mqueue.c 35.6 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4
/*
 * POSIX message queues filesystem for Linux.
 *
 * Copyright (C) 2003,2004  Krzysztof Benedyczak    (golbi@mat.uni.torun.pl)
5
 *                          Michal Wronski          (michal.wronski@gmail.com)
Linus Torvalds's avatar
Linus Torvalds committed
6 7 8
 *
 * Spinlocks:               Mohamed Abbas           (abbas.mohamed@intel.com)
 * Lockless receive & send, fd based notify:
Manfred Spraul's avatar
Manfred Spraul committed
9
 *			    Manfred Spraul	    (manfred@colorfullife.com)
Linus Torvalds's avatar
Linus Torvalds committed
10
 *
11 12
 * Audit:                   George Wilson           (ltcgcw@us.ibm.com)
 *
Linus Torvalds's avatar
Linus Torvalds committed
13 14 15
 * This file is released under the GPL.
 */

16
#include <linux/capability.h>
Linus Torvalds's avatar
Linus Torvalds committed
17 18 19 20 21 22 23 24 25 26
#include <linux/init.h>
#include <linux/pagemap.h>
#include <linux/file.h>
#include <linux/mount.h>
#include <linux/namei.h>
#include <linux/sysctl.h>
#include <linux/poll.h>
#include <linux/mqueue.h>
#include <linux/msg.h>
#include <linux/skbuff.h>
27
#include <linux/vmalloc.h>
Linus Torvalds's avatar
Linus Torvalds committed
28 29
#include <linux/netlink.h>
#include <linux/syscalls.h>
30
#include <linux/audit.h>
31
#include <linux/signal.h>
32
#include <linux/mutex.h>
33 34
#include <linux/nsproxy.h>
#include <linux/pid.h>
35
#include <linux/ipc_namespace.h>
36
#include <linux/user_namespace.h>
37
#include <linux/slab.h>
38

Linus Torvalds's avatar
Linus Torvalds committed
39 40 41 42 43 44 45 46 47 48 49
#include <net/sock.h>
#include "util.h"

#define MQUEUE_MAGIC	0x19800202
#define DIRENT_SIZE	20
#define FILENT_SIZE	80

#define SEND		0
#define RECV		1

#define STATE_NONE	0
50
#define STATE_READY	1
Linus Torvalds's avatar
Linus Torvalds committed
51

52 53 54 55 56 57
struct posix_msg_tree_node {
	struct rb_node		rb_node;
	struct list_head	msg_list;
	int			priority;
};

Linus Torvalds's avatar
Linus Torvalds committed
58 59 60 61 62 63 64 65 66 67 68 69
struct ext_wait_queue {		/* queue of sleeping tasks */
	struct task_struct *task;
	struct list_head list;
	struct msg_msg *msg;	/* ptr of loaded message */
	int state;		/* one of STATE_* values */
};

struct mqueue_inode_info {
	spinlock_t lock;
	struct inode vfs_inode;
	wait_queue_head_t wait_q;

70
	struct rb_root msg_tree;
71
	struct posix_msg_tree_node *node_cache;
Linus Torvalds's avatar
Linus Torvalds committed
72 73 74
	struct mq_attr attr;

	struct sigevent notify;
Manfred Spraul's avatar
Manfred Spraul committed
75
	struct pid *notify_owner;
76
	struct user_namespace *notify_user_ns;
77
	struct user_struct *user;	/* user who created, for accounting */
Linus Torvalds's avatar
Linus Torvalds committed
78 79 80 81 82 83 84 85 86
	struct sock *notify_sock;
	struct sk_buff *notify_cookie;

	/* for tasks waiting for free space and messages, respectively */
	struct ext_wait_queue e_wait_q[2];

	unsigned long qsize; /* size of queue in memory (sum of all msgs) */
};

87
static const struct inode_operations mqueue_dir_inode_operations;
88
static const struct file_operations mqueue_file_operations;
89
static const struct super_operations mqueue_super_ops;
Linus Torvalds's avatar
Linus Torvalds committed
90 91
static void remove_notification(struct mqueue_inode_info *info);

92
static struct kmem_cache *mqueue_inode_cachep;
Linus Torvalds's avatar
Linus Torvalds committed
93

Manfred Spraul's avatar
Manfred Spraul committed
94
static struct ctl_table_header *mq_sysctl_table;
Linus Torvalds's avatar
Linus Torvalds committed
95 96 97 98 99 100

static inline struct mqueue_inode_info *MQUEUE_I(struct inode *inode)
{
	return container_of(inode, struct mqueue_inode_info, vfs_inode);
}

101 102 103 104
/*
 * This routine should be called with the mq_lock held.
 */
static inline struct ipc_namespace *__get_ns_from_inode(struct inode *inode)
105
{
106
	return get_ipc_ns(inode->i_sb->s_fs_info);
107 108
}

109
static struct ipc_namespace *get_ns_from_inode(struct inode *inode)
110
{
111 112 113 114 115 116
	struct ipc_namespace *ns;

	spin_lock(&mq_lock);
	ns = __get_ns_from_inode(inode);
	spin_unlock(&mq_lock);
	return ns;
117 118
}

119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136
/* Auxiliary functions to manipulate messages' list */
static int msg_insert(struct msg_msg *msg, struct mqueue_inode_info *info)
{
	struct rb_node **p, *parent = NULL;
	struct posix_msg_tree_node *leaf;

	p = &info->msg_tree.rb_node;
	while (*p) {
		parent = *p;
		leaf = rb_entry(parent, struct posix_msg_tree_node, rb_node);

		if (likely(leaf->priority == msg->m_type))
			goto insert_msg;
		else if (msg->m_type < leaf->priority)
			p = &(*p)->rb_left;
		else
			p = &(*p)->rb_right;
	}
137 138 139 140 141 142 143 144 145
	if (info->node_cache) {
		leaf = info->node_cache;
		info->node_cache = NULL;
	} else {
		leaf = kmalloc(sizeof(*leaf), GFP_ATOMIC);
		if (!leaf)
			return -ENOMEM;
		INIT_LIST_HEAD(&leaf->msg_list);
	}
146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182
	leaf->priority = msg->m_type;
	rb_link_node(&leaf->rb_node, parent, p);
	rb_insert_color(&leaf->rb_node, &info->msg_tree);
insert_msg:
	info->attr.mq_curmsgs++;
	info->qsize += msg->m_ts;
	list_add_tail(&msg->m_list, &leaf->msg_list);
	return 0;
}

static inline struct msg_msg *msg_get(struct mqueue_inode_info *info)
{
	struct rb_node **p, *parent = NULL;
	struct posix_msg_tree_node *leaf;
	struct msg_msg *msg;

try_again:
	p = &info->msg_tree.rb_node;
	while (*p) {
		parent = *p;
		/*
		 * During insert, low priorities go to the left and high to the
		 * right.  On receive, we want the highest priorities first, so
		 * walk all the way to the right.
		 */
		p = &(*p)->rb_right;
	}
	if (!parent) {
		if (info->attr.mq_curmsgs) {
			pr_warn_once("Inconsistency in POSIX message queue, "
				     "no tree element, but supposedly messages "
				     "should exist!\n");
			info->attr.mq_curmsgs = 0;
		}
		return NULL;
	}
	leaf = rb_entry(parent, struct posix_msg_tree_node, rb_node);
183
	if (unlikely(list_empty(&leaf->msg_list))) {
184 185 186 187
		pr_warn_once("Inconsistency in POSIX message queue, "
			     "empty leaf node but we haven't implemented "
			     "lazy leaf delete!\n");
		rb_erase(&leaf->rb_node, &info->msg_tree);
188 189 190 191 192
		if (info->node_cache) {
			kfree(leaf);
		} else {
			info->node_cache = leaf;
		}
193 194 195 196 197 198 199
		goto try_again;
	} else {
		msg = list_first_entry(&leaf->msg_list,
				       struct msg_msg, m_list);
		list_del(&msg->m_list);
		if (list_empty(&leaf->msg_list)) {
			rb_erase(&leaf->rb_node, &info->msg_tree);
200 201 202 203 204
			if (info->node_cache) {
				kfree(leaf);
			} else {
				info->node_cache = leaf;
			}
205 206 207 208 209 210 211
		}
	}
	info->attr.mq_curmsgs--;
	info->qsize -= msg->m_ts;
	return msg;
}

