1 /* 2 * POSIX message queues filesystem for Linux. 3 * 4 * Copyright (C) 2003,2004 Krzysztof Benedyczak (golbi@mat.uni.torun.pl) 5 * Michal Wronski (michal.wronski@gmail.com) 6 * 7 * Spinlocks: Mohamed Abbas (abbas.mohamed@intel.com) 8 * Lockless receive & send, fd based notify: 9 * Manfred Spraul (manfred@colorfullife.com) 10 * 11 * Audit: George Wilson (ltcgcw@us.ibm.com) 12 * 13 * This file is released under the GPL. 14 */ 15 16 #include <linux/capability.h> 17 #include <linux/init.h> 18 #include <linux/pagemap.h> 19 #include <linux/file.h> 20 #include <linux/mount.h> 21 #include <linux/namei.h> 22 #include <linux/sysctl.h> 23 #include <linux/poll.h> 24 #include <linux/mqueue.h> 25 #include <linux/msg.h> 26 #include <linux/skbuff.h> 27 #include <linux/netlink.h> 28 #include <linux/syscalls.h> 29 #include <linux/audit.h> 30 #include <linux/signal.h> 31 #include <linux/mutex.h> 32 #include <linux/nsproxy.h> 33 #include <linux/pid.h> 34 #include <linux/ipc_namespace.h> 35 #include <linux/slab.h> 36 37 #include <net/sock.h> 38 #include "util.h" 39 40 #define MQUEUE_MAGIC 0x19800202 41 #define DIRENT_SIZE 20 42 #define FILENT_SIZE 80 43 44 #define SEND 0 45 #define RECV 1 46 47 #define STATE_NONE 0 48 #define STATE_PENDING 1 49 #define STATE_READY 2 50 51 struct ext_wait_queue { /* queue of sleeping tasks */ 52 struct task_struct *task; 53 struct list_head list; 54 struct msg_msg *msg; /* ptr of loaded message */ 55 int state; /* one of STATE_* values */ 56 }; 57 58 struct mqueue_inode_info { 59 spinlock_t lock; 60 struct inode vfs_inode; 61 wait_queue_head_t wait_q; 62 63 struct msg_msg **messages; 64 struct mq_attr attr; 65 66 struct sigevent notify; 67 struct pid* notify_owner; 68 struct user_struct *user; /* user who created, for accounting */ 69 struct sock *notify_sock; 70 struct sk_buff *notify_cookie; 71 72 /* for tasks waiting for free space and messages, respectively */ 73 struct ext_wait_queue e_wait_q[2]; 74 75 unsigned long qsize; /* size of queue in memory (sum of all msgs) */ 76 }; 77 78 static const struct inode_operations mqueue_dir_inode_operations; 79 static const struct file_operations mqueue_file_operations; 80 static const struct super_operations mqueue_super_ops; 81 static void remove_notification(struct mqueue_inode_info *info); 82 83 static struct kmem_cache *mqueue_inode_cachep; 84 85 static struct ctl_table_header * mq_sysctl_table; 86 87 static inline struct mqueue_inode_info *MQUEUE_I(struct inode *inode) 88 { 89 return container_of(inode, struct mqueue_inode_info, vfs_inode); 90 } 91 92 /* 93 * This routine should be called with the mq_lock held. 94 */ 95 static inline struct ipc_namespace *__get_ns_from_inode(struct inode *inode) 96 { 97 return get_ipc_ns(inode->i_sb->s_fs_info); 98 } 99 100 static struct ipc_namespace *get_ns_from_inode(struct inode *inode) 101 { 102 struct ipc_namespace *ns; 103 104 spin_lock(&mq_lock); 105 ns = __get_ns_from_inode(inode); 106 spin_unlock(&mq_lock); 107 return ns; 108 } 109 110 static struct inode *mqueue_get_inode(struct super_block *sb, 111 struct ipc_namespace *ipc_ns, int mode, 112 struct mq_attr *attr) 113 { 114 struct user_struct *u = current_user(); 115 struct inode *inode; 116 int ret = -ENOMEM; 117 118 inode = new_inode(sb); 119 if (!inode) 120 goto err; 121 122 inode->i_ino = get_next_ino(); 123 inode->i_mode = mode; 124 inode->i_uid = current_fsuid(); 125 inode->i_gid = current_fsgid(); 126 inode->i_mtime = inode->i_ctime = inode->i_atime = CURRENT_TIME; 127 128 if (S_ISREG(mode)) { 129 struct mqueue_inode_info *info; 130 struct task_struct *p = current; 131 unsigned long mq_bytes, mq_msg_tblsz; 132 133 inode->i_fop = &mqueue_file_operations; 134 inode->i_size = FILENT_SIZE; 135 /* mqueue specific info */ 136 info = MQUEUE_I(inode); 137 spin_lock_init(&info->lock); 138 init_waitqueue_head(&info->wait_q); 139 INIT_LIST_HEAD(&info->e_wait_q[0].list); 140 INIT_LIST_HEAD(&info->e_wait_q[1].list); 141 info->notify_owner = NULL; 142 info->qsize = 0; 143 info->user = NULL; /* set when all is ok */ 144 memset(&info->attr, 0, sizeof(info->attr)); 145 info->attr.mq_maxmsg = ipc_ns->mq_msg_max; 146 info->attr.mq_msgsize = ipc_ns->mq_msgsize_max; 147 if (attr) { 148 info->attr.mq_maxmsg = attr->mq_maxmsg; 149 info->attr.mq_msgsize = attr->mq_msgsize; 150 } 151 mq_msg_tblsz = info->attr.mq_maxmsg * sizeof(struct msg_msg *); 152 info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL); 153 if (!info->messages) 154 goto out_inode; 155 156 mq_bytes = (mq_msg_tblsz + 157 (info->attr.mq_maxmsg * info->attr.mq_msgsize)); 158 159 spin_lock(&mq_lock); 160 if (u->mq_bytes + mq_bytes < u->mq_bytes || 161 u->mq_bytes + mq_bytes > task_rlimit(p, RLIMIT_MSGQUEUE)) { 162 spin_unlock(&mq_lock); 163 /* mqueue_evict_inode() releases info->messages */ 164 ret = -EMFILE; 165 goto out_inode; 166 } 167 u->mq_bytes += mq_bytes; 168 spin_unlock(&mq_lock); 169 170 /* all is ok */ 171 info->user = get_uid(u); 172 } else if (S_ISDIR(mode)) { 173 inc_nlink(inode); 174 /* Some things misbehave if size == 0 on a directory */ 175 inode->i_size = 2 * DIRENT_SIZE; 176 inode->i_op = &mqueue_dir_inode_operations; 177 inode->i_fop = &simple_dir_operations; 178 } 179 180 return inode; 181 out_inode: 182 iput(inode); 183 err: 184 return ERR_PTR(ret); 185 } 186 187 static int mqueue_fill_super(struct super_block *sb, void *data, int silent) 188 { 189 struct inode *inode; 190 struct ipc_namespace *ns = data; 191 int error; 192 193 sb->s_blocksize = PAGE_CACHE_SIZE; 194 sb->s_blocksize_bits = PAGE_CACHE_SHIFT; 195 sb->s_magic = MQUEUE_MAGIC; 196 sb->s_op = &mqueue_super_ops; 197 198 inode = mqueue_get_inode(sb, ns, S_IFDIR | S_ISVTX | S_IRWXUGO, 199 NULL); 200 if (IS_ERR(inode)) { 201 error = PTR_ERR(inode); 202 goto out; 203 } 204 205 sb->s_root = d_alloc_root(inode); 206 if (!sb->s_root) { 207 iput(inode); 208 error = -ENOMEM; 209 goto out; 210 } 211 error = 0; 212 213 out: 214 return error; 215 } 216 217 static struct dentry *mqueue_mount(struct file_system_type *fs_type, 218 int flags, const char *dev_name, 219 void *data) 220 { 221 if (!(flags & MS_KERNMOUNT)) 222 data = current->nsproxy->ipc_ns; 223 return mount_ns(fs_type, flags, data, mqueue_fill_super); 224 } 225 226 static void init_once(void *foo) 227 { 228 struct mqueue_inode_info *p = (struct mqueue_inode_info *) foo; 229 230 inode_init_once(&p->vfs_inode); 231 } 232 233 static struct inode *mqueue_alloc_inode(struct super_block *sb) 234 { 235 struct mqueue_inode_info *ei; 236 237 ei = kmem_cache_alloc(mqueue_inode_cachep, GFP_KERNEL); 238 if (!ei) 239 return NULL; 240 return &ei->vfs_inode; 241 } 242 243 static void mqueue_i_callback(struct rcu_head *head) 244 { 245 struct inode *inode = container_of(head, struct inode, i_rcu); 246 INIT_LIST_HEAD(&inode->i_dentry); 247 kmem_cache_free(mqueue_inode_cachep, MQUEUE_I(inode)); 248 } 249 250 static void mqueue_destroy_inode(struct inode *inode) 251 { 252 call_rcu(&inode->i_rcu, mqueue_i_callback); 253 } 254 255 static void mqueue_evict_inode(struct inode *inode) 256 { 257 struct mqueue_inode_info *info; 258 struct user_struct *user; 259 unsigned long mq_bytes; 260 int i; 261 struct ipc_namespace *ipc_ns; 262 263 end_writeback(inode); 264 265 if (S_ISDIR(inode->i_mode)) 266 return; 267 268 ipc_ns = get_ns_from_inode(inode); 269 info = MQUEUE_I(inode); 270 spin_lock(&info->lock); 271 for (i = 0; i < info->attr.mq_curmsgs; i++) 272 free_msg(info->messages[i]); 273 kfree(info->messages); 274 spin_unlock(&info->lock); 275 276 /* Total amount of bytes accounted for the mqueue */ 277 mq_bytes = info->attr.mq_maxmsg * (sizeof(struct msg_msg *) 278 + info->attr.mq_msgsize); 279 user = info->user; 280 if (user) { 281 spin_lock(&mq_lock); 282 user->mq_bytes -= mq_bytes; 283 /* 284 * get_ns_from_inode() ensures that the 285 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns 286 * to which we now hold a reference, or it is NULL. 287 * We can't put it here under mq_lock, though. 