2 * POSIX message queues filesystem for Linux.
4 * Copyright (C) 2003,2004 Krzysztof Benedyczak (golbi@mat.uni.torun.pl)
5 * Michal Wronski (michal.wronski@gmail.com)
7 * Spinlocks: Mohamed Abbas (abbas.mohamed@intel.com)
8 * Lockless receive & send, fd based notify:
9 * Manfred Spraul (manfred@colorfullife.com)
11 * Audit: George Wilson (ltcgcw@us.ibm.com)
13 * This file is released under the GPL.
16 #include <linux/capability.h>
17 #include <linux/init.h>
18 #include <linux/pagemap.h>
19 #include <linux/file.h>
20 #include <linux/mount.h>
21 #include <linux/fs_context.h>
22 #include <linux/namei.h>
23 #include <linux/sysctl.h>
24 #include <linux/poll.h>
25 #include <linux/mqueue.h>
26 #include <linux/msg.h>
27 #include <linux/skbuff.h>
28 #include <linux/vmalloc.h>
29 #include <linux/netlink.h>
30 #include <linux/syscalls.h>
31 #include <linux/audit.h>
32 #include <linux/signal.h>
33 #include <linux/mutex.h>
34 #include <linux/nsproxy.h>
35 #include <linux/pid.h>
36 #include <linux/ipc_namespace.h>
37 #include <linux/user_namespace.h>
38 #include <linux/slab.h>
39 #include <linux/sched/wake_q.h>
40 #include <linux/sched/signal.h>
41 #include <linux/sched/user.h>
46 struct mqueue_fs_context
{
47 struct ipc_namespace
*ipc_ns
;
48 bool newns
; /* Set if newly created ipc namespace */
51 #define MQUEUE_MAGIC 0x19800202
52 #define DIRENT_SIZE 20
53 #define FILENT_SIZE 80
61 struct posix_msg_tree_node
{
62 struct rb_node rb_node
;
63 struct list_head msg_list
;
70 * Accesses to a message queue are synchronized by acquiring info->lock.
72 * There are two notable exceptions:
73 * - The actual wakeup of a sleeping task is performed using the wake_q
74 * framework. info->lock is already released when wake_up_q is called.
75 * - The exit codepaths after sleeping check ext_wait_queue->state without
76 * any locks. If it is STATE_READY, then the syscall is completed without
77 * acquiring info->lock.
80 * To achieve proper release/acquire memory barrier pairing, the state is set to
81 * STATE_READY with smp_store_release(), and it is read with READ_ONCE followed
82 * by smp_acquire__after_ctrl_dep(). In addition, wake_q_add_safe() is used.
84 * This prevents the following races:
86 * 1) With the simple wake_q_add(), the task could be gone already before
87 * the increase of the reference happens
90 * WRITE_ONCE(wait.state, STATE_NONE);
91 * schedule_hrtimeout()
93 * if (cmpxchg()) // success
94 * ->state = STATE_READY (reordered)
96 * if (wait.state == STATE_READY) return;
97 * sysret to user space
99 * get_task_struct() // UaF
101 * Solution: Use wake_q_add_safe() and perform the get_task_struct() before
102 * the smp_store_release() that does ->state = STATE_READY.
104 * 2) Without proper _release/_acquire barriers, the woken up task
105 * could read stale data
110 * WRITE_ONCE(wait.state, STATE_NONE);
111 * schedule_hrtimeout()
112 * state = STATE_READY;
114 * if (wait.state == STATE_READY) return;
115 * msg_ptr = wait.msg; // Access to stale data!
116 * receiver->msg = message; (reordered)
118 * Solution: use _release and _acquire barriers.
120 * 3) There is intentionally no barrier when setting current->state
121 * to TASK_INTERRUPTIBLE: spin_unlock(&info->lock) provides the
122 * release memory barrier, and the wakeup is triggered when holding
123 * info->lock, i.e. spin_lock(&info->lock) provided a pairing
124 * acquire memory barrier.
127 struct ext_wait_queue
{ /* queue of sleeping tasks */
128 struct task_struct
*task
;
129 struct list_head list
;
130 struct msg_msg
*msg
; /* ptr of loaded message */
131 int state
; /* one of STATE_* values */
134 struct mqueue_inode_info
{
136 struct inode vfs_inode
;
137 wait_queue_head_t wait_q
;
139 struct rb_root msg_tree
;
140 struct rb_node
*msg_tree_rightmost
;
141 struct posix_msg_tree_node
*node_cache
;
144 struct sigevent notify
;
145 struct pid
*notify_owner
;
146 u32 notify_self_exec_id
;
147 struct user_namespace
*notify_user_ns
;
148 struct ucounts
*ucounts
; /* user who created, for accounting */
149 struct sock
*notify_sock
;
150 struct sk_buff
*notify_cookie
;
152 /* for tasks waiting for free space and messages, respectively */
153 struct ext_wait_queue e_wait_q
[2];
155 unsigned long qsize
; /* size of queue in memory (sum of all msgs) */
158 static struct file_system_type mqueue_fs_type
;
159 static const struct inode_operations mqueue_dir_inode_operations
;
160 static const struct file_operations mqueue_file_operations
;
161 static const struct super_operations mqueue_super_ops
;
162 static const struct fs_context_operations mqueue_fs_context_ops
;
163 static void remove_notification(struct mqueue_inode_info
*info
);
165 static struct kmem_cache
*mqueue_inode_cachep
;
167 static inline struct mqueue_inode_info
*MQUEUE_I(struct inode
*inode
)
169 return container_of(inode
, struct mqueue_inode_info
, vfs_inode
);
173 * This routine should be called with the mq_lock held.
