2 * POSIX message queues filesystem for Linux.
4 * Copyright (C) 2003,2004 Krzysztof Benedyczak (golbi@mat.uni.torun.pl)
5 * Michal Wronski (michal.wronski@gmail.com)
7 * Spinlocks: Mohamed Abbas (abbas.mohamed@intel.com)
8 * Lockless receive & send, fd based notify:
9 * Manfred Spraul (manfred@colorfullife.com)
11 * Audit: George Wilson (ltcgcw@us.ibm.com)
13 * This file is released under the GPL.
16 #include <linux/capability.h>
17 #include <linux/init.h>
18 #include <linux/pagemap.h>
19 #include <linux/file.h>
20 #include <linux/mount.h>
21 #include <linux/namei.h>
22 #include <linux/sysctl.h>
23 #include <linux/poll.h>
24 #include <linux/mqueue.h>
25 #include <linux/msg.h>
26 #include <linux/skbuff.h>
27 #include <linux/vmalloc.h>
28 #include <linux/netlink.h>
29 #include <linux/syscalls.h>
30 #include <linux/audit.h>
31 #include <linux/signal.h>
32 #include <linux/mutex.h>
33 #include <linux/nsproxy.h>
34 #include <linux/pid.h>
35 #include <linux/ipc_namespace.h>
36 #include <linux/user_namespace.h>
37 #include <linux/slab.h>
42 #define MQUEUE_MAGIC 0x19800202
43 #define DIRENT_SIZE 20
44 #define FILENT_SIZE 80
50 #define STATE_PENDING 1
53 struct posix_msg_tree_node
{
54 struct rb_node rb_node
;
55 struct list_head msg_list
;
59 struct ext_wait_queue
{ /* queue of sleeping tasks */
60 struct task_struct
*task
;
61 struct list_head list
;
62 struct msg_msg
*msg
; /* ptr of loaded message */
63 int state
; /* one of STATE_* values */
66 struct mqueue_inode_info
{
68 struct inode vfs_inode
;
69 wait_queue_head_t wait_q
;
71 struct rb_root msg_tree
;
72 struct posix_msg_tree_node
*node_cache
;
75 struct sigevent notify
;
76 struct pid
* notify_owner
;
77 struct user_namespace
*notify_user_ns
;
78 struct user_struct
*user
; /* user who created, for accounting */
79 struct sock
*notify_sock
;
80 struct sk_buff
*notify_cookie
;
82 /* for tasks waiting for free space and messages, respectively */
83 struct ext_wait_queue e_wait_q
[2];
85 unsigned long qsize
; /* size of queue in memory (sum of all msgs) */
88 static const struct inode_operations mqueue_dir_inode_operations
;
89 static const struct file_operations mqueue_file_operations
;
90 static const struct super_operations mqueue_super_ops
;
91 static void remove_notification(struct mqueue_inode_info
*info
);
93 static struct kmem_cache
*mqueue_inode_cachep
;
95 static struct ctl_table_header
* mq_sysctl_table
;
97 static inline struct mqueue_inode_info
*MQUEUE_I(struct inode
*inode
)
99 return container_of(inode
, struct mqueue_inode_info
, vfs_inode
);
103 * This routine should be called with the mq_lock held.
105 static inline struct ipc_namespace
*__get_ns_from_inode(struct inode
*inode
)
107 return get_ipc_ns(inode
->i_sb
->s_fs_info
);
110 static struct ipc_namespace
*get_ns_from_inode(struct inode
*inode
)
112 struct ipc_namespace
*ns
;
115 ns
= __get_ns_from_inode(inode
);
116 spin_unlock(&mq_lock
);
120 /* Auxiliary functions to manipulate messages' list */
121 static int msg_insert(struct msg_msg
*msg
, struct mqueue_inode_info
*info
)
123 struct rb_node
**p
, *parent
= NULL
;
124 struct posix_msg_tree_node
*leaf
;
126 p
= &info
->msg_tree
.rb_node
;
129 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
131 if (likely(leaf
->priority
== msg
->m_type
))
133 else if (msg
->m_type
< leaf
->priority
)
138 if (info
->node_cache
) {
139 leaf
= info
->node_cache
;
140 info
->node_cache
= NULL
;
142 leaf
= kmalloc(sizeof(*leaf
), GFP_ATOMIC
);
145 INIT_LIST_HEAD(&leaf
->msg_list
);
147 leaf
->priority
= msg
->m_type
;
148 rb_link_node(&leaf
->rb_node
, parent
, p
);
149 rb_insert_color(&leaf
->rb_node
, &info
->msg_tree
);
151 info
->attr
.mq_curmsgs
++;
152 info
->qsize
+= msg
->m_ts
;
153 list_add_tail(&msg
->m_list
, &leaf
->msg_list
);
157 static inline struct msg_msg
*msg_get(struct mqueue_inode_info
*info
)
159 struct rb_node
**p
, *parent
= NULL
;
160 struct posix_msg_tree_node
*leaf
;
164 p
= &info
->msg_tree
.rb_node
;
168 * During insert, low priorities go to the left and high to the
169 * right. On receive, we want the highest priorities first, so
170 * walk all the way to the right.