212
static struct inode *mqueue_get_inode(struct super_block *sb,
Al Viro's avatar
Al Viro committed
213
		struct ipc_namespace *ipc_ns, umode_t mode,
214
		struct mq_attr *attr)
Linus Torvalds's avatar
Linus Torvalds committed
215
{
216
	struct user_struct *u = current_user();
Linus Torvalds's avatar
Linus Torvalds committed
217
	struct inode *inode;
218
	int ret = -ENOMEM;
Linus Torvalds's avatar
Linus Torvalds committed
219 220

	inode = new_inode(sb);
221 222 223 224 225 226 227 228 229 230 231
	if (!inode)
		goto err;

	inode->i_ino = get_next_ino();
	inode->i_mode = mode;
	inode->i_uid = current_fsuid();
	inode->i_gid = current_fsgid();
	inode->i_mtime = inode->i_ctime = inode->i_atime = CURRENT_TIME;

	if (S_ISREG(mode)) {
		struct mqueue_inode_info *info;
232
		unsigned long mq_bytes, mq_treesize;
233 234 235 236 237 238 239 240 241 242

		inode->i_fop = &mqueue_file_operations;
		inode->i_size = FILENT_SIZE;
		/* mqueue specific info */
		info = MQUEUE_I(inode);
		spin_lock_init(&info->lock);
		init_waitqueue_head(&info->wait_q);
		INIT_LIST_HEAD(&info->e_wait_q[0].list);
		INIT_LIST_HEAD(&info->e_wait_q[1].list);
		info->notify_owner = NULL;
243
		info->notify_user_ns = NULL;
244 245
		info->qsize = 0;
		info->user = NULL;	/* set when all is ok */
246
		info->msg_tree = RB_ROOT;
247
		info->node_cache = NULL;
248
		memset(&info->attr, 0, sizeof(info->attr));
249 250 251 252
		info->attr.mq_maxmsg = min(ipc_ns->mq_msg_max,
					   ipc_ns->mq_msg_default);
		info->attr.mq_msgsize = min(ipc_ns->mq_msgsize_max,
					    ipc_ns->mq_msgsize_default);
253 254 255 256
		if (attr) {
			info->attr.mq_maxmsg = attr->mq_maxmsg;
			info->attr.mq_msgsize = attr->mq_msgsize;
		}
257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272
		/*
		 * We used to allocate a static array of pointers and account
		 * the size of that array as well as one msg_msg struct per
		 * possible message into the queue size. That's no longer
		 * accurate as the queue is now an rbtree and will grow and
		 * shrink depending on usage patterns.  We can, however, still
		 * account one msg_msg struct per message, but the nodes are
		 * allocated depending on priority usage, and most programs
		 * only use one, or a handful, of priorities.  However, since
		 * this is pinned memory, we need to assume worst case, so
		 * that means the min(mq_maxmsg, max_priorities) * struct
		 * posix_msg_tree_node.
		 */
		mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
			min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
			sizeof(struct posix_msg_tree_node);
273

274 275
		mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
					  info->attr.mq_msgsize);
Linus Torvalds's avatar
Linus Torvalds committed
276

277 278
		spin_lock(&mq_lock);
		if (u->mq_bytes + mq_bytes < u->mq_bytes ||
279
		    u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE)) {
280 281
			spin_unlock(&mq_lock);
			/* mqueue_evict_inode() releases info->messages */
282
			ret = -EMFILE;
283
			goto out_inode;
Linus Torvalds's avatar
Linus Torvalds committed
284
		}
285 286 287 288 289 290 291 292 293 294 295
		u->mq_bytes += mq_bytes;
		spin_unlock(&mq_lock);

		/* all is ok */
		info->user = get_uid(u);
	} else if (S_ISDIR(mode)) {
		inc_nlink(inode);
		/* Some things misbehave if size == 0 on a directory */
		inode->i_size = 2 * DIRENT_SIZE;
		inode->i_op = &mqueue_dir_inode_operations;
		inode->i_fop = &simple_dir_operations;
Linus Torvalds's avatar
Linus Torvalds committed
296
	}
297

Linus Torvalds's avatar
Linus Torvalds committed
298 299 300
	return inode;
out_inode:
	iput(inode);
301
err:
302
	return ERR_PTR(ret);
Linus Torvalds's avatar
Linus Torvalds committed
303 304 305 306 307
}

static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
{
	struct inode *inode;
308
	struct ipc_namespace *ns = sb->s_fs_info;
Linus Torvalds's avatar
Linus Torvalds committed
309

310
	sb->s_iflags |= SB_I_NOEXEC | SB_I_NODEV;
311 312
	sb->s_blocksize = PAGE_SIZE;
	sb->s_blocksize_bits = PAGE_SHIFT;
Linus Torvalds's avatar
Linus Torvalds committed
313 314 315
	sb->s_magic = MQUEUE_MAGIC;
	sb->s_op = &mqueue_super_ops;

316 317 318
	inode = mqueue_get_inode(sb, ns, S_IFDIR | S_ISVTX | S_IRWXUGO, NULL);
	if (IS_ERR(inode))
		return PTR_ERR(inode);
Linus Torvalds's avatar
Linus Torvalds committed
319

320 321 322 323
	sb->s_root = d_make_root(inode);
	if (!sb->s_root)
		return -ENOMEM;
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
324 325
}

Al Viro's avatar
Al Viro committed
326
static struct dentry *mqueue_mount(struct file_system_type *fs_type,
327
			 int flags, const char *dev_name,
Al Viro's avatar
Al Viro committed
328
			 void *data)
Linus Torvalds's avatar
Linus Torvalds committed
329
{
330 331 332 333 334 335
	struct ipc_namespace *ns;
	if (flags & MS_KERNMOUNT) {
		ns = data;
		data = NULL;
	} else {
		ns = current->nsproxy->ipc_ns;
336
	}
337
	return mount_ns(fs_type, flags, data, ns, ns->user_ns, mqueue_fill_super);
Linus Torvalds's avatar
Linus Torvalds committed
338 339
}

340
static void init_once(void *foo)
Linus Torvalds's avatar
Linus Torvalds committed
341 342 343
{
	struct mqueue_inode_info *p = (struct mqueue_inode_info *) foo;

