2 * POSIX message queues filesystem for Linux.
4 * Copyright (C) 2003,2004 Krzysztof Benedyczak (golbi@mat.uni.torun.pl)
5 * Michal Wronski (michal.wronski@gmail.com)
7 * Spinlocks: Mohamed Abbas (abbas.mohamed@intel.com)
8 * Lockless receive & send, fd based notify:
9 * Manfred Spraul (manfred@colorfullife.com)
11 * Audit: George Wilson (ltcgcw@us.ibm.com)
13 * This file is released under the GPL.
16 #include <linux/capability.h>
17 #include <linux/init.h>
18 #include <linux/pagemap.h>
19 #include <linux/file.h>
20 #include <linux/mount.h>
21 #include <linux/namei.h>
22 #include <linux/sysctl.h>
23 #include <linux/poll.h>
24 #include <linux/mqueue.h>
25 #include <linux/msg.h>
26 #include <linux/skbuff.h>
27 #include <linux/vmalloc.h>
28 #include <linux/netlink.h>
29 #include <linux/syscalls.h>
30 #include <linux/audit.h>
31 #include <linux/signal.h>
32 #include <linux/mutex.h>
33 #include <linux/nsproxy.h>
34 #include <linux/pid.h>
35 #include <linux/ipc_namespace.h>
36 #include <linux/user_namespace.h>
37 #include <linux/slab.h>
38 #include <linux/sched/wake_q.h>
39 #include <linux/sched/signal.h>
40 #include <linux/sched/user.h>
45 #define MQUEUE_MAGIC 0x19800202
46 #define DIRENT_SIZE 20
47 #define FILENT_SIZE 80
55 struct posix_msg_tree_node
{
56 struct rb_node rb_node
;
57 struct list_head msg_list
;
61 struct ext_wait_queue
{ /* queue of sleeping tasks */
62 struct task_struct
*task
;
63 struct list_head list
;
64 struct msg_msg
*msg
; /* ptr of loaded message */
65 int state
; /* one of STATE_* values */
68 struct mqueue_inode_info
{
70 struct inode vfs_inode
;
71 wait_queue_head_t wait_q
;
73 struct rb_root msg_tree
;
74 struct posix_msg_tree_node
*node_cache
;
77 struct sigevent notify
;
78 struct pid
*notify_owner
;
79 struct user_namespace
*notify_user_ns
;
80 struct user_struct
*user
; /* user who created, for accounting */
81 struct sock
*notify_sock
;
82 struct sk_buff
*notify_cookie
;
84 /* for tasks waiting for free space and messages, respectively */
85 struct ext_wait_queue e_wait_q
[2];
87 unsigned long qsize
; /* size of queue in memory (sum of all msgs) */
90 static const struct inode_operations mqueue_dir_inode_operations
;
91 static const struct file_operations mqueue_file_operations
;
92 static const struct super_operations mqueue_super_ops
;
93 static void remove_notification(struct mqueue_inode_info
*info
);
95 static struct kmem_cache
*mqueue_inode_cachep
;
97 static struct ctl_table_header
*mq_sysctl_table
;
99 static inline struct mqueue_inode_info
*MQUEUE_I(struct inode
*inode
)
101 return container_of(inode
, struct mqueue_inode_info
, vfs_inode
);
105 * This routine should be called with the mq_lock held.
107 static inline struct ipc_namespace
*__get_ns_from_inode(struct inode
*inode
)
109 return get_ipc_ns(inode
->i_sb
->s_fs_info
);
112 static struct ipc_namespace
*get_ns_from_inode(struct inode
*inode
)
114 struct ipc_namespace
*ns
;
117 ns
= __get_ns_from_inode(inode
);
118 spin_unlock(&mq_lock
);
122 /* Auxiliary functions to manipulate messages' list */
123 static int msg_insert(struct msg_msg
*msg
, struct mqueue_inode_info
*info
)
125 struct rb_node
**p
, *parent
= NULL
;
126 struct posix_msg_tree_node
*leaf
;
128 p
= &info
->msg_tree
.rb_node
;
131 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
133 if (likely(leaf
->priority
== msg
->m_type
))
135 else if (msg
->m_type
< leaf
->priority
)
140 if (info
->node_cache
) {
141 leaf
= info
->node_cache
;
142 info
->node_cache
= NULL
;
144 leaf
= kmalloc(sizeof(*leaf
), GFP_ATOMIC
);
147 INIT_LIST_HEAD(&leaf
->msg_list
);
149 leaf
->priority
= msg
->m_type
;
150 rb_link_node(&leaf
->rb_node
, parent
, p
);
151 rb_insert_color(&leaf
->rb_node
, &info
->msg_tree
);
153 info
->attr
.mq_curmsgs
++;
154 info
->qsize
+= msg
->m_ts
;
155 list_add_tail(&msg
->m_list
, &leaf
->msg_list
);
159 static inline struct msg_msg
*msg_get(struct mqueue_inode_info
*info
)
161 struct rb_node
**p
, *parent
= NULL
;
162 struct posix_msg_tree_node
*leaf
;
166 p
= &info
->msg_tree
.rb_node
;
170 * During insert, low priorities go to the left and high to the
171 * right. On receive, we want the highest priorities first, so
172 * walk all the way to the right.
