70  * Accesses to a message queue are synchronized by acquiring info->lock.
73  * - The actual wakeup of a sleeping task is performed using the wake_q
74  *   framework. info->lock is already released when wake_up_q is called.
75  * - The exit codepaths after sleeping check ext_wait_queue->state without
77  *   acquiring info->lock.
94  *				   ->state = STATE_READY (reordered)
102  * the smp_store_release() that does ->state = STATE_READY.
116  *				receiver->msg = message; (reordered)
120  * 3) There is intentionally no barrier when setting current->state
121  *    to TASK_INTERRUPTIBLE: spin_unlock(&info->lock) provides the
123  *    info->lock, i.e. spin_lock(&info->lock) provided a pairing
127 struct ext_wait_queue {		/* queue of sleeping tasks */
155 	unsigned long qsize; /* size of queue in memory (sum of all msgs) */
177 	return get_ipc_ns(inode->i_sb->s_fs_info);  in __get_ns_from_inode()
197 	p = &info->msg_tree.rb_node;  in msg_insert()
202 		if (likely(leaf->priority == msg->m_type))  in msg_insert()
204 		else if (msg->m_type < leaf->priority) {  in msg_insert()
205 			p = &(*p)->rb_left;  in msg_insert()
208 			p = &(*p)->rb_right;  in msg_insert()
210 	if (info->node_cache) {  in msg_insert()
211 		leaf = info->node_cache;  in msg_insert()
212 		info->node_cache = NULL;  in msg_insert()
216 			return -ENOMEM;  in msg_insert()
217 		INIT_LIST_HEAD(&leaf->msg_list);  in msg_insert()
219 	leaf->priority = msg->m_type;  in msg_insert()
222 		info->msg_tree_rightmost = &leaf->rb_node;  in msg_insert()
224 	rb_link_node(&leaf->rb_node, parent, p);  in msg_insert()
225 	rb_insert_color(&leaf->rb_node, &info->msg_tree);  in msg_insert()
227 	info->attr.mq_curmsgs++;  in msg_insert()
228 	info->qsize += msg->m_ts;  in msg_insert()
229 	list_add_tail(&msg->m_list, &leaf->msg_list);  in msg_insert()
236 	struct rb_node *node = &leaf->rb_node;  in msg_tree_erase()
238 	if (info->msg_tree_rightmost == node)  in msg_tree_erase()
239 		info->msg_tree_rightmost = rb_prev(node);  in msg_tree_erase()
241 	rb_erase(node, &info->msg_tree);  in msg_tree_erase()
242 	if (info->node_cache)  in msg_tree_erase()
245 		info->node_cache = leaf;  in msg_tree_erase()
260 	parent = info->msg_tree_rightmost;  in msg_get()
262 		if (info->attr.mq_curmsgs) {  in msg_get()
263 			pr_warn_once("Inconsistency in POSIX message queue, "  in msg_get()
266 			info->attr.mq_curmsgs = 0;  in msg_get()
271 	if (unlikely(list_empty(&leaf->msg_list))) {  in msg_get()
272 		pr_warn_once("Inconsistency in POSIX message queue, "  in msg_get()
278 		msg = list_first_entry(&leaf->msg_list,  in msg_get()
280 		list_del(&msg->m_list);  in msg_get()
281 		if (list_empty(&leaf->msg_list)) {  in msg_get()
285 	info->attr.mq_curmsgs--;  in msg_get()
286 	info->qsize -= msg->m_ts;  in msg_get()
295 	int ret = -ENOMEM;  in mqueue_get_inode()
301 	inode->i_ino = get_next_ino();  in mqueue_get_inode()
302 	inode->i_mode = mode;  in mqueue_get_inode()
303 	inode->i_uid = current_fsuid();  in mqueue_get_inode()
304 	inode->i_gid = current_fsgid();  in mqueue_get_inode()
305 	inode->i_mtime = inode->i_atime = inode_set_ctime_current(inode);  in mqueue_get_inode()
311 		inode->i_fop = &mqueue_file_operations;  in mqueue_get_inode()
312 		inode->i_size = FILENT_SIZE;  in mqueue_get_inode()
315 		spin_lock_init(&info->lock);  in mqueue_get_inode()