175 static inline struct ipc_namespace
*__get_ns_from_inode(struct inode
*inode
)
177 return get_ipc_ns(inode
->i_sb
->s_fs_info
);
180 static struct ipc_namespace
*get_ns_from_inode(struct inode
*inode
)
182 struct ipc_namespace
*ns
;
185 ns
= __get_ns_from_inode(inode
);
186 spin_unlock(&mq_lock
);
190 /* Auxiliary functions to manipulate messages' list */
191 static int msg_insert(struct msg_msg
*msg
, struct mqueue_inode_info
*info
)
193 struct rb_node
**p
, *parent
= NULL
;
194 struct posix_msg_tree_node
*leaf
;
195 bool rightmost
= true;
197 p
= &info
->msg_tree
.rb_node
;
200 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
202 if (likely(leaf
->priority
== msg
->m_type
))
204 else if (msg
->m_type
< leaf
->priority
) {
210 if (info
->node_cache
) {
211 leaf
= info
->node_cache
;
212 info
->node_cache
= NULL
;
214 leaf
= kmalloc(sizeof(*leaf
), GFP_ATOMIC
);
217 INIT_LIST_HEAD(&leaf
->msg_list
);
219 leaf
->priority
= msg
->m_type
;
222 info
->msg_tree_rightmost
= &leaf
->rb_node
;
224 rb_link_node(&leaf
->rb_node
, parent
, p
);
225 rb_insert_color(&leaf
->rb_node
, &info
->msg_tree
);
227 info
->attr
.mq_curmsgs
++;
228 info
->qsize
+= msg
->m_ts
;
229 list_add_tail(&msg
->m_list
, &leaf
->msg_list
);
233 static inline void msg_tree_erase(struct posix_msg_tree_node
*leaf
,
234 struct mqueue_inode_info
*info
)
236 struct rb_node
*node
= &leaf
->rb_node
;
238 if (info
->msg_tree_rightmost
== node
)
239 info
->msg_tree_rightmost
= rb_prev(node
);
241 rb_erase(node
, &info
->msg_tree
);
242 if (info
->node_cache
)
245 info
->node_cache
= leaf
;
248 static inline struct msg_msg
*msg_get(struct mqueue_inode_info
*info
)
250 struct rb_node
*parent
= NULL
;
251 struct posix_msg_tree_node
*leaf
;
256 * During insert, low priorities go to the left and high to the
257 * right. On receive, we want the highest priorities first, so
258 * walk all the way to the right.
260 parent
= info
->msg_tree_rightmost
;
262 if (info
->attr
.mq_curmsgs
) {
263 pr_warn_once("Inconsistency in POSIX message queue, "
264 "no tree element, but supposedly messages "
266 info
->attr
.mq_curmsgs
= 0;
270 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
271 if (unlikely(list_empty(&leaf
->msg_list
))) {
272 pr_warn_once("Inconsistency in POSIX message queue, "
273 "empty leaf node but we haven't implemented "
274 "lazy leaf delete!\n");
275 msg_tree_erase(leaf
, info
);
278 msg
= list_first_entry(&leaf
->msg_list
,
279 struct msg_msg
, m_list
);
280 list_del(&msg
->m_list
);
281 if (list_empty(&leaf
->msg_list
)) {
282 msg_tree_erase(leaf
, info
);
285 info
->attr
.mq_curmsgs
--;
286 info
->qsize
-= msg
->m_ts
;
290 static struct inode
*mqueue_get_inode(struct super_block
*sb
,
291 struct ipc_namespace
*ipc_ns
, umode_t mode
,
292 struct mq_attr
*attr
)
297 inode
= new_inode(sb
);
301 inode
->i_ino
= get_next_ino();
302 inode
->i_mode
= mode
;
303 inode
->i_uid
= current_fsuid();
304 inode
->i_gid
= current_fsgid();
305 simple_inode_init_ts(inode
);
308 struct mqueue_inode_info
*info
;
309 unsigned long mq_bytes
, mq_treesize
;
311 inode
->i_fop
= &mqueue_file_operations
;
312 inode
->i_size
= FILENT_SIZE
;
313 /* mqueue specific info */
314 info
= MQUEUE_I(inode
);
315 spin_lock_init(&info
->lock
);
316 init_waitqueue_head(&info
->wait_q
);
317 INIT_LIST_HEAD(&info
->e_wait_q
[0].list
);
318 INIT_LIST_HEAD(&info
->e_wait_q
[1].list
);
319 info
->notify_owner
= NULL
;
320 info
->notify_user_ns
= NULL
;
322 info
->ucounts
= NULL
; /* set when all is ok */
323 info
->msg_tree
= RB_ROOT
;
324 info
->msg_tree_rightmost
= NULL
;
325 info
->node_cache
= NULL
;
326 memset(&info
->attr
, 0, sizeof(info
->attr
));
327 info
->attr
.mq_maxmsg
= min(ipc_ns
->mq_msg_max
,
328 ipc_ns
->mq_msg_default
);
329 info
->attr
.mq_msgsize
= min(ipc_ns
->mq_msgsize_max
,
330 ipc_ns
->mq_msgsize_default
);
332 info
->attr
.mq_maxmsg
= attr
->mq_maxmsg
;
333 info
->attr
.mq_msgsize
= attr
->mq_msgsize
;
336 * We used to allocate a static array of pointers and account
337 * the size of that array as well as one msg_msg struct per
338 * possible message into the queue size. That's no longer
339 * accurate as the queue is now an rbtree and will grow and
340 * shrink depending on usage patterns. We can, however, still
341 * account one msg_msg struct per message, but the nodes are
342 * allocated depending on priority usage, and most programs
343 * only use one, or a handful, of priorities. However, since
344 * this is pinned memory, we need to assume worst case, so
345 * that means the min(mq_maxmsg, max_priorities) * struct
346 * posix_msg_tree_node.
350 if (info
->attr
.mq_maxmsg
<= 0 || info
->attr
.mq_msgsize
<= 0)
352 if (capable(CAP_SYS_RESOURCE
)) {
353 if (info
->attr
.mq_maxmsg
> HARD_MSGMAX
||
354 info
->attr
.mq_msgsize
> HARD_MSGSIZEMAX
)
357 if (info
->attr
.mq_maxmsg
> ipc_ns
->mq_msg_max
||
358 info
->attr
.mq_msgsize
> ipc_ns
->mq_msgsize_max
)
362 /* check for overflow */
363 if (info
->attr
.mq_msgsize
> ULONG_MAX
/info
->attr
.mq_maxmsg
)
365 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
366 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
367 sizeof(struct posix_msg_tree_node
);
368 mq_bytes
= info
->attr
.mq_maxmsg
* info
->attr
.mq_msgsize
;
369 if (mq_bytes
+ mq_treesize
< mq_bytes
)
371 mq_bytes
+= mq_treesize
;
372 info
->ucounts
= get_ucounts(current_ucounts());
377 msgqueue
= inc_rlimit_ucounts(info
->ucounts
, UCOUNT_RLIMIT_MSGQUEUE
, mq_bytes
);
378 if (msgqueue
== LONG_MAX
|| msgqueue
> rlimit(RLIMIT_MSGQUEUE
)) {
379 dec_rlimit_ucounts(info
->ucounts
, UCOUNT_RLIMIT_MSGQUEUE
, mq_bytes
);
380 spin_unlock(&mq_lock
);
381 put_ucounts(info
->ucounts
);
382 info
->ucounts
= NULL
;
383 /* mqueue_evict_inode() releases info->messages */
387 spin_unlock(&mq_lock
);
389 } else if (S_ISDIR(mode
)) {
391 /* Some things misbehave if size == 0 on a directory */
392 inode
->i_size
= 2 * DIRENT_SIZE
;
393 inode
->i_op
= &mqueue_dir_inode_operations
;
394 inode
->i_fop
= &simple_dir_operations
;
404 static int mqueue_fill_super(struct super_block
*sb
, struct fs_context
*fc
)
407 struct ipc_namespace
*ns
= sb
->s_fs_info
;
409 sb
->s_iflags
|= SB_I_NOEXEC
| SB_I_NODEV
;
410 sb
->s_blocksize
= PAGE_SIZE
;
411 sb
->s_blocksize_bits
= PAGE_SHIFT
;
412 sb
->s_magic
= MQUEUE_MAGIC
;
413 sb
->s_op
= &mqueue_super_ops
;
415 inode
= mqueue_get_inode(sb
, ns
, S_IFDIR
| S_ISVTX
| S_IRWXUGO
, NULL
);
417 return PTR_ERR(inode
);
419 sb
->s_root
= d_make_root(inode
);
425 static int mqueue_get_tree(struct fs_context
*fc
)
427 struct mqueue_fs_context
*ctx
= fc
->fs_private
;
430 * With a newly created ipc namespace, we don't need to do a search
431 * for an ipc namespace match, but we still need to set s_fs_info.
