2 * POSIX message queues filesystem for Linux.
4 * Copyright (C) 2003,2004 Krzysztof Benedyczak (golbi@mat.uni.torun.pl)
5 * Michal Wronski (michal.wronski@gmail.com)
7 * Spinlocks: Mohamed Abbas (abbas.mohamed@intel.com)
8 * Lockless receive & send, fd based notify:
9 * Manfred Spraul (manfred@colorfullife.com)
11 * Audit: George Wilson (ltcgcw@us.ibm.com)
13 * This file is released under the GPL.
16 #include <linux/capability.h>
17 #include <linux/init.h>
18 #include <linux/pagemap.h>
19 #include <linux/file.h>
20 #include <linux/mount.h>
21 #include <linux/namei.h>
22 #include <linux/sysctl.h>
23 #include <linux/poll.h>
24 #include <linux/mqueue.h>
25 #include <linux/msg.h>
26 #include <linux/skbuff.h>
27 #include <linux/vmalloc.h>
28 #include <linux/netlink.h>
29 #include <linux/syscalls.h>
30 #include <linux/audit.h>
31 #include <linux/signal.h>
32 #include <linux/mutex.h>
33 #include <linux/nsproxy.h>
34 #include <linux/pid.h>
35 #include <linux/ipc_namespace.h>
36 #include <linux/user_namespace.h>
37 #include <linux/slab.h>
38 #include <linux/sched/wake_q.h>
39 #include <linux/sched/signal.h>
40 #include <linux/sched/user.h>
45 #define MQUEUE_MAGIC 0x19800202
46 #define DIRENT_SIZE 20
47 #define FILENT_SIZE 80
55 struct posix_msg_tree_node
{
56 struct rb_node rb_node
;
57 struct list_head msg_list
;
61 struct ext_wait_queue
{ /* queue of sleeping tasks */
62 struct task_struct
*task
;
63 struct list_head list
;
64 struct msg_msg
*msg
; /* ptr of loaded message */
65 int state
; /* one of STATE_* values */
68 struct mqueue_inode_info
{
70 struct inode vfs_inode
;
71 wait_queue_head_t wait_q
;
73 struct rb_root msg_tree
;
74 struct posix_msg_tree_node
*node_cache
;
77 struct sigevent notify
;
78 struct pid
*notify_owner
;
79 struct user_namespace
*notify_user_ns
;
80 struct user_struct
*user
; /* user who created, for accounting */
81 struct sock
*notify_sock
;
82 struct sk_buff
*notify_cookie
;
84 /* for tasks waiting for free space and messages, respectively */
85 struct ext_wait_queue e_wait_q
[2];
87 unsigned long qsize
; /* size of queue in memory (sum of all msgs) */
90 static const struct inode_operations mqueue_dir_inode_operations
;
91 static const struct file_operations mqueue_file_operations
;
92 static const struct super_operations mqueue_super_ops
;
93 static void remove_notification(struct mqueue_inode_info
*info
);
95 static struct kmem_cache
*mqueue_inode_cachep
;
97 static struct ctl_table_header
*mq_sysctl_table
;
99 static inline struct mqueue_inode_info
*MQUEUE_I(struct inode
*inode
)
101 return container_of(inode
, struct mqueue_inode_info
, vfs_inode
);
105 * This routine should be called with the mq_lock held.
107 static inline struct ipc_namespace
*__get_ns_from_inode(struct inode
*inode
)
109 return get_ipc_ns(inode
->i_sb
->s_fs_info
);
112 static struct ipc_namespace
*get_ns_from_inode(struct inode
*inode
)
114 struct ipc_namespace
*ns
;
117 ns
= __get_ns_from_inode(inode
);
118 spin_unlock(&mq_lock
);
122 /* Auxiliary functions to manipulate messages' list */
123 static int msg_insert(struct msg_msg
*msg
, struct mqueue_inode_info
*info
)
125 struct rb_node
**p
, *parent
= NULL
;
126 struct posix_msg_tree_node
*leaf
;
128 p
= &info
->msg_tree
.rb_node
;
131 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
133 if (likely(leaf
->priority
== msg
->m_type
))
135 else if (msg
->m_type
< leaf
->priority
)
140 if (info
->node_cache
) {
141 leaf
= info
->node_cache
;
142 info
->node_cache
= NULL
;
144 leaf
= kmalloc(sizeof(*leaf
), GFP_ATOMIC
);
147 INIT_LIST_HEAD(&leaf
->msg_list
);
149 leaf
->priority
= msg
->m_type
;
150 rb_link_node(&leaf
->rb_node
, parent
, p
);
151 rb_insert_color(&leaf
->rb_node
, &info
->msg_tree
);
153 info
->attr
.mq_curmsgs
++;
154 info
->qsize
+= msg
->m_ts
;
155 list_add_tail(&msg
->m_list
, &leaf
->msg_list
);
159 static inline struct msg_msg
*msg_get(struct mqueue_inode_info
*info
)
161 struct rb_node
**p
, *parent
= NULL
;
162 struct posix_msg_tree_node
*leaf
;
166 p
= &info
->msg_tree
.rb_node
;
170 * During insert, low priorities go to the left and high to the
171 * right. On receive, we want the highest priorities first, so
172 * walk all the way to the right.