316 		init_waitqueue_head(&info->wait_q);  in mqueue_get_inode()
317 		INIT_LIST_HEAD(&info->e_wait_q[0].list);  in mqueue_get_inode()
318 		INIT_LIST_HEAD(&info->e_wait_q[1].list);  in mqueue_get_inode()
319 		info->notify_owner = NULL;  in mqueue_get_inode()
320 		info->notify_user_ns = NULL;  in mqueue_get_inode()
321 		info->qsize = 0;  in mqueue_get_inode()
322 		info->ucounts = NULL;	/* set when all is ok */  in mqueue_get_inode()
323 		info->msg_tree = RB_ROOT;  in mqueue_get_inode()
324 		info->msg_tree_rightmost = NULL;  in mqueue_get_inode()
325 		info->node_cache = NULL;  in mqueue_get_inode()
326 		memset(&info->attr, 0, sizeof(info->attr));  in mqueue_get_inode()
327 		info->attr.mq_maxmsg = min(ipc_ns->mq_msg_max,  in mqueue_get_inode()
328 					   ipc_ns->mq_msg_default);  in mqueue_get_inode()
329 		info->attr.mq_msgsize = min(ipc_ns->mq_msgsize_max,  in mqueue_get_inode()
330 					    ipc_ns->mq_msgsize_default);  in mqueue_get_inode()
332 			info->attr.mq_maxmsg = attr->mq_maxmsg;  in mqueue_get_inode()
333 			info->attr.mq_msgsize = attr->mq_msgsize;  in mqueue_get_inode()
338 		 * possible message into the queue size. That's no longer  in mqueue_get_inode()
339 		 * accurate as the queue is now an rbtree and will grow and  in mqueue_get_inode()
349 		ret = -EINVAL;  in mqueue_get_inode()
350 		if (info->attr.mq_maxmsg <= 0 || info->attr.mq_msgsize <= 0)  in mqueue_get_inode()
353 			if (info->attr.mq_maxmsg > HARD_MSGMAX ||  in mqueue_get_inode()
354 			    info->attr.mq_msgsize > HARD_MSGSIZEMAX)  in mqueue_get_inode()
357 			if (info->attr.mq_maxmsg > ipc_ns->mq_msg_max ||  in mqueue_get_inode()
358 					info->attr.mq_msgsize > ipc_ns->mq_msgsize_max)  in mqueue_get_inode()
361 		ret = -EOVERFLOW;  in mqueue_get_inode()
363 		if (info->attr.mq_msgsize > ULONG_MAX/info->attr.mq_maxmsg)  in mqueue_get_inode()
365 		mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +  in mqueue_get_inode()
366 			min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *  in mqueue_get_inode()
368 		mq_bytes = info->attr.mq_maxmsg * info->attr.mq_msgsize;  in mqueue_get_inode()
372 		info->ucounts = get_ucounts(current_ucounts());  in mqueue_get_inode()
373 		if (info->ucounts) {  in mqueue_get_inode()
377 			msgqueue = inc_rlimit_ucounts(info->ucounts, UCOUNT_RLIMIT_MSGQUEUE, mq_bytes);  in mqueue_get_inode()
379 				dec_rlimit_ucounts(info->ucounts, UCOUNT_RLIMIT_MSGQUEUE, mq_bytes);  in mqueue_get_inode()
381 				put_ucounts(info->ucounts);  in mqueue_get_inode()
382 				info->ucounts = NULL;  in mqueue_get_inode()
383 				/* mqueue_evict_inode() releases info->messages */  in mqueue_get_inode()
384 				ret = -EMFILE;  in mqueue_get_inode()
392 		inode->i_size = 2 * DIRENT_SIZE;  in mqueue_get_inode()
393 		inode->i_op = &mqueue_dir_inode_operations;  in mqueue_get_inode()
394 		inode->i_fop = &simple_dir_operations;  in mqueue_get_inode()
407 	struct ipc_namespace *ns = sb->s_fs_info;  in mqueue_fill_super()
409 	sb->s_iflags |= SB_I_NOEXEC | SB_I_NODEV;  in mqueue_fill_super()
410 	sb->s_blocksize = PAGE_SIZE;  in mqueue_fill_super()
411 	sb->s_blocksize_bits = PAGE_SHIFT;  in mqueue_fill_super()
412 	sb->s_magic = MQUEUE_MAGIC;  in mqueue_fill_super()
413 	sb->s_op = &mqueue_super_ops;  in mqueue_fill_super()
419 	sb->s_root = d_make_root(inode);  in mqueue_fill_super()