344
	inode_init_once(&p->vfs_inode);
Linus Torvalds's avatar
Linus Torvalds committed
345 346 347 348 349 350
}

static struct inode *mqueue_alloc_inode(struct super_block *sb)
{
	struct mqueue_inode_info *ei;

351
	ei = kmem_cache_alloc(mqueue_inode_cachep, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
352 353 354 355 356
	if (!ei)
		return NULL;
	return &ei->vfs_inode;
}

Nick Piggin's avatar
Nick Piggin committed
357
static void mqueue_i_callback(struct rcu_head *head)
Linus Torvalds's avatar
Linus Torvalds committed
358
{
Nick Piggin's avatar
Nick Piggin committed
359
	struct inode *inode = container_of(head, struct inode, i_rcu);
Linus Torvalds's avatar
Linus Torvalds committed
360 361 362
	kmem_cache_free(mqueue_inode_cachep, MQUEUE_I(inode));
}

Nick Piggin's avatar
Nick Piggin committed
363 364 365 366 367
static void mqueue_destroy_inode(struct inode *inode)
{
	call_rcu(&inode->i_rcu, mqueue_i_callback);
}

368
static void mqueue_evict_inode(struct inode *inode)
Linus Torvalds's avatar
Linus Torvalds committed
369 370 371
{
	struct mqueue_inode_info *info;
	struct user_struct *user;
372
	unsigned long mq_bytes, mq_treesize;
373
	struct ipc_namespace *ipc_ns;
374
	struct msg_msg *msg;
Linus Torvalds's avatar
Linus Torvalds committed
375

376
	clear_inode(inode);
377 378

	if (S_ISDIR(inode->i_mode))
Linus Torvalds's avatar
Linus Torvalds committed
379
		return;
380

381
	ipc_ns = get_ns_from_inode(inode);
Linus Torvalds's avatar
Linus Torvalds committed
382 383
	info = MQUEUE_I(inode);
	spin_lock(&info->lock);
384 385
	while ((msg = msg_get(info)) != NULL)
		free_msg(msg);
386
	kfree(info->node_cache);
Linus Torvalds's avatar
Linus Torvalds committed
387 388
	spin_unlock(&info->lock);

389
	/* Total amount of bytes accounted for the mqueue */
390 391 392 393 394 395 396
	mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
		min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
		sizeof(struct posix_msg_tree_node);

	mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
				  info->attr.mq_msgsize);

Linus Torvalds's avatar
Linus Torvalds committed
397 398 399 400
	user = info->user;
	if (user) {
		spin_lock(&mq_lock);
		user->mq_bytes -= mq_bytes;
401 402 403 404 405 406 407 408
		/*
		 * get_ns_from_inode() ensures that the
		 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
		 * to which we now hold a reference, or it is NULL.
		 * We can't put it here under mq_lock, though.
		 */
		if (ipc_ns)
			ipc_ns->mq_queues_count--;
Linus Torvalds's avatar
Linus Torvalds committed
409 410 411
		spin_unlock(&mq_lock);
		free_uid(user);
	}
412 413
	if (ipc_ns)
		put_ipc_ns(ipc_ns);
Linus Torvalds's avatar
Linus Torvalds committed
414 415 416
}

static int mqueue_create(struct inode *dir, struct dentry *dentry,
417
				umode_t mode, bool excl)
Linus Torvalds's avatar
Linus Torvalds committed
418 419 420 421
{
	struct inode *inode;
	struct mq_attr *attr = dentry->d_fsdata;
	int error;
422
	struct ipc_namespace *ipc_ns;
Linus Torvalds's avatar
Linus Torvalds committed
423 424

	spin_lock(&mq_lock);
425 426 427 428 429
	ipc_ns = __get_ns_from_inode(dir);
	if (!ipc_ns) {
		error = -EACCES;
		goto out_unlock;
	}
430 431 432

	if (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&
	    !capable(CAP_SYS_RESOURCE)) {
Linus Torvalds's avatar
Linus Torvalds committed
433
		error = -ENOSPC;
434
		goto out_unlock;
Linus Torvalds's avatar
Linus Torvalds committed
435
	}
436
	ipc_ns->mq_queues_count++;
Linus Torvalds's avatar
Linus Torvalds committed
437 438
	spin_unlock(&mq_lock);

439
	inode = mqueue_get_inode(dir->i_sb, ipc_ns, mode, attr);
440 441
	if (IS_ERR(inode)) {
		error = PTR_ERR(inode);
Linus Torvalds's avatar
Linus Torvalds committed
442
		spin_lock(&mq_lock);
443 444
		ipc_ns->mq_queues_count--;
		goto out_unlock;
Linus Torvalds's avatar
Linus Torvalds committed
445 446
	}

447
	put_ipc_ns(ipc_ns);
Linus Torvalds's avatar
Linus Torvalds committed
448 449 450 451 452 453
	dir->i_size += DIRENT_SIZE;
	dir->i_ctime = dir->i_mtime = dir->i_atime = CURRENT_TIME;

	d_instantiate(dentry, inode);
	dget(dentry);
	return 0;
454
out_unlock:
Linus Torvalds's avatar
Linus Torvalds committed
455
	spin_unlock(&mq_lock);
456 457
	if (ipc_ns)
		put_ipc_ns(ipc_ns);
Linus Torvalds's avatar
Linus Torvalds committed
458 459 460 461 462
	return error;
}

static int mqueue_unlink(struct inode *dir, struct dentry *dentry)
{
463
	struct inode *inode = d_inode(dentry);
Linus Torvalds's avatar
Linus Torvalds committed
464 465 466

	dir->i_ctime = dir->i_mtime = dir->i_atime = CURRENT_TIME;
	dir->i_size -= DIRENT_SIZE;
Manfred Spraul's avatar
Manfred Spraul committed
467 468 469
	drop_nlink(inode);
	dput(dentry);
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
470 471 472 473 474 475 476 477 478 479
}

/*
*	This is routine for system read from queue file.
*	To avoid mess with doing here some sort of mq_receive we allow
*	to read only queue size & notification info (the only values
*	that are interesting from user point of view and aren't accessible
*	through std routines)
*/
static ssize_t mqueue_read_file(struct file *filp, char __user *u_data,
480
				size_t count, loff_t *off)
Linus Torvalds's avatar
Linus Torvalds committed
481
{
Al Viro's avatar
Al Viro committed
482
	struct mqueue_inode_info *info = MQUEUE_I(file_inode(filp));
Linus Torvalds's avatar
Linus Torvalds committed
483
	char buffer[FILENT_SIZE];
484
	ssize_t ret;
Linus Torvalds's avatar
Linus Torvalds committed
485 486 487 488 489 490 491 492 493

	spin_lock(&info->lock);
	snprintf(buffer, sizeof(buffer),
			"QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",
			info->qsize,
			info->notify_owner ? info->notify.sigev_notify : 0,
			(info->notify_owner &&
			 info->notify.sigev_notify == SIGEV_SIGNAL) ?
				info->notify.sigev_signo : 0,
494
			pid_vnr(info->notify_owner));
Linus Torvalds's avatar
Linus Torvalds committed
495 496 497
	spin_unlock(&info->lock);
	buffer[sizeof(buffer)-1] = '\0';

498 499 500 501
	ret = simple_read_from_buffer(u_data, count, off, buffer,
				strlen(buffer));
	if (ret <= 0)
		return ret;
Linus Torvalds's avatar
Linus Torvalds committed
502