177 if (info
->attr
.mq_curmsgs
) {
178 pr_warn_once("Inconsistency in POSIX message queue, "
179 "no tree element, but supposedly messages "
181 info
->attr
.mq_curmsgs
= 0;
185 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
186 if (unlikely(list_empty(&leaf
->msg_list
))) {
187 pr_warn_once("Inconsistency in POSIX message queue, "
188 "empty leaf node but we haven't implemented "
189 "lazy leaf delete!\n");
190 rb_erase(&leaf
->rb_node
, &info
->msg_tree
);
191 if (info
->node_cache
) {
194 info
->node_cache
= leaf
;
198 msg
= list_first_entry(&leaf
->msg_list
,
199 struct msg_msg
, m_list
);
200 list_del(&msg
->m_list
);
201 if (list_empty(&leaf
->msg_list
)) {
202 rb_erase(&leaf
->rb_node
, &info
->msg_tree
);
203 if (info
->node_cache
) {
206 info
->node_cache
= leaf
;
210 info
->attr
.mq_curmsgs
--;
211 info
->qsize
-= msg
->m_ts
;
215 static struct inode
*mqueue_get_inode(struct super_block
*sb
,
216 struct ipc_namespace
*ipc_ns
, umode_t mode
,
217 struct mq_attr
*attr
)
219 struct user_struct
*u
= current_user();
223 inode
= new_inode(sb
);
227 inode
->i_ino
= get_next_ino();
228 inode
->i_mode
= mode
;
229 inode
->i_uid
= current_fsuid();
230 inode
->i_gid
= current_fsgid();
231 inode
->i_mtime
= inode
->i_ctime
= inode
->i_atime
= current_time(inode
);
234 struct mqueue_inode_info
*info
;
235 unsigned long mq_bytes
, mq_treesize
;
237 inode
->i_fop
= &mqueue_file_operations
;
238 inode
->i_size
= FILENT_SIZE
;
239 /* mqueue specific info */
240 info
= MQUEUE_I(inode
);
241 spin_lock_init(&info
->lock
);
242 init_waitqueue_head(&info
->wait_q
);
243 INIT_LIST_HEAD(&info
->e_wait_q
[0].list
);
244 INIT_LIST_HEAD(&info
->e_wait_q
[1].list
);
245 info
->notify_owner
= NULL
;
246 info
->notify_user_ns
= NULL
;
248 info
->user
= NULL
; /* set when all is ok */
249 info
->msg_tree
= RB_ROOT
;
250 info
->node_cache
= NULL
;
251 memset(&info
->attr
, 0, sizeof(info
->attr
));
252 info
->attr
.mq_maxmsg
= min(ipc_ns
->mq_msg_max
,
253 ipc_ns
->mq_msg_default
);
254 info
->attr
.mq_msgsize
= min(ipc_ns
->mq_msgsize_max
,
255 ipc_ns
->mq_msgsize_default
);
257 info
->attr
.mq_maxmsg
= attr
->mq_maxmsg
;
258 info
->attr
.mq_msgsize
= attr
->mq_msgsize
;
261 * We used to allocate a static array of pointers and account
262 * the size of that array as well as one msg_msg struct per
263 * possible message into the queue size. That's no longer
264 * accurate as the queue is now an rbtree and will grow and
265 * shrink depending on usage patterns. We can, however, still
266 * account one msg_msg struct per message, but the nodes are
267 * allocated depending on priority usage, and most programs
268 * only use one, or a handful, of priorities. However, since
269 * this is pinned memory, we need to assume worst case, so
270 * that means the min(mq_maxmsg, max_priorities) * struct
271 * posix_msg_tree_node.
273 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
274 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
275 sizeof(struct posix_msg_tree_node
);
277 mq_bytes
= mq_treesize
+ (info
->attr
.mq_maxmsg
*
278 info
->attr
.mq_msgsize
);
281 if (u
->mq_bytes
+ mq_bytes
< u
->mq_bytes
||
282 u
->mq_bytes
+ mq_bytes
> rlimit(RLIMIT_MSGQUEUE
)) {
283 spin_unlock(&mq_lock
);
284 /* mqueue_evict_inode() releases info->messages */
288 u
->mq_bytes
+= mq_bytes
;
289 spin_unlock(&mq_lock
);
292 info
->user
= get_uid(u
);
293 } else if (S_ISDIR(mode
)) {
295 /* Some things misbehave if size == 0 on a directory */
296 inode
->i_size
= 2 * DIRENT_SIZE
;
297 inode
->i_op
= &mqueue_dir_inode_operations
;
298 inode
->i_fop
= &simple_dir_operations
;
308 static int mqueue_fill_super(struct super_block
*sb
, void *data
, int silent
)
311 struct ipc_namespace
*ns
= sb
->s_fs_info
;
313 sb
->s_iflags
|= SB_I_NOEXEC
| SB_I_NODEV
;
314 sb
->s_blocksize
= PAGE_SIZE
;
315 sb
->s_blocksize_bits
= PAGE_SHIFT
;
316 sb
->s_magic
= MQUEUE_MAGIC
;
317 sb
->s_op
= &mqueue_super_ops
;
319 inode
= mqueue_get_inode(sb
, ns
, S_IFDIR
| S_ISVTX
| S_IRWXUGO
, NULL
);
321 return PTR_ERR(inode
);
323 sb
->s_root
= d_make_root(inode
);
329 static struct dentry
*mqueue_mount(struct file_system_type
*fs_type
,
330 int flags
, const char *dev_name
,
333 struct ipc_namespace
*ns
;
334 if (flags
& SB_KERNMOUNT
) {
338 ns
= current
->nsproxy
->ipc_ns
;
340 return mount_ns(fs_type
, flags
, data
, ns
, ns
->user_ns
, mqueue_fill_super
);
343 static void init_once(void *foo
)
345 struct mqueue_inode_info
*p
= (struct mqueue_inode_info
*) foo
;
347 inode_init_once(&p
->vfs_inode
);
350 static struct inode
*mqueue_alloc_inode(struct super_block
*sb
)
352 struct mqueue_inode_info
*ei
;
354 ei
= kmem_cache_alloc(mqueue_inode_cachep
, GFP_KERNEL
);
357 return &ei
->vfs_inode
;
360 static void mqueue_i_callback(struct rcu_head
*head
)
362 struct inode
*inode
= container_of(head
, struct inode
, i_rcu
);
363 kmem_cache_free(mqueue_inode_cachep
, MQUEUE_I(inode
));
366 static void mqueue_destroy_inode(struct inode
*inode
)
368 call_rcu(&inode
->i_rcu
, mqueue_i_callback
);
371 static void mqueue_evict_inode(struct inode
*inode
)
373 struct mqueue_inode_info
*info
;
374 struct user_struct
*user
;
375 struct ipc_namespace
*ipc_ns
;
376 struct msg_msg
*msg
, *nmsg
;
381 if (S_ISDIR(inode
->i_mode
))
384 ipc_ns
= get_ns_from_inode(inode
);
385 info
= MQUEUE_I(inode
);
386 spin_lock(&info
->lock
);
387 while ((msg
= msg_get(info
)) != NULL
)
388 list_add_tail(&msg
->m_list
, &tmp_msg
);
389 kfree(info
->node_cache
);
390 spin_unlock(&info
->lock
);
392 list_for_each_entry_safe(msg
, nmsg
, &tmp_msg
, m_list
) {
393 list_del(&msg
->m_list
);
399 unsigned long mq_bytes
, mq_treesize
;
401 /* Total amount of bytes accounted for the mqueue */
402 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
403 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
404 sizeof(struct posix_msg_tree_node
);
406 mq_bytes
= mq_treesize
+ (info
->attr
.mq_maxmsg
*
407 info
->attr
.mq_msgsize
);
410 user
->mq_bytes
-= mq_bytes
;
412 * get_ns_from_inode() ensures that the
413 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
414 * to which we now hold a reference, or it is NULL.