288 */ 289 if (ipc_ns) 290 ipc_ns->mq_queues_count--; 291 spin_unlock(&mq_lock); 292 free_uid(user); 293 } 294 if (ipc_ns) 295 put_ipc_ns(ipc_ns); 296 } 297 298 static int mqueue_create(struct inode *dir, struct dentry *dentry, 299 int mode, struct nameidata *nd) 300 { 301 struct inode *inode; 302 struct mq_attr *attr = dentry->d_fsdata; 303 int error; 304 struct ipc_namespace *ipc_ns; 305 306 spin_lock(&mq_lock); 307 ipc_ns = __get_ns_from_inode(dir); 308 if (!ipc_ns) { 309 error = -EACCES; 310 goto out_unlock; 311 } 312 if (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max && 313 !capable(CAP_SYS_RESOURCE)) { 314 error = -ENOSPC; 315 goto out_unlock; 316 } 317 ipc_ns->mq_queues_count++; 318 spin_unlock(&mq_lock); 319 320 inode = mqueue_get_inode(dir->i_sb, ipc_ns, mode, attr); 321 if (IS_ERR(inode)) { 322 error = PTR_ERR(inode); 323 spin_lock(&mq_lock); 324 ipc_ns->mq_queues_count--; 325 goto out_unlock; 326 } 327 328 put_ipc_ns(ipc_ns); 329 dir->i_size += DIRENT_SIZE; 330 dir->i_ctime = dir->i_mtime = dir->i_atime = CURRENT_TIME; 331 332 d_instantiate(dentry, inode); 333 dget(dentry); 334 return 0; 335 out_unlock: 336 spin_unlock(&mq_lock); 337 if (ipc_ns) 338 put_ipc_ns(ipc_ns); 339 return error; 340 } 341 342 static int mqueue_unlink(struct inode *dir, struct dentry *dentry) 343 { 344 struct inode *inode = dentry->d_inode; 345 346 dir->i_ctime = dir->i_mtime = dir->i_atime = CURRENT_TIME; 347 dir->i_size -= DIRENT_SIZE; 348 drop_nlink(inode); 349 dput(dentry); 350 return 0; 351 } 352 353 /* 354 * This is routine for system read from queue file. 355 * To avoid mess with doing here some sort of mq_receive we allow 356 * to read only queue size & notification info (the only values 357 * that are interesting from user point of view and aren't accessible 358 * through std routines) 359 */ 360 static ssize_t mqueue_read_file(struct file *filp, char __user *u_data, 361 size_t count, loff_t *off) 362 { 363 struct mqueue_inode_info *info = MQUEUE_I(filp->f_path.dentry->d_inode); 364 char buffer[FILENT_SIZE]; 365 ssize_t ret; 366 367 spin_lock(&info->lock); 368 snprintf(buffer, sizeof(buffer), 369 "QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n", 370 info->qsize, 371 info->notify_owner ? info->notify.sigev_notify : 0, 372 (info->notify_owner && 373 info->notify.sigev_notify == SIGEV_SIGNAL) ? 374 info->notify.sigev_signo : 0, 375 pid_vnr(info->notify_owner)); 376 spin_unlock(&info->lock); 377 buffer[sizeof(buffer)-1] = '\0'; 378 379 ret = simple_read_from_buffer(u_data, count, off, buffer, 380 strlen(buffer)); 381 if (ret <= 0) 382 return ret; 383 384 filp->f_path.dentry->d_inode->i_atime = filp->f_path.dentry->d_inode->i_ctime = CURRENT_TIME; 385 return ret; 386 } 387 388 static int mqueue_flush_file(struct file *filp, fl_owner_t id) 389 { 390 struct mqueue_inode_info *info = MQUEUE_I(filp->f_path.dentry->d_inode); 391 392 spin_lock(&info->lock); 393 if (task_tgid(current) == info->notify_owner) 394 remove_notification(info); 395 396 spin_unlock(&info->lock); 397 return 0; 398 } 399 400 static unsigned int mqueue_poll_file(struct file *filp, struct poll_table_struct *poll_tab) 401 { 402 struct mqueue_inode_info *info = MQUEUE_I(filp->f_path.dentry->d_inode); 