420 	if (!sb->s_root)  in mqueue_fill_super()
421 		return -ENOMEM;  in mqueue_fill_super()
427 	struct mqueue_fs_context *ctx = fc->fs_private;  in mqueue_get_tree()
433 	if (ctx->newns) {  in mqueue_get_tree()
434 		fc->s_fs_info = ctx->ipc_ns;  in mqueue_get_tree()
437 	return get_tree_keyed(fc, mqueue_fill_super, ctx->ipc_ns);  in mqueue_get_tree()
442 	struct mqueue_fs_context *ctx = fc->fs_private;  in mqueue_fs_context_free()
444 	put_ipc_ns(ctx->ipc_ns);  in mqueue_fs_context_free()
454 		return -ENOMEM;  in mqueue_init_fs_context()
456 	ctx->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);  in mqueue_init_fs_context()
457 	put_user_ns(fc->user_ns);  in mqueue_init_fs_context()
458 	fc->user_ns = get_user_ns(ctx->ipc_ns->user_ns);  in mqueue_init_fs_context()
459 	fc->fs_private = ctx;  in mqueue_init_fs_context()
460 	fc->ops = &mqueue_fs_context_ops;  in mqueue_init_fs_context()
478 	ctx = fc->fs_private;  in mq_create_mount()
479 	ctx->newns = true;  in mq_create_mount()
480 	put_ipc_ns(ctx->ipc_ns);  in mq_create_mount()
481 	ctx->ipc_ns = get_ipc_ns(ns);  in mq_create_mount()
482 	put_user_ns(fc->user_ns);  in mq_create_mount()
483 	fc->user_ns = get_user_ns(ctx->ipc_ns->user_ns);  in mq_create_mount()
490 static void init_once(void *foo)  in init_once()  argument
492 	struct mqueue_inode_info *p = foo;  in init_once()
494 	inode_init_once(&p->vfs_inode);  in init_once()
504 	return &ei->vfs_inode;  in mqueue_alloc_inode()
521 	if (S_ISDIR(inode->i_mode))  in mqueue_evict_inode()
526 	spin_lock(&info->lock);  in mqueue_evict_inode()
528 		list_add_tail(&msg->m_list, &tmp_msg);  in mqueue_evict_inode()
529 	kfree(info->node_cache);  in mqueue_evict_inode()
530 	spin_unlock(&info->lock);  in mqueue_evict_inode()
533 		list_del(&msg->m_list);  in mqueue_evict_inode()
537 	if (info->ucounts) {  in mqueue_evict_inode()
541 		mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +  in mqueue_evict_inode()
542 			min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *  in mqueue_evict_inode()
545 		mq_bytes = mq_treesize + (info->attr.mq_maxmsg *  in mqueue_evict_inode()
546 					  info->attr.mq_msgsize);  in mqueue_evict_inode()
549 		dec_rlimit_ucounts(info->ucounts, UCOUNT_RLIMIT_MSGQUEUE, mq_bytes);  in mqueue_evict_inode()
552 		 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns  in mqueue_evict_inode()
557 			ipc_ns->mq_queues_count--;  in mqueue_evict_inode()
559 		put_ucounts(info->ucounts);  in mqueue_evict_inode()
560 		info->ucounts = NULL;  in mqueue_evict_inode()
568 	struct inode *dir = dentry->d_parent->d_inode;  in mqueue_create_attr()
577 		error = -EACCES;  in mqueue_create_attr()
581 	if (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&  in mqueue_create_attr()
583 		error = -ENOSPC;  in mqueue_create_attr()
586 	ipc_ns->mq_queues_count++;  in mqueue_create_attr()
589 	inode = mqueue_get_inode(dir->i_sb, ipc_ns, mode, attr);  in mqueue_create_attr()
593 		ipc_ns->mq_queues_count--;  in mqueue_create_attr()
598 	dir->i_size += DIRENT_SIZE;  in mqueue_create_attr()
599 	dir->i_mtime = dir->i_atime = inode_set_ctime_current(dir);  in mqueue_create_attr()
621 	dir->i_mtime = dir->i_atime = inode_set_ctime_current(dir);  in mqueue_unlink()
622 	dir->i_size -= DIRENT_SIZE;  in mqueue_unlink()
629 *	This is routine for system read from queue file.