415 * We can't put it here under mq_lock, though.
418 ipc_ns
->mq_queues_count
--;
419 spin_unlock(&mq_lock
);
426 static int mqueue_create(struct inode
*dir
, struct dentry
*dentry
,
427 umode_t mode
, bool excl
)
430 struct mq_attr
*attr
= dentry
->d_fsdata
;
432 struct ipc_namespace
*ipc_ns
;
435 ipc_ns
= __get_ns_from_inode(dir
);
441 if (ipc_ns
->mq_queues_count
>= ipc_ns
->mq_queues_max
&&
442 !capable(CAP_SYS_RESOURCE
)) {
446 ipc_ns
->mq_queues_count
++;
447 spin_unlock(&mq_lock
);
449 inode
= mqueue_get_inode(dir
->i_sb
, ipc_ns
, mode
, attr
);
451 error
= PTR_ERR(inode
);
453 ipc_ns
->mq_queues_count
--;
458 dir
->i_size
+= DIRENT_SIZE
;
459 dir
->i_ctime
= dir
->i_mtime
= dir
->i_atime
= current_time(dir
);
461 d_instantiate(dentry
, inode
);
465 spin_unlock(&mq_lock
);
471 static int mqueue_unlink(struct inode
*dir
, struct dentry
*dentry
)
473 struct inode
*inode
= d_inode(dentry
);
475 dir
->i_ctime
= dir
->i_mtime
= dir
->i_atime
= current_time(dir
);
476 dir
->i_size
-= DIRENT_SIZE
;
483 * This is routine for system read from queue file.
484 * To avoid mess with doing here some sort of mq_receive we allow
485 * to read only queue size & notification info (the only values
486 * that are interesting from user point of view and aren't accessible
487 * through std routines)
489 static ssize_t
mqueue_read_file(struct file
*filp
, char __user
*u_data
,
490 size_t count
, loff_t
*off
)
492 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
493 char buffer
[FILENT_SIZE
];
496 spin_lock(&info
->lock
);
497 snprintf(buffer
, sizeof(buffer
),
498 "QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",
500 info
->notify_owner
? info
->notify
.sigev_notify
: 0,
501 (info
->notify_owner
&&
502 info
->notify
.sigev_notify
== SIGEV_SIGNAL
) ?
503 info
->notify
.sigev_signo
: 0,
504 pid_vnr(info
->notify_owner
));
505 spin_unlock(&info
->lock
);
506 buffer
[sizeof(buffer
)-1] = '\0';
508 ret
= simple_read_from_buffer(u_data
, count
, off
, buffer
,
513 file_inode(filp
)->i_atime
= file_inode(filp
)->i_ctime
= current_time(file_inode(filp
));
517 static int mqueue_flush_file(struct file
*filp
, fl_owner_t id
)
519 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
521 spin_lock(&info
->lock
);
522 if (task_tgid(current
) == info
->notify_owner
)
523 remove_notification(info
);
525 spin_unlock(&info
->lock
);
529 static unsigned int mqueue_poll_file(struct file
*filp
, struct poll_table_struct
*poll_tab
)
531 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
534 poll_wait(filp
, &info
->wait_q
, poll_tab
);
536 spin_lock(&info
->lock
);
537 if (info
->attr
.mq_curmsgs
)
538 retval
= POLLIN
| POLLRDNORM
;
540 if (info
->attr
.mq_curmsgs
< info
->attr
.mq_maxmsg
)
541 retval
|= POLLOUT
| POLLWRNORM
;
542 spin_unlock(&info
->lock
);
547 /* Adds current to info->e_wait_q[sr] before element with smaller prio */
548 static void wq_add(struct mqueue_inode_info
*info
, int sr
,
549 struct ext_wait_queue
*ewp
)
551 struct ext_wait_queue
*walk
;
555 list_for_each_entry(walk
, &info
->e_wait_q
[sr
].list
, list
) {
556 if (walk
->task
->static_prio
<= current
->static_prio
) {
557 list_add_tail(&ewp
->list
, &walk
->list
);
561 list_add_tail(&ewp
->list
, &info
->e_wait_q
[sr
].list
);
565 * Puts current task to sleep. Caller must hold queue lock. After return
569 static int wq_sleep(struct mqueue_inode_info
*info
, int sr
,
570 ktime_t
*timeout
, struct ext_wait_queue
*ewp
)
571 __releases(&info
->lock
)
576 wq_add(info
, sr
, ewp
);
579 __set_current_state(TASK_INTERRUPTIBLE
);
581 spin_unlock(&info
->lock
);
582 time
= schedule_hrtimeout_range_clock(timeout
, 0,
583 HRTIMER_MODE_ABS
, CLOCK_REALTIME
);
585 if (ewp
->state
== STATE_READY
) {
589 spin_lock(&info
->lock
);
590 if (ewp
->state
== STATE_READY
) {
594 if (signal_pending(current
)) {
595 retval
= -ERESTARTSYS
;
603 list_del(&ewp
->list
);
605 spin_unlock(&info
->lock
);
611 * Returns waiting task that should be serviced first or NULL if none exists
613 static struct ext_wait_queue
*wq_get_first_waiter(
614 struct mqueue_inode_info
*info
, int sr
)
616 struct list_head
*ptr
;
618 ptr
= info
->e_wait_q
[sr
].list
.prev
;
619 if (ptr
== &info
->e_wait_q
[sr
].list
)
621 return list_entry(ptr
, struct ext_wait_queue
, list
);
625 static inline void set_cookie(struct sk_buff
*skb
, char code
)
627 ((char *)skb
->data
)[NOTIFY_COOKIE_LEN
-1] = code
;
631 * The next function is only to split too long sys_mq_timedsend
633 static void __do_notify(struct mqueue_inode_info
*info
)
636 * invoked when there is registered process and there isn't process
637 * waiting synchronously for message AND state of queue changed from