175 if (info
->attr
.mq_curmsgs
) {
176 pr_warn_once("Inconsistency in POSIX message queue, "
177 "no tree element, but supposedly messages "
179 info
->attr
.mq_curmsgs
= 0;
183 leaf
= rb_entry(parent
, struct posix_msg_tree_node
, rb_node
);
184 if (unlikely(list_empty(&leaf
->msg_list
))) {
185 pr_warn_once("Inconsistency in POSIX message queue, "
186 "empty leaf node but we haven't implemented "
187 "lazy leaf delete!\n");
188 rb_erase(&leaf
->rb_node
, &info
->msg_tree
);
189 if (info
->node_cache
) {
192 info
->node_cache
= leaf
;
196 msg
= list_first_entry(&leaf
->msg_list
,
197 struct msg_msg
, m_list
);
198 list_del(&msg
->m_list
);
199 if (list_empty(&leaf
->msg_list
)) {
200 rb_erase(&leaf
->rb_node
, &info
->msg_tree
);
201 if (info
->node_cache
) {
204 info
->node_cache
= leaf
;
208 info
->attr
.mq_curmsgs
--;
209 info
->qsize
-= msg
->m_ts
;
213 static struct inode
*mqueue_get_inode(struct super_block
*sb
,
214 struct ipc_namespace
*ipc_ns
, umode_t mode
,
215 struct mq_attr
*attr
)
217 struct user_struct
*u
= current_user();
221 inode
= new_inode(sb
);
225 inode
->i_ino
= get_next_ino();
226 inode
->i_mode
= mode
;
227 inode
->i_uid
= current_fsuid();
228 inode
->i_gid
= current_fsgid();
229 inode
->i_mtime
= inode
->i_ctime
= inode
->i_atime
= CURRENT_TIME
;
232 struct mqueue_inode_info
*info
;
233 unsigned long mq_bytes
, mq_treesize
;
235 inode
->i_fop
= &mqueue_file_operations
;
236 inode
->i_size
= FILENT_SIZE
;
237 /* mqueue specific info */
238 info
= MQUEUE_I(inode
);
239 spin_lock_init(&info
->lock
);
240 init_waitqueue_head(&info
->wait_q
);
241 INIT_LIST_HEAD(&info
->e_wait_q
[0].list
);
242 INIT_LIST_HEAD(&info
->e_wait_q
[1].list
);
243 info
->notify_owner
= NULL
;
244 info
->notify_user_ns
= NULL
;
246 info
->user
= NULL
; /* set when all is ok */
247 info
->msg_tree
= RB_ROOT
;
248 info
->node_cache
= NULL
;
249 memset(&info
->attr
, 0, sizeof(info
->attr
));
250 info
->attr
.mq_maxmsg
= min(ipc_ns
->mq_msg_max
,
251 ipc_ns
->mq_msg_default
);
252 info
->attr
.mq_msgsize
= min(ipc_ns
->mq_msgsize_max
,
253 ipc_ns
->mq_msgsize_default
);
255 info
->attr
.mq_maxmsg
= attr
->mq_maxmsg
;
256 info
->attr
.mq_msgsize
= attr
->mq_msgsize
;
259 * We used to allocate a static array of pointers and account
260 * the size of that array as well as one msg_msg struct per
261 * possible message into the queue size. That's no longer
262 * accurate as the queue is now an rbtree and will grow and
263 * shrink depending on usage patterns. We can, however, still
264 * account one msg_msg struct per message, but the nodes are
265 * allocated depending on priority usage, and most programs
266 * only use one, or a handful, of priorities. However, since
267 * this is pinned memory, we need to assume worst case, so
268 * that means the min(mq_maxmsg, max_priorities) * struct
269 * posix_msg_tree_node.
271 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
272 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
273 sizeof(struct posix_msg_tree_node
);
275 mq_bytes
= mq_treesize
+ (info
->attr
.mq_maxmsg
*
276 info
->attr
.mq_msgsize
);
279 if (u
->mq_bytes
+ mq_bytes
< u
->mq_bytes
||
280 u
->mq_bytes
+ mq_bytes
> rlimit(RLIMIT_MSGQUEUE
)) {
281 spin_unlock(&mq_lock
);
282 /* mqueue_evict_inode() releases info->messages */
286 u
->mq_bytes
+= mq_bytes
;
287 spin_unlock(&mq_lock
);
290 info
->user
= get_uid(u
);
291 } else if (S_ISDIR(mode
)) {
293 /* Some things misbehave if size == 0 on a directory */
294 inode
->i_size
= 2 * DIRENT_SIZE
;
295 inode
->i_op
= &mqueue_dir_inode_operations
;
296 inode
->i_fop
= &simple_dir_operations
;
306 static int mqueue_fill_super(struct super_block
*sb
, void *data
, int silent
)
309 struct ipc_namespace
*ns
= data
;
311 sb
->s_blocksize
= PAGE_CACHE_SIZE
;
312 sb
->s_blocksize_bits
= PAGE_CACHE_SHIFT
;
313 sb
->s_magic
= MQUEUE_MAGIC
;
314 sb
->s_op
= &mqueue_super_ops
;
316 inode
= mqueue_get_inode(sb
, ns
, S_IFDIR
| S_ISVTX
| S_IRWXUGO
, NULL
);
318 return PTR_ERR(inode
);
320 sb
->s_root
= d_make_root(inode
);
326 static struct dentry
*mqueue_mount(struct file_system_type
*fs_type
,
327 int flags
, const char *dev_name
,
330 if (!(flags
& MS_KERNMOUNT
)) {
331 struct ipc_namespace
*ns
= current
->nsproxy
->ipc_ns
;
332 /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
333 * over the ipc namespace.