177 if (info
->attr
.mq_curmsgs
) {
178 pr_warn_once("Inconsistency in POSIX message queue, "
179 "no tree element, but supposedly messages "
181 info
->attr
.mq_curmsgs
= 0;
185 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
186 if (unlikely(list_empty(&leaf
->msg_list
))) {
187 pr_warn_once("Inconsistency in POSIX message queue, "
188 "empty leaf node but we haven't implemented "
189 "lazy leaf delete!\n");
190 rb_erase(&leaf
->rb_node
, &info
->msg_tree
);
191 if (info
->node_cache
) {
194 info
->node_cache
= leaf
;
198 msg
= list_first_entry(&leaf
->msg_list
,
199 struct msg_msg
, m_list
);
200 list_del(&msg
->m_list
);
201 if (list_empty(&leaf
->msg_list
)) {
202 rb_erase(&leaf
->rb_node
, &info
->msg_tree
);
203 if (info
->node_cache
) {
206 info
->node_cache
= leaf
;
210 info
->attr
.mq_curmsgs
--;
211 info
->qsize
-= msg
->m_ts
;
215 static struct inode
*mqueue_get_inode(struct super_block
*sb
,
216 struct ipc_namespace
*ipc_ns
, umode_t mode
,
217 struct mq_attr
*attr
)
219 struct user_struct
*u
= current_user();
223 inode
= new_inode(sb
);
227 inode
->i_ino
= get_next_ino();
228 inode
->i_mode
= mode
;
229 inode
->i_uid
= current_fsuid();
230 inode
->i_gid
= current_fsgid();
231 inode
->i_mtime
= inode
->i_ctime
= inode
->i_atime
= current_time(inode
);
234 struct mqueue_inode_info
*info
;
235 unsigned long mq_bytes
, mq_treesize
;
237 inode
->i_fop
= &mqueue_file_operations
;
238 inode
->i_size
= FILENT_SIZE
;
239 /* mqueue specific info */
240 info
= MQUEUE_I(inode
);
241 spin_lock_init(&info
->lock
);
242 init_waitqueue_head(&info
->wait_q
);
243 INIT_LIST_HEAD(&info
->e_wait_q
[0].list
);
244 INIT_LIST_HEAD(&info
->e_wait_q
[1].list
);
245 info
->notify_owner
= NULL
;
246 info
->notify_user_ns
= NULL
;
248 info
->user
= NULL
; /* set when all is ok */
249 info
->msg_tree
= RB_ROOT
;
250 info
->node_cache
= NULL
;
251 memset(&info
->attr
, 0, sizeof(info
->attr
));
252 info
->attr
.mq_maxmsg
= min(ipc_ns
->mq_msg_max
,
253 ipc_ns
->mq_msg_default
);
254 info
->attr
.mq_msgsize
= min(ipc_ns
->mq_msgsize_max
,
255 ipc_ns
->mq_msgsize_default
);
257 info
->attr
.mq_maxmsg
= attr
->mq_maxmsg
;
258 info
->attr
.mq_msgsize
= attr
->mq_msgsize
;
261 * We used to allocate a static array of pointers and account
262 * the size of that array as well as one msg_msg struct per
263 * possible message into the queue size. That's no longer
264 * accurate as the queue is now an rbtree and will grow and
265 * shrink depending on usage patterns. We can, however, still
266 * account one msg_msg struct per message, but the nodes are
267 * allocated depending on priority usage, and most programs
268 * only use one, or a handful, of priorities. However, since
269 * this is pinned memory, we need to assume worst case, so
270 * that means the min(mq_maxmsg, max_priorities) * struct
271 * posix_msg_tree_node.
275 if (info
->attr
.mq_maxmsg
<= 0 || info
->attr
.mq_msgsize
<= 0)
277 if (capable(CAP_SYS_RESOURCE
)) {
278 if (info
->attr
.mq_maxmsg
> HARD_MSGMAX
||
279 info
->attr
.mq_msgsize
> HARD_MSGSIZEMAX
)
282 if (info
->attr
.mq_maxmsg
> ipc_ns
->mq_msg_max
||
283 info
->attr
.mq_msgsize
> ipc_ns
->mq_msgsize_max
)
287 /* check for overflow */
288 if (info
->attr
.mq_msgsize
> ULONG_MAX
/info
->attr
.mq_maxmsg
)
290 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
291 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
292 sizeof(struct posix_msg_tree_node
);
293 mq_bytes
= info
->attr
.mq_maxmsg
* info
->attr
.mq_msgsize
;
294 if (mq_bytes
+ mq_treesize
< mq_bytes
)
296 mq_bytes
+= mq_treesize
;
298 if (u
->mq_bytes
+ mq_bytes
< u
->mq_bytes
||
299 u
->mq_bytes
+ mq_bytes
> rlimit(RLIMIT_MSGQUEUE
)) {
300 spin_unlock(&mq_lock
);
301 /* mqueue_evict_inode() releases info->messages */
305 u
->mq_bytes
+= mq_bytes
;
306 spin_unlock(&mq_lock
);
309 info
->user
= get_uid(u
);
310 } else if (S_ISDIR(mode
)) {
312 /* Some things misbehave if size == 0 on a directory */
313 inode
->i_size
= 2 * DIRENT_SIZE
;
314 inode
->i_op
= &mqueue_dir_inode_operations
;
315 inode
->i_fop
= &simple_dir_operations
;
325 static int mqueue_fill_super(struct super_block
*sb
, void *data
, int silent
)
328 struct ipc_namespace
*ns