638 * empty to not empty. Here we are sure that no one is waiting
640 if (info
->notify_owner
&&
641 info
->attr
.mq_curmsgs
== 1) {
642 struct siginfo sig_i
;
643 switch (info
->notify
.sigev_notify
) {
649 sig_i
.si_signo
= info
->notify
.sigev_signo
;
651 sig_i
.si_code
= SI_MESGQ
;
652 sig_i
.si_value
= info
->notify
.sigev_value
;
653 /* map current pid/uid into info->owner's namespaces */
655 sig_i
.si_pid
= task_tgid_nr_ns(current
,
656 ns_of_pid(info
->notify_owner
));
657 sig_i
.si_uid
= from_kuid_munged(info
->notify_user_ns
, current_uid());
660 kill_pid_info(info
->notify
.sigev_signo
,
661 &sig_i
, info
->notify_owner
);
664 set_cookie(info
->notify_cookie
, NOTIFY_WOKENUP
);
665 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
668 /* after notification unregisters process */
669 put_pid(info
->notify_owner
);
670 put_user_ns(info
->notify_user_ns
);
671 info
->notify_owner
= NULL
;
672 info
->notify_user_ns
= NULL
;
674 wake_up(&info
->wait_q
);
677 static int prepare_timeout(const struct timespec __user
*u_abs_timeout
,
678 struct timespec64
*ts
)
680 if (get_timespec64(ts
, u_abs_timeout
))
682 if (!timespec64_valid(ts
))
687 static void remove_notification(struct mqueue_inode_info
*info
)
689 if (info
->notify_owner
!= NULL
&&
690 info
->notify
.sigev_notify
== SIGEV_THREAD
) {
691 set_cookie(info
->notify_cookie
, NOTIFY_REMOVED
);
692 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
694 put_pid(info
->notify_owner
);
695 put_user_ns(info
->notify_user_ns
);
696 info
->notify_owner
= NULL
;
697 info
->notify_user_ns
= NULL
;
700 static int mq_attr_ok(struct ipc_namespace
*ipc_ns
, struct mq_attr
*attr
)
703 unsigned long total_size
;
705 if (attr
->mq_maxmsg
<= 0 || attr
->mq_msgsize
<= 0)
707 if (capable(CAP_SYS_RESOURCE
)) {
708 if (attr
->mq_maxmsg
> HARD_MSGMAX
||
709 attr
->mq_msgsize
> HARD_MSGSIZEMAX
)
712 if (attr
->mq_maxmsg
> ipc_ns
->mq_msg_max
||
713 attr
->mq_msgsize
> ipc_ns
->mq_msgsize_max
)
716 /* check for overflow */
717 if (attr
->mq_msgsize
> ULONG_MAX
/attr
->mq_maxmsg
)
719 mq_treesize
= attr
->mq_maxmsg
* sizeof(struct msg_msg
) +
720 min_t(unsigned int, attr
->mq_maxmsg
, MQ_PRIO_MAX
) *
721 sizeof(struct posix_msg_tree_node
);
722 total_size
= attr
->mq_maxmsg
* attr
->mq_msgsize
;
723 if (total_size
+ mq_treesize
< total_size
)
729 * Invoked when creating a new queue via sys_mq_open
731 static struct file
*do_create(struct ipc_namespace
*ipc_ns
, struct inode
*dir
,
732 struct path
*path
, int oflag
, umode_t mode
,
733 struct mq_attr
*attr
)
735 const struct cred
*cred
= current_cred();
739 ret
= mq_attr_ok(ipc_ns
, attr
);
742 /* store for use during create */
743 path
->dentry
->d_fsdata
= attr
;
745 struct mq_attr def_attr
;
747 def_attr
.mq_maxmsg
= min(ipc_ns
->mq_msg_max
,
748 ipc_ns
->mq_msg_default
);
749 def_attr
.mq_msgsize
= min(ipc_ns
->mq_msgsize_max
,
750 ipc_ns
->mq_msgsize_default
);
751 ret
= mq_attr_ok(ipc_ns
, &def_attr
);
756 mode
&= ~current_umask();
757 ret
= vfs_create(dir
, path
->dentry
, mode
, true);
758 path
->dentry
->d_fsdata
= NULL
;
761 return dentry_open(path
, oflag
, cred
);
764 /* Opens existing queue */
765 static struct file
*do_open(struct path
*path
, int oflag
)
767 static const int oflag2acc
[O_ACCMODE
] = { MAY_READ
, MAY_WRITE
,
768 MAY_READ
| MAY_WRITE
};
770 if ((oflag
& O_ACCMODE
) == (O_RDWR
| O_WRONLY
))
771 return ERR_PTR(-EINVAL
);
772 acc
= oflag2acc
[oflag
& O_ACCMODE
];
773 if (inode_permission(d_inode(path
->dentry
), acc
))
774 return ERR_PTR(-EACCES
);
775 return dentry_open(path
, oflag
, current_cred());
778 static int do_mq_open(const char __user
*u_name
, int oflag
, umode_t mode
,
779 struct mq_attr
*attr
)
783 struct filename
*name
;
785 struct ipc_namespace
*ipc_ns
= current
->nsproxy
->ipc_ns
;
786 struct vfsmount
*mnt
= ipc_ns
->mq_mnt
;
787 struct dentry
*root
= mnt
->mnt_root
;
790 audit_mq_open(oflag
, mode
, attr
);
792 if (IS_ERR(name
= getname(u_name
)))
793 return PTR_ERR(name
);
795 fd
= get_unused_fd_flags(O_CLOEXEC
);
799 ro
= mnt_want_write(mnt
); /* we'll drop it in any case */
801 inode_lock(d_inode(root
));
802 path
.dentry
= lookup_one_len(name
->name
, root
, strlen(name
->name
));
803 if (IS_ERR(path
.dentry
)) {
804 error
= PTR_ERR(path
.dentry
);
807 path
.mnt
= mntget(mnt
);
809 if (oflag
& O_CREAT
) {
810 if (d_really_is_positive(path
.dentry
)) { /* entry already exists */
811 audit_inode(name
, path
.dentry
, 0);
812 if (oflag
& O_EXCL
) {
816 filp
= do_open(&path
, oflag
);
822 audit_inode_parent_hidden(name
, root
);
823 filp
= do_create(ipc_ns
, d_inode(root
), &path
,
827 if (d_really_is_negative(path
.dentry
)) {