Al Viro's avatar
Al Viro committed
503
	file_inode(filp)->i_atime = file_inode(filp)->i_ctime = CURRENT_TIME;
504
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
505 506
}

507
static int mqueue_flush_file(struct file *filp, fl_owner_t id)
Linus Torvalds's avatar
Linus Torvalds committed
508
{
Al Viro's avatar
Al Viro committed
509
	struct mqueue_inode_info *info = MQUEUE_I(file_inode(filp));
Linus Torvalds's avatar
Linus Torvalds committed
510 511

	spin_lock(&info->lock);
512
	if (task_tgid(current) == info->notify_owner)
Linus Torvalds's avatar
Linus Torvalds committed
513 514 515 516 517 518 519 520
		remove_notification(info);

	spin_unlock(&info->lock);
	return 0;
}

static unsigned int mqueue_poll_file(struct file *filp, struct poll_table_struct *poll_tab)
{
Al Viro's avatar
Al Viro committed
521
	struct mqueue_inode_info *info = MQUEUE_I(file_inode(filp));
Linus Torvalds's avatar
Linus Torvalds committed
522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559
	int retval = 0;

	poll_wait(filp, &info->wait_q, poll_tab);

	spin_lock(&info->lock);
	if (info->attr.mq_curmsgs)
		retval = POLLIN | POLLRDNORM;

	if (info->attr.mq_curmsgs < info->attr.mq_maxmsg)
		retval |= POLLOUT | POLLWRNORM;
	spin_unlock(&info->lock);

	return retval;
}

/* Adds current to info->e_wait_q[sr] before element with smaller prio */
static void wq_add(struct mqueue_inode_info *info, int sr,
			struct ext_wait_queue *ewp)
{
	struct ext_wait_queue *walk;

	ewp->task = current;

	list_for_each_entry(walk, &info->e_wait_q[sr].list, list) {
		if (walk->task->static_prio <= current->static_prio) {
			list_add_tail(&ewp->list, &walk->list);
			return;
		}
	}
	list_add_tail(&ewp->list, &info->e_wait_q[sr].list);
}

/*
 * Puts current task to sleep. Caller must hold queue lock. After return
 * lock isn't held.
 * sr: SEND or RECV
 */
static int wq_sleep(struct mqueue_inode_info *info, int sr,
560
		    ktime_t *timeout, struct ext_wait_queue *ewp)
Linus Torvalds's avatar
Linus Torvalds committed
561 562 563 564 565 566 567
{
	int retval;
	signed long time;

	wq_add(info, sr, ewp);

	for (;;) {
568
		__set_current_state(TASK_INTERRUPTIBLE);
Linus Torvalds's avatar
Linus Torvalds committed
569 570

		spin_unlock(&info->lock);
571 572
		time = schedule_hrtimeout_range_clock(timeout, 0,
			HRTIMER_MODE_ABS, CLOCK_REALTIME);
Linus Torvalds's avatar
Linus Torvalds committed
573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615

		if (ewp->state == STATE_READY) {
			retval = 0;
			goto out;
		}
		spin_lock(&info->lock);
		if (ewp->state == STATE_READY) {
			retval = 0;
			goto out_unlock;
		}
		if (signal_pending(current)) {
			retval = -ERESTARTSYS;
			break;
		}
		if (time == 0) {
			retval = -ETIMEDOUT;
			break;
		}
	}
	list_del(&ewp->list);
out_unlock:
	spin_unlock(&info->lock);
out:
	return retval;
}

/*
 * Returns waiting task that should be serviced first or NULL if none exists
 */
static struct ext_wait_queue *wq_get_first_waiter(
		struct mqueue_inode_info *info, int sr)
{
	struct list_head *ptr;

	ptr = info->e_wait_q[sr].list.prev;
	if (ptr == &info->e_wait_q[sr].list)
		return NULL;
	return list_entry(ptr, struct ext_wait_queue, list);
}


static inline void set_cookie(struct sk_buff *skb, char code)
{
Manfred Spraul's avatar
Manfred Spraul committed
616
	((char *)skb->data)[NOTIFY_COOKIE_LEN-1] = code;
Linus Torvalds's avatar
Linus Torvalds committed
617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641
}

/*
 * The next function is only to split too long sys_mq_timedsend
 */
static void __do_notify(struct mqueue_inode_info *info)
{
	/* notification
	 * invoked when there is registered process and there isn't process
	 * waiting synchronously for message AND state of queue changed from
	 * empty to not empty. Here we are sure that no one is waiting
	 * synchronously. */
	if (info->notify_owner &&
	    info->attr.mq_curmsgs == 1) {
		struct siginfo sig_i;
		switch (info->notify.sigev_notify) {
		case SIGEV_NONE:
			break;
		case SIGEV_SIGNAL:
			/* sends signal */

			sig_i.si_signo = info->notify.sigev_signo;
			sig_i.si_errno = 0;
			sig_i.si_code = SI_MESGQ;
			sig_i.si_value = info->notify.sigev_value;
642 643
			/* map current pid/uid into info->owner's namespaces */
			rcu_read_lock();
644 645
			sig_i.si_pid = task_tgid_nr_ns(current,
						ns_of_pid(info->notify_owner));
646
			sig_i.si_uid = from_kuid_munged(info->notify_user_ns, current_uid());
647
			rcu_read_unlock();
Linus Torvalds's avatar
Linus Torvalds committed
648

649 650
			kill_pid_info(info->notify.sigev_signo,
				      &sig_i, info->notify_owner);
Linus Torvalds's avatar
Linus Torvalds committed
651 652 653
			break;
		case SIGEV_THREAD:
			set_cookie(info->notify_cookie, NOTIFY_WOKENUP);
654
			netlink_sendskb(info->notify_sock, info->notify_cookie);
Linus Torvalds's avatar
Linus Torvalds committed
655 656 657
			break;
		}
		/* after notification unregisters process */
658
		put_pid(info->notify_owner);
659
		put_user_ns(info->notify_user_ns);
660
		info->notify_owner = NULL;
661
		info->notify_user_ns = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
662 663 664 665
	}
	wake_up(&info->wait_q);
}

666 667
static int prepare_timeout(const struct timespec __user *u_abs_timeout,
			   ktime_t *expires, struct timespec *ts)
Linus Torvalds's avatar
Linus Torvalds committed
668
{
669 670 671 672
	if (copy_from_user(ts, u_abs_timeout, sizeof(struct timespec)))
		return -EFAULT;
	if (!timespec_valid(ts))
		return -EINVAL;
Linus Torvalds's avatar
Linus Torvalds committed
673

674 675
	*expires = timespec_to_ktime(*ts);
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
676 677 678 679
}

static void remove_notification(struct mqueue_inode_info *info)
{
680
	if (info->notify_owner != NULL &&
Linus Torvalds's avatar
Linus Torvalds committed
681 682
	    info->notify.sigev_notify == SIGEV_THREAD) {
		set_cookie(info->notify_cookie, NOTIFY_REMOVED);
683
		netlink_sendskb(info->notify_sock, info->notify_cookie);
Linus Torvalds's avatar
Linus Torvalds committed
684
	}
685
	put_pid(info->notify_owner);
686
	put_user_ns(info->notify_user_ns);
687
	info->notify_owner = NULL;
688
	info->notify_user_ns = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
689 690
}