= sb
->s_fs_info
;
330 sb
->s_iflags
|= SB_I_NOEXEC
| SB_I_NODEV
;
331 sb
->s_blocksize
= PAGE_SIZE
;
332 sb
->s_blocksize_bits
= PAGE_SHIFT
;
333 sb
->s_magic
= MQUEUE_MAGIC
;
334 sb
->s_op
= &mqueue_super_ops
;
336 inode
= mqueue_get_inode(sb
, ns
, S_IFDIR
| S_ISVTX
| S_IRWXUGO
, NULL
);
338 return PTR_ERR(inode
);
340 sb
->s_root
= d_make_root(inode
);
346 static struct dentry
*mqueue_mount(struct file_system_type
*fs_type
,
347 int flags
, const char *dev_name
,
350 struct ipc_namespace
*ns
;
351 if (flags
& SB_KERNMOUNT
) {
355 ns
= current
->nsproxy
->ipc_ns
;
357 return mount_ns(fs_type
, flags
, data
, ns
, ns
->user_ns
, mqueue_fill_super
);
360 static void init_once(void *foo
)
362 struct mqueue_inode_info
*p
= (struct mqueue_inode_info
*) foo
;
364 inode_init_once(&p
->vfs_inode
);
367 static struct inode
*mqueue_alloc_inode(struct super_block
*sb
)
369 struct mqueue_inode_info
*ei
;
371 ei
= kmem_cache_alloc(mqueue_inode_cachep
, GFP_KERNEL
);
374 return &ei
->vfs_inode
;
377 static void mqueue_i_callback(struct rcu_head
*head
)
379 struct inode
*inode
= container_of(head
, struct inode
, i_rcu
);
380 kmem_cache_free(mqueue_inode_cachep
, MQUEUE_I(inode
));
383 static void mqueue_destroy_inode(struct inode
*inode
)
385 call_rcu(&inode
->i_rcu
, mqueue_i_callback
);
388 static void mqueue_evict_inode(struct inode
*inode
)
390 struct mqueue_inode_info
*info
;
391 struct user_struct
*user
;
392 unsigned long mq_bytes
, mq_treesize
;
393 struct ipc_namespace
*ipc_ns
;
398 if (S_ISDIR(inode
->i_mode
))
401 ipc_ns
= get_ns_from_inode(inode
);
402 info
= MQUEUE_I(inode
);
403 spin_lock(&info
->lock
);
404 while ((msg
= msg_get(info
)) != NULL
)
406 kfree(info
->node_cache
);
407 spin_unlock(&info
->lock
);
409 /* Total amount of bytes accounted for the mqueue */
410 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
411 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
412 sizeof(struct posix_msg_tree_node
);
414 mq_bytes
= mq_treesize
+ (info
->attr
.mq_maxmsg
*
415 info
->attr
.mq_msgsize
);
420 user
->mq_bytes
-= mq_bytes
;
422 * get_ns_from_inode() ensures that the
423 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
424 * to which we now hold a reference, or it is NULL.
425 * We can't put it here under mq_lock, though.
428 ipc_ns
->mq_queues_count
--;
429 spin_unlock(&mq_lock
);
436 static int mqueue_create_attr(struct dentry
*dentry
, umode_t mode
, void *arg
)
438 struct inode
*dir
= dentry
->d_parent
->d_inode
;
440 struct mq_attr
*attr
= arg
;
442 struct ipc_namespace
*ipc_ns
;
445 ipc_ns
= __get_ns_from_inode(dir
);
451 if (ipc_ns
->mq_queues_count
>= ipc_ns
->mq_queues_max
&&
452 !capable(CAP_SYS_RESOURCE
)) {
456 ipc_ns
->mq_queues_count
++;
457 spin_unlock(&mq_lock
);
459 inode
= mqueue_get_inode(dir
->i_sb
, ipc_ns
, mode
, attr
);
461 error
= PTR_ERR(inode
);
463 ipc_ns
->mq_queues_count
--;
468 dir
->i_size
+= DIRENT_SIZE
;
469 dir
->i_ctime
= dir
->i_mtime
= dir
->i_atime
= current_time(dir
);
471 d_instantiate(dentry
, inode
);
475 spin_unlock(&mq_lock
);
481 static int mqueue_create(struct inode
*dir
, struct dentry
*dentry
,
482 umode_t mode
, bool excl
)
484 return mqueue_create_attr(dentry
, mode
, NULL
);
487 static int mqueue_unlink(struct inode
*dir
, struct dentry
*dentry
)
489 struct inode
*inode
= d_inode(dentry
);
491 dir
->i_ctime
= dir
->i_mtime
= dir
->i_atime
= current_time(dir
);
492 dir
->i_size
-= DIRENT_SIZE
;
499 * This is routine for system read from queue file.
500 * To avoid mess with doing here some sort of mq_receive we allow
501 * to read only queue size & notification info (the only values
502 * that are interesting from user point of view and aren't accessible
503 * through std routines)
505 static ssize_t
mqueue_read_file(struct file
*filp
, char __user
*u_data
,
506 size_t count
, loff_t
*off
)
508 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
509 char buffer
[FILENT_SIZE
];
512 spin_lock(&info
->lock
);
513 snprintf(buffer
, sizeof(buffer
),
514 "QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",
516 info
->notify_owner
? info
->notify
.sigev_notify
: 0,
517 (info
->notify_owner
&&
518 info
->notify
.sigev_notify
== SIGEV_SIGNAL
) ?