831 audit_inode(name
, path
.dentry
, 0);
832 filp
= do_open(&path
, oflag
);
836 fd_install(fd
, filp
);
838 error
= PTR_ERR(filp
);
846 inode_unlock(d_inode(root
));
854 SYSCALL_DEFINE4(mq_open
, const char __user
*, u_name
, int, oflag
, umode_t
, mode
,
855 struct mq_attr __user
*, u_attr
)
858 if (u_attr
&& copy_from_user(&attr
, u_attr
, sizeof(struct mq_attr
)))
861 return do_mq_open(u_name
, oflag
, mode
, u_attr
? &attr
: NULL
);
864 SYSCALL_DEFINE1(mq_unlink
, const char __user
*, u_name
)
867 struct filename
*name
;
868 struct dentry
*dentry
;
869 struct inode
*inode
= NULL
;
870 struct ipc_namespace
*ipc_ns
= current
->nsproxy
->ipc_ns
;
871 struct vfsmount
*mnt
= ipc_ns
->mq_mnt
;
873 name
= getname(u_name
);
875 return PTR_ERR(name
);
877 audit_inode_parent_hidden(name
, mnt
->mnt_root
);
878 err
= mnt_want_write(mnt
);
881 inode_lock_nested(d_inode(mnt
->mnt_root
), I_MUTEX_PARENT
);
882 dentry
= lookup_one_len(name
->name
, mnt
->mnt_root
,
884 if (IS_ERR(dentry
)) {
885 err
= PTR_ERR(dentry
);
889 inode
= d_inode(dentry
);
894 err
= vfs_unlink(d_inode(dentry
->d_parent
), dentry
, NULL
);
899 inode_unlock(d_inode(mnt
->mnt_root
));
909 /* Pipelined send and receive functions.
911 * If a receiver finds no waiting message, then it registers itself in the
912 * list of waiting receivers. A sender checks that list before adding the new
913 * message into the message array. If there is a waiting receiver, then it
914 * bypasses the message array and directly hands the message over to the
915 * receiver. The receiver accepts the message and returns without grabbing the
918 * - Set pointer to message.
919 * - Queue the receiver task for later wakeup (without the info->lock).
920 * - Update its state to STATE_READY. Now the receiver can continue.
921 * - Wake up the process after the lock is dropped. Should the process wake up
922 * before this wakeup (due to a timeout or a signal) it will either see
923 * STATE_READY and continue or acquire the lock to check the state again.
925 * The same algorithm is used for senders.
928 /* pipelined_send() - send a message directly to the task waiting in
929 * sys_mq_timedreceive() (without inserting message into a queue).
931 static inline void pipelined_send(struct wake_q_head
*wake_q
,
932 struct mqueue_inode_info
*info
,
933 struct msg_msg
*message
,
934 struct ext_wait_queue
*receiver
)
936 receiver
->msg
= message
;
937 list_del(&receiver
->list
);
938 wake_q_add(wake_q
, receiver
->task
);
940 * Rely on the implicit cmpxchg barrier from wake_q_add such
941 * that we can ensure that updating receiver->state is the last
942 * write operation: As once set, the receiver can continue,
943 * and if we don't have the reference count from the wake_q,
944 * yet, at that point we can later have a use-after-free
945 * condition and bogus wakeup.
947 receiver
->state
= STATE_READY
;
950 /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
951 * gets its message and put to the queue (we have one free place for sure). */
952 static inline void pipelined_receive(struct wake_q_head
*wake_q
,
953 struct mqueue_inode_info
*info
)
955 struct ext_wait_queue
*sender
= wq_get_first_waiter(info
, SEND
);
959 wake_up_interruptible(&info
->wait_q
);
962 if (msg_insert(sender
->msg
, info
))
965 list_del(&sender
->list
);
966 wake_q_add(wake_q
, sender
->task
);
967 sender
->state
= STATE_READY
;
970 static int do_mq_timedsend(mqd_t mqdes
, const char __user
*u_msg_ptr
,
971 size_t msg_len
, unsigned int msg_prio
,
972 struct timespec64
*ts
)
976 struct ext_wait_queue wait
;
977 struct ext_wait_queue
*receiver
;
978 struct msg_msg
*msg_ptr
;
979 struct mqueue_inode_info
*info
;
980 ktime_t expires
, *timeout
= NULL
;
981 struct posix_msg_tree_node
*new_leaf
= NULL
;
983 DEFINE_WAKE_Q(wake_q
);
985 if (unlikely(msg_prio
>= (unsigned long) MQ_PRIO_MAX
))
989 expires
= timespec64_to_ktime(*ts
);
993 audit_mq_sendrecv(mqdes
, msg_len
, msg_prio
, ts
);
996 if (unlikely(!f
.file
)) {
1001 inode
= file_inode(f
.file
);
1002 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1006 info
= MQUEUE_I(inode
);
1009 if (unlikely(!(f
.file
->f_mode
& FMODE_WRITE
))) {
1014 if (unlikely(msg_len
> info
->attr
.mq_msgsize
)) {
1019 /* First try to allocate memory, before doing anything with
1020 * existing queues. */
1021 msg_ptr
= load_msg(u_msg_ptr
, msg_len
);
1022 if (IS_ERR(msg_ptr
)) {
1023 ret
= PTR_ERR(msg_ptr
);
1026 msg_ptr
->m_ts
= msg_len
;
1027 msg_ptr
->m_type
= msg_prio
;
1030 * msg_insert really wants us to have a valid, spare node struct so
1031 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
1032 * fall back to that if necessary.