403 int retval = 0; 404 405 poll_wait(filp, &info->wait_q, poll_tab); 406 407 spin_lock(&info->lock); 408 if (info->attr.mq_curmsgs) 409 retval = POLLIN | POLLRDNORM; 410 411 if (info->attr.mq_curmsgs < info->attr.mq_maxmsg) 412 retval |= POLLOUT | POLLWRNORM; 413 spin_unlock(&info->lock); 414 415 return retval; 416 } 417 418 /* Adds current to info->e_wait_q[sr] before element with smaller prio */ 419 static void wq_add(struct mqueue_inode_info *info, int sr, 420 struct ext_wait_queue *ewp) 421 { 422 struct ext_wait_queue *walk; 423 424 ewp->task = current; 425 426 list_for_each_entry(walk, &info->e_wait_q[sr].list, list) { 427 if (walk->task->static_prio <= current->static_prio) { 428 list_add_tail(&ewp->list, &walk->list); 429 return; 430 } 431 } 432 list_add_tail(&ewp->list, &info->e_wait_q[sr].list); 433 } 434 435 /* 436 * Puts current task to sleep. Caller must hold queue lock. After return 437 * lock isn't held. 438 * sr: SEND or RECV 439 */ 440 static int wq_sleep(struct mqueue_inode_info *info, int sr, 441 ktime_t *timeout, struct ext_wait_queue *ewp) 442 { 443 int retval; 444 signed long time; 445 446 wq_add(info, sr, ewp); 447 448 for (;;) { 449 set_current_state(TASK_INTERRUPTIBLE); 450 451 spin_unlock(&info->lock); 452 time = schedule_hrtimeout_range_clock(timeout, 453 HRTIMER_MODE_ABS, 0, CLOCK_REALTIME); 454 455 while (ewp->state == STATE_PENDING) 456 cpu_relax(); 457 458 if (ewp->state == STATE_READY) { 459 retval = 0; 460 goto out; 461 } 462 spin_lock(&info->lock); 463 if (ewp->state == STATE_READY) { 464 retval = 0; 465 goto out_unlock; 466 } 467 if (signal_pending(current)) { 468 retval = -ERESTARTSYS; 469 break; 470 } 471 if (time == 0) { 472 retval = -ETIMEDOUT; 473 break; 474 } 475 } 476 list_del(&ewp->list); 477 out_unlock: 478 spin_unlock(&info->lock); 479 out: 480 return retval; 481 } 482 483 /* 484 * Returns waiting task that should be serviced first or NULL if none exists 485 */ 486 static struct ext_wait_queue *wq_get_first_waiter( 487 struct mqueue_inode_info *info, int sr) 488 { 489 struct list_head *ptr; 490 491 ptr = info->e_wait_q[sr].list.prev; 492 if (ptr == &info->e_wait_q[sr].list) 493 return NULL; 494 return list_entry(ptr, struct ext_wait_queue, list); 495 } 496 497 /* Auxiliary functions to manipulate messages' list */ 498 static void msg_insert(struct msg_msg *ptr, struct mqueue_inode_info *info) 499 { 500 int k; 501 502 k = info->attr.mq_curmsgs - 1; 503 while (k >= 0 && info->messages[k]->m_type >= ptr->m_type) { 504 info->messages[k + 1] = info->messages[k]; 505 k--; 506 } 507 info->attr.mq_curmsgs++; 508 info->qsize += ptr->m_ts; 509 info->messages[k + 1] = ptr; 510 } 511 512 static inline struct msg_msg *msg_get(struct mqueue_inode_info *info) 513 { 514 info->qsize -= info->messages[--info->attr.mq_curmsgs]->m_ts; 515 return info->messages[info->attr.mq_curmsgs]; 516 } 517 518 static inline void set_cookie(struct sk_buff *skb, char code) 519 { 520 ((char*)skb->data)[NOTIFY_COOKIE_LEN-1] = code; 521 } 522 523 /* 524 * The next function is only to split too long sys_mq_timedsend 525 */ 526 static void __do_notify(struct mqueue_inode_info *info) 527 { 528 /* notification 529 * invoked when there is registered process and there isn't process 530 * waiting synchronously for message AND state of queue changed from 531 * empty to not empty. Here we are sure that no one is waiting 532 * synchronously. */ 533 if (info->notify_owner && 534 info->attr.mq_curmsgs == 1) { 535 struct siginfo sig_i; 536 switch (info->notify.sigev_notify) { 537 case SIGEV_NONE: 538 break; 539 case SIGEV_SIGNAL: 540 /* sends signal */ 541 542 sig_i.si_signo = info->notify.sigev_signo; 543 sig_i.si_errno = 0; 544 sig_i.si_code = SI_MESGQ; 545 