519 info
->notify
.sigev_signo
: 0,
520 pid_vnr(info
->notify_owner
));
521 spin_unlock(&info
->lock
);
522 buffer
[sizeof(buffer
)-1] = '\0';
524 ret
= simple_read_from_buffer(u_data
, count
, off
, buffer
,
529 file_inode(filp
)->i_atime
= file_inode(filp
)->i_ctime
= current_time(file_inode(filp
));
533 static int mqueue_flush_file(struct file
*filp
, fl_owner_t id
)
535 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
537 spin_lock(&info
->lock
);
538 if (task_tgid(current
) == info
->notify_owner
)
539 remove_notification(info
);
541 spin_unlock(&info
->lock
);
545 static __poll_t
mqueue_poll_file(struct file
*filp
, struct poll_table_struct
*poll_tab
)
547 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
550 poll_wait(filp
, &info
->wait_q
, poll_tab
);
552 spin_lock(&info
->lock
);
553 if (info
->attr
.mq_curmsgs
)
554 retval
= EPOLLIN
| EPOLLRDNORM
;
556 if (info
->attr
.mq_curmsgs
< info
->attr
.mq_maxmsg
)
557 retval
|= EPOLLOUT
| EPOLLWRNORM
;
558 spin_unlock(&info
->lock
);
563 /* Adds current to info->e_wait_q[sr] before element with smaller prio */
564 static void wq_add(struct mqueue_inode_info
*info
, int sr
,
565 struct ext_wait_queue
*ewp
)
567 struct ext_wait_queue
*walk
;
571 list_for_each_entry(walk
, &info
->e_wait_q
[sr
].list
, list
) {
572 if (walk
->task
->prio
<= current
->prio
) {
573 list_add_tail(&ewp
->list
, &walk
->list
);
577 list_add_tail(&ewp
->list
, &info
->e_wait_q
[sr
].list
);
581 * Puts current task to sleep. Caller must hold queue lock. After return
585 static int wq_sleep(struct mqueue_inode_info
*info
, int sr
,
586 ktime_t
*timeout
, struct ext_wait_queue
*ewp
)
587 __releases(&info
->lock
)
592 wq_add(info
, sr
, ewp
);
595 __set_current_state(TASK_INTERRUPTIBLE
);
597 spin_unlock(&info
->lock
);
598 time
= schedule_hrtimeout_range_clock(timeout
, 0,
599 HRTIMER_MODE_ABS
, CLOCK_REALTIME
);
601 if (ewp
->state
== STATE_READY
) {
605 spin_lock(&info
->lock
);
606 if (ewp
->state
== STATE_READY
) {
610 if (signal_pending(current
)) {
611 retval
= -ERESTARTSYS
;
619 list_del(&ewp
->list
);
621 spin_unlock(&info
->lock
);
627 * Returns waiting task that should be serviced first or NULL if none exists
629 static struct ext_wait_queue
*wq_get_first_waiter(
630 struct mqueue_inode_info
*info
, int sr
)
632 struct list_head
*ptr
;
634 ptr
= info
->e_wait_q
[sr
].list
.prev
;
635 if (ptr
== &info
->e_wait_q
[sr
].list
)
637 return list_entry(ptr
, struct ext_wait_queue
, list
);
641 static inline void set_cookie(struct sk_buff
*skb
, char code
)
643 ((char *)skb
->data
)[NOTIFY_COOKIE_LEN
-1] = code
;
647 * The next function is only to split too long sys_mq_timedsend
649 static void __do_notify(struct mqueue_inode_info
*info
)
652 * invoked when there is registered process and there isn't process
653 * waiting synchronously for message AND state of queue changed from
654 * empty to not empty. Here we are sure that no one is waiting
656 if (info
->notify_owner
&&
657 info
->attr
.mq_curmsgs
== 1) {
658 struct kernel_siginfo sig_i
;
659 switch (info
->notify
.sigev_notify
) {
665 clear_siginfo(&sig_i
);
666 sig_i
.si_signo
= info
->notify
.sigev_signo
;
668 sig_i
.si_code
= SI_MESGQ
;
669 sig_i
.si_value
= info
->notify
.sigev_value
;
670 /* map current pid/uid into info->owner's namespaces */
672 sig_i
.si_pid
= task_tgid_nr_ns(current
,
673 ns_of_pid(info
->notify_owner
));
674 sig_i
.si_uid
= from_kuid_munged(info
->notify_user_ns
, current_uid());
677 kill_pid_info(info
->notify
.sigev_signo
,
678 &sig_i
, info
->notify_owner
);
681 set_cookie(info
->notify_cookie
, NOTIFY_WOKENUP
);
682 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
685 /* after notification unregisters process */
686 put_pid(info
->notify_owner
);
687 put_user_ns(info
->notify_user_ns
);
688 info
->notify_owner
= NULL
;
689 info
->notify_user_ns
= NULL
;
691 wake_up(&info
->wait_q
);
694 static int prepare_timeout(const struct __kernel_timespec __user
*u_abs_timeout
,
695 struct timespec64
*ts
)
697 if (get_timespec64(ts
, u_abs_timeout
))
699 if (!timespec64_valid(ts
))
704 static void remove_notification(struct mqueue_inode_info
*info
)
706 if (info
->notify_owner
!= NULL
&&
707 info
->notify
.sigev_notify
== SIGEV_THREAD
) {
708 set_cookie(info
->notify_cookie
, NOTIFY_REMOVED
);
709 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
711 put_pid(info
->notify_owner
);
712 put_user_ns(info
->notify_user_ns
);
713 info
->notify_owner
= NULL
;
714 info
->notify_user_ns
= NULL
;
717 static int prepare_open(struct dentry
*dentry
, int oflag
, int ro
,
718 umode_t mode
, struct filename
*name
,
719 struct mq_attr
*attr
)
721 static const int oflag2acc
[O_ACCMODE
] = { MAY_READ
, MAY_WRITE
,
722 MAY_READ
| MAY_WRITE
};
725 if (d_really_is_negative(dentry
)) {
726 if (!(oflag
& O_CREAT
))
730 audit_inode_parent_hidden(name
, dentry
->d_parent
);
731 return vfs_mkobj(dentry
, mode
& ~current_umask(),
732 mqueue_create_attr
, attr
);
734 /* it already existed */
735 audit_inode(name
, dentry
, 0);
736 if ((oflag
& (O_CREAT
|O_EXCL
)) == (O_CREAT
|O_EXCL
))
738 if ((oflag
& O_ACCMODE
) == (O_RDWR
| O_WRONLY
))
740 acc
= oflag2acc
[oflag
& O_ACCMODE
];
741 return inode_permission(d_inode(dentry
), acc
);
744 static int do_mq_open(const char __user
*u_name
, int oflag
, umode_t mode