1034 if (!info
->node_cache
)
1035 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
1037 spin_lock(&info
->lock
);
1039 if (!info
->node_cache
&& new_leaf
) {
1040 /* Save our speculative allocation into the cache */
1041 INIT_LIST_HEAD(&new_leaf
->msg_list
);
1042 info
->node_cache
= new_leaf
;
1048 if (info
->attr
.mq_curmsgs
== info
->attr
.mq_maxmsg
) {
1049 if (f
.file
->f_flags
& O_NONBLOCK
) {
1052 wait
.task
= current
;
1053 wait
.msg
= (void *) msg_ptr
;
1054 wait
.state
= STATE_NONE
;
1055 ret
= wq_sleep(info
, SEND
, timeout
, &wait
);
1057 * wq_sleep must be called with info->lock held, and
1058 * returns with the lock released
1063 receiver
= wq_get_first_waiter(info
, RECV
);
1065 pipelined_send(&wake_q
, info
, msg_ptr
, receiver
);
1067 /* adds message to the queue */
1068 ret
= msg_insert(msg_ptr
, info
);
1073 inode
->i_atime
= inode
->i_mtime
= inode
->i_ctime
=
1074 current_time(inode
);
1077 spin_unlock(&info
->lock
);
1088 static int do_mq_timedreceive(mqd_t mqdes
, char __user
*u_msg_ptr
,
1089 size_t msg_len
, unsigned int __user
*u_msg_prio
,
1090 struct timespec64
*ts
)
1093 struct msg_msg
*msg_ptr
;
1095 struct inode
*inode
;
1096 struct mqueue_inode_info
*info
;
1097 struct ext_wait_queue wait
;
1098 ktime_t expires
, *timeout
= NULL
;
1099 struct posix_msg_tree_node
*new_leaf
= NULL
;
1102 expires
= timespec64_to_ktime(*ts
);
1106 audit_mq_sendrecv(mqdes
, msg_len
, 0, ts
);
1109 if (unlikely(!f
.file
)) {
1114 inode
= file_inode(f
.file
);
1115 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1119 info
= MQUEUE_I(inode
);
1122 if (unlikely(!(f
.file
->f_mode
& FMODE_READ
))) {
1127 /* checks if buffer is big enough */
1128 if (unlikely(msg_len
< info
->attr
.mq_msgsize
)) {
1134 * msg_insert really wants us to have a valid, spare node struct so
1135 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
1136 * fall back to that if necessary.
1138 if (!info
->node_cache
)
1139 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
1141 spin_lock(&info
->lock
);
1143 if (!info
->node_cache
&& new_leaf
) {
1144 /* Save our speculative allocation into the cache */
1145 INIT_LIST_HEAD(&new_leaf
->msg_list
);
1146 info
->node_cache
= new_leaf
;
1151 if (info
->attr
.mq_curmsgs
== 0) {
1152 if (f
.file
->f_flags
& O_NONBLOCK
) {
1153 spin_unlock(&info
->lock
);
1156 wait
.task
= current
;
1157 wait
.state
= STATE_NONE
;
1158 ret
= wq_sleep(info
, RECV
, timeout
, &wait
);
1162 DEFINE_WAKE_Q(wake_q
);
1164 msg_ptr
= msg_get(info
);
1166 inode
->i_atime
= inode
->i_mtime
= inode
->i_ctime
=
1167 current_time(inode
);
1169 /* There is now free space in queue. */
1170 pipelined_receive(&wake_q
, info
);
1171 spin_unlock(&info
->lock
);
1176 ret
= msg_ptr
->m_ts
;
1178 if ((u_msg_prio
&& put_user(msg_ptr
->m_type
, u_msg_prio
)) ||
1179 store_msg(u_msg_ptr
, msg_ptr
, msg_ptr
->m_ts
)) {
1190 SYSCALL_DEFINE5(mq_timedsend
, mqd_t
, mqdes
, const char __user
*, u_msg_ptr
,
1191 size_t, msg_len
, unsigned int, msg_prio
,
1192 const struct timespec __user
*, u_abs_timeout
)
1194 struct timespec64 ts
, *p
= NULL
;
1195 if (u_abs_timeout
) {
1196 int res
= prepare_timeout(u_abs_timeout
, &ts
);
1201 return do_mq_timedsend(mqdes
, u_msg_ptr
, msg_len
, msg_prio
, p
);
1204 SYSCALL_DEFINE5(mq_timedreceive
, mqd_t
, mqdes
, char __user
*, u_msg_ptr
,
1205 size_t, msg_len
, unsigned int __user
*, u_msg_prio
,
1206 const struct timespec __user
*, u_abs_timeout
)
1208 struct timespec64 ts
, *p
= NULL
;
1209 if (u_abs_timeout
) {
1210 int res
= prepare_timeout(u_abs_timeout
, &ts
);
1215 return do_mq_timedreceive(mqdes
, u_msg_ptr
, msg_len
, u_msg_prio
, p
);
1219 * Notes: the case when user wants us to deregister (with NULL as pointer)
1220 * and he isn't currently owner of notification, will be silently discarded.
1221 * It isn't explicitly defined in the POSIX.