434 fc
->s_fs_info
= ctx
->ipc_ns
;
435 return get_tree_nodev(fc
, mqueue_fill_super
);
437 return get_tree_keyed(fc
, mqueue_fill_super
, ctx
->ipc_ns
);
440 static void mqueue_fs_context_free(struct fs_context
*fc
)
442 struct mqueue_fs_context
*ctx
= fc
->fs_private
;
444 put_ipc_ns(ctx
->ipc_ns
);
448 static int mqueue_init_fs_context(struct fs_context
*fc
)
450 struct mqueue_fs_context
*ctx
;
452 ctx
= kzalloc(sizeof(struct mqueue_fs_context
), GFP_KERNEL
);
456 ctx
->ipc_ns
= get_ipc_ns(current
->nsproxy
->ipc_ns
);
457 put_user_ns(fc
->user_ns
);
458 fc
->user_ns
= get_user_ns(ctx
->ipc_ns
->user_ns
);
459 fc
->fs_private
= ctx
;
460 fc
->ops
= &mqueue_fs_context_ops
;
465 * mq_init_ns() is currently the only caller of mq_create_mount().
466 * So the ns parameter is always a newly created ipc namespace.
468 static struct vfsmount
*mq_create_mount(struct ipc_namespace
*ns
)
470 struct mqueue_fs_context
*ctx
;
471 struct fs_context
*fc
;
472 struct vfsmount
*mnt
;
474 fc
= fs_context_for_mount(&mqueue_fs_type
, SB_KERNMOUNT
);
478 ctx
= fc
->fs_private
;
480 put_ipc_ns(ctx
->ipc_ns
);
481 ctx
->ipc_ns
= get_ipc_ns(ns
);
482 put_user_ns(fc
->user_ns
);
483 fc
->user_ns
= get_user_ns(ctx
->ipc_ns
->user_ns
);
490 static void init_once(void *foo
)
492 struct mqueue_inode_info
*p
= foo
;
494 inode_init_once(&p
->vfs_inode
);
497 static struct inode
*mqueue_alloc_inode(struct super_block
*sb
)
499 struct mqueue_inode_info
*ei
;
501 ei
= alloc_inode_sb(sb
, mqueue_inode_cachep
, GFP_KERNEL
);
504 return &ei
->vfs_inode
;
507 static void mqueue_free_inode(struct inode
*inode
)
509 kmem_cache_free(mqueue_inode_cachep
, MQUEUE_I(inode
));
512 static void mqueue_evict_inode(struct inode
*inode
)
514 struct mqueue_inode_info
*info
;
515 struct ipc_namespace
*ipc_ns
;
516 struct msg_msg
*msg
, *nmsg
;
521 if (S_ISDIR(inode
->i_mode
))
524 ipc_ns
= get_ns_from_inode(inode
);
525 info
= MQUEUE_I(inode
);
526 spin_lock(&info
->lock
);
527 while ((msg
= msg_get(info
)) != NULL
)
528 list_add_tail(&msg
->m_list
, &tmp_msg
);
529 kfree(info
->node_cache
);
530 spin_unlock(&info
->lock
);
532 list_for_each_entry_safe(msg
, nmsg
, &tmp_msg
, m_list
) {
533 list_del(&msg
->m_list
);
538 unsigned long mq_bytes
, mq_treesize
;
540 /* Total amount of bytes accounted for the mqueue */
541 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
542 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
543 sizeof(struct posix_msg_tree_node
);
545 mq_bytes
= mq_treesize
+ (info
->attr
.mq_maxmsg
*
546 info
->attr
.mq_msgsize
);
549 dec_rlimit_ucounts(info
->ucounts
, UCOUNT_RLIMIT_MSGQUEUE
, mq_bytes
);
551 * get_ns_from_inode() ensures that the
552 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
553 * to which we now hold a reference, or it is NULL.
554 * We can't put it here under mq_lock, though.
557 ipc_ns
->mq_queues_count
--;
558 spin_unlock(&mq_lock
);
559 put_ucounts(info
->ucounts
);
560 info
->ucounts
= NULL
;
566 static int mqueue_create_attr(struct dentry
*dentry
, umode_t mode
, void *arg
)
568 struct inode
*dir
= dentry
->d_parent
->d_inode
;
570 struct mq_attr
*attr
= arg
;
572 struct ipc_namespace
*ipc_ns
;
575 ipc_ns
= __get_ns_from_inode(dir
);
581 if (ipc_ns
->mq_queues_count
>= ipc_ns
->mq_queues_max
&&
582 !capable(CAP_SYS_RESOURCE
)) {
586 ipc_ns
->mq_queues_count
++;
587 spin_unlock(&mq_lock
);
589 inode
= mqueue_get_inode(dir
->i_sb
, ipc_ns
, mode
, attr
);
591 error
= PTR_ERR(inode
);
593 ipc_ns
->mq_queues_count
--;
598 dir
->i_size
+= DIRENT_SIZE
;
599 simple_inode_init_ts(dir
);
601 d_instantiate(dentry
, inode
);
605 spin_unlock(&mq_lock
);
611 static int mqueue_create(struct mnt_idmap
*idmap
, struct inode
*dir
,
612 struct dentry
*dentry
, umode_t mode
, bool excl
)
614 return mqueue_create_attr(dentry
, mode
, NULL
);
617 static int mqueue_unlink(struct inode
*dir
, struct dentry
*dentry
)
619 struct inode
*inode
= d_inode(dentry
);
621 simple_inode_init_ts(dir
);
622 dir
->i_size
-= DIRENT_SIZE
;
629 * This is routine for system read from queue file.