,
745 struct mq_attr
*attr
)
747 struct vfsmount
*mnt
= current
->nsproxy
->ipc_ns
->mq_mnt
;
748 struct dentry
*root
= mnt
->mnt_root
;
749 struct filename
*name
;
754 audit_mq_open(oflag
, mode
, attr
);
756 if (IS_ERR(name
= getname(u_name
)))
757 return PTR_ERR(name
);
759 fd
= get_unused_fd_flags(O_CLOEXEC
);
763 ro
= mnt_want_write(mnt
); /* we'll drop it in any case */
764 inode_lock(d_inode(root
));
765 path
.dentry
= lookup_one_len(name
->name
, root
, strlen(name
->name
));
766 if (IS_ERR(path
.dentry
)) {
767 error
= PTR_ERR(path
.dentry
);
770 path
.mnt
= mntget(mnt
);
771 error
= prepare_open(path
.dentry
, oflag
, ro
, mode
, name
, attr
);
773 struct file
*file
= dentry_open(&path
, oflag
, current_cred());
775 fd_install(fd
, file
);
777 error
= PTR_ERR(file
);
785 inode_unlock(d_inode(root
));
793 SYSCALL_DEFINE4(mq_open
, const char __user
*, u_name
, int, oflag
, umode_t
, mode
,
794 struct mq_attr __user
*, u_attr
)
797 if (u_attr
&& copy_from_user(&attr
, u_attr
, sizeof(struct mq_attr
)))
800 return do_mq_open(u_name
, oflag
, mode
, u_attr
? &attr
: NULL
);
803 SYSCALL_DEFINE1(mq_unlink
, const char __user
*, u_name
)
806 struct filename
*name
;
807 struct dentry
*dentry
;
808 struct inode
*inode
= NULL
;
809 struct ipc_namespace
*ipc_ns
= current
->nsproxy
->ipc_ns
;
810 struct vfsmount
*mnt
= ipc_ns
->mq_mnt
;
812 name
= getname(u_name
);
814 return PTR_ERR(name
);
816 audit_inode_parent_hidden(name
, mnt
->mnt_root
);
817 err
= mnt_want_write(mnt
);
820 inode_lock_nested(d_inode(mnt
->mnt_root
), I_MUTEX_PARENT
);
821 dentry
= lookup_one_len(name
->name
, mnt
->mnt_root
,
823 if (IS_ERR(dentry
)) {
824 err
= PTR_ERR(dentry
);
828 inode
= d_inode(dentry
);
833 err
= vfs_unlink(d_inode(dentry
->d_parent
), dentry
, NULL
);
838 inode_unlock(d_inode(mnt
->mnt_root
));
848 /* Pipelined send and receive functions.
850 * If a receiver finds no waiting message, then it registers itself in the
851 * list of waiting receivers. A sender checks that list before adding the new
852 * message into the message array. If there is a waiting receiver, then it
853 * bypasses the message array and directly hands the message over to the
854 * receiver. The receiver accepts the message and returns without grabbing the
857 * - Set pointer to message.
858 * - Queue the receiver task for later wakeup (without the info->lock).
859 * - Update its state to STATE_READY. Now the receiver can continue.
860 * - Wake up the process after the lock is dropped. Should the process wake up
861 * before this wakeup (due to a timeout or a signal) it will either see
862 * STATE_READY and continue or acquire the lock to check the state again.
864 * The same algorithm is used for senders.
867 /* pipelined_send() - send a message directly to the task waiting in
868 * sys_mq_timedreceive() (without inserting message into a queue).
870 static inline void pipelined_send(struct wake_q_head
*wake_q
,
871 struct mqueue_inode_info
*info
,
872 struct msg_msg
*message
,
873 struct ext_wait_queue
*receiver
)
875 receiver
->msg
= message
;
876 list_del(&receiver
->list
);
877 wake_q_add(wake_q
, receiver
->task
);
879 * Rely on the implicit cmpxchg barrier from wake_q_add such
880 * that we can ensure that updating receiver->state is the last
881 * write operation: As once set, the receiver can continue,
882 * and if we don't have the reference count from the wake_q,
883 * yet, at that point we can later have a use-after-free
884 * condition and bogus wakeup.
886 receiver
->state
= STATE_READY
;
889 /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
890 * gets its message and put to the queue (we have one free place for sure). */
891 static inline void pipelined_receive(struct wake_q_head
*wake_q
,
892 struct mqueue_inode_info
*info
)
894 struct ext_wait_queue
*sender
= wq_get_first_waiter(info
, SEND
);
898 wake_up_interruptible(&info
->wait_q
);
901 if (msg_insert(sender
->msg
, info
))
904 list_del(&sender
->list
);
905 wake_q_add(wake_q
, sender
->task
);
906 sender
->state
= STATE_READY
;
909 static int do_mq_timedsend(mqd_t mqdes
, const char __user
*u_msg_ptr
,
910 size_t msg_len
, unsigned int msg_prio
,
911 struct timespec64
*ts
)
915 struct ext_wait_queue wait
;
916 struct ext_wait_queue
*receiver
;
917 struct msg_msg
*msg_ptr
;
918 struct mqueue_inode_info
*info
;
919 ktime_t expires
, *timeout
= NULL
;
920 struct posix_msg_tree_node
*new_leaf
= NULL
;
922 DEFINE_WAKE_Q(wake_q
);
924 if (unlikely(msg_prio
>= (unsigned long) MQ_PRIO_MAX
))
928 expires
= timespec64_to_ktime(*ts
);
932 audit_mq_sendrecv(mqdes
, msg_len
, msg_prio
, ts
);
935 if (unlikely(!f
.file
)) {
940 inode
= file_inode(f
.file
);
941 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
945 info
= MQUEUE_I(inode
);
948 if (unlikely(!(f
.file
->f_mode
& FMODE_WRITE
))) {
953 if (unlikely(msg_len
> info
->attr
.mq_msgsize
)) {
958 /* First try to allocate memory, before doing anything with
959 * existing queues. */
960 msg_ptr
= load_msg(u_msg_ptr
, msg_len
);
961 if (IS_ERR(msg_ptr
)) {
962 ret
= PTR_ERR(msg_ptr
);
965 msg_ptr
->m_ts
= msg_len
;
966 msg_ptr
->m_type
= msg_prio
;
969 * msg_insert really wants us to have a valid, spare node struct so
970 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
971 * fall back to that if necessary.
