notify
!= SIGEV_SIGNAL
&&
1212 notification
.sigev_notify
!= SIGEV_THREAD
))
1214 if (notification
.sigev_notify
== SIGEV_SIGNAL
&&
1215 !valid_signal(notification
.sigev_signo
)) {
1218 if (notification
.sigev_notify
== SIGEV_THREAD
) {
1221 /* create the notify skb */
1222 nc
= alloc_skb(NOTIFY_COOKIE_LEN
, GFP_KERNEL
);
1227 if (copy_from_user(nc
->data
,
1228 notification
.sigev_value
.sival_ptr
,
1229 NOTIFY_COOKIE_LEN
)) {
1234 /* TODO: add a header? */
1235 skb_put(nc
, NOTIFY_COOKIE_LEN
);
1236 /* and attach it to the socket */
1238 f
= fdget(notification
.sigev_signo
);
1243 sock
= netlink_getsockbyfilp(f
.file
);
1246 ret
= PTR_ERR(sock
);
1251 timeo
= MAX_SCHEDULE_TIMEOUT
;
1252 ret
= netlink_attachskb(sock
, nc
, &timeo
, NULL
);
1269 inode
= file_inode(f
.file
);
1270 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1274 info
= MQUEUE_I(inode
);
1277 spin_lock(&info
->lock
);
1278 if (u_notification
== NULL
) {
1279 if (info
->notify_owner
== task_tgid(current
)) {
1280 remove_notification(info
);
1281 inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
1283 } else if (info
->notify_owner
!= NULL
) {
1286 switch (notification
.sigev_notify
) {
1288 info
->notify
.sigev_notify
= SIGEV_NONE
;
1291 info
->notify_sock
= sock
;
1292 info
->notify_cookie
= nc
;
1295 info
->notify
.sigev_notify
= SIGEV_THREAD
;
1298 info
->notify
.sigev_signo
= notification
.sigev_signo
;
1299 info
->notify
.sigev_value
= notification
.sigev_value
;
1300 info
->notify
.sigev_notify
= SIGEV_SIGNAL
;
1304 info
->notify_owner
= get_pid(task_tgid(current
));
1305 info
->notify_user_ns
= get_user_ns(current_user_ns());
1306 inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
1308 spin_unlock(&info
->lock
);
1313 netlink_detachskb(sock
, nc
);
1320 SYSCALL_DEFINE3(mq_getsetattr
, mqd_t
, mqdes
,
1321 const struct mq_attr __user
*, u_mqstat
,
1322 struct mq_attr __user
*, u_omqstat
)
1325 struct mq_attr mqstat
, omqstat
;
1327 struct inode
*inode
;
1328 struct mqueue_inode_info
*info
;
1330 if (u_mqstat
!= NULL
) {
1331 if (copy_from_user(&mqstat
, u_mqstat
, sizeof(struct mq_attr
)))
1333 if (mqstat
.mq_flags
& (~O_NONBLOCK
))
1343 inode
= file_inode(f
.file
);
1344 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1348 info
= MQUEUE_I(inode
);
1350 spin_lock(&info
->lock
);
1352 omqstat
= info
->attr
;
1353 omqstat
.mq_flags
= f
.file
->f_flags
& O_NONBLOCK
;
1355 audit_mq_getsetattr(mqdes
, &mqstat
);
1356 spin_lock(&f
.file
->f_lock
);
1357 if (mqstat
.mq_flags
& O_NONBLOCK
)
1358 f
.file
->f_flags
|= O_NONBLOCK
;
1360 f
.file
->f_flags
&= ~O_NONBLOCK
;
1361 spin_unlock(&f
.file
->f_lock
);
1363 inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
1366 spin_unlock(&info
->lock
);
1369 if (u_omqstat
!= NULL
&& copy_to_user(u_omqstat
, &omqstat
,
1370 sizeof(struct mq_attr
)))
1379 static const struct inode_operations mqueue_dir_inode_operations
= {
1380 .lookup
= simple_lookup
,
1381 .create
= mqueue_create
,
1382 .unlink
= mqueue_unlink
,
1385 static const struct file_operations mqueue_file_operations
= {
1386 .flush
= mqueue_flush_file
,
1387 .poll
= mqueue_poll_file
,
1388 .read
= mqueue_read_file
,
1389 .llseek
= default_llseek
,
1392 static const struct super_operations mqueue_super_ops
= {
1393 .alloc_inode
= mqueue_alloc_inode
,
1394 .destroy_inode
= mqueue_destroy_inode
,
1395 .evict_inode
= mqueue_evict_inode
,
1396 .statfs
= simple_statfs
,
1399 static struct file_system_type mqueue_fs_type
= {
1401 .mount
= mqueue_mount
,
1402 .kill_sb
= kill_litter_super
,
1403 .fs_flags
= FS_USERNS_MOUNT
,
1406 int mq_init_ns(struct ipc_namespace
*ns
)
1408 ns
->mq_queues_count
= 0;
1409 ns
->mq_queues_max
= DFLT_QUEUESMAX
;
1410 ns
->mq_msg_max
= DFLT_MSGMAX
;
1411 ns
->mq_msgsize_max
= DFLT_MSGSIZEMAX
;
1412 ns
->mq_msg_default
= DFLT_MSG
;
1413 ns
->mq_msgsize_default
= DFLT_MSGSIZE
;
1415 ns
->mq_mnt
= kern_mount_data(&mqueue_fs_type
, ns
);
1416 if (IS_ERR(ns
->mq_mnt
)) {
1417 int err
= PTR_ERR(ns
->mq_mnt
);
1424 void mq_clear_sbinfo(struct ipc_namespace
*ns
)
1426 ns
->mq_mnt
->mnt_sb
->s_fs_info
= NULL
;
1429 void mq_put_mnt(struct ipc_namespace
*ns
)
1431 kern_unmount(ns
->mq_mnt
);
1434 static int __init
init_mqueue_fs(void)
1438 mqueue_inode_cachep
= kmem_cache_create("mqueue_inode_cache",
1439 sizeof(struct mqueue_inode_info
), 0,
1440 SLAB_HWCACHE_ALIGN
|SLAB_ACCOUNT
, init_once
);
1441 if (mqueue_inode_cachep
== NULL
)
1444 /* ignore failures - they are not fatal */
1445 mq_sysctl_table
= mq_register_sysctl_table();
1447 error
= register_filesystem(&mqueue_fs_type
);
1451 spin_lock_init(&mq_lock
);
1453 error
= mq_init_ns(&init_ipc_ns
);
1455 goto out_filesystem
;
1460 unregister_filesystem(&mqueue_fs_type
);
1462 if (mq_sysctl_table
)
1463 unregister_sysctl_table(mq_sysctl_table
);
1464 kmem_cache_destroy(mqueue_inode_cachep
);
1468 device_initcall(init_mqueue_fs
);