630 * To avoid mess with doing here some sort of mq_receive we allow
631 * to read only queue size & notification info (the only values
632 * that are interesting from user point of view and aren't accessible
633 * through std routines)
635 static ssize_t
mqueue_read_file(struct file
*filp
, char __user
*u_data
,
636 size_t count
, loff_t
*off
)
638 struct inode
*inode
= file_inode(filp
);
639 struct mqueue_inode_info
*info
= MQUEUE_I(inode
);
640 char buffer
[FILENT_SIZE
];
643 spin_lock(&info
->lock
);
644 snprintf(buffer
, sizeof(buffer
),
645 "QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",
647 info
->notify_owner
? info
->notify
.sigev_notify
: 0,
648 (info
->notify_owner
&&
649 info
->notify
.sigev_notify
== SIGEV_SIGNAL
) ?
650 info
->notify
.sigev_signo
: 0,
651 pid_vnr(info
->notify_owner
));
652 spin_unlock(&info
->lock
);
653 buffer
[sizeof(buffer
)-1] = '\0';
655 ret
= simple_read_from_buffer(u_data
, count
, off
, buffer
,
660 inode_set_atime_to_ts(inode
, inode_set_ctime_current(inode
));
664 static int mqueue_flush_file(struct file
*filp
, fl_owner_t id
)
666 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
668 spin_lock(&info
->lock
);
669 if (task_tgid(current
) == info
->notify_owner
)
670 remove_notification(info
);
672 spin_unlock(&info
->lock
);
676 static __poll_t
mqueue_poll_file(struct file
*filp
, struct poll_table_struct
*poll_tab
)
678 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
681 poll_wait(filp
, &info
->wait_q
, poll_tab
);
683 spin_lock(&info
->lock
);
684 if (info
->attr
.mq_curmsgs
)
685 retval
= EPOLLIN
| EPOLLRDNORM
;
687 if (info
->attr
.mq_curmsgs
< info
->attr
.mq_maxmsg
)
688 retval
|= EPOLLOUT
| EPOLLWRNORM
;
689 spin_unlock(&info
->lock
);
694 /* Adds current to info->e_wait_q[sr] before element with smaller prio */
695 static void wq_add(struct mqueue_inode_info
*info
, int sr
,
696 struct ext_wait_queue
*ewp
)
698 struct ext_wait_queue
*walk
;
700 list_for_each_entry(walk
, &info
->e_wait_q
[sr
].list
, list
) {
701 if (walk
->task
->prio
<= current
->prio
) {
702 list_add_tail(&ewp
->list
, &walk
->list
);
706 list_add_tail(&ewp
->list
, &info
->e_wait_q
[sr
].list
);
710 * Puts current task to sleep. Caller must hold queue lock. After return
714 static int wq_sleep(struct mqueue_inode_info
*info
, int sr
,
715 ktime_t
*timeout
, struct ext_wait_queue
*ewp
)
716 __releases(&info
->lock
)
721 wq_add(info
, sr
, ewp
);
724 /* memory barrier not required, we hold info->lock */
725 __set_current_state(TASK_INTERRUPTIBLE
);
727 spin_unlock(&info
->lock
);
728 time
= schedule_hrtimeout_range_clock(timeout
, 0,
729 HRTIMER_MODE_ABS
, CLOCK_REALTIME
);
731 if (READ_ONCE(ewp
->state
) == STATE_READY
) {
732 /* see MQ_BARRIER for purpose/pairing */
733 smp_acquire__after_ctrl_dep();
737 spin_lock(&info
->lock
);
739 /* we hold info->lock, so no memory barrier required */
740 if (READ_ONCE(ewp
->state
) == STATE_READY
) {
744 if (signal_pending(current
)) {
745 retval
= -ERESTARTSYS
;
753 list_del(&ewp
->list
);
755 spin_unlock(&info
->lock
);
761 * Returns waiting task that should be serviced first or NULL if none exists
763 static struct ext_wait_queue
*wq_get_first_waiter(
764 struct mqueue_inode_info
*info
, int sr
)
766 struct list_head
*ptr
;
768 ptr
= info
->e_wait_q
[sr
].list
.prev
;
769 if (ptr
== &info
->e_wait_q
[sr
].list
)
771 return list_entry(ptr
, struct ext_wait_queue
, list
);
775 static inline void set_cookie(struct sk_buff
*skb
, char code
)
777 ((char *)skb
->data
)[NOTIFY_COOKIE_LEN
-1] = code
;
781 * The next function is only to split too long sys_mq_timedsend
783 static void __do_notify(struct mqueue_inode_info
*info
)
786 * invoked when there is registered process and there isn't process
787 * waiting synchronously for message AND state of queue changed from
788 * empty to not empty. Here we are sure that no one is waiting
790 if (info
->notify_owner
&&
791 info
->attr
.mq_curmsgs
== 1) {
792 switch (info
->notify
.sigev_notify
) {
796 struct kernel_siginfo sig_i
;
797 struct task_struct
*task
;
799 /* do_mq_notify() accepts sigev_signo == 0, why?? */
800 if (!info
->notify
.sigev_signo
)
803 clear_siginfo(&sig_i
);
804 sig_i
.si_signo
= info
->notify
.sigev_signo
;
806 sig_i
.si_code
= SI_MESGQ
;
807 sig_i
.si_value
= info
->notify
.sigev_value
;
809 /* map current pid/uid into info->owner's namespaces */
810 sig_i
.si_pid
= task_tgid_nr_ns(current
,
811 ns_of_pid(info
->notify_owner
));
812 sig_i
.si_uid
= from_kuid_munged(info
->notify_user_ns
,
815 * We can't use kill_pid_info(), this signal should
816 * bypass check_kill_permission(). It is from kernel
817 * but si_fromuser() can't know this.
818 * We do check the self_exec_id, to avoid sending
819 * signals to programs that don't expect them.