691
static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
Linus Torvalds's avatar
Linus Torvalds committed
692
{
693 694 695
	int mq_treesize;
	unsigned long total_size;

Linus Torvalds's avatar
Linus Torvalds committed
696
	if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0)
697
		return -EINVAL;
Linus Torvalds's avatar
Linus Torvalds committed
698
	if (capable(CAP_SYS_RESOURCE)) {
699 700
		if (attr->mq_maxmsg > HARD_MSGMAX ||
		    attr->mq_msgsize > HARD_MSGSIZEMAX)
701
			return -EINVAL;
Linus Torvalds's avatar
Linus Torvalds committed
702
	} else {
703 704
		if (attr->mq_maxmsg > ipc_ns->mq_msg_max ||
				attr->mq_msgsize > ipc_ns->mq_msgsize_max)
705
			return -EINVAL;
Linus Torvalds's avatar
Linus Torvalds committed
706 707 708
	}
	/* check for overflow */
	if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg)
709
		return -EOVERFLOW;
710 711 712 713 714
	mq_treesize = attr->mq_maxmsg * sizeof(struct msg_msg) +
		min_t(unsigned int, attr->mq_maxmsg, MQ_PRIO_MAX) *
		sizeof(struct posix_msg_tree_node);
	total_size = attr->mq_maxmsg * attr->mq_msgsize;
	if (total_size + mq_treesize < total_size)
715 716
		return -EOVERFLOW;
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
717 718 719 720 721
}

/*
 * Invoked when creating a new queue via sys_mq_open
 */
722 723
static struct file *do_create(struct ipc_namespace *ipc_ns, struct inode *dir,
			struct path *path, int oflag, umode_t mode,
724
			struct mq_attr *attr)
Linus Torvalds's avatar
Linus Torvalds committed
725
{
726
	const struct cred *cred = current_cred();
Linus Torvalds's avatar
Linus Torvalds committed
727 728
	int ret;

Al Viro's avatar
Al Viro committed
729
	if (attr) {
730 731
		ret = mq_attr_ok(ipc_ns, attr);
		if (ret)
732
			return ERR_PTR(ret);
Linus Torvalds's avatar
Linus Torvalds committed
733
		/* store for use during create */
734
		path->dentry->d_fsdata = attr;
735 736 737 738 739 740 741 742 743
	} else {
		struct mq_attr def_attr;

		def_attr.mq_maxmsg = min(ipc_ns->mq_msg_max,
					 ipc_ns->mq_msg_default);
		def_attr.mq_msgsize = min(ipc_ns->mq_msgsize_max,
					  ipc_ns->mq_msgsize_default);
		ret = mq_attr_ok(ipc_ns, &def_attr);
		if (ret)
744
			return ERR_PTR(ret);
Linus Torvalds's avatar
Linus Torvalds committed
745 746
	}

Al Viro's avatar
Al Viro committed
747
	mode &= ~current_umask();
748 749
	ret = vfs_create(dir, path->dentry, mode, true);
	path->dentry->d_fsdata = NULL;
750 751 752
	if (ret)
		return ERR_PTR(ret);
	return dentry_open(path, oflag, cred);
Linus Torvalds's avatar
Linus Torvalds committed
753 754 755
}

/* Opens existing queue */
756
static struct file *do_open(struct path *path, int oflag)
Linus Torvalds's avatar
Linus Torvalds committed
757
{
758 759
	static const int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
						  MAY_READ | MAY_WRITE };
760 761 762 763
	int acc;
	if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY))
		return ERR_PTR(-EINVAL);
	acc = oflag2acc[oflag & O_ACCMODE];
764
	if (inode_permission(d_inode(path->dentry), acc))
765 766
		return ERR_PTR(-EACCES);
	return dentry_open(path, oflag, current_cred());
Linus Torvalds's avatar
Linus Torvalds committed
767 768
}

Al Viro's avatar
Al Viro committed
769
SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode,
770
		struct mq_attr __user *, u_attr)
Linus Torvalds's avatar
Linus Torvalds committed
771
{
772
	struct path path;
Linus Torvalds's avatar
Linus Torvalds committed
773
	struct file *filp;
774
	struct filename *name;
Al Viro's avatar
Al Viro committed
775
	struct mq_attr attr;
Linus Torvalds's avatar
Linus Torvalds committed
776
	int fd, error;
777
	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
778 779 780
	struct vfsmount *mnt = ipc_ns->mq_mnt;
	struct dentry *root = mnt->mnt_root;
	int ro;
Linus Torvalds's avatar
Linus Torvalds committed
781

Al Viro's avatar
Al Viro committed
782 783 784 785
	if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
		return -EFAULT;

	audit_mq_open(oflag, mode, u_attr ? &attr : NULL);
786

Linus Torvalds's avatar
Linus Torvalds committed
787 788 789
	if (IS_ERR(name = getname(u_name)))
		return PTR_ERR(name);

790
	fd = get_unused_fd_flags(O_CLOEXEC);
Linus Torvalds's avatar
Linus Torvalds committed
791 792 793
	if (fd < 0)
		goto out_putname;

794
	ro = mnt_want_write(mnt);	/* we'll drop it in any case */
795
	error = 0;
Al Viro's avatar
Al Viro committed
796
	inode_lock(d_inode(root));
797
	path.dentry = lookup_one_len(name->name, root, strlen(name->name));
798 799
	if (IS_ERR(path.dentry)) {
		error = PTR_ERR(path.dentry);
800
		goto out_putfd;
Linus Torvalds's avatar
Linus Torvalds committed
801
	}
802
	path.mnt = mntget(mnt);
Linus Torvalds's avatar
Linus Torvalds committed
803 804

	if (oflag & O_CREAT) {
805
		if (d_really_is_positive(path.dentry)) {	/* entry already exists */
806
			audit_inode(name, path.dentry, 0);
807 808
			if (oflag & O_EXCL) {
				error = -EEXIST;
809
				goto out;
810
			}
811
			filp = do_open(&path, oflag);
Linus Torvalds's avatar
Linus Torvalds committed
812
		} else {
813 814 815 816
			if (ro) {
				error = ro;
				goto out;
			}
817
			audit_inode_parent_hidden(name, root);
818
			filp = do_create(ipc_ns, d_inode(root),
819
						&path, oflag, mode,
Al Viro's avatar
Al Viro committed
820
						u_attr ? &attr : NULL);
Linus Torvalds's avatar
Linus Torvalds committed
821
		}
822
	} else {
823
		if (d_really_is_negative(path.dentry)) {
824
			error = -ENOENT;
825
			goto out;
826
		}
827
		audit_inode(name, path.dentry, 0);
828
		filp = do_open(&path, oflag);
829
	}
Linus Torvalds's avatar
Linus Torvalds committed
830

831 832 833
	if (!IS_ERR(filp))
		fd_install(fd, filp);
	else
Linus Torvalds's avatar
Linus Torvalds committed
834
		error = PTR_ERR(filp);
835
out:
836
	path_put(&path);
837
out_putfd:
838 839 840 841
	if (error) {
		put_unused_fd(fd);
		fd = error;
	}
Al Viro's avatar
Al Viro committed
842
	inode_unlock(d_inode(root));
843 844
	if (!ro)
		mnt_drop_write(mnt);
Linus Torvalds's avatar
Linus Torvalds committed
845 846 847 848 849
out_putname:
	putname(name);
	return fd;
}