sig_i.si_value = info->notify.sigev_value; 546 sig_i.si_pid = task_tgid_nr_ns(current, 547 ns_of_pid(info->notify_owner)); 548 sig_i.si_uid = current_uid(); 549 550 kill_pid_info(info->notify.sigev_signo, 551 &sig_i, info->notify_owner); 552 break; 553 case SIGEV_THREAD: 554 set_cookie(info->notify_cookie, NOTIFY_WOKENUP); 555 netlink_sendskb(info->notify_sock, info->notify_cookie); 556 break; 557 } 558 /* after notification unregisters process */ 559 put_pid(info->notify_owner); 560 info->notify_owner = NULL; 561 } 562 wake_up(&info->wait_q); 563 } 564 565 static int prepare_timeout(const struct timespec __user *u_abs_timeout, 566 ktime_t *expires, struct timespec *ts) 567 { 568 if (copy_from_user(ts, u_abs_timeout, sizeof(struct timespec))) 569 return -EFAULT; 570 if (!timespec_valid(ts)) 571 return -EINVAL; 572 573 *expires = timespec_to_ktime(*ts); 574 return 0; 575 } 576 577 static void remove_notification(struct mqueue_inode_info *info) 578 { 579 if (info->notify_owner != NULL && 580 info->notify.sigev_notify == SIGEV_THREAD) { 581 set_cookie(info->notify_cookie, NOTIFY_REMOVED); 582 netlink_sendskb(info->notify_sock, info->notify_cookie); 583 } 584 put_pid(info->notify_owner); 585 info->notify_owner = NULL; 586 } 587 588 static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr) 589 { 590 if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0) 591 return 0; 592 if (capable(CAP_SYS_RESOURCE)) { 593 if (attr->mq_maxmsg > HARD_MSGMAX) 594 return 0; 595 } else { 596 if (attr->mq_maxmsg > ipc_ns->mq_msg_max || 597 attr->mq_msgsize > ipc_ns->mq_msgsize_max) 598 return 0; 599 } 600 /* check for overflow */ 601 if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg) 602 return 0; 603 if ((unsigned long)(attr->mq_maxmsg * (attr->mq_msgsize 604 + sizeof (struct msg_msg *))) < 605 (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize)) 606 return 0; 607 return 1; 608 } 609 610 /* 611 * Invoked when creating a new queue via sys_mq_open 612 */ 613 static struct file *do_create(struct ipc_namespace *ipc_ns, struct dentry *dir, 614 struct dentry *dentry, int oflag, mode_t mode, 615 struct mq_attr *attr) 616 { 617 const struct cred *cred = current_cred(); 618 struct file *result; 619 int ret; 620 621 if (attr) { 622 if (!mq_attr_ok(ipc_ns, attr)) { 623 ret = -EINVAL; 624 goto out; 625 } 626 /* store for use during create */ 627 dentry->d_fsdata = attr; 628 } 629 630 mode &= ~current_umask(); 631 ret = mnt_want_write(ipc_ns->mq_mnt); 632 if (ret) 633 goto out; 634 ret = vfs_create(dir->d_inode, dentry, mode, NULL); 635 dentry->d_fsdata = NULL; 636 if (ret) 637 goto out_drop_write; 638 639 result = dentry_open(dentry, ipc_ns->mq_mnt, oflag, cred); 640 /* 641 * dentry_open() took a persistent mnt_want_write(), 642 * so we can now drop this one. 643 */ 644 mnt_drop_write(ipc_ns->mq_mnt); 645 return result; 646 647 out_drop_write: 648 mnt_drop_write(ipc_ns->mq_mnt); 649 out: 650 dput(dentry); 651 mntput(ipc_ns->mq_mnt); 652 return ERR_PTR(ret); 653 } 654 655 /* Opens existing queue */ 656 static struct file *do_open(struct ipc_namespace *ipc_ns, 657 struct dentry *dentry, int oflag) 658 { 659 int ret; 660 const struct cred *cred = current_cred(); 661 662 static const int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE, 663 MAY_READ | MAY_WRITE }; 664 665 if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) { 666 ret = -EINVAL; 667 goto err; 668 } 669 670 if (inode_permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE])) { 671 ret = -EACCES; 672 goto err; 673 } 674 675 return dentry_open(dentry, ipc_ns->mq_mnt, oflag, cred); 676 677 err: 678 dput(dentry); 679 mntput(ipc_ns->mq_mnt); 680 return ERR_PTR(ret); 681 } 682 683 SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode, 684 struct mq_attr __user *, u_attr) 685 { 686 struct dentry *dentry; 687 struct file *filp; 688 char *name; 689 struct mq_attr attr; 690 int fd, error; 691 struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns; 692 693 if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr))) 694 return -EFAULT; 695 696 audit_mq_open(oflag, mode, u_attr ? &attr : NULL); 697 698 if (IS_ERR(name = getname(u_name))) 699 return PTR_ERR(name); 700 701 fd = get_unused_fd_flags(O_CLOEXEC); 702 if (fd < 0) 703 goto out_putname; 704 705 mutex_lock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex); 706 dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name)); 707 if (IS_ERR(dentry)) { 708 error = PTR_ERR(dentry); 709 goto out_putfd; 710 } 711 mntget(ipc_ns->mq_mnt); 712 713 if (oflag & O_CREAT) { 714 if (dentry->d_inode) { /* entry already exists */ 715 audit_inode(name, dentry); 716 if (oflag & O_EXCL) { 717 error = -EEXIST; 718 goto out; 719 } 720 filp = do_open(ipc_ns, dentry, oflag); 721 } else { 722 filp = do_create(ipc_ns, ipc_ns->mq_mnt->mnt_root, 723 dentry, oflag, mode, 724 u_attr ? &attr : NULL); 725 } 726 } else { 727 if (!dentry->d_inode) { 728 error = -ENOENT; 729 goto out; 730 } 731 audit_inode(name, dentry); 732 filp = do_open(ipc_ns, dentry, oflag); 733 } 734 735 if (IS_ERR(filp)) { 736 error = PTR_ERR(filp); 737 goto out_putfd; 738 } 739 740 fd_install(fd, filp); 741 goto out_upsem; 742 743 out: 744 dput(dentry); 745 mntput(ipc_ns->mq_mnt); 746 out_putfd: 747 put_unused_fd(fd); 748 fd = error; 749 out_upsem: 750 mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex); 751 out_putname: 752 putname(name); 753 return fd; 754 } 755 756 SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name) 757 { 758 int err; 759 char *name; 760 struct dentry *dentry; 761 struct inode *inode = NULL; 762 struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns; 763 764 name = getname(u_name); 765 if (IS_ERR(name)) 766 return PTR_ERR(name); 767 768 mutex_lock_nested(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex, 769 I_MUTEX_PARENT); 770 dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name)); 771 if (IS_ERR(dentry)) { 772 err = PTR_ERR(dentry); 773 goto out_unlock; 774 } 775 776 if (!dentry->d_inode) { 777 err = -ENOENT; 778 goto out_err; 779 } 780 781 inode = dentry->d_inode; 782 if (inode) 783 ihold(inode); 784 err = mnt_want_write(ipc_ns->mq_mnt); 785 if (err) 786 goto out_err; 787 err = vfs_unlink(dentry->d_parent->d_inode, dentry); 788 mnt_drop_write(ipc_ns->mq_mnt); 789 out_err: 790 dput(dentry); 791 792 out_unlock: 793 mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex); 794 putname(name); 795 if (inode) 796 iput(inode); 797 798 return err; 799 } 800 801 /* Pipelined send and receive functions. 802 * 803 * If a receiver finds no waiting message, then it registers itself in the 804 * list of waiting receivers. A sender checks that list before adding the new 805 * message into the message array. If there is a waiting receiver, then it 806 * bypasses the message array and directly hands the message over to the 807 * receiver. 808 * The receiver accepts the message and returns without grabbing the queue 809 * spinlock. Therefore an intermediate STATE_PENDING state and memory barriers 810 * are necessary. The same algorithm is used for sysv semaphores, see 811 * ipc/sem.c for more details. 812 * 813 * The same algorithm is used for senders. 814 */ 815 816 /* pipelined_send() - send a message directly to the task waiting in 817 * sys_mq_timedreceive() (without inserting message into a queue). 