335 if (!ns_capable(ns
->user_ns
, CAP_SYS_ADMIN
))
336 return ERR_PTR(-EPERM
);
340 return mount_ns(fs_type
, flags
, data
, mqueue_fill_super
);
343 static void init_once(void *foo
)
345 struct mqueue_inode_info
*p
= (struct mqueue_inode_info
*) foo
;
347 inode_init_once(&p
->vfs_inode
);
350 static struct inode
*mqueue_alloc_inode(struct super_block
*sb
)
352 struct mqueue_inode_info
*ei
;
354 ei
= kmem_cache_alloc(mqueue_inode_cachep
, GFP_KERNEL
);
357 return &ei
->vfs_inode
;
360 static void mqueue_i_callback(struct rcu_head
*head
)
362 struct inode
*inode
= container_of(head
, struct inode
, i_rcu
);
363 kmem_cache_free(mqueue_inode_cachep
, MQUEUE_I(inode
));
366 static void mqueue_destroy_inode(struct inode
*inode
)
368 call_rcu(&inode
->i_rcu
, mqueue_i_callback
);
371 static void mqueue_evict_inode(struct inode
*inode
)
373 struct mqueue_inode_info
*info
;
374 struct user_struct
*user
;
375 unsigned long mq_bytes
, mq_treesize
;
376 struct ipc_namespace
*ipc_ns
;
381 if (S_ISDIR(inode
->i_mode
))
384 ipc_ns
= get_ns_from_inode(inode
);
385 info
= MQUEUE_I(inode
);
386 spin_lock(&info
->lock
);
387 while ((msg
= msg_get(info
)) != NULL
)
389 kfree(info
->node_cache
);
390 spin_unlock(&info
->lock
);
392 /* Total amount of bytes accounted for the mqueue */
393 mq_treesize
= info
->attr
.mq_maxmsg
* sizeof(struct msg_msg
) +
394 min_t(unsigned int, info
->attr
.mq_maxmsg
, MQ_PRIO_MAX
) *
395 sizeof(struct posix_msg_tree_node
);
397 mq_bytes
= mq_treesize
+ (info
->attr
.mq_maxmsg
*
398 info
->attr
.mq_msgsize
);
403 user
->mq_bytes
-= mq_bytes
;
405 * get_ns_from_inode() ensures that the
406 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
407 * to which we now hold a reference, or it is NULL.
408 * We can't put it here under mq_lock, though.
411 ipc_ns
->mq_queues_count
--;
412 spin_unlock(&mq_lock
);
419 static int mqueue_create(struct inode
*dir
, struct dentry
*dentry
,
420 umode_t mode
, bool excl
)
423 struct mq_attr
*attr
= dentry
->d_fsdata
;
425 struct ipc_namespace
*ipc_ns
;
428 ipc_ns
= __get_ns_from_inode(dir
);
434 if (ipc_ns
->mq_queues_count
>= ipc_ns
->mq_queues_max
&&
435 !capable(CAP_SYS_RESOURCE
)) {
439 ipc_ns
->mq_queues_count
++;
440 spin_unlock(&mq_lock
);
442 inode
= mqueue_get_inode(dir
->i_sb
, ipc_ns
, mode
, attr
);
444 error
= PTR_ERR(inode
);
446 ipc_ns
->mq_queues_count
--;
451 dir
->i_size
+= DIRENT_SIZE
;
452 dir
->i_ctime
= dir
->i_mtime
= dir
->i_atime
= CURRENT_TIME
;
454 d_instantiate(dentry
, inode
);
458 spin_unlock(&mq_lock
);
464 static int mqueue_unlink(struct inode
*dir
, struct dentry
*dentry
)
466 struct inode
*inode
= dentry
->d_inode
;
468 dir
->i_ctime
= dir
->i_mtime
= dir
->i_atime
= CURRENT_TIME
;
469 dir
->i_size
-= DIRENT_SIZE
;
476 * This is routine for system read from queue file.
477 * To avoid mess with doing here some sort of mq_receive we allow
478 * to read only queue size & notification info (the only values
479 * that are interesting from user point of view and aren't accessible
480 * through std routines)
482 static ssize_t
mqueue_read_file(struct file
*filp
, char __user
*u_data
,
483 size_t count
, loff_t
*off
)
485 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
486 char buffer
[FILENT_SIZE
];
489 spin_lock(&info
->lock
);
490 snprintf(buffer
, sizeof(buffer
),
491 "QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",
493 info
->notify_owner
? info
->notify
.sigev_notify
: 0,
494 (info
->notify_owner
&&
495 info
->notify
.sigev_notify
== SIGEV_SIGNAL
) ?