821 task
= pid_task(info
->notify_owner
, PIDTYPE_TGID
);
822 if (task
&& task
->self_exec_id
==
823 info
->notify_self_exec_id
) {
824 do_send_sig_info(info
->notify
.sigev_signo
,
825 &sig_i
, task
, PIDTYPE_TGID
);
831 set_cookie(info
->notify_cookie
, NOTIFY_WOKENUP
);
832 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
835 /* after notification unregisters process */
836 put_pid(info
->notify_owner
);
837 put_user_ns(info
->notify_user_ns
);
838 info
->notify_owner
= NULL
;
839 info
->notify_user_ns
= NULL
;
841 wake_up(&info
->wait_q
);
844 static int prepare_timeout(const struct __kernel_timespec __user
*u_abs_timeout
,
845 struct timespec64
*ts
)
847 if (get_timespec64(ts
, u_abs_timeout
))
849 if (!timespec64_valid(ts
))
854 static void remove_notification(struct mqueue_inode_info
*info
)
856 if (info
->notify_owner
!= NULL
&&
857 info
->notify
.sigev_notify
== SIGEV_THREAD
) {
858 set_cookie(info
->notify_cookie
, NOTIFY_REMOVED
);
859 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
861 put_pid(info
->notify_owner
);
862 put_user_ns(info
->notify_user_ns
);
863 info
->notify_owner
= NULL
;
864 info
->notify_user_ns
= NULL
;
867 static int prepare_open(struct dentry
*dentry
, int oflag
, int ro
,
868 umode_t mode
, struct filename
*name
,
869 struct mq_attr
*attr
)
871 static const int oflag2acc
[O_ACCMODE
] = { MAY_READ
, MAY_WRITE
,
872 MAY_READ
| MAY_WRITE
};
875 if (d_really_is_negative(dentry
)) {
876 if (!(oflag
& O_CREAT
))
880 audit_inode_parent_hidden(name
, dentry
->d_parent
);
881 return vfs_mkobj(dentry
, mode
& ~current_umask(),
882 mqueue_create_attr
, attr
);
884 /* it already existed */
885 audit_inode(name
, dentry
, 0);
886 if ((oflag
& (O_CREAT
|O_EXCL
)) == (O_CREAT
|O_EXCL
))
888 if ((oflag
& O_ACCMODE
) == (O_RDWR
| O_WRONLY
))
890 acc
= oflag2acc
[oflag
& O_ACCMODE
];
891 return inode_permission(&nop_mnt_idmap
, d_inode(dentry
), acc
);
894 static int do_mq_open(const char __user
*u_name
, int oflag
, umode_t mode
,
895 struct mq_attr
*attr
)
897 struct vfsmount
*mnt
= current
->nsproxy
->ipc_ns
->mq_mnt
;
898 struct dentry
*root
= mnt
->mnt_root
;
899 struct filename
*name
;
904 audit_mq_open(oflag
, mode
, attr
);
906 name
= getname(u_name
);
908 return PTR_ERR(name
);
910 fd
= get_unused_fd_flags(O_CLOEXEC
);
914 ro
= mnt_want_write(mnt
); /* we'll drop it in any case */
915 inode_lock(d_inode(root
));
916 path
.dentry
= lookup_one_len(name
->name
, root
, strlen(name
->name
));
917 if (IS_ERR(path
.dentry
)) {
918 error
= PTR_ERR(path
.dentry
);
921 path
.mnt
= mntget(mnt
);
922 error
= prepare_open(path
.dentry
, oflag
, ro
, mode
, name
, attr
);
924 struct file
*file
= dentry_open(&path
, oflag
, current_cred());
926 fd_install(fd
, file
);
928 error
= PTR_ERR(file
);
936 inode_unlock(d_inode(root
));
944 SYSCALL_DEFINE4(mq_open
, const char __user
*, u_name
, int, oflag
, umode_t
, mode
,
945 struct mq_attr __user
*, u_attr
)
948 if (u_attr
&& copy_from_user(&attr
, u_attr
, sizeof(struct mq_attr
)))
951 return do_mq_open(u_name
, oflag
, mode
, u_attr
? &attr
: NULL
);
954 SYSCALL_DEFINE1(mq_unlink
, const char __user
*, u_name
)
957 struct filename
*name
;
958 struct dentry
*dentry
;
959 struct inode
*inode
= NULL
;
960 struct ipc_namespace
*ipc_ns
= current
->nsproxy
->ipc_ns
;
961 struct vfsmount
*mnt
= ipc_ns
->mq_mnt
;
963 name
= getname(u_name
);
965 return PTR_ERR(name
);
967 audit_inode_parent_hidden(name
, mnt
->mnt_root
);
968 err
= mnt_want_write(mnt
);
971 inode_lock_nested(d_inode(mnt
->mnt_root
), I_MUTEX_PARENT
);
972 dentry
= lookup_one_len(name
->name
, mnt
->mnt_root
,
974 if (IS_ERR(dentry
)) {
975 err
= PTR_ERR(dentry
);
979 inode
= d_inode(dentry
);
984 err
= vfs_unlink(&nop_mnt_idmap
, d_inode(dentry
->d_parent
),
990 inode_unlock(d_inode(mnt
->mnt_root
));
999 /* Pipelined send and receive functions.
1001 * If a receiver finds no waiting message, then it registers itself in the
1002 * list of waiting receivers. A sender checks that list before adding the new
1003 * message into the message array. If there is a waiting receiver, then it
1004 * bypasses the message array and directly hands the message over to the
1005 * receiver. The receiver accepts the message and returns without grabbing the
1008 * - Set pointer to message.
1009 * - Queue the receiver task for later wakeup (without the info->lock).
1010 * - Update its state to STATE_READY. Now the receiver can continue.
1011 * - Wake up the process after the lock is dropped. Should the process wake up
1012 * before this wakeup (due to a timeout or a signal) it will either see
1013 * STATE_READY and continue or acquire the lock to check the state again.
1015 * The same algorithm is used for senders.
1018 static inline void __pipelined_op(struct wake_q_head
*wake_q
,
1019 struct mqueue_inode_info
*info
,
1020 struct ext_wait_queue
*this)
1022 struct task_struct
*task
;
1024 list_del(&this->list
);
1025 task
= get_task_struct(this->task
);
1027 /* see MQ_BARRIER for purpose/pairing */
1028 smp_store_release(&this->state
, STATE_READY
);
1029 wake_q_add_safe(wake_q
, task
);
1032 /* pipelined_send() - send a message directly to the task waiting in
1033 * sys_mq_timedreceive() (without inserting message into a queue).