850
SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
Linus Torvalds's avatar
Linus Torvalds committed
851 852
{
	int err;
853
	struct filename *name;
Linus Torvalds's avatar
Linus Torvalds committed
854 855
	struct dentry *dentry;
	struct inode *inode = NULL;
856
	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
857
	struct vfsmount *mnt = ipc_ns->mq_mnt;
Linus Torvalds's avatar
Linus Torvalds committed
858 859 860 861 862

	name = getname(u_name);
	if (IS_ERR(name))
		return PTR_ERR(name);

863
	audit_inode_parent_hidden(name, mnt->mnt_root);
864 865 866
	err = mnt_want_write(mnt);
	if (err)
		goto out_name;
Al Viro's avatar
Al Viro committed
867
	inode_lock_nested(d_inode(mnt->mnt_root), I_MUTEX_PARENT);
868 869
	dentry = lookup_one_len(name->name, mnt->mnt_root,
				strlen(name->name));
Linus Torvalds's avatar
Linus Torvalds committed
870 871 872 873 874
	if (IS_ERR(dentry)) {
		err = PTR_ERR(dentry);
		goto out_unlock;
	}

875
	inode = d_inode(dentry);
876 877 878
	if (!inode) {
		err = -ENOENT;
	} else {
Al Viro's avatar
Al Viro committed
879
		ihold(inode);
880
		err = vfs_unlink(d_inode(dentry->d_parent), dentry, NULL);
881
	}
Linus Torvalds's avatar
Linus Torvalds committed
882 883 884
	dput(dentry);

out_unlock:
Al Viro's avatar
Al Viro committed
885
	inode_unlock(d_inode(mnt->mnt_root));
Linus Torvalds's avatar
Linus Torvalds committed
886 887
	if (inode)
		iput(inode);
888 889 890
	mnt_drop_write(mnt);
out_name:
	putname(name);
Linus Torvalds's avatar
Linus Torvalds committed
891 892 893 894 895 896 897 898 899 900

	return err;
}

/* Pipelined send and receive functions.
 *
 * If a receiver finds no waiting message, then it registers itself in the
 * list of waiting receivers. A sender checks that list before adding the new
 * message into the message array. If there is a waiting receiver, then it
 * bypasses the message array and directly hands the message over to the
901 902 903 904 905 906 907 908 909
 * receiver. The receiver accepts the message and returns without grabbing the
 * queue spinlock:
 *
 * - Set pointer to message.
 * - Queue the receiver task for later wakeup (without the info->lock).
 * - Update its state to STATE_READY. Now the receiver can continue.
 * - Wake up the process after the lock is dropped. Should the process wake up
 *   before this wakeup (due to a timeout or a signal) it will either see
 *   STATE_READY and continue or acquire the lock to check the state again.
Linus Torvalds's avatar
Linus Torvalds committed
910 911 912 913 914 915 916
 *
 * The same algorithm is used for senders.
 */

/* pipelined_send() - send a message directly to the task waiting in
 * sys_mq_timedreceive() (without inserting message into a queue).
 */
917 918
static inline void pipelined_send(struct wake_q_head *wake_q,
				  struct mqueue_inode_info *info,
Linus Torvalds's avatar
Linus Torvalds committed
919 920 921 922 923
				  struct msg_msg *message,
				  struct ext_wait_queue *receiver)
{
	receiver->msg = message;
	list_del(&receiver->list);
924 925 926 927 928 929 930 931 932
	wake_q_add(wake_q, receiver->task);
	/*
	 * Rely on the implicit cmpxchg barrier from wake_q_add such
	 * that we can ensure that updating receiver->state is the last
	 * write operation: As once set, the receiver can continue,
	 * and if we don't have the reference count from the wake_q,
	 * yet, at that point we can later have a use-after-free
	 * condition and bogus wakeup.
	 */
Linus Torvalds's avatar
Linus Torvalds committed
933 934 935 936 937
	receiver->state = STATE_READY;
}

/* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
 * gets its message and put to the queue (we have one free place for sure). */
938 939
static inline void pipelined_receive(struct wake_q_head *wake_q,
				     struct mqueue_inode_info *info)
Linus Torvalds's avatar
Linus Torvalds committed
940 941 942 943 944 945 946 947
{
	struct ext_wait_queue *sender = wq_get_first_waiter(info, SEND);

	if (!sender) {
		/* for poll */
		wake_up_interruptible(&info->wait_q);
		return;
	}
948 949
	if (msg_insert(sender->msg, info))
		return;
950

Linus Torvalds's avatar
Linus Torvalds committed
951
	list_del(&sender->list);
952
	wake_q_add(wake_q, sender->task);
Linus Torvalds's avatar
Linus Torvalds committed
953 954 955
	sender->state = STATE_READY;
}

956 957 958
SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr,
		size_t, msg_len, unsigned int, msg_prio,
		const struct timespec __user *, u_abs_timeout)
Linus Torvalds's avatar
Linus Torvalds committed
959
{
960
	struct fd f;
Linus Torvalds's avatar
Linus Torvalds committed
961 962 963 964 965
	struct inode *inode;
	struct ext_wait_queue wait;
	struct ext_wait_queue *receiver;
	struct msg_msg *msg_ptr;
	struct mqueue_inode_info *info;
966 967
	ktime_t expires, *timeout = NULL;
	struct timespec ts;
968
	struct posix_msg_tree_node *new_leaf = NULL;
969
	int ret = 0;
970
	WAKE_Q(wake_q);
Linus Torvalds's avatar
Linus Torvalds committed
971

Al Viro's avatar
Al Viro committed
972
	if (u_abs_timeout) {
973 974 975 976
		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
		if (res)
			return res;
		timeout = &expires;
Al Viro's avatar
Al Viro committed
977
	}
978

Linus Torvalds's avatar
Linus Torvalds committed
979 980 981
	if (unlikely(msg_prio >= (unsigned long) MQ_PRIO_MAX))
		return -EINVAL;

982
	audit_mq_sendrecv(mqdes, msg_len, msg_prio, timeout ? &ts : NULL);
Linus Torvalds's avatar
Linus Torvalds committed
983

984 985
	f = fdget(mqdes);
	if (unlikely(!f.file)) {
986
		ret = -EBADF;
Linus Torvalds's avatar
Linus Torvalds committed
987
		goto out;
988
	}
Linus Torvalds's avatar
Linus Torvalds committed
989

Al Viro's avatar
Al Viro committed
990
	inode = file_inode(f.file);
991
	if (unlikely(f.file->f_op != &mqueue_file_operations)) {
992
		ret = -EBADF;
Linus Torvalds's avatar
Linus Torvalds committed
993
		goto out_fput;
994
	}
Linus Torvalds's avatar
Linus Torvalds committed
995
	info = MQUEUE_I(inode);
Al Viro's avatar
Al Viro committed
996
	audit_file(f.file);
Linus Torvalds's avatar
Linus Torvalds committed
997

998
	if (unlikely(!(f.file->f_mode & FMODE_WRITE))) {
999
		ret = -EBADF;
Linus Torvalds's avatar
Linus Torvalds committed
1000
		goto out_fput;
1001
	}
Linus Torvalds's avatar
Linus Torvalds committed
1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017

	if (unlikely(msg_len > info->attr.mq_msgsize)) {
		ret = -EMSGSIZE;
		goto out_fput;
	}