496 info
->notify
.sigev_signo
: 0,
497 pid_vnr(info
->notify_owner
));
498 spin_unlock(&info
->lock
);
499 buffer
[sizeof(buffer
)-1] = '\0';
501 ret
= simple_read_from_buffer(u_data
, count
, off
, buffer
,
506 file_inode(filp
)->i_atime
= file_inode(filp
)->i_ctime
= CURRENT_TIME
;
510 static int mqueue_flush_file(struct file
*filp
, fl_owner_t id
)
512 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
514 spin_lock(&info
->lock
);
515 if (task_tgid(current
) == info
->notify_owner
)
516 remove_notification(info
);
518 spin_unlock(&info
->lock
);
522 static unsigned int mqueue_poll_file(struct file
*filp
, struct poll_table_struct
*poll_tab
)
524 struct mqueue_inode_info
*info
= MQUEUE_I(file_inode(filp
));
527 poll_wait(filp
, &info
->wait_q
, poll_tab
);
529 spin_lock(&info
->lock
);
530 if (info
->attr
.mq_curmsgs
)
531 retval
= POLLIN
| POLLRDNORM
;
533 if (info
->attr
.mq_curmsgs
< info
->attr
.mq_maxmsg
)
534 retval
|= POLLOUT
| POLLWRNORM
;
535 spin_unlock(&info
->lock
);
540 /* Adds current to info->e_wait_q[sr] before element with smaller prio */
541 static void wq_add(struct mqueue_inode_info
*info
, int sr
,
542 struct ext_wait_queue
*ewp
)
544 struct ext_wait_queue
*walk
;
548 list_for_each_entry(walk
, &info
->e_wait_q
[sr
].list
, list
) {
549 if (walk
->task
->static_prio
<= current
->static_prio
) {
550 list_add_tail(&ewp
->list
, &walk
->list
);
554 list_add_tail(&ewp
->list
, &info
->e_wait_q
[sr
].list
);
558 * Puts current task to sleep. Caller must hold queue lock. After return
562 static int wq_sleep(struct mqueue_inode_info
*info
, int sr
,
563 ktime_t
*timeout
, struct ext_wait_queue
*ewp
)
568 wq_add(info
, sr
, ewp
);
571 set_current_state(TASK_INTERRUPTIBLE
);
573 spin_unlock(&info
->lock
);
574 time
= schedule_hrtimeout_range_clock(timeout
, 0,
575 HRTIMER_MODE_ABS
, CLOCK_REALTIME
);
577 while (ewp
->state
== STATE_PENDING
)
580 if (ewp
->state
== STATE_READY
) {
584 spin_lock(&info
->lock
);
585 if (ewp
->state
== STATE_READY
) {
589 if (signal_pending(current
)) {
590 retval
= -ERESTARTSYS
;
598 list_del(&ewp
->list
);
600 spin_unlock(&info
->lock
);
606 * Returns waiting task that should be serviced first or NULL if none exists
608 static struct ext_wait_queue
*wq_get_first_waiter(
609 struct mqueue_inode_info
*info
, int sr
)
611 struct list_head
*ptr
;
613 ptr
= info
->e_wait_q
[sr
].list
.prev
;
614 if (ptr
== &info
->e_wait_q
[sr
].list
)
616 return list_entry(ptr
, struct ext_wait_queue
, list
);
620 static inline void set_cookie(struct sk_buff
*skb
, char code
)
622 ((char*)skb
->data
)[NOTIFY_COOKIE_LEN
-1] = code
;
626 * The next function is only to split too long sys_mq_timedsend
628 static void __do_notify(struct mqueue_inode_info
*info
)
631 * invoked when there is registered process and there isn't process
632 * waiting synchronously for message AND state of queue changed from
633 * empty to not empty. Here we are sure that no one is waiting
635 if (info
->notify_owner
&&
636 info
->attr
.mq_curmsgs
== 1) {
637 struct siginfo sig_i
;
638 switch (info
->notify
.sigev_notify
) {
644 sig_i
.si_signo
= info
->notify
.sigev_signo
;
646 sig_i
.si_code
= SI_MESGQ
;
647 sig_i
.si_value
= info
->notify
.sigev_value
;
648 /* map current pid/uid into info->owner's namespaces */
650 sig_i
.si_pid
= task_tgid_nr_ns(current
,
651 ns_of_pid(info
->notify_owner
));
652 sig_i
.si_uid
= from_kuid_munged(info
->notify_user_ns
, current_uid());
655 kill_pid_info(info
->notify
.sigev_signo
,
656 &sig_i
, info
->notify_owner
);
659 set_cookie(info
->notify_cookie
, NOTIFY_WOKENUP
);
660 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
663 /* after notification unregisters process */
664 put_pid(info
->notify_owner
);
665 put_user_ns(info
->notify_user_ns
);
666 info
->notify_owner
= NULL
;
667 info
->notify_user_ns
= NULL
;
669 wake_up(&info
->wait_q
);
672 static int prepare_timeout(const struct timespec __user
*u_abs_timeout
,
673 ktime_t
*expires
, struct timespec
*ts
)
675 if (copy_from_user(ts
, u_abs_timeout
, sizeof(struct timespec
)))
677 if (!timespec_valid(ts
))
680 *expires
= timespec_to_ktime(*ts
);
684 static void remove_notification(struct mqueue_inode_info
*info
)
686 if (info
->notify_owner
!= NULL
&&
687 info
->notify
.sigev_notify
== SIGEV_THREAD
) {
688 set_cookie(info
->notify_cookie
, NOTIFY_REMOVED
);
689 netlink_sendskb(info