1223 static int do_mq_notify(mqd_t mqdes
, const struct sigevent
*notification
)
1228 struct inode
*inode
;
1229 struct mqueue_inode_info
*info
;
1232 audit_mq_notify(mqdes
, notification
);
1236 if (notification
!= NULL
) {
1237 if (unlikely(notification
->sigev_notify
!= SIGEV_NONE
&&
1238 notification
->sigev_notify
!= SIGEV_SIGNAL
&&
1239 notification
->sigev_notify
!= SIGEV_THREAD
))
1241 if (notification
->sigev_notify
== SIGEV_SIGNAL
&&
1242 !valid_signal(notification
->sigev_signo
)) {
1245 if (notification
->sigev_notify
== SIGEV_THREAD
) {
1248 /* create the notify skb */
1249 nc
= alloc_skb(NOTIFY_COOKIE_LEN
, GFP_KERNEL
);
1254 if (copy_from_user(nc
->data
,
1255 notification
->sigev_value
.sival_ptr
,
1256 NOTIFY_COOKIE_LEN
)) {
1261 /* TODO: add a header? */
1262 skb_put(nc
, NOTIFY_COOKIE_LEN
);
1263 /* and attach it to the socket */
1265 f
= fdget(notification
->sigev_signo
);
1270 sock
= netlink_getsockbyfilp(f
.file
);
1273 ret
= PTR_ERR(sock
);
1278 timeo
= MAX_SCHEDULE_TIMEOUT
;
1279 ret
= netlink_attachskb(sock
, nc
, &timeo
, NULL
);
1298 inode
= file_inode(f
.file
);
1299 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1303 info
= MQUEUE_I(inode
);
1306 spin_lock(&info
->lock
);
1307 if (notification
== NULL
) {
1308 if (info
->notify_owner
== task_tgid(current
)) {
1309 remove_notification(info
);
1310 inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
1312 } else if (info
->notify_owner
!= NULL
) {
1315 switch (notification
->sigev_notify
) {
1317 info
->notify
.sigev_notify
= SIGEV_NONE
;
1320 info
->notify_sock
= sock
;
1321 info
->notify_cookie
= nc
;
1324 info
->notify
.sigev_notify
= SIGEV_THREAD
;
1327 info
->notify
.sigev_signo
= notification
->sigev_signo
;
1328 info
->notify
.sigev_value
= notification
->sigev_value
;
1329 info
->notify
.sigev_notify
= SIGEV_SIGNAL
;
1333 info
->notify_owner
= get_pid(task_tgid(current
));
1334 info
->notify_user_ns
= get_user_ns(current_user_ns());
1335 inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
1337 spin_unlock(&info
->lock
);
1342 netlink_detachskb(sock
, nc
);
1349 SYSCALL_DEFINE2(mq_notify
, mqd_t
, mqdes
,
1350 const struct sigevent __user
*, u_notification
)
1352 struct sigevent n
, *p
= NULL
;
1353 if (u_notification
) {
1354 if (copy_from_user(&n
, u_notification
, sizeof(struct sigevent
)))
1358 return do_mq_notify(mqdes
, p
);
1361 static int do_mq_getsetattr(int mqdes
, struct mq_attr
*new, struct mq_attr
*old
)
1364 struct inode
*inode
;
1365 struct mqueue_inode_info
*info
;
1367 if (new && (new->mq_flags
& (~O_NONBLOCK
)))
1374 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1379 inode
= file_inode(f
.file
);
1380 info
= MQUEUE_I(inode
);
1382 spin_lock(&info
->lock
);
1386 old
->mq_flags
= f
.file
->f_flags
& O_NONBLOCK
;
1389 audit_mq_getsetattr(mqdes
, new);
1390 spin_lock(&f
.file
->f_lock
);
1391 if (new->mq_flags
& O_NONBLOCK
)
1392 f
.file
->f_flags
|= O_NONBLOCK
;
1394 f
.file
->f_flags
&= ~O_NONBLOCK
;
1395 spin_unlock(&f
.file
->f_lock
);
1397 inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
1400 spin_unlock(&info
->lock
);
1405 SYSCALL_DEFINE3(mq_getsetattr
, mqd_t
, mqdes
,
1406 const struct mq_attr __user
*, u_mqstat
,
1407 struct mq_attr __user
*, u_omqstat
)
1410 struct mq_attr mqstat
, omqstat
;
1411 struct mq_attr
*new = NULL
, *old
= NULL
;
1415 if (copy_from_user(new, u_mqstat
, sizeof(struct mq_attr
)))
1421 ret
= do_mq_getsetattr(mqdes
, new, old
);
1425 if (copy_to_user(u_omqstat
, old
, sizeof(struct mq_attr
)))
1430 #ifdef CONFIG_COMPAT
1432 struct compat_mq_attr
{
1433 compat_long_t mq_flags
; /* message queue flags */
1434 compat_long_t mq_maxmsg
; /* maximum number of messages */
1435 compat_long_t mq_msgsize
; /* maximum message size */
1436 compat_long_t mq_curmsgs
; /* number of messages currently queued */
1437 compat_long_t __reserved
[4]; /* ignored for input, zeroed for output */
1440 static inline int get_compat_mq_attr(struct mq_attr
*attr
,
1441 const struct compat_mq_attr __user
*uattr
)
1443 struct compat_mq_attr v
;
1445 if (copy_from_user(&v
, uattr
, sizeof(*uattr
)))
1448 memset(attr
, 0, sizeof(*attr
));
1449 attr
->mq_flags
= v
.mq_flags
;
1450 attr
->mq_maxmsg
= v
.mq_maxmsg
;
1451 attr
->mq_msgsize
= v
.mq_msgsize
;
1452 attr
->mq_curmsgs
= v
.mq_curmsgs
;
1456 static inline int put_compat_mq_attr(const struct mq_attr
*attr
,
1457 struct compat_mq_attr __user
*uattr
)
1459 struct compat_mq_attr v