1035 static inline void pipelined_send(struct wake_q_head
*wake_q
,
1036 struct mqueue_inode_info
*info
,
1037 struct msg_msg
*message
,
1038 struct ext_wait_queue
*receiver
)
1040 receiver
->msg
= message
;
1041 __pipelined_op(wake_q
, info
, receiver
);
1044 /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
1045 * gets its message and put to the queue (we have one free place for sure). */
1046 static inline void pipelined_receive(struct wake_q_head
*wake_q
,
1047 struct mqueue_inode_info
*info
)
1049 struct ext_wait_queue
*sender
= wq_get_first_waiter(info
, SEND
);
1053 wake_up_interruptible(&info
->wait_q
);
1056 if (msg_insert(sender
->msg
, info
))
1059 __pipelined_op(wake_q
, info
, sender
);
1062 static int do_mq_timedsend(mqd_t mqdes
, const char __user
*u_msg_ptr
,
1063 size_t msg_len
, unsigned int msg_prio
,
1064 struct timespec64
*ts
)
1066 struct inode
*inode
;
1067 struct ext_wait_queue wait
;
1068 struct ext_wait_queue
*receiver
;
1069 struct msg_msg
*msg_ptr
;
1070 struct mqueue_inode_info
*info
;
1071 ktime_t expires
, *timeout
= NULL
;
1072 struct posix_msg_tree_node
*new_leaf
= NULL
;
1074 DEFINE_WAKE_Q(wake_q
);
1076 if (unlikely(msg_prio
>= (unsigned long) MQ_PRIO_MAX
))
1080 expires
= timespec64_to_ktime(*ts
);
1084 audit_mq_sendrecv(mqdes
, msg_len
, msg_prio
, ts
);
1086 CLASS(fd
, f
)(mqdes
);
1090 inode
= file_inode(fd_file(f
));
1091 if (unlikely(fd_file(f
)->f_op
!= &mqueue_file_operations
))
1093 info
= MQUEUE_I(inode
);
1094 audit_file(fd_file(f
));
1096 if (unlikely(!(fd_file(f
)->f_mode
& FMODE_WRITE
)))
1099 if (unlikely(msg_len
> info
->attr
.mq_msgsize
))
1102 /* First try to allocate memory, before doing anything with
1103 * existing queues. */
1104 msg_ptr
= load_msg(u_msg_ptr
, msg_len
);
1105 if (IS_ERR(msg_ptr
))
1106 return PTR_ERR(msg_ptr
);
1107 msg_ptr
->m_ts
= msg_len
;
1108 msg_ptr
->m_type
= msg_prio
;
1111 * msg_insert really wants us to have a valid, spare node struct so
1112 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
1113 * fall back to that if necessary.
1115 if (!info
->node_cache
)
1116 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
1118 spin_lock(&info
->lock
);
1120 if (!info
->node_cache
&& new_leaf
) {
1121 /* Save our speculative allocation into the cache */
1122 INIT_LIST_HEAD(&new_leaf
->msg_list
);
1123 info
->node_cache
= new_leaf
;
1129 if (info
->attr
.mq_curmsgs
== info
->attr
.mq_maxmsg
) {
1130 if (fd_file(f
)->f_flags
& O_NONBLOCK
) {
1133 wait
.task
= current
;
1134 wait
.msg
= (void *) msg_ptr
;
1136 /* memory barrier not required, we hold info->lock */
1137 WRITE_ONCE(wait
.state
, STATE_NONE
);
1138 ret
= wq_sleep(info
, SEND
, timeout
, &wait
);
1140 * wq_sleep must be called with info->lock held, and
1141 * returns with the lock released
1146 receiver
= wq_get_first_waiter(info
, RECV
);
1148 pipelined_send(&wake_q
, info
, msg_ptr
, receiver
);
1150 /* adds message to the queue */
1151 ret
= msg_insert(msg_ptr
, info
);
1156 simple_inode_init_ts(inode
);
1159 spin_unlock(&info
->lock
);
1167 static int do_mq_timedreceive(mqd_t mqdes
, char __user
*u_msg_ptr
,
1168 size_t msg_len
, unsigned int __user
*u_msg_prio
,
1169 struct timespec64
*ts
)
1172 struct msg_msg
*msg_ptr
;
1173 struct inode
*inode
;
1174 struct mqueue_inode_info
*info
;
1175 struct ext_wait_queue wait
;
1176 ktime_t expires
, *timeout
= NULL
;
1177 struct posix_msg_tree_node
*new_leaf
= NULL
;
1180 expires
= timespec64_to_ktime(*ts
);
1184 audit_mq_sendrecv(mqdes
, msg_len
, 0, ts
);
1186 CLASS(fd
, f
)(mqdes
);
1190 inode
= file_inode(fd_file(f
));
1191 if (unlikely(fd_file(f
)->f_op
!= &mqueue_file_operations
))
1193 info
= MQUEUE_I(inode
);
1194 audit_file(fd_file(f
));
1196 if (unlikely(!(fd_file(f
)->f_mode
& FMODE_READ
)))
1199 /* checks if buffer is big enough */
1200 if (unlikely(msg_len
< info
->attr
.mq_msgsize
))
1204 * msg_insert really wants us to have a valid, spare node struct so
1205 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
1206 * fall back to that if necessary.
1208 if (!info
->node_cache
)
1209 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
1211 spin_lock(&info
->lock
);
1213 if (!info
->node_cache
&& new_leaf
) {
1214 /* Save our speculative allocation into the cache */
1215 INIT_LIST_HEAD(&new_leaf
->msg_list
);
1216 info
->node_cache
= new_leaf
;
1221 if (info
->attr
.mq_curmsgs
== 0) {
1222 if (fd_file(f
)->f_flags
& O_NONBLOCK
) {
1223 spin_unlock(&info
->lock
);
1226 wait
.task
= current
;
1228 /* memory barrier not required, we hold info->lock */
1229 WRITE_ONCE(wait
.state
, STATE_NONE
);
1230 ret
= wq_sleep(info
, RECV
, timeout
, &wait
);
1234 DEFINE_WAKE_Q(wake_q
);
1236 msg_ptr
= msg_get(info
);
1238 simple_inode_init_ts(inode
);
1240 /* There is now free space in queue. */
1241 pipelined_receive(&wake_q
, info
);
1242 spin_unlock(&info
->lock
);
1247 ret
= msg_ptr
->m_ts
;
1249 if ((u_msg_prio
&& put_user(msg_ptr
->m_type
, u_msg_prio
)) ||
1250 store_msg(u_msg_ptr
, msg_ptr
, msg_ptr
->m_ts
)) {
1258 SYSCALL_DEFINE5(mq_timedsend
, mqd_t
, mqdes
, const char __user
*, u_msg_ptr
,
1259 size_t, msg_len
, unsigned int, msg_prio
,
1260 const struct __kernel_timespec __user
*, u_abs_timeout
)
1262 struct timespec64 ts
, *p
= NULL
;
1263 if (u_abs_timeout
) {
1264 int res
= prepare_timeout(u_abs_timeout
, &ts
);
1269 return do_mq_timedsend(mqdes
, u_msg_ptr
, msg_len
, msg_prio
, p
);
1272 SYSCALL_DEFINE5(mq_timedreceive
, mqd_t
, mqdes
, char __user
*, u_msg_ptr
,
1273 size_t, msg_len
, unsigned int __user
*, u_msg_prio
,
1274 const struct __kernel_timespec __user
*, u_abs_timeout
)
1276 struct timespec64 ts
, *p
= NULL
;
1277 if (u_abs_timeout
) {
1278 int res
= prepare_timeout(u_abs_timeout
, &ts
);
1283 return do_mq_timedreceive(mqdes
, u_msg_ptr
, msg_len
, u_msg_prio
, p
);
1287 * Notes: the case when user wants us to deregister (with NULL as pointer)
1288 * and he isn't currently owner of notification, will be silently discarded.