->notify_sock
, info
->notify_cookie
);
691 put_pid(info
->notify_owner
);
692 put_user_ns(info
->notify_user_ns
);
693 info
->notify_owner
= NULL
;
694 info
->notify_user_ns
= NULL
;
697 static int mq_attr_ok(struct ipc_namespace
*ipc_ns
, struct mq_attr
*attr
)
700 unsigned long total_size
;
702 if (attr
->mq_maxmsg
<= 0 || attr
->mq_msgsize
<= 0)
704 if (capable(CAP_SYS_RESOURCE
)) {
705 if (attr
->mq_maxmsg
> HARD_MSGMAX
||
706 attr
->mq_msgsize
> HARD_MSGSIZEMAX
)
709 if (attr
->mq_maxmsg
> ipc_ns
->mq_msg_max
||
710 attr
->mq_msgsize
> ipc_ns
->mq_msgsize_max
)
713 /* check for overflow */
714 if (attr
->mq_msgsize
> ULONG_MAX
/attr
->mq_maxmsg
)
716 mq_treesize
= attr
->mq_maxmsg
* sizeof(struct msg_msg
) +
717 min_t(unsigned int, attr
->mq_maxmsg
, MQ_PRIO_MAX
) *
718 sizeof(struct posix_msg_tree_node
);
719 total_size
= attr
->mq_maxmsg
* attr
->mq_msgsize
;
720 if (total_size
+ mq_treesize
< total_size
)
726 * Invoked when creating a new queue via sys_mq_open
728 static struct file
*do_create(struct ipc_namespace
*ipc_ns
, struct inode
*dir
,
729 struct path
*path
, int oflag
, umode_t mode
,
730 struct mq_attr
*attr
)
732 const struct cred
*cred
= current_cred();
736 ret
= mq_attr_ok(ipc_ns
, attr
);
739 /* store for use during create */
740 path
->dentry
->d_fsdata
= attr
;
742 struct mq_attr def_attr
;
744 def_attr
.mq_maxmsg
= min(ipc_ns
->mq_msg_max
,
745 ipc_ns
->mq_msg_default
);
746 def_attr
.mq_msgsize
= min(ipc_ns
->mq_msgsize_max
,
747 ipc_ns
->mq_msgsize_default
);
748 ret
= mq_attr_ok(ipc_ns
, &def_attr
);
753 mode
&= ~current_umask();
754 ret
= vfs_create(dir
, path
->dentry
, mode
, true);
755 path
->dentry
->d_fsdata
= NULL
;
758 return dentry_open(path
, oflag
, cred
);
761 /* Opens existing queue */
762 static struct file
*do_open(struct path
*path
, int oflag
)
764 static const int oflag2acc
[O_ACCMODE
] = { MAY_READ
, MAY_WRITE
,
765 MAY_READ
| MAY_WRITE
};
767 if ((oflag
& O_ACCMODE
) == (O_RDWR
| O_WRONLY
))
768 return ERR_PTR(-EINVAL
);
769 acc
= oflag2acc
[oflag
& O_ACCMODE
];
770 if (inode_permission(path
->dentry
->d_inode
, acc
))
771 return ERR_PTR(-EACCES
);
772 return dentry_open(path
, oflag
, current_cred());
775 SYSCALL_DEFINE4(mq_open
, const char __user
*, u_name
, int, oflag
, umode_t
, mode
,
776 struct mq_attr __user
*, u_attr
)
780 struct filename
*name
;
783 struct ipc_namespace
*ipc_ns
= current
->nsproxy
->ipc_ns
;
784 struct vfsmount
*mnt
= ipc_ns
->mq_mnt
;
785 struct dentry
*root
= mnt
->mnt_root
;
788 if (u_attr
&& copy_from_user(&attr
, u_attr
, sizeof(struct mq_attr
)))
791 audit_mq_open(oflag
, mode
, u_attr
? &attr
: NULL
);
793 if (IS_ERR(name
= getname(u_name
)))
794 return PTR_ERR(name
);
796 fd
= get_unused_fd_flags(O_CLOEXEC
);
800 ro
= mnt_want_write(mnt
); /* we'll drop it in any case */
802 mutex_lock(&root
->d_inode
->i_mutex
);
803 path
.dentry
= lookup_one_len(name
->name
, root
, strlen(name
->name
));
804 if (IS_ERR(path
.dentry
)) {
805 error
= PTR_ERR(path
.dentry
);
808 path
.mnt
= mntget(mnt
);
810 if (oflag
& O_CREAT
) {
811 if (path
.dentry
->d_inode
) { /* entry already exists */
812 audit_inode(name
, path
.dentry
, 0);
813 if (oflag
& O_EXCL
) {
817 filp
= do_open(&path
, oflag
);
823 audit_inode_parent_hidden(name
, root
);
824 filp
= do_create(ipc_ns
, root
->d_inode
,
826 u_attr
? &attr
: NULL
);
829 if (!path
.dentry
->d_inode
) {
833 audit_inode(name
, path
.dentry
, 0);
834 filp
= do_open(&path
, oflag
);
838 fd_install(fd
, filp
);
840 error
= PTR_ERR(filp
);
848 mutex_unlock(&root
->d_inode
->i_mutex
);
856 SYSCALL_DEFINE1(mq_unlink
, const char __user
*, u_name
)
859 struct filename
*name
;
860 struct dentry
*dentry
;
861 struct inode
*inode
= NULL
;
862 struct ipc_namespace
*ipc_ns
= current
->nsproxy
->ipc_ns
;
863 struct vfsmount
*mnt
= ipc_ns
->mq_mnt
;
865 name
= getname(u_name
);
867 return PTR_ERR(name
);
869 audit_inode_parent_hidden(name
, mnt
->mnt_root
);
870 err
= mnt_want_write(mnt
);
873 mutex_lock_nested(&mnt
->mnt_root
->d_inode
->i_mutex
, I_MUTEX_PARENT
);
874 dentry
= lookup_one_len(name
->name
, mnt
->mnt_root
,
876 if (IS_ERR(dentry
)) {
877 err
= PTR_ERR(dentry
);
881 inode
= dentry
->d_inode
;
886 err
= vfs_unlink(dentry
->d_parent
->d_inode
, dentry
);
891 mutex_unlock(&mnt
->mnt_root
->d_inode
->i_mutex
);
901 /* Pipelined send and receive functions.