818 */ 819 static inline void pipelined_send(struct mqueue_inode_info *info, 820 struct msg_msg *message, 821 struct ext_wait_queue *receiver) 822 { 823 receiver->msg = message; 824 list_del(&receiver->list); 825 receiver->state = STATE_PENDING; 826 wake_up_process(receiver->task); 827 smp_wmb(); 828 receiver->state = STATE_READY; 829 } 830 831 /* pipelined_receive() - if there is task waiting in sys_mq_timedsend() 832 * gets its message and put to the queue (we have one free place for sure). */ 833 static inline void pipelined_receive(struct mqueue_inode_info *info) 834 { 835 struct ext_wait_queue *sender = wq_get_first_waiter(info, SEND); 836 837 if (!sender) { 838 /* for poll */ 839 wake_up_interruptible(&info->wait_q); 840 return; 841 } 842 msg_insert(sender->msg, info); 843 list_del(&sender->list); 844 sender->state = STATE_PENDING; 845 wake_up_process(sender->task); 846 smp_wmb(); 847 sender->state = STATE_READY; 848 } 849 850 SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr, 851 size_t, msg_len, unsigned int, msg_prio, 852 const struct timespec __user *, u_abs_timeout) 853 { 854 struct file *filp; 855 struct inode *inode; 856 struct ext_wait_queue wait; 857 struct ext_wait_queue *receiver; 858 struct msg_msg *msg_ptr; 859 struct mqueue_inode_info *info; 860 ktime_t expires, *timeout = NULL; 861 struct timespec ts; 862 int ret; 863 864 if (u_abs_timeout) { 865 int res = prepare_timeout(u_abs_timeout, &expires, &ts); 866 if (res) 867 return res; 868 timeout = &expires; 869 } 870 871 if (unlikely(msg_prio >= (unsigned long) MQ_PRIO_MAX)) 872 return -EINVAL; 873 874 audit_mq_sendrecv(mqdes, msg_len, msg_prio, timeout ? &ts : NULL); 875 876 filp = fget(mqdes); 877 if (unlikely(!filp)) { 878 ret = -EBADF; 879 goto out; 880 } 881 882 inode = filp->f_path.dentry->d_inode; 883 if (unlikely(filp->f_op != &mqueue_file_operations)) { 884 ret = -EBADF; 885 goto out_fput; 886 } 887 info = MQUEUE_I(inode); 888 audit_inode(NULL, filp->f_path.dentry); 889 890 if (unlikely(!(filp->f_mode & FMODE_WRITE))) { 891 ret = -EBADF; 892 goto out_fput; 893 } 894 895 if (unlikely(msg_len > info->attr.mq_msgsize)) { 896 ret = -EMSGSIZE; 897 goto out_fput; 898 } 899 900 /* First try to allocate memory, before doing anything with 901 * existing queues. */ 902 msg_ptr = load_msg(u_msg_ptr, msg_len); 903 if (IS_ERR(msg_ptr)) { 904 ret = PTR_ERR(msg_ptr); 905 goto out_fput; 906 } 907 msg_ptr->m_ts = msg_len; 908 msg_ptr->m_type = msg_prio; 909 910 spin_lock(&info->lock); 911 912 if (info->attr.mq_curmsgs == info->attr.mq_maxmsg) { 913 if (filp->f_flags & O_NONBLOCK) { 914 spin_unlock(&info->lock); 915 ret = -EAGAIN; 916 } else { 917 wait.task = current; 918 wait.msg = (void *) msg_ptr; 919 wait.state = STATE_NONE; 920 ret = wq_sleep(info, SEND, timeout, &wait); 921 } 922 if (ret < 0) 923 free_msg(msg_ptr); 924 } else { 925 receiver = wq_get_first_waiter(info, RECV); 926 if (receiver) { 927 pipelined_send(info, msg_ptr, receiver); 928 } else { 929 /* adds message to the queue */ 930 msg_insert(msg_ptr, info); 931 __do_notify(info); 932 } 933 inode->i_atime = inode->i_mtime = inode->i_ctime = 934 CURRENT_TIME; 935 spin_unlock(&info->lock); 936 ret = 0; 937 } 938 out_fput: 939 fput(filp); 940 out: 941 return ret; 942 } 943 944 SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr, 945 size_t, msg_len, unsigned int __user *, u_msg_prio, 946 const struct timespec __user *, u_abs_timeout) 947 { 948 ssize_t ret; 949 struct msg_msg *msg_ptr; 950 struct file *filp; 951 struct inode *inode; 952 struct mqueue_inode_info *info; 953 struct ext_wait_queue wait; 954 ktime_t expires, *timeout = NULL; 955 struct timespec ts; 956 957 if (u_abs_timeout) { 958 int res = prepare_timeout(u_abs_timeout, &expires, &ts); 959 if (res) 960 return res; 961 timeout = &expires; 962 } 963 964 audit_mq_sendrecv(mqdes, msg_len, 0, timeout ? &ts : NULL); 965 966 filp = fget(mqdes); 967 if (unlikely(!filp)) { 968 ret = -EBADF; 969 goto out; 970 } 971 972 inode = filp->f_path.dentry->d_inode; 973 if (unlikely(filp->f_op != &mqueue_file_operations)) { 974 ret = -EBADF; 975 goto out_fput; 976 } 977 info = MQUEUE_I(inode); 978 audit_inode(NULL, filp->f_path.dentry); 979 980 if (unlikely(!