973 if (!info
->node_cache
)
974 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
976 spin_lock(&info
->lock
);
978 if (!info
->node_cache
&& new_leaf
) {
979 /* Save our speculative allocation into the cache */
980 INIT_LIST_HEAD(&new_leaf
->msg_list
);
981 info
->node_cache
= new_leaf
;
987 if (info
->attr
.mq_curmsgs
== info
->attr
.mq_maxmsg
) {
988 if (f
.file
->f_flags
& O_NONBLOCK
) {
992 wait
.msg
= (void *) msg_ptr
;
993 wait
.state
= STATE_NONE
;
994 ret
= wq_sleep(info
, SEND
, timeout
, &wait
);
996 * wq_sleep must be called with info->lock held, and
997 * returns with the lock released
1002 receiver
= wq_get_first_waiter(info
, RECV
);
1004 pipelined_send(&wake_q
, info
, msg_ptr
, receiver
);
1006 /* adds message to the queue */
1007 ret
= msg_insert(msg_ptr
, info
);
1012 inode
->i_atime
= inode
->i_mtime
= inode
->i_ctime
=
1013 current_time(inode
);
1016 spin_unlock(&info
->lock
);
1027 static int do_mq_timedreceive(mqd_t mqdes
, char __user
*u_msg_ptr
,
1028 size_t msg_len
, unsigned int __user
*u_msg_prio
,
1029 struct timespec64
*ts
)
1032 struct msg_msg
*msg_ptr
;
1034 struct inode
*inode
;
1035 struct mqueue_inode_info
*info
;
1036 struct ext_wait_queue wait
;
1037 ktime_t expires
, *timeout
= NULL
;
1038 struct posix_msg_tree_node
*new_leaf
= NULL
;
1041 expires
= timespec64_to_ktime(*ts
);
1045 audit_mq_sendrecv(mqdes
, msg_len
, 0, ts
);
1048 if (unlikely(!f
.file
)) {
1053 inode
= file_inode(f
.file
);
1054 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1058 info
= MQUEUE_I(inode
);
1061 if (unlikely(!(f
.file
->f_mode
& FMODE_READ
))) {
1066 /* checks if buffer is big enough */
1067 if (unlikely(msg_len
< info
->attr
.mq_msgsize
)) {
1073 * msg_insert really wants us to have a valid, spare node struct so
1074 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
1075 * fall back to that if necessary.
1077 if (!info
->node_cache
)
1078 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
1080 spin_lock(&info
->lock
);
1082 if (!info
->node_cache
&& new_leaf
) {
1083 /* Save our speculative allocation into the cache */
1084 INIT_LIST_HEAD(&new_leaf
->msg_list
);
1085 info
->node_cache
= new_leaf
;
1090 if (info
->attr
.mq_curmsgs
== 0) {
1091 if (f
.file
->f_flags
& O_NONBLOCK
) {
1092 spin_unlock(&info
->lock
);
1095 wait
.task
= current
;
1096 wait
.state
= STATE_NONE
;
1097 ret
= wq_sleep(info
, RECV
, timeout
, &wait
);
1101 DEFINE_WAKE_Q(wake_q
);
1103 msg_ptr
= msg_get(info
);
1105 inode
->i_atime
= inode
->i_mtime
= inode
->i_ctime
=
1106 current_time(inode
);
1108 /* There is now free space in queue. */
1109 pipelined_receive(&wake_q
, info
);
1110 spin_unlock(&info
->lock
);
1115 ret
= msg_ptr
->m_ts
;
1117 if ((u_msg_prio
&& put_user(msg_ptr
->m_type
, u_msg_prio
)) ||
1118 store_msg(u_msg_ptr
, msg_ptr
, msg_ptr
->m_ts
)) {
1129 SYSCALL_DEFINE5(mq_timedsend
, mqd_t
, mqdes
, const char __user
*, u_msg_ptr
,
1130 size_t, msg_len
, unsigned int, msg_prio
,
1131 const struct __kernel_timespec __user
*, u_abs_timeout
)
1133 struct timespec64 ts
, *p
= NULL
;
1134 if (u_abs_timeout
) {
1135 int res
= prepare_timeout(u_abs_timeout
, &ts
);
1140 return do_mq_timedsend(mqdes
, u_msg_ptr
, msg_len
, msg_prio
, p
);
1143 SYSCALL_DEFINE5(mq_timedreceive
, mqd_t
, mqdes
, char __user
*, u_msg_ptr
,
1144 size_t, msg_len
, unsigned int __user
*, u_msg_prio
,
1145 const struct __kernel_timespec __user
*, u_abs_timeout
)
1147 struct timespec64 ts
, *p
= NULL
;
1148 if (u_abs_timeout
) {
1149 int res
= prepare_timeout(u_abs_timeout
, &ts
);
1154 return do_mq_timedreceive(mqdes
, u_msg_ptr
, msg_len
, u_msg_prio
, p
);
1158 * Notes: the case when user wants us to deregister (with NULL as pointer)
1159 * and he isn't currently owner of notification, will be silently discarded.
1160 * It isn't explicitly defined in the POSIX.