903 * If a receiver finds no waiting message, then it registers itself in the
904 * list of waiting receivers. A sender checks that list before adding the new
905 * message into the message array. If there is a waiting receiver, then it
906 * bypasses the message array and directly hands the message over to the
908 * The receiver accepts the message and returns without grabbing the queue
909 * spinlock. Therefore an intermediate STATE_PENDING state and memory barriers
910 * are necessary. The same algorithm is used for sysv semaphores, see
911 * ipc/sem.c for more details.
913 * The same algorithm is used for senders.
916 /* pipelined_send() - send a message directly to the task waiting in
917 * sys_mq_timedreceive() (without inserting message into a queue).
919 static inline void pipelined_send(struct mqueue_inode_info
*info
,
920 struct msg_msg
*message
,
921 struct ext_wait_queue
*receiver
)
923 receiver
->msg
= message
;
924 list_del(&receiver
->list
);
925 receiver
->state
= STATE_PENDING
;
926 wake_up_process(receiver
->task
);
928 receiver
->state
= STATE_READY
;
931 /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
932 * gets its message and put to the queue (we have one free place for sure). */
933 static inline void pipelined_receive(struct mqueue_inode_info
*info
)
935 struct ext_wait_queue
*sender
= wq_get_first_waiter(info
, SEND
);
939 wake_up_interruptible(&info
->wait_q
);
942 if (msg_insert(sender
->msg
, info
))
944 list_del(&sender
->list
);
945 sender
->state
= STATE_PENDING
;
946 wake_up_process(sender
->task
);
948 sender
->state
= STATE_READY
;
951 SYSCALL_DEFINE5(mq_timedsend
, mqd_t
, mqdes
, const char __user
*, u_msg_ptr
,
952 size_t, msg_len
, unsigned int, msg_prio
,
953 const struct timespec __user
*, u_abs_timeout
)
957 struct ext_wait_queue wait
;
958 struct ext_wait_queue
*receiver
;
959 struct msg_msg
*msg_ptr
;
960 struct mqueue_inode_info
*info
;
961 ktime_t expires
, *timeout
= NULL
;
963 struct posix_msg_tree_node
*new_leaf
= NULL
;
967 int res
= prepare_timeout(u_abs_timeout
, &expires
, &ts
);
973 if (unlikely(msg_prio
>= (unsigned long) MQ_PRIO_MAX
))
976 audit_mq_sendrecv(mqdes
, msg_len
, msg_prio
, timeout
? &ts
: NULL
);
979 if (unlikely(!f
.file
)) {
984 inode
= file_inode(f
.file
);
985 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
989 info
= MQUEUE_I(inode
);
990 audit_inode(NULL
, f
.file
->f_path
.dentry
, 0);
992 if (unlikely(!(f
.file
->f_mode
& FMODE_WRITE
))) {
997 if (unlikely(msg_len
> info
->attr
.mq_msgsize
)) {
1002 /* First try to allocate memory, before doing anything with
1003 * existing queues. */
1004 msg_ptr
= load_msg(u_msg_ptr
, msg_len
);
1005 if (IS_ERR(msg_ptr
)) {
1006 ret
= PTR_ERR(msg_ptr
);
1009 msg_ptr
->m_ts
= msg_len
;
1010 msg_ptr
->m_type
= msg_prio
;
1013 * msg_insert really wants us to have a valid, spare node struct so
1014 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
1015 * fall back to that if necessary.