1289 * It isn't explicitly defined in the POSIX.
1291 static int do_mq_notify(mqd_t mqdes
, const struct sigevent
*notification
)
1295 struct inode
*inode
;
1296 struct mqueue_inode_info
*info
;
1299 audit_mq_notify(mqdes
, notification
);
1303 if (notification
!= NULL
) {
1304 if (unlikely(notification
->sigev_notify
!= SIGEV_NONE
&&
1305 notification
->sigev_notify
!= SIGEV_SIGNAL
&&
1306 notification
->sigev_notify
!= SIGEV_THREAD
))
1308 if (notification
->sigev_notify
== SIGEV_SIGNAL
&&
1309 !valid_signal(notification
->sigev_signo
)) {
1312 if (notification
->sigev_notify
== SIGEV_THREAD
) {
1315 /* create the notify skb */
1316 nc
= alloc_skb(NOTIFY_COOKIE_LEN
, GFP_KERNEL
);
1320 if (copy_from_user(nc
->data
,
1321 notification
->sigev_value
.sival_ptr
,
1322 NOTIFY_COOKIE_LEN
)) {
1327 /* TODO: add a header? */
1328 skb_put(nc
, NOTIFY_COOKIE_LEN
);
1329 /* and attach it to the socket */
1331 sock
= netlink_getsockbyfd(notification
->sigev_signo
);
1334 return PTR_ERR(sock
);
1337 timeo
= MAX_SCHEDULE_TIMEOUT
;
1338 ret
= netlink_attachskb(sock
, nc
, &timeo
, NULL
);
1346 CLASS(fd
, f
)(mqdes
);
1352 inode
= file_inode(fd_file(f
));
1353 if (unlikely(fd_file(f
)->f_op
!= &mqueue_file_operations
)) {
1357 info
= MQUEUE_I(inode
);
1360 spin_lock(&info
->lock
);
1361 if (notification
== NULL
) {
1362 if (info
->notify_owner
== task_tgid(current
)) {
1363 remove_notification(info
);
1364 inode_set_atime_to_ts(inode
,
1365 inode_set_ctime_current(inode
));
1367 } else if (info
->notify_owner
!= NULL
) {
1370 switch (notification
->sigev_notify
) {
1372 info
->notify
.sigev_notify
= SIGEV_NONE
;
1375 info
->notify_sock
= sock
;
1376 info
->notify_cookie
= nc
;
1379 info
->notify
.sigev_notify
= SIGEV_THREAD
;
1382 info
->notify
.sigev_signo
= notification
->sigev_signo
;
1383 info
->notify
.sigev_value
= notification
->sigev_value
;
1384 info
->notify
.sigev_notify
= SIGEV_SIGNAL
;
1385 info
->notify_self_exec_id
= current
->self_exec_id
;
1389 info
->notify_owner
= get_pid(task_tgid(current
));
1390 info
->notify_user_ns
= get_user_ns(current_user_ns());
1391 inode_set_atime_to_ts(inode
, inode_set_ctime_current(inode
));
1393 spin_unlock(&info
->lock
);
1396 netlink_detachskb(sock
, nc
);
1400 SYSCALL_DEFINE2(mq_notify
, mqd_t
, mqdes
,
1401 const struct sigevent __user
*, u_notification
)
1403 struct sigevent n
, *p
= NULL
;
1404 if (u_notification
) {
1405 if (copy_from_user(&n
, u_notification
, sizeof(struct sigevent
)))
1409 return do_mq_notify(mqdes
, p
);
1412 static int do_mq_getsetattr(int mqdes
, struct mq_attr
*new, struct mq_attr
*old
)
1414 struct inode
*inode
;
1415 struct mqueue_inode_info
*info
;
1417 if (new && (new->mq_flags
& (~O_NONBLOCK
)))
1420 CLASS(fd
, f
)(mqdes
);
1424 if (unlikely(fd_file(f
)->f_op
!= &mqueue_file_operations
))
1427 inode
= file_inode(fd_file(f
));
1428 info
= MQUEUE_I(inode
);
1430 spin_lock(&info
->lock
);
1434 old
->mq_flags
= fd_file(f
)->f_flags
& O_NONBLOCK
;
1437 audit_mq_getsetattr(mqdes
, new);
1438 spin_lock(&fd_file(f
)->f_lock
);
1439 if (new->mq_flags
& O_NONBLOCK
)
1440 fd_file(f
)->f_flags
|= O_NONBLOCK
;
1442 fd_file(f
)->f_flags
&= ~O_NONBLOCK
;
1443 spin_unlock(&fd_file(f
)->f_lock
);
1445 inode_set_atime_to_ts(inode
, inode_set_ctime_current(inode
));
1448 spin_unlock(&info
->lock
);
1452 SYSCALL_DEFINE3(mq_getsetattr
, mqd_t
, mqdes
,
1453 const struct mq_attr __user
*, u_mqstat
,
1454 struct mq_attr __user
*, u_omqstat
)
1457 struct mq_attr mqstat
, omqstat
;
1458 struct mq_attr
*new = NULL
, *old
= NULL
;
1462 if (copy_from_user(new, u_mqstat
, sizeof(struct mq_attr
)))
1468 ret
= do_mq_getsetattr(mqdes
, new, old
);
1472 if (copy_to_user(u_omqstat
, old
, sizeof(struct mq_attr
)))
1477 #ifdef CONFIG_COMPAT
1479 struct compat_mq_attr
{
1480 compat_long_t mq_flags
; /* message queue flags */
1481 compat_long_t mq_maxmsg
; /* maximum number of messages */
1482 compat_long_t mq_msgsize
; /* maximum message size */
1483 compat_long_t mq_curmsgs
; /* number of messages currently queued */
1484 compat_long_t __reserved
[4]; /* ignored for input, zeroed for output */
1487 static inline int get_compat_mq_attr(struct mq_attr
*attr
,
1488 const struct compat_mq_attr __user
*uattr
)
1490 struct compat_mq_attr v
;
1492 if (copy_from_user(&v
, uattr
, sizeof(*uattr
)))
1495 memset(attr
, 0, sizeof(*attr
));
1496 attr
->mq_flags
= v
.mq_flags
;
1497 attr
->mq_maxmsg
= v
.mq_maxmsg
;
1498 attr
->mq_msgsize
= v
.mq_msgsize
;
1499 attr
->mq_curmsgs
= v
.mq_curmsgs
;