	/* First try to allocate memory, before doing anything with
	 * existing queues. */
	msg_ptr = load_msg(u_msg_ptr, msg_len);
	if (IS_ERR(msg_ptr)) {
		ret = PTR_ERR(msg_ptr);
		goto out_fput;
	}
	msg_ptr->m_ts = msg_len;
	msg_ptr->m_type = msg_prio;

1018 1019 1020 1021 1022 1023 1024 1025
	/*
	 * msg_insert really wants us to have a valid, spare node struct so
	 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
	 * fall back to that if necessary.
	 */
	if (!info->node_cache)
		new_leaf = kmalloc(sizeof(*new_leaf), GFP_KERNEL);

Linus Torvalds's avatar
Linus Torvalds committed
1026 1027
	spin_lock(&info->lock);

1028 1029 1030 1031 1032 1033 1034 1035 1036
	if (!info->node_cache && new_leaf) {
		/* Save our speculative allocation into the cache */
		INIT_LIST_HEAD(&new_leaf->msg_list);
		info->node_cache = new_leaf;
		new_leaf = NULL;
	} else {
		kfree(new_leaf);
	}

Linus Torvalds's avatar
Linus Torvalds committed
1037
	if (info->attr.mq_curmsgs == info->attr.mq_maxmsg) {
1038
		if (f.file->f_flags & O_NONBLOCK) {
Linus Torvalds's avatar
Linus Torvalds committed
1039 1040 1041 1042 1043 1044
			ret = -EAGAIN;
		} else {
			wait.task = current;
			wait.msg = (void *) msg_ptr;
			wait.state = STATE_NONE;
			ret = wq_sleep(info, SEND, timeout, &wait);
1045 1046 1047 1048 1049
			/*
			 * wq_sleep must be called with info->lock held, and
			 * returns with the lock released
			 */
			goto out_free;
Linus Torvalds's avatar
Linus Torvalds committed
1050 1051 1052 1053
		}
	} else {
		receiver = wq_get_first_waiter(info, RECV);
		if (receiver) {
1054
			pipelined_send(&wake_q, info, msg_ptr, receiver);
Linus Torvalds's avatar
Linus Torvalds committed
1055 1056
		} else {
			/* adds message to the queue */
1057 1058 1059
			ret = msg_insert(msg_ptr, info);
			if (ret)
				goto out_unlock;
Linus Torvalds's avatar
Linus Torvalds committed
1060 1061 1062 1063 1064
			__do_notify(info);
		}
		inode->i_atime = inode->i_mtime = inode->i_ctime =
				CURRENT_TIME;
	}
1065 1066
out_unlock:
	spin_unlock(&info->lock);
1067
	wake_up_q(&wake_q);
1068 1069 1070
out_free:
	if (ret)
		free_msg(msg_ptr);
Linus Torvalds's avatar
Linus Torvalds committed
1071
out_fput:
1072
	fdput(f);
Linus Torvalds's avatar
Linus Torvalds committed
1073 1074 1075 1076
out:
	return ret;
}

1077 1078 1079
SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr,
		size_t, msg_len, unsigned int __user *, u_msg_prio,
		const struct timespec __user *, u_abs_timeout)
Linus Torvalds's avatar
Linus Torvalds committed
1080 1081 1082
{
	ssize_t ret;
	struct msg_msg *msg_ptr;
1083
	struct fd f;
Linus Torvalds's avatar
Linus Torvalds committed
1084 1085 1086
	struct inode *inode;
	struct mqueue_inode_info *info;
	struct ext_wait_queue wait;
1087 1088
	ktime_t expires, *timeout = NULL;
	struct timespec ts;
1089
	struct posix_msg_tree_node *new_leaf = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
1090

Al Viro's avatar
Al Viro committed
1091
	if (u_abs_timeout) {
1092 1093 1094 1095
		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
		if (res)
			return res;
		timeout = &expires;
Al Viro's avatar
Al Viro committed
1096
	}
1097

1098
	audit_mq_sendrecv(mqdes, msg_len, 0, timeout ? &ts : NULL);
Linus Torvalds's avatar
Linus Torvalds committed
1099

1100 1101
	f = fdget(mqdes);
	if (unlikely(!f.file)) {
1102
		ret = -EBADF;
Linus Torvalds's avatar
Linus Torvalds committed
1103
		goto out;
1104
	}
Linus Torvalds's avatar
Linus Torvalds committed
1105

Al Viro's avatar
Al Viro committed
1106
	inode = file_inode(f.file);
1107
	if (unlikely(f.file->f_op != &mqueue_file_operations)) {
1108
		ret = -EBADF;
Linus Torvalds's avatar
Linus Torvalds committed
1109
		goto out_fput;
1110
	}
Linus Torvalds's avatar
Linus Torvalds committed
1111
	info = MQUEUE_I(inode);
Al Viro's avatar
Al Viro committed
1112
	audit_file(f.file);
Linus Torvalds's avatar
Linus Torvalds committed
1113

1114
	if (unlikely(!(f.file->f_mode & FMODE_READ))) {
1115
		ret = -EBADF;
Linus Torvalds's avatar
Linus Torvalds committed
1116
		goto out_fput;
1117
	}
Linus Torvalds's avatar
Linus Torvalds committed
1118 1119 1120 1121 1122 1123 1124

	/* checks if buffer is big enough */
	if (unlikely(msg_len < info->attr.mq_msgsize)) {
		ret = -EMSGSIZE;
		goto out_fput;
	}

1125 1126 1127 1128 1129 1130 1131 1132
	/*
	 * msg_insert really wants us to have a valid, spare node struct so
	 * it doesn't have to kmalloc a GFP_ATOMIC allocation, but it will
	 * fall back to that if necessary.
	 */
	if (!info->node_cache)
		new_leaf = kmalloc(sizeof(*new_leaf), GFP_KERNEL);

Linus Torvalds's avatar
Linus Torvalds committed
1133
	spin_lock(&info->lock);
1134 1135 1136 1137 1138 1139 1140 1141 1142

	if (!info->node_cache && new_leaf) {
		/* Save our speculative allocation into the cache */
		INIT_LIST_HEAD(&new_leaf->msg_list);
		info->node_cache = new_leaf;
	} else {
		kfree(new_leaf);
	}

Linus Torvalds's avatar
Linus Torvalds committed
1143
	if (info->attr.mq_curmsgs == 0) {
1144
		if (f.file->f_flags & O_NONBLOCK) {
Linus Torvalds's avatar
Linus Torvalds committed
1145 1146 1147 1148 1149 1150 1151 1152 1153
			spin_unlock(&info->lock);
			ret = -EAGAIN;
		} else {
			wait.task = current;
			wait.state = STATE_NONE;
			ret = wq_sleep(info, RECV, timeout, &wait);
			msg_ptr = wait.msg;
		}
	} else {
1154 1155
		WAKE_Q(wake_q);

Linus Torvalds's avatar
Linus Torvalds committed
1156 1157 1158 1159 1160 1161
		msg_ptr = msg_get(info);

		inode->i_atime = inode->i_mtime = inode->i_ctime =
				CURRENT_TIME;