1017 if (!info
->node_cache
)
1018 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
1020 spin_lock(&info
->lock
);
1022 if (!info
->node_cache
&& new_leaf
) {
1023 /* Save our speculative allocation into the cache */
1024 INIT_LIST_HEAD(&new_leaf
->msg_list
);
1025 info
->node_cache
= new_leaf
;
1031 if (info
->attr
.mq_curmsgs
== info
->attr
.mq_maxmsg
) {
1032 if (f
.file
->f_flags
& O_NONBLOCK
) {
1035 wait
.task
= current
;
1036 wait
.msg
= (void *) msg_ptr
;
1037 wait
.state
= STATE_NONE
;
1038 ret
= wq_sleep(info
, SEND
, timeout
, &wait
);
1040 * wq_sleep must be called with info->lock held, and
1041 * returns with the lock released
1046 receiver
= wq_get_first_waiter(info
, RECV
);
1048 pipelined_send(info
, msg_ptr
, receiver
);
1050 /* adds message to the queue */
1051 ret
= msg_insert(msg_ptr
, info
);
1056 inode
->i_atime
= inode
->i_mtime
= inode
->i_ctime
=
1060 spin_unlock(&info
->lock
);
1070 SYSCALL_DEFINE5(mq_timedreceive
, mqd_t
, mqdes
, char __user
*, u_msg_ptr
,
1071 size_t, msg_len
, unsigned int __user
*, u_msg_prio
,
1072 const struct timespec __user
*, u_abs_timeout
)
1075 struct msg_msg
*msg_ptr
;
1077 struct inode
*inode
;
1078 struct mqueue_inode_info
*info
;
1079 struct ext_wait_queue wait
;
1080 ktime_t expires
, *timeout
= NULL
;
1082 struct posix_msg_tree_node
*new_leaf
= NULL
;
1084 if (u_abs_timeout
) {
1085 int res
= prepare_timeout(u_abs_timeout
, &expires
, &ts
);
1091 audit_mq_sendrecv(mqdes
, msg_len
, 0, timeout
? &ts
: NULL
);
1094 if (unlikely(!f
.file
)) {
1099 inode
= file_inode(f
.file
);
1100 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1104 info
= MQUEUE_I(inode
);
1105 audit_inode(NULL
, f
.file
->f_path
.dentry
, 0);
1107 if (unlikely(!(f
.file
->f_mode
& FMODE_READ
))) {
1112 /* checks if buffer is big enough */
1113 if (unlikely(msg_len
< info
->attr
.mq_msgsize
)) {
1119 * msg_insert really wants us to have a valid, spare node struct so
1120 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
1121 * fall back to that if necessary.
1123 if (!info
->node_cache
)
1124 new_leaf
= kmalloc(sizeof(*new_leaf
), GFP_KERNEL
);
1126 spin_lock(&info
->lock
);
1128 if (!info
->node_cache
&& new_leaf
) {
1129 /* Save our speculative allocation into the cache */
1130 INIT_LIST_HEAD(&new_leaf
->msg_list
);
1131 info
->node_cache
= new_leaf
;
1136 if (info
->attr
.mq_curmsgs
== 0) {
1137 if (f
.file
->f_flags
& O_NONBLOCK
) {
1138 spin_unlock(&info
->lock
);
1141 wait
.task
= current
;
1142 wait
.state
= STATE_NONE
;
1143 ret
= wq_sleep(info
, RECV
, timeout
, &wait
);
1147 msg_ptr
= msg_get(info
);
1149 inode
->i_atime
= inode
->i_mtime
= inode
->i_ctime
=
1152 /* There is now free space in queue. */
1153 pipelined_receive(info
);
1154 spin_unlock(&info
->lock
);
1158 ret
= msg_ptr
->m_ts
;
1160 if ((u_msg_prio
&& put_user(msg_ptr
->m_type
, u_msg_prio
)) ||
1161 store_msg(u_msg_ptr
, msg_ptr
, msg_ptr
->m_ts
)) {
1173 * Notes: the case when user wants us to deregister (with NULL as pointer)
1174 * and he isn't currently owner of notification, will be silently discarded.
1175 * It isn't explicitly defined in the POSIX.
1177 SYSCALL_DEFINE2(mq_notify
, mqd_t
, mqdes
,
1178 const struct sigevent __user
*, u_notification
)
1183 struct inode
*inode
;
1184 struct sigevent notification
;
1185 struct mqueue_inode_info
*info
;
1188 if (u_notification
) {
1189 if (copy_from_user(¬ification
, u_notification
,
1190 sizeof(struct sigevent
)))
1194 audit_mq_notify(mqdes
, u_notification
? ¬ification
: NULL
);
1198 if (u_notification
!= NULL
) {
1199 if (unlikely(notification
.sigev_notify
!= SIGEV_NONE
&&
1200 notification
.sigev_notify
!= SIGEV_SIGNAL
&&
1201 notification
.sigev_notify
!= SIGEV_THREAD
))
1203 if (notification
.sigev_notify
== SIGEV_SIGNAL
&&
1204 !valid_signal(notification
.sigev_signo
)) {
1207 if (notification
.sigev_notify
== SIGEV_THREAD
) {
1210 /* create the notify skb */
1211 nc
= alloc_skb(NOTIFY_COOKIE_LEN
, GFP_KERNEL
);
1216 if (copy_from_user(nc
->data
,
1217 notification
.sigev_value
.sival_ptr
,
1218 NOTIFY_COOKIE_LEN
)) {
1223 /* TODO: add a header? */
1224 skb_put(nc
, NOTIFY_COOKIE_LEN
);
1225 /* and attach it to the socket */
1227 f
= fdget(notification
.sigev_signo
);
1232 sock