631 *	to read only queue size & notification info (the only values
643 	spin_lock(&info->lock);  in mqueue_read_file()
645 			"QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",  in mqueue_read_file()
646 			info->qsize,  in mqueue_read_file()
647 			info->notify_owner ? info->notify.sigev_notify : 0,  in mqueue_read_file()
648 			(info->notify_owner &&  in mqueue_read_file()
649 			 info->notify.sigev_notify == SIGEV_SIGNAL) ?  in mqueue_read_file()
650 				info->notify.sigev_signo : 0,  in mqueue_read_file()
651 			pid_vnr(info->notify_owner));  in mqueue_read_file()
652 	spin_unlock(&info->lock);  in mqueue_read_file()
653 	buffer[sizeof(buffer)-1] = '\0';  in mqueue_read_file()
660 	inode->i_atime = inode_set_ctime_current(inode);  in mqueue_read_file()
668 	spin_lock(&info->lock);  in mqueue_flush_file()
669 	if (task_tgid(current) == info->notify_owner)  in mqueue_flush_file()
672 	spin_unlock(&info->lock);  in mqueue_flush_file()
681 	poll_wait(filp, &info->wait_q, poll_tab);  in mqueue_poll_file()
683 	spin_lock(&info->lock);  in mqueue_poll_file()
684 	if (info->attr.mq_curmsgs)  in mqueue_poll_file()
687 	if (info->attr.mq_curmsgs < info->attr.mq_maxmsg)  in mqueue_poll_file()
689 	spin_unlock(&info->lock);  in mqueue_poll_file()
694 /* Adds current to info->e_wait_q[sr] before element with smaller prio */
700 	list_for_each_entry(walk, &info->e_wait_q[sr].list, list) {  in wq_add()
701 		if (walk->task->prio <= current->prio) {  in wq_add()
702 			list_add_tail(&ewp->list, &walk->list);  in wq_add()
706 	list_add_tail(&ewp->list, &info->e_wait_q[sr].list);  in wq_add()
710  * Puts current task to sleep. Caller must hold queue lock. After return
716 	__releases(&info->lock)  in wq_sleep()
724 		/* memory barrier not required, we hold info->lock */  in wq_sleep()
727 		spin_unlock(&info->lock);  in wq_sleep()
731 		if (READ_ONCE(ewp->state) == STATE_READY) {  in wq_sleep()
737 		spin_lock(&info->lock);  in wq_sleep()
739 		/* we hold info->lock, so no memory barrier required */  in wq_sleep()
740 		if (READ_ONCE(ewp->state) == STATE_READY) {  in wq_sleep()
745 			retval = -ERESTARTSYS;  in wq_sleep()
749 			retval = -ETIMEDOUT;  in wq_sleep()
753 	list_del(&ewp->list);  in wq_sleep()
755 	spin_unlock(&info->lock);  in wq_sleep()
768 	ptr = info->e_wait_q[sr].list.prev;  in wq_get_first_waiter()
769 	if (ptr == &info->e_wait_q[sr].list)  in wq_get_first_waiter()
777 	((char *)skb->data)[NOTIFY_COOKIE_LEN-1] = code;  in set_cookie()
787 	 * waiting synchronously for message AND state of queue changed from  in __do_notify()
790 	if (info->notify_owner &&  in __do_notify()
791 	    info->attr.mq_curmsgs == 1) {  in __do_notify()
792 		switch (info->notify.sigev_notify) {  in __do_notify()
800 			if (!info->notify.sigev_signo)  in __do_notify()