		/* There is now free space in queue. */
1162
		pipelined_receive(&wake_q, info);
Linus Torvalds's avatar
Linus Torvalds committed
1163
		spin_unlock(&info->lock);
1164
		wake_up_q(&wake_q);
Linus Torvalds's avatar
Linus Torvalds committed
1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176
		ret = 0;
	}
	if (ret == 0) {
		ret = msg_ptr->m_ts;

		if ((u_msg_prio && put_user(msg_ptr->m_type, u_msg_prio)) ||
			store_msg(u_msg_ptr, msg_ptr, msg_ptr->m_ts)) {
			ret = -EFAULT;
		}
		free_msg(msg_ptr);
	}
out_fput:
1177
	fdput(f);
Linus Torvalds's avatar
Linus Torvalds committed
1178 1179 1180 1181 1182 1183 1184 1185 1186
out:
	return ret;
}

/*
 * Notes: the case when user wants us to deregister (with NULL as pointer)
 * and he isn't currently owner of notification, will be silently discarded.
 * It isn't explicitly defined in the POSIX.
 */
1187 1188
SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
		const struct sigevent __user *, u_notification)
Linus Torvalds's avatar
Linus Torvalds committed
1189
{
1190 1191
	int ret;
	struct fd f;
Linus Torvalds's avatar
Linus Torvalds committed
1192 1193 1194 1195 1196 1197
	struct sock *sock;
	struct inode *inode;
	struct sigevent notification;
	struct mqueue_inode_info *info;
	struct sk_buff *nc;

Al Viro's avatar
Al Viro committed
1198
	if (u_notification) {
Linus Torvalds's avatar
Linus Torvalds committed
1199 1200 1201
		if (copy_from_user(&notification, u_notification,
					sizeof(struct sigevent)))
			return -EFAULT;
Al Viro's avatar
Al Viro committed
1202 1203 1204
	}

	audit_mq_notify(mqdes, u_notification ? &notification : NULL);
Linus Torvalds's avatar
Linus Torvalds committed
1205

Al Viro's avatar
Al Viro committed
1206 1207 1208
	nc = NULL;
	sock = NULL;
	if (u_notification != NULL) {
Linus Torvalds's avatar
Linus Torvalds committed
1209 1210 1211 1212 1213
		if (unlikely(notification.sigev_notify != SIGEV_NONE &&
			     notification.sigev_notify != SIGEV_SIGNAL &&
			     notification.sigev_notify != SIGEV_THREAD))
			return -EINVAL;
		if (notification.sigev_notify == SIGEV_SIGNAL &&
1214
			!valid_signal(notification.sigev_signo)) {
Linus Torvalds's avatar
Linus Torvalds committed
1215 1216 1217
			return -EINVAL;
		}
		if (notification.sigev_notify == SIGEV_THREAD) {
1218 1219
			long timeo;

Linus Torvalds's avatar
Linus Torvalds committed
1220 1221
			/* create the notify skb */
			nc = alloc_skb(NOTIFY_COOKIE_LEN, GFP_KERNEL);
1222 1223
			if (!nc) {
				ret = -ENOMEM;
Linus Torvalds's avatar
Linus Torvalds committed
1224
				goto out;
1225
			}
Linus Torvalds's avatar
Linus Torvalds committed
1226 1227 1228
			if (copy_from_user(nc->data,
					notification.sigev_value.sival_ptr,
					NOTIFY_COOKIE_LEN)) {
1229
				ret = -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
1230 1231 1232 1233 1234 1235 1236
				goto out;
			}

			/* TODO: add a header? */
			skb_put(nc, NOTIFY_COOKIE_LEN);
			/* and attach it to the socket */
retry:
1237 1238
			f = fdget(notification.sigev_signo);
			if (!f.file) {
1239
				ret = -EBADF;
Linus Torvalds's avatar
Linus Torvalds committed
1240
				goto out;
1241
			}
1242 1243
			sock = netlink_getsockbyfilp(f.file);
			fdput(f);
Linus Torvalds's avatar
Linus Torvalds committed
1244 1245 1246 1247 1248 1249
			if (IS_ERR(sock)) {
				ret = PTR_ERR(sock);
				sock = NULL;
				goto out;
			}

1250
			timeo = MAX_SCHEDULE_TIMEOUT;
1251
			ret = netlink_attachskb(sock, nc, &timeo, NULL);
Linus Torvalds's avatar
Linus Torvalds committed
1252
			if (ret == 1)
1253
				goto retry;
Linus Torvalds's avatar
Linus Torvalds committed
1254 1255 1256 1257 1258 1259 1260 1261
			if (ret) {
				sock = NULL;
				nc = NULL;
				goto out;
			}
		}
	}

1262 1263
	f = fdget(mqdes);
	if (!f.file) {
1264
		ret = -EBADF;
Linus Torvalds's avatar
Linus Torvalds committed
1265
		goto out;
1266
	}
Linus Torvalds's avatar
Linus Torvalds committed
1267

Al Viro's avatar
Al Viro committed
1268
	inode = file_inode(f.file);
1269
	if (unlikely(f.file->f_op != &mqueue_file_operations)) {
1270
		ret = -EBADF;
Linus Torvalds's avatar
Linus Torvalds committed
1271
		goto out_fput;
1272
	}
Linus Torvalds's avatar
Linus Torvalds committed
1273 1274 1275 1276 1277
	info = MQUEUE_I(inode);

	ret = 0;
	spin_lock(&info->lock);
	if (u_notification == NULL) {
1278
		if (info->notify_owner == task_tgid(current)) {
Linus Torvalds's avatar
Linus Torvalds committed
1279 1280 1281
			remove_notification(info);
			inode->i_atime = inode->i_ctime = CURRENT_TIME;
		}
1282
	} else if (info->notify_owner != NULL) {
Linus Torvalds's avatar
Linus Torvalds committed
1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301
		ret = -EBUSY;
	} else {
		switch (notification.sigev_notify) {
		case SIGEV_NONE:
			info->notify.sigev_notify = SIGEV_NONE;
			break;
		case SIGEV_THREAD:
			info->notify_sock = sock;
			info->notify_cookie = nc;
			sock = NULL;
			nc = NULL;
			info->notify.sigev_notify = SIGEV_THREAD;
			break;
		case SIGEV_SIGNAL:
			info->notify.sigev_signo = notification.sigev_signo;
			info->notify.sigev_value = notification.sigev_value;
			info->notify.sigev_notify = SIGEV_SIGNAL;
			break;
		}
1302 1303

		info->notify_owner = get_pid(task_tgid(current));
1304
		info->notify_user_ns = get_user_ns(current_user_ns());
Linus Torvalds's avatar
Linus Torvalds committed
1305 1306 1307 1308
		inode->i_atime = inode->i_ctime = CURRENT_TIME;
	}
	spin_unlock(&info->lock);
out_fput:
1309
	fdput(f);
Linus Torvalds's avatar
Linus Torvalds committed
1310
out:
1311
	if (sock)
Linus Torvalds's avatar
Linus Torvalds committed
1312
		netlink_detachskb(sock, nc);
1313
	else if (nc)
Linus Torvalds's avatar
Linus Torvalds committed
1314
		dev_kfree_skb(nc);
1315

Linus Torvalds's avatar
Linus Torvalds committed
1316 1317 1318
	return ret;
}

1319 1320 1321
SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mqdes,
		const struct mq_attr __user *, u_mqstat,
		struct mq_attr __user *, u_omqstat)
Linus Torvalds's avatar
Linus Torvalds committed
1322 1323 1324
{
	int ret;
	struct mq_attr mqstat, omqstat;
Al Viro's avatar