1503 static inline int put_compat_mq_attr(const struct mq_attr
*attr
,
1504 struct compat_mq_attr __user
*uattr
)
1506 struct compat_mq_attr v
;
1508 memset(&v
, 0, sizeof(v
));
1509 v
.mq_flags
= attr
->mq_flags
;
1510 v
.mq_maxmsg
= attr
->mq_maxmsg
;
1511 v
.mq_msgsize
= attr
->mq_msgsize
;
1512 v
.mq_curmsgs
= attr
->mq_curmsgs
;
1513 if (copy_to_user(uattr
, &v
, sizeof(*uattr
)))
1518 COMPAT_SYSCALL_DEFINE4(mq_open
, const char __user
*, u_name
,
1519 int, oflag
, compat_mode_t
, mode
,
1520 struct compat_mq_attr __user
*, u_attr
)
1522 struct mq_attr attr
, *p
= NULL
;
1523 if (u_attr
&& oflag
& O_CREAT
) {
1525 if (get_compat_mq_attr(&attr
, u_attr
))
1528 return do_mq_open(u_name
, oflag
, mode
, p
);
1531 COMPAT_SYSCALL_DEFINE2(mq_notify
, mqd_t
, mqdes
,
1532 const struct compat_sigevent __user
*, u_notification
)
1534 struct sigevent n
, *p
= NULL
;
1535 if (u_notification
) {
1536 if (get_compat_sigevent(&n
, u_notification
))
1538 if (n
.sigev_notify
== SIGEV_THREAD
)
1539 n
.sigev_value
.sival_ptr
= compat_ptr(n
.sigev_value
.sival_int
);
1542 return do_mq_notify(mqdes
, p
);
1545 COMPAT_SYSCALL_DEFINE3(mq_getsetattr
, mqd_t
, mqdes
,
1546 const struct compat_mq_attr __user
*, u_mqstat
,
1547 struct compat_mq_attr __user
*, u_omqstat
)
1550 struct mq_attr mqstat
, omqstat
;
1551 struct mq_attr
*new = NULL
, *old
= NULL
;
1555 if (get_compat_mq_attr(new, u_mqstat
))
1561 ret
= do_mq_getsetattr(mqdes
, new, old
);
1565 if (put_compat_mq_attr(old
, u_omqstat
))
1571 #ifdef CONFIG_COMPAT_32BIT_TIME
1572 static int compat_prepare_timeout(const struct old_timespec32 __user
*p
,
1573 struct timespec64
*ts
)
1575 if (get_old_timespec32(ts
, p
))
1577 if (!timespec64_valid(ts
))
1582 SYSCALL_DEFINE5(mq_timedsend_time32
, mqd_t
, mqdes
,
1583 const char __user
*, u_msg_ptr
,
1584 unsigned int, msg_len
, unsigned int, msg_prio
,
1585 const struct old_timespec32 __user
*, u_abs_timeout
)
1587 struct timespec64 ts
, *p
= NULL
;
1588 if (u_abs_timeout
) {
1589 int res
= compat_prepare_timeout(u_abs_timeout
, &ts
);
1594 return do_mq_timedsend(mqdes
, u_msg_ptr
, msg_len
, msg_prio
, p
);
1597 SYSCALL_DEFINE5(mq_timedreceive_time32
, mqd_t
, mqdes
,
1598 char __user
*, u_msg_ptr
,
1599 unsigned int, msg_len
, unsigned int __user
*, u_msg_prio
,
1600 const struct old_timespec32 __user
*, u_abs_timeout
)
1602 struct timespec64 ts
, *p
= NULL
;
1603 if (u_abs_timeout
) {
1604 int res
= compat_prepare_timeout(u_abs_timeout
, &ts
);
1609 return do_mq_timedreceive(mqdes
, u_msg_ptr
, msg_len
, u_msg_prio
, p
);
1613 static const struct inode_operations mqueue_dir_inode_operations
= {
1614 .lookup
= simple_lookup
,
1615 .create
= mqueue_create
,
1616 .unlink
= mqueue_unlink
,
1619 static const struct file_operations mqueue_file_operations
= {
1620 .flush
= mqueue_flush_file
,
1621 .poll
= mqueue_poll_file
,
1622 .read
= mqueue_read_file
,
1623 .llseek
= default_llseek
,
1626 static const struct super_operations mqueue_super_ops
= {
1627 .alloc_inode
= mqueue_alloc_inode
,
1628 .free_inode
= mqueue_free_inode
,
1629 .evict_inode
= mqueue_evict_inode
,
1630 .statfs
= simple_statfs
,
1633 static const struct fs_context_operations mqueue_fs_context_ops
= {
1634 .free
= mqueue_fs_context_free
,
1635 .get_tree
= mqueue_get_tree
,
1638 static struct file_system_type mqueue_fs_type
= {
1640 .init_fs_context
= mqueue_init_fs_context
,
1641 .kill_sb
= kill_litter_super
,
1642 .fs_flags
= FS_USERNS_MOUNT
,
1645 int mq_init_ns(struct ipc_namespace
*ns
)
1649 ns
->mq_queues_count
= 0;
1650 ns
->mq_queues_max
= DFLT_QUEUESMAX
;
1651 ns
->mq_msg_max
= DFLT_MSGMAX
;
1652 ns
->mq_msgsize_max
= DFLT_MSGSIZEMAX
;
1653 ns
->mq_msg_default
= DFLT_MSG
;
1654 ns
->mq_msgsize_default
= DFLT_MSGSIZE
;
1656 m
= mq_create_mount(ns
);
1663 void mq_clear_sbinfo(struct ipc_namespace
*ns
)
1665 ns
->mq_mnt
->mnt_sb
->s_fs_info
= NULL
;
1668 static int __init
init_mqueue_fs(void)
1672 mqueue_inode_cachep
= kmem_cache_create("mqueue_inode_cache",
1673 sizeof(struct mqueue_inode_info
), 0,
1674 SLAB_HWCACHE_ALIGN
|SLAB_ACCOUNT
, init_once
);
1675 if (mqueue_inode_cachep
== NULL
)
1678 if (!setup_mq_sysctls(&init_ipc_ns
)) {
1679 pr_warn("sysctl registration failed\n");
1684 error
= register_filesystem(&mqueue_fs_type
);
1688 spin_lock_init(&mq_lock
);
1690 error
= mq_init_ns(&init_ipc_ns
);
1692 goto out_filesystem
;
1697 unregister_filesystem(&mqueue_fs_type
);
1699 retire_mq_sysctls(&init_ipc_ns
);
1701 kmem_cache_destroy(mqueue_inode_cachep
);
1705 device_initcall(init_mqueue_fs
);