804 			sig_i.si_signo = info->notify.sigev_signo;  in __do_notify()
807 			sig_i.si_value = info->notify.sigev_value;  in __do_notify()
809 			/* map current pid/uid into info->owner's namespaces */  in __do_notify()
811 						ns_of_pid(info->notify_owner));  in __do_notify()
812 			sig_i.si_uid = from_kuid_munged(info->notify_user_ns,  in __do_notify()
821 			task = pid_task(info->notify_owner, PIDTYPE_TGID);  in __do_notify()
822 			if (task && task->self_exec_id ==  in __do_notify()
823 						info->notify_self_exec_id) {  in __do_notify()
824 				do_send_sig_info(info->notify.sigev_signo,  in __do_notify()
831 			set_cookie(info->notify_cookie, NOTIFY_WOKENUP);  in __do_notify()
832 			netlink_sendskb(info->notify_sock, info->notify_cookie);  in __do_notify()
836 		put_pid(info->notify_owner);  in __do_notify()
837 		put_user_ns(info->notify_user_ns);  in __do_notify()
838 		info->notify_owner = NULL;  in __do_notify()
839 		info->notify_user_ns = NULL;  in __do_notify()
841 	wake_up(&info->wait_q);  in __do_notify()
848 		return -EFAULT;  in prepare_timeout()
850 		return -EINVAL;  in prepare_timeout()
856 	if (info->notify_owner != NULL &&  in remove_notification()
857 	    info->notify.sigev_notify == SIGEV_THREAD) {  in remove_notification()
858 		set_cookie(info->notify_cookie, NOTIFY_REMOVED);  in remove_notification()
859 		netlink_sendskb(info->notify_sock, info->notify_cookie);  in remove_notification()
861 	put_pid(info->notify_owner);  in remove_notification()
862 	put_user_ns(info->notify_user_ns);  in remove_notification()
863 	info->notify_owner = NULL;  in remove_notification()
864 	info->notify_user_ns = NULL;  in remove_notification()
877 			return -ENOENT;  in prepare_open()
880 		audit_inode_parent_hidden(name, dentry->d_parent);  in prepare_open()
887 		return -EEXIST;  in prepare_open()
889 		return -EINVAL;  in prepare_open()
897 	struct vfsmount *mnt = current->nsproxy->ipc_ns->mq_mnt;  in do_mq_open()
898 	struct dentry *root = mnt->mnt_root;  in do_mq_open()
915 	path.dentry = lookup_one_len(name->name, root, strlen(name->name));  in do_mq_open()
948 		return -EFAULT;  in SYSCALL_DEFINE4()
959 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;  in SYSCALL_DEFINE1()
960 	struct vfsmount *mnt = ipc_ns->mq_mnt;  in SYSCALL_DEFINE1()
966 	audit_inode_parent_hidden(name, mnt->mnt_root);  in SYSCALL_DEFINE1()
970 	inode_lock_nested(d_inode(mnt->mnt_root), I_MUTEX_PARENT);  in SYSCALL_DEFINE1()
971 	dentry = lookup_one_len(name->name, mnt->mnt_root,  in SYSCALL_DEFINE1()
972 				strlen(name->name));  in SYSCALL_DEFINE1()
980 		err = -ENOENT;  in SYSCALL_DEFINE1()
983 		err = vfs_unlink(&nop_mnt_idmap, d_inode(dentry->d_parent),  in SYSCALL_DEFINE1()
989 	inode_unlock(d_inode(mnt->mnt_root));  in SYSCALL_DEFINE1()
1005  * queue spinlock:
1007  * - Set pointer to message.