= netlink_getsockbyfilp(f
.file
);
1235 ret
= PTR_ERR(sock
);
1240 timeo
= MAX_SCHEDULE_TIMEOUT
;
1241 ret
= netlink_attachskb(sock
, nc
, &timeo
, NULL
);
1258 inode
= file_inode(f
.file
);
1259 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1263 info
= MQUEUE_I(inode
);
1266 spin_lock(&info
->lock
);
1267 if (u_notification
== NULL
) {
1268 if (info
->notify_owner
== task_tgid(current
)) {
1269 remove_notification(info
);
1270 inode
->i_atime
= inode
->i_ctime
= CURRENT_TIME
;
1272 } else if (info
->notify_owner
!= NULL
) {
1275 switch (notification
.sigev_notify
) {
1277 info
->notify
.sigev_notify
= SIGEV_NONE
;
1280 info
->notify_sock
= sock
;
1281 info
->notify_cookie
= nc
;
1284 info
->notify
.sigev_notify
= SIGEV_THREAD
;
1287 info
->notify
.sigev_signo
= notification
.sigev_signo
;
1288 info
->notify
.sigev_value
= notification
.sigev_value
;
1289 info
->notify
.sigev_notify
= SIGEV_SIGNAL
;
1293 info
->notify_owner
= get_pid(task_tgid(current
));
1294 info
->notify_user_ns
= get_user_ns(current_user_ns());
1295 inode
->i_atime
= inode
->i_ctime
= CURRENT_TIME
;
1297 spin_unlock(&info
->lock
);
1302 netlink_detachskb(sock
, nc
);
1309 SYSCALL_DEFINE3(mq_getsetattr
, mqd_t
, mqdes
,
1310 const struct mq_attr __user
*, u_mqstat
,
1311 struct mq_attr __user
*, u_omqstat
)
1314 struct mq_attr mqstat
, omqstat
;
1316 struct inode
*inode
;
1317 struct mqueue_inode_info
*info
;
1319 if (u_mqstat
!= NULL
) {
1320 if (copy_from_user(&mqstat
, u_mqstat
, sizeof(struct mq_attr
)))
1322 if (mqstat
.mq_flags
& (~O_NONBLOCK
))
1332 inode
= file_inode(f
.file
);
1333 if (unlikely(f
.file
->f_op
!= &mqueue_file_operations
)) {
1337 info
= MQUEUE_I(inode
);
1339 spin_lock(&info
->lock
);
1341 omqstat
= info
->attr
;
1342 omqstat
.mq_flags
= f
.file
->f_flags
& O_NONBLOCK
;
1344 audit_mq_getsetattr(mqdes
, &mqstat
);
1345 spin_lock(&f
.file
->f_lock
);
1346 if (mqstat
.mq_flags
& O_NONBLOCK
)
1347 f
.file
->f_flags
|= O_NONBLOCK
;
1349 f
.file
->f_flags
&= ~O_NONBLOCK
;
1350 spin_unlock(&f
.file
->f_lock
);
1352 inode
->i_atime
= inode
->i_ctime
= CURRENT_TIME
;
1355 spin_unlock(&info
->lock
);
1358 if (u_omqstat
!= NULL
&& copy_to_user(u_omqstat
, &omqstat
,
1359 sizeof(struct mq_attr
)))
1368 static const struct inode_operations mqueue_dir_inode_operations
= {
1369 .lookup
= simple_lookup
,
1370 .create
= mqueue_create
,
1371 .unlink
= mqueue_unlink
,
1374 static const struct file_operations mqueue_file_operations
= {
1375 .flush
= mqueue_flush_file
,
1376 .poll
= mqueue_poll_file
,
1377 .read
= mqueue_read_file
,
1378 .llseek
= default_llseek
,
1381 static const struct super_operations mqueue_super_ops
= {
1382 .alloc_inode
= mqueue_alloc_inode
,
1383 .destroy_inode
= mqueue_destroy_inode
,
1384 .evict_inode
= mqueue_evict_inode
,
1385 .statfs
= simple_statfs
,
1388 static struct file_system_type mqueue_fs_type
= {
1390 .mount
= mqueue_mount
,
1391 .kill_sb
= kill_litter_super
,
1392 .fs_flags
= FS_USERNS_MOUNT
,
1395 int mq_init_ns(struct ipc_namespace
*ns
)
1397 ns
->mq_queues_count
= 0;
1398 ns
->mq_queues_max
= DFLT_QUEUESMAX
;
1399 ns
->mq_msg_max
= DFLT_MSGMAX
;
1400 ns
->mq_msgsize_max
= DFLT_MSGSIZEMAX
;
1401 ns
->mq_msg_default
= DFLT_MSG
;
1402 ns
->mq_msgsize_default
= DFLT_MSGSIZE
;
1404 ns
->mq_mnt
= kern_mount_data(&mqueue_fs_type
, ns
);
1405 if (IS_ERR(ns
->mq_mnt
)) {
1406 int err
= PTR_ERR(ns
->mq_mnt
);
1413 void mq_clear_sbinfo(struct ipc_namespace
*ns
)
1415 ns
->mq_mnt
->mnt_sb
->s_fs_info
= NULL
;
1418 void mq_put_mnt(struct ipc_namespace
*ns
)
1420 kern_unmount(ns
->mq_mnt
);
1423 static int __init
init_mqueue_fs(void)
1427 mqueue_inode_cachep
= kmem_cache_create("mqueue_inode_cache",
1428 sizeof(struct mqueue_inode_info
), 0,
1429 SLAB_HWCACHE_ALIGN
, init_once
);
1430 if (mqueue_inode_cachep
== NULL
)
1433 /* ignore failures - they are not fatal */
1434 mq_sysctl_table
= mq_register_sysctl_table();
1436 error
= register_filesystem(&mqueue_fs_type
);
1440 spin_lock_init(&mq_lock
);
1442 error
= mq_init_ns(&init_ipc_ns
);
1444 goto out_filesystem
;
1449 unregister_filesystem(&mqueue_fs_type
);
1451 if (mq_sysctl_table
)
1452 unregister_sysctl_table(mq_sysctl_table
);
1453 kmem_cache_destroy(mqueue_inode_cachep
);
1457 __initcall(init_mqueue_fs
);