1162 static int do_mq_notify(mqd_t mqdes
, const struct sigevent
*notification
)
1167 struct inode
*inode
;
1168 struct mqueue_inode_info
*info
;
1171 audit_mq_notify(mqdes
, notification
);
1175 if (notification
!= NULL
) {
1176 if (unlikely(notification
->sigev_notify
!= SIGEV_NONE
&&
1177 notification
->sigev_notify
!= SIGEV_SIGNAL
&&
1178 notification
->sigev_notify
!= SIGEV_THREAD
))
1180 if (notification
->sigev_notify
== SIGEV_SIGNAL
&&
1181 !valid_signal(notification
->sigev_signo
)) {
1184 if (notification
->sigev_notify
== SIGEV_THREAD
) {
1187 /* create the notify skb */
1188 nc
= alloc_skb(NOTIFY_COOKIE_LEN
, GFP_KERNEL
);
1193 if (copy_from_user(nc
->data
,
1194 notification
->sigev_value
.sival_ptr
,
1195 NOTIFY_COOKIE_LEN
)) {
1200 /* TODO: add a header? */
1201 skb_put(nc
, NOTIFY_COOKIE_LEN
);
1202 /* and attach it to the socket */
1204 f
= fdget(notification
->sigev_signo
);
1209 sock
= netlink_getsockbyfilp(f
.file
);
1212 ret
= PTR_ERR(sock
);
1217 timeo
= MAX_SCHEDULE_TIMEOUT
;
1218 ret
= netlink_attachskb(sock
, nc
, &timeo
, NULL
);
1237 inode
= file_inode(f
.file
);
1238 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1242 info
= MQUEUE_I(inode
);
1245 spin_lock(&info
->lock
);
1246 if (notification
== NULL
) {
1247 if (info
->notify_owner
== task_tgid(current
)) {
1248 remove_notification(info
);
1249 inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
1251 } else if (info
->notify_owner
!= NULL
) {
1254 switch (notification
->sigev_notify
) {
1256 info
->notify
.sigev_notify
= SIGEV_NONE
;
1259 info
->notify_sock
= sock
;
1260 info
->notify_cookie
= nc
;
1263 info
->notify
.sigev_notify
= SIGEV_THREAD
;
1266 info
->notify
.sigev_signo
= notification
->sigev_signo
;
1267 info
->notify
.sigev_value
= notification
->sigev_value
;
1268 info
->notify
.sigev_notify
= SIGEV_SIGNAL
;
1272 info
->notify_owner
= get_pid(task_tgid(current
));
1273 info
->notify_user_ns
= get_user_ns(current_user_ns());
1274 inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
1276 spin_unlock(&info
->lock
);
1281 netlink_detachskb(sock
, nc
);
1288 SYSCALL_DEFINE2(mq_notify
, mqd_t
, mqdes
,
1289 const struct sigevent __user
*, u_notification
)
1291 struct sigevent n
, *p
= NULL
;
1292 if (u_notification
) {
1293 if (copy_from_user(&n
, u_notification
, sizeof(struct sigevent
)))
1297 return do_mq_notify(mqdes
, p
);
1300 static int do_mq_getsetattr(int mqdes
, struct mq_attr
*new, struct mq_attr
*old
)
1303 struct inode
*inode
;
1304 struct mqueue_inode_info
*info
;
1306 if (new && (new->mq_flags
& (~O_NONBLOCK
)))
1313 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1318 inode
= file_inode(f
.file
);
1319 info
= MQUEUE_I(inode
);
1321 spin_lock(&info
->lock
);
1325 old
->mq_flags
= f
.file
->f_flags
& O_NONBLOCK
;
1328 audit_mq_getsetattr(mqdes
, new);
1329 spin_lock(&f
.file
->f_lock
);
1330 if (new->mq_flags
& O_NONBLOCK
)
1331 f
.file
->f_flags
|= O_NONBLOCK
;
1333 f
.file
->f_flags
&= ~O_NONBLOCK
;
1334 spin_unlock(&f
.file
->f_lock
);
1336 inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
1339 spin_unlock(&info
->lock
);
1344 SYSCALL_DEFINE3(mq_getsetattr
, mqd_t
, mqdes
,
1345 const struct mq_attr __user
*, u_mqstat
,
1346 struct mq_attr __user
*, u_omqstat
)
1349 struct mq_attr mqstat
, omqstat
;
1350 struct mq_attr
*new = NULL
, *old
= NULL
;
1354 if (copy_from_user(new, u_mqstat
, sizeof(struct mq_attr
)))
1360 ret
= do_mq_getsetattr(mqdes
, new, old
);
1364 if (copy_to_user(u_omqstat
, old
, sizeof(struct mq_attr
)))
1369 #ifdef CONFIG_COMPAT
1371 struct compat_mq_attr
{
1372 compat_long_t mq_flags
; /* message queue flags */
1373 compat_long_t mq_maxmsg
; /* maximum number of messages */
1374 compat_long_t mq_msgsize
; /* maximum message size */
1375 compat_long_t mq_curmsgs
; /* number of messages currently queued */
1376 compat_long_t __reserved
[4]; /* ignored for input, zeroed for output */
1379 static inline int get_compat_mq_attr(struct mq_attr
*attr
,
1380 const struct compat_mq_attr __user
*uattr
)
1382 struct compat_mq_attr v
;
1384 if (copy_from_user(&v
, uattr
, sizeof(*uattr
)))
1387 memset(attr
, 0, sizeof(*attr
));
1388 attr
->mq_flags
= v
.mq_flags
;
1389 attr
->mq_maxmsg
= v
.mq_maxmsg
;
1390 attr
->mq_msgsize
= v
.mq_msgsize
;
1391 attr
->mq_curmsgs
= v
.mq_curmsgs
;
1395 static inline int put_compat_mq_attr(const struct mq_attr
*attr
,
1396 struct compat_mq_attr __user
*uattr
)
1398 struct compat_mq_attr v
;