1008  * - Queue the receiver task for later wakeup (without the info->lock).
1009  * - Update its state to STATE_READY. Now the receiver can continue.
1010  * - Wake up the process after the lock is dropped. Should the process wake up
1023 	list_del(&this->list);  in __pipelined_op()
1024 	task = get_task_struct(this->task);  in __pipelined_op()
1027 	smp_store_release(&this->state, STATE_READY);  in __pipelined_op()
1031 /* pipelined_send() - send a message directly to the task waiting in
1032  * sys_mq_timedreceive() (without inserting message into a queue).
1039 	receiver->msg = message;  in pipelined_send()
1043 /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
1044  * gets its message and put to the queue (we have one free place for sure). */
1052 		wake_up_interruptible(&info->wait_q);  in pipelined_receive()
1055 	if (msg_insert(sender->msg, info))  in pipelined_receive()
1077 		return -EINVAL;  in do_mq_timedsend()
1088 		ret = -EBADF;  in do_mq_timedsend()
1093 	if (unlikely(f.file->f_op != &mqueue_file_operations)) {  in do_mq_timedsend()
1094 		ret = -EBADF;  in do_mq_timedsend()
1100 	if (unlikely(!(f.file->f_mode & FMODE_WRITE))) {  in do_mq_timedsend()
1101 		ret = -EBADF;  in do_mq_timedsend()
1105 	if (unlikely(msg_len > info->attr.mq_msgsize)) {  in do_mq_timedsend()
1106 		ret = -EMSGSIZE;  in do_mq_timedsend()
1117 	msg_ptr->m_ts = msg_len;  in do_mq_timedsend()
1118 	msg_ptr->m_type = msg_prio;  in do_mq_timedsend()
1125 	if (!info->node_cache)  in do_mq_timedsend()
1128 	spin_lock(&info->lock);  in do_mq_timedsend()
1130 	if (!info->node_cache && new_leaf) {  in do_mq_timedsend()
1132 		INIT_LIST_HEAD(&new_leaf->msg_list);  in do_mq_timedsend()
1133 		info->node_cache = new_leaf;  in do_mq_timedsend()
1139 	if (info->attr.mq_curmsgs == info->attr.mq_maxmsg) {  in do_mq_timedsend()
1140 		if (f.file->f_flags & O_NONBLOCK) {  in do_mq_timedsend()
1141 			ret = -EAGAIN;  in do_mq_timedsend()
1146 			/* memory barrier not required, we hold info->lock */  in do_mq_timedsend()
1150 			 * wq_sleep must be called with info->lock held, and  in do_mq_timedsend()
1160 			/* adds message to the queue */  in do_mq_timedsend()
1166 		inode->i_atime = inode->i_mtime = inode_set_ctime_current(inode);  in do_mq_timedsend()
1169 	spin_unlock(&info->lock);  in do_mq_timedsend()
1202 		ret = -EBADF;  in do_mq_timedreceive()
1207 	if (unlikely(f.file->f_op != &mqueue_file_operations)) {  in do_mq_timedreceive()
1208 		ret = -EBADF;  in do_mq_timedreceive()
1214 	if (unlikely(!(f.file->f_mode & FMODE_READ))) {  in do_mq_timedreceive()
1215 		ret = -EBADF;  in do_mq_timedreceive()
1220 	if (unlikely(msg_len < info->attr.mq_msgsize)) {  in do_mq_timedreceive()
1221 		ret = -EMSGSIZE;  in do_mq_timedreceive()
1230 	if (!info->node_cache)  in do_mq_timedreceive()
1233 	spin_lock(&info->lock);  in do_mq_timedreceive()