;
1461 memset(&v
, 0, sizeof(v
));
1462 v
.mq_flags
= attr
->mq_flags
;
1463 v
.mq_maxmsg
= attr
->mq_maxmsg
;
1464 v
.mq_msgsize
= attr
->mq_msgsize
;
1465 v
.mq_curmsgs
= attr
->mq_curmsgs
;
1466 if (copy_to_user(uattr
, &v
, sizeof(*uattr
)))
1471 COMPAT_SYSCALL_DEFINE4(mq_open
, const char __user
*, u_name
,
1472 int, oflag
, compat_mode_t
, mode
,
1473 struct compat_mq_attr __user
*, u_attr
)
1475 struct mq_attr attr
, *p
= NULL
;
1476 if (u_attr
&& oflag
& O_CREAT
) {
1478 if (get_compat_mq_attr(&attr
, u_attr
))
1481 return do_mq_open(u_name
, oflag
, mode
, p
);
1484 static int compat_prepare_timeout(const struct compat_timespec __user
*p
,
1485 struct timespec64
*ts
)
1487 if (compat_get_timespec64(ts
, p
))
1489 if (!timespec64_valid(ts
))
1494 COMPAT_SYSCALL_DEFINE5(mq_timedsend
, mqd_t
, mqdes
,
1495 const char __user
*, u_msg_ptr
,
1496 compat_size_t
, msg_len
, unsigned int, msg_prio
,
1497 const struct compat_timespec __user
*, u_abs_timeout
)
1499 struct timespec64 ts
, *p
= NULL
;
1500 if (u_abs_timeout
) {
1501 int res
= compat_prepare_timeout(u_abs_timeout
, &ts
);
1506 return do_mq_timedsend(mqdes
, u_msg_ptr
, msg_len
, msg_prio
, p
);
1509 COMPAT_SYSCALL_DEFINE5(mq_timedreceive
, mqd_t
, mqdes
,
1510 char __user
*, u_msg_ptr
,
1511 compat_size_t
, msg_len
, unsigned int __user
*, u_msg_prio
,
1512 const struct compat_timespec __user
*, u_abs_timeout
)
1514 struct timespec64 ts
, *p
= NULL
;
1515 if (u_abs_timeout
) {
1516 int res
= compat_prepare_timeout(u_abs_timeout
, &ts
);
1521 return do_mq_timedreceive(mqdes
, u_msg_ptr
, msg_len
, u_msg_prio
, p
);
1524 COMPAT_SYSCALL_DEFINE2(mq_notify
, mqd_t
, mqdes
,
1525 const struct compat_sigevent __user
*, u_notification
)
1527 struct sigevent n
, *p
= NULL
;
1528 if (u_notification
) {
1529 if (get_compat_sigevent(&n
, u_notification
))
1531 if (n
.sigev_notify
== SIGEV_THREAD
)
1532 n
.sigev_value
.sival_ptr
= compat_ptr(n
.sigev_value
.sival_int
);
1535 return do_mq_notify(mqdes
, p
);
1538 COMPAT_SYSCALL_DEFINE3(mq_getsetattr
, mqd_t
, mqdes
,
1539 const struct compat_mq_attr __user
*, u_mqstat
,
1540 struct compat_mq_attr __user
*, u_omqstat
)
1543 struct mq_attr mqstat
, omqstat
;
1544 struct mq_attr
*new = NULL
, *old
= NULL
;
1548 if (get_compat_mq_attr(new, u_mqstat
))
1554 ret
= do_mq_getsetattr(mqdes
, new, old
);
1558 if (put_compat_mq_attr(old
, u_omqstat
))
1564 static const struct inode_operations mqueue_dir_inode_operations
= {
1565 .lookup
= simple_lookup
,
1566 .create
= mqueue_create
,
1567 .unlink
= mqueue_unlink
,
1570 static const struct file_operations mqueue_file_operations
= {
1571 .flush
= mqueue_flush_file
,
1572 .poll
= mqueue_poll_file
,
1573 .read
= mqueue_read_file
,
1574 .llseek
= default_llseek
,
1577 static const struct super_operations mqueue_super_ops
= {
1578 .alloc_inode
= mqueue_alloc_inode
,
1579 .destroy_inode
= mqueue_destroy_inode
,
1580 .evict_inode
= mqueue_evict_inode
,
1581 .statfs
= simple_statfs
,
1584 static struct file_system_type mqueue_fs_type
= {
1586 .mount
= mqueue_mount
,
1587 .kill_sb
= kill_litter_super
,
1588 .fs_flags
= FS_USERNS_MOUNT
,
1591 int mq_init_ns(struct ipc_namespace
*ns
)
1593 ns
->mq_queues_count
= 0;
1594 ns
->mq_queues_max
= DFLT_QUEUESMAX
;
1595 ns
->mq_msg_max
= DFLT_MSGMAX
;
1596 ns
->mq_msgsize_max
= DFLT_MSGSIZEMAX
;
1597 ns
->mq_msg_default
= DFLT_MSG
;
1598 ns
->mq_msgsize_default
= DFLT_MSGSIZE
;
1600 ns
->mq_mnt
= kern_mount_data(&mqueue_fs_type
, ns
);
1601 if (IS_ERR(ns
->mq_mnt
)) {
1602 int err
= PTR_ERR(ns
->mq_mnt
);
1609 void mq_clear_sbinfo(struct ipc_namespace
*ns
)
1611 ns
->mq_mnt
->mnt_sb
->s_fs_info
= NULL
;
1614 void mq_put_mnt(struct ipc_namespace
*ns
)
1616 kern_unmount(ns
->mq_mnt
);
1619 static int __init
init_mqueue_fs(void)
1623 mqueue_inode_cachep
= kmem_cache_create("mqueue_inode_cache",
1624 sizeof(struct mqueue_inode_info
), 0,
1625 SLAB_HWCACHE_ALIGN
|SLAB_ACCOUNT
, init_once
);
1626 if (mqueue_inode_cachep
== NULL
)
1629 /* ignore failures - they are not fatal */
1630 mq_sysctl_table
= mq_register_sysctl_table();
1632 error
= register_filesystem(&mqueue_fs_type
);
1636 spin_lock_init(&mq_lock
);
1638 error
= mq_init_ns(&init_ipc_ns
);
1640 goto out_filesystem
;
1645 unregister_filesystem(&mqueue_fs_type
);
1647 if (mq_sysctl_table
)
1648 unregister_sysctl_table(mq_sysctl_table
);
1649 kmem_cache_destroy(mqueue_inode_cachep
);
1653 device_initcall(init_mqueue_fs
);