1400 memset(&v
, 0, sizeof(v
));
1401 v
.mq_flags
= attr
->mq_flags
;
1402 v
.mq_maxmsg
= attr
->mq_maxmsg
;
1403 v
.mq_msgsize
= attr
->mq_msgsize
;
1404 v
.mq_curmsgs
= attr
->mq_curmsgs
;
1405 if (copy_to_user(uattr
, &v
, sizeof(*uattr
)))
1410 COMPAT_SYSCALL_DEFINE4(mq_open
, const char __user
*, u_name
,
1411 int, oflag
, compat_mode_t
, mode
,
1412 struct compat_mq_attr __user
*, u_attr
)
1414 struct mq_attr attr
, *p
= NULL
;
1415 if (u_attr
&& oflag
& O_CREAT
) {
1417 if (get_compat_mq_attr(&attr
, u_attr
))
1420 return do_mq_open(u_name
, oflag
, mode
, p
);
1423 COMPAT_SYSCALL_DEFINE2(mq_notify
, mqd_t
, mqdes
,
1424 const struct compat_sigevent __user
*, u_notification
)
1426 struct sigevent n
, *p
= NULL
;
1427 if (u_notification
) {
1428 if (get_compat_sigevent(&n
, u_notification
))
1430 if (n
.sigev_notify
== SIGEV_THREAD
)
1431 n
.sigev_value
.sival_ptr
= compat_ptr(n
.sigev_value
.sival_int
);
1434 return do_mq_notify(mqdes
, p
);
1437 COMPAT_SYSCALL_DEFINE3(mq_getsetattr
, mqd_t
, mqdes
,
1438 const struct compat_mq_attr __user
*, u_mqstat
,
1439 struct compat_mq_attr __user
*, u_omqstat
)
1442 struct mq_attr mqstat
, omqstat
;
1443 struct mq_attr
*new = NULL
, *old
= NULL
;
1447 if (get_compat_mq_attr(new, u_mqstat
))
1453 ret
= do_mq_getsetattr(mqdes
, new, old
);
1457 if (put_compat_mq_attr(old
, u_omqstat
))
1463 #ifdef CONFIG_COMPAT_32BIT_TIME
1464 static int compat_prepare_timeout(const struct old_timespec32 __user
*p
,
1465 struct timespec64
*ts
)
1467 if (get_old_timespec32(ts
, p
))
1469 if (!timespec64_valid(ts
))
1474 SYSCALL_DEFINE5(mq_timedsend_time32
, mqd_t
, mqdes
,
1475 const char __user
*, u_msg_ptr
,
1476 unsigned int, msg_len
, unsigned int, msg_prio
,
1477 const struct old_timespec32 __user
*, u_abs_timeout
)
1479 struct timespec64 ts
, *p
= NULL
;
1480 if (u_abs_timeout
) {
1481 int res
= compat_prepare_timeout(u_abs_timeout
, &ts
);
1486 return do_mq_timedsend(mqdes
, u_msg_ptr
, msg_len
, msg_prio
, p
);
1489 SYSCALL_DEFINE5(mq_timedreceive_time32
, mqd_t
, mqdes
,
1490 char __user
*, u_msg_ptr
,
1491 unsigned int, msg_len
, unsigned int __user
*, u_msg_prio
,
1492 const struct old_timespec32 __user
*, u_abs_timeout
)
1494 struct timespec64 ts
, *p
= NULL
;
1495 if (u_abs_timeout
) {
1496 int res
= compat_prepare_timeout(u_abs_timeout
, &ts
);
1501 return do_mq_timedreceive(mqdes
, u_msg_ptr
, msg_len
, u_msg_prio
, p
);
1505 static const struct inode_operations mqueue_dir_inode_operations
= {
1506 .lookup
= simple_lookup
,
1507 .create
= mqueue_create
,
1508 .unlink
= mqueue_unlink
,
1511 static const struct file_operations mqueue_file_operations
= {
1512 .flush
= mqueue_flush_file
,
1513 .poll
= mqueue_poll_file
,
1514 .read
= mqueue_read_file
,
1515 .llseek
= default_llseek
,
1518 static const struct super_operations mqueue_super_ops
= {
1519 .alloc_inode
= mqueue_alloc_inode
,
1520 .destroy_inode
= mqueue_destroy_inode
,
1521 .evict_inode
= mqueue_evict_inode
,
1522 .statfs
= simple_statfs
,
1525 static struct file_system_type mqueue_fs_type
= {
1527 .mount
= mqueue_mount
,
1528 .kill_sb
= kill_litter_super
,
1529 .fs_flags
= FS_USERNS_MOUNT
,
1532 int mq_init_ns(struct ipc_namespace
*ns
)
1534 ns
->mq_queues_count
= 0;
1535 ns
->mq_queues_max
= DFLT_QUEUESMAX
;
1536 ns
->mq_msg_max
= DFLT_MSGMAX
;
1537 ns
->mq_msgsize_max
= DFLT_MSGSIZEMAX
;
1538 ns
->mq_msg_default
= DFLT_MSG
;
1539 ns
->mq_msgsize_default
= DFLT_MSGSIZE
;
1541 ns
->mq_mnt
= kern_mount_data(&mqueue_fs_type
, ns
);
1542 if (IS_ERR(ns
->mq_mnt
)) {
1543 int err
= PTR_ERR(ns
->mq_mnt
);
1550 void mq_clear_sbinfo(struct ipc_namespace
*ns
)
1552 ns
->mq_mnt
->mnt_sb
->s_fs_info
= NULL
;
1555 void mq_put_mnt(struct ipc_namespace
*ns
)
1557 kern_unmount(ns
->mq_mnt
);
1560 static int __init
init_mqueue_fs(void)
1564 mqueue_inode_cachep
= kmem_cache_create("mqueue_inode_cache",
1565 sizeof(struct mqueue_inode_info
), 0,
1566 SLAB_HWCACHE_ALIGN
|SLAB_ACCOUNT
, init_once
);
1567 if (mqueue_inode_cachep
== NULL
)
1570 /* ignore failures - they are not fatal */
1571 mq_sysctl_table
= mq_register_sysctl_table();
1573 error
= register_filesystem(&mqueue_fs_type
);
1577 spin_lock_init(&mq_lock
);
1579 error
= mq_init_ns(&init_ipc_ns
);
1581 goto out_filesystem
;
1586 unregister_filesystem(&mqueue_fs_type
);
1588 if (mq_sysctl_table
)
1589 unregister_sysctl_table(mq_sysctl_table
);
1590 kmem_cache_destroy(mqueue_inode_cachep
);
1594 device_initcall(init_mqueue_fs
);