1235 	if (!info->node_cache && new_leaf) {  in do_mq_timedreceive()
1237 		INIT_LIST_HEAD(&new_leaf->msg_list);  in do_mq_timedreceive()
1238 		info->node_cache = new_leaf;  in do_mq_timedreceive()
1243 	if (info->attr.mq_curmsgs == 0) {  in do_mq_timedreceive()
1244 		if (f.file->f_flags & O_NONBLOCK) {  in do_mq_timedreceive()
1245 			spin_unlock(&info->lock);  in do_mq_timedreceive()
1246 			ret = -EAGAIN;  in do_mq_timedreceive()
1250 			/* memory barrier not required, we hold info->lock */  in do_mq_timedreceive()
1260 		inode->i_atime = inode->i_mtime = inode_set_ctime_current(inode);  in do_mq_timedreceive()
1262 		/* There is now free space in queue. */  in do_mq_timedreceive()
1264 		spin_unlock(&info->lock);  in do_mq_timedreceive()
1269 		ret = msg_ptr->m_ts;  in do_mq_timedreceive()
1271 		if ((u_msg_prio && put_user(msg_ptr->m_type, u_msg_prio)) ||  in do_mq_timedreceive()
1272 			store_msg(u_msg_ptr, msg_ptr, msg_ptr->m_ts)) {  in do_mq_timedreceive()
1273 			ret = -EFAULT;  in do_mq_timedreceive()
1330 		if (unlikely(notification->sigev_notify != SIGEV_NONE &&  in do_mq_notify()
1331 			     notification->sigev_notify != SIGEV_SIGNAL &&  in do_mq_notify()
1332 			     notification->sigev_notify != SIGEV_THREAD))  in do_mq_notify()
1333 			return -EINVAL;  in do_mq_notify()
1334 		if (notification->sigev_notify == SIGEV_SIGNAL &&  in do_mq_notify()
1335 			!valid_signal(notification->sigev_signo)) {  in do_mq_notify()
1336 			return -EINVAL;  in do_mq_notify()
1338 		if (notification->sigev_notify == SIGEV_THREAD) {  in do_mq_notify()
1344 				return -ENOMEM;  in do_mq_notify()
1346 			if (copy_from_user(nc->data,  in do_mq_notify()
1347 					notification->sigev_value.sival_ptr,  in do_mq_notify()
1349 				ret = -EFAULT;  in do_mq_notify()
1357 			f = fdget(notification->sigev_signo);  in do_mq_notify()
1359 				ret = -EBADF;  in do_mq_notify()
1382 		ret = -EBADF;  in do_mq_notify()
1387 	if (unlikely(f.file->f_op != &mqueue_file_operations)) {  in do_mq_notify()
1388 		ret = -EBADF;  in do_mq_notify()
1394 	spin_lock(&info->lock);  in do_mq_notify()
1396 		if (info->notify_owner == task_tgid(current)) {  in do_mq_notify()
1398 			inode->i_atime = inode_set_ctime_current(inode);  in do_mq_notify()
1400 	} else if (info->notify_owner != NULL) {  in do_mq_notify()
1401 		ret = -EBUSY;  in do_mq_notify()
1403 		switch (notification->sigev_notify) {  in do_mq_notify()
1405 			info->notify.sigev_notify = SIGEV_NONE;  in do_mq_notify()
1408 			info->notify_sock = sock;  in do_mq_notify()
1409 			info->notify_cookie = nc;  in do_mq_notify()
1412 			info->notify.sigev_notify = SIGEV_THREAD;  in do_mq_notify()
1415 			info->notify.sigev_signo = notification->sigev_signo;  in do_mq_notify()
1416 			info->notify.sigev_value = notification->sigev_value;  in do_mq_notify()
1417 			info->notify.sigev_notify = SIGEV_SIGNAL;  in do_mq_notify()
1418 			info->notify_self_exec_id = current->self_exec_id;  in do_mq_notify()
1422 		info->notify_owner = get_pid(task_tgid(current));  in do_mq_notify()
1423 		info->notify_user_ns = get_user_ns(current_user_ns());  in do_mq_notify()
1424 		inode->i_atime = inode_set_ctime_current(inode);  in do_mq_notify()
1426 	spin_unlock(&info->lock);  in do_mq_notify()
1445 			return -EFAULT;  in SYSCALL_DEFINE2()
1457 	if (new && (new->mq_flags & (~O_NONBLOCK)))  in do_mq_getsetattr()
1458 		return -EINVAL;  in do_mq_getsetattr()
1462 		return -EBADF;  in do_mq_getsetattr()
1464 	if (unlikely(f.file->f_op != &mqueue_file_operations)) {  in do_mq_getsetattr()
1466 		return -EBADF;  in do_mq_getsetattr()
1472 	spin_lock(&info->lock);  in do_mq_getsetattr()
1475 		*old = info->attr;  in do_mq_getsetattr()
1476 		old->mq_flags = f.file->f_flags & O_NONBLOCK;  in do_mq_getsetattr()
1480 		spin_lock(&f.file->f_lock);  in do_mq_getsetattr()
1481 		if (new->mq_flags & O_NONBLOCK)  in do_mq_getsetattr()
1482 			f.file->f_flags |= O_NONBLOCK;  in do_mq_getsetattr()
1484 			f.file->f_flags &= ~O_NONBLOCK;  in do_mq_getsetattr()
1485 		spin_unlock(&f.file->f_lock);  in do_mq_getsetattr()
1487 		inode->i_atime = inode_set_ctime_current(inode);  in do_mq_getsetattr()
1490 	spin_unlock(&info->lock);  in do_mq_getsetattr()
1506 			return -EFAULT;  in SYSCALL_DEFINE3()
1516 		return -EFAULT;  in SYSCALL_DEFINE3()
1523 	compat_long_t mq_flags;      /* message queue flags		     */
1536 		return -EFAULT;  in get_compat_mq_attr()
1539 	attr->mq_flags = v.mq_flags;  in get_compat_mq_attr()
1540 	attr->mq_maxmsg = v.mq_maxmsg;  in get_compat_mq_attr()
1541 	attr->mq_msgsize = v.mq_msgsize;  in get_compat_mq_attr()
1542 	attr->mq_curmsgs = v.mq_curmsgs;  in get_compat_mq_attr()
1552 	v.mq_flags = attr->mq_flags;  in put_compat_mq_attr()
1553 	v.mq_maxmsg = attr->mq_maxmsg;  in put_compat_mq_attr()
1554 	v.mq_msgsize = attr->mq_msgsize;  in put_compat_mq_attr()
1555 	v.mq_curmsgs = attr->mq_curmsgs;  in put_compat_mq_attr()
1557 		return -EFAULT;  in put_compat_mq_attr()
1569 			return -EFAULT;  in COMPAT_SYSCALL_DEFINE4()
1580 			return -EFAULT;  in COMPAT_SYSCALL_DEFINE2()
1599 			return -EFAULT;  in COMPAT_SYSCALL_DEFINE3()
1609 		return -EFAULT;  in COMPAT_SYSCALL_DEFINE3()
1619 		return -EFAULT;  in compat_prepare_timeout()
1621 		return -EINVAL;  in compat_prepare_timeout()
1692 	ns->mq_queues_count  = 0;  in mq_init_ns()
1693 	ns->mq_queues_max    = DFLT_QUEUESMAX;  in mq_init_ns()
1694 	ns->mq_msg_max       = DFLT_MSGMAX;  in mq_init_ns()
1695 	ns->mq_msgsize_max   = DFLT_MSGSIZEMAX;  in mq_init_ns()
1696 	ns->mq_msg_default   = DFLT_MSG;  in mq_init_ns()
1697 	ns->mq_msgsize_default  = DFLT_MSGSIZE;  in mq_init_ns()
1702 	ns->mq_mnt = m;  in mq_init_ns()
1708 	ns->mq_mnt->mnt_sb->s_fs_info = NULL;  in mq_clear_sbinfo()
1719 		return -ENOMEM;  in init_mqueue_fs()
1723 		error = -ENOMEM;  in init_mqueue_fs()