(filp->f_mode & FMODE_READ))) { 981 ret = -EBADF; 982 goto out_fput; 983 } 984 985 /* checks if buffer is big enough */ 986 if (unlikely(msg_len < info->attr.mq_msgsize)) { 987 ret = -EMSGSIZE; 988 goto out_fput; 989 } 990 991 spin_lock(&info->lock); 992 if (info->attr.mq_curmsgs == 0) { 993 if (filp->f_flags & O_NONBLOCK) { 994 spin_unlock(&info->lock); 995 ret = -EAGAIN; 996 } else { 997 wait.task = current; 998 wait.state = STATE_NONE; 999 ret = wq_sleep(info, RECV, timeout, &wait); 1000 msg_ptr = wait.msg; 1001 } 1002 } else { 1003 msg_ptr = msg_get(info); 1004 1005 inode->i_atime = inode->i_mtime = inode->i_ctime = 1006 CURRENT_TIME; 1007 1008 /* There is now free space in queue. */ 1009 pipelined_receive(info); 1010 spin_unlock(&info->lock); 1011 ret = 0; 1012 } 1013 if (ret == 0) { 1014 ret = msg_ptr->m_ts; 1015 1016 if ((u_msg_prio && put_user(msg_ptr->m_type, u_msg_prio)) || 1017 store_msg(u_msg_ptr, msg_ptr, msg_ptr->m_ts)) { 1018 ret = -EFAULT; 1019 } 1020 free_msg(msg_ptr); 1021 } 1022 out_fput: 1023 fput(filp); 1024 out: 1025 return ret; 1026 } 1027 1028 /* 1029 * Notes: the case when user wants us to deregister (with NULL as pointer) 1030 * and he isn't currently owner of notification, will be silently discarded. 1031 * It isn't explicitly defined in the POSIX. 1032 */ 1033 SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes, 1034 const struct sigevent __user *, u_notification) 1035 { 1036 int ret; 1037 struct file *filp; 1038 struct sock *sock; 1039 struct inode *inode; 1040 struct sigevent notification; 1041 struct mqueue_inode_info *info; 1042 struct sk_buff *nc; 1043 1044 if (u_notification) { 1045 if (copy_from_user(¬ification, u_notification, 1046 sizeof(struct sigevent))) 1047 return -EFAULT; 1048 } 1049 1050 audit_mq_notify(mqdes, u_notification ? ¬ification : NULL); 1051 1052 nc = NULL; 1053 sock = NULL; 1054 if (u_notification != NULL) { 1055 if (unlikely(notification.sigev_notify != SIGEV_NONE && 1056 notification.sigev_notify != SIGEV_SIGNAL && 1057 notification.sigev_notify != SIGEV_THREAD)) 1058 return -EINVAL; 1059 if (notification.sigev_notify == SIGEV_SIGNAL && 1060 !valid_signal(notification.sigev_signo)) { 1061 return -EINVAL; 1062 } 1063 if (notification.sigev_notify == SIGEV_THREAD) { 1064 long timeo; 1065 1066 /* create the notify skb */ 1067 nc = alloc_skb(NOTIFY_COOKIE_LEN, GFP_KERNEL); 1068 if (!nc) { 1069 ret = -ENOMEM; 1070 goto out; 1071 } 1072 if (copy_from_user(nc->data, 1073 notification.sigev_value.sival_ptr, 1074 NOTIFY_COOKIE_LEN)) { 1075 ret = -EFAULT; 1076 goto out; 1077 } 1078 1079 /* TODO: add a header? */ 1080 skb_put(nc, NOTIFY_COOKIE_LEN); 1081 /* and attach it to the socket */ 1082 retry: 1083 filp = fget(notification.sigev_signo); 1084 if (!filp) { 1085 ret = -EBADF; 1086 goto out; 1087 } 1088 sock = netlink_getsockbyfilp(filp); 1089 fput(filp); 1090 if (IS_ERR(sock)) { 1091 ret = PTR_ERR(sock); 1092 sock = NULL; 1093 goto out; 1094 } 1095 1096 timeo = MAX_SCHEDULE_TIMEOUT; 1097 ret = netlink_attachskb(sock, nc, &timeo, NULL); 1098 if (ret == 1) 1099 goto retry; 1100 if (ret) { 1101 sock = NULL; 1102 nc = NULL; 1103 goto out; 1104 } 1105 } 1106 } 1107 1108 filp = fget(mqdes); 1109 if (!filp) { 1110 ret = -EBADF; 1111 goto out; 1112 } 1113 1114 inode = filp->f_path.dentry->d_inode; 1115 if (unlikely(filp->f_op != &mqueue_file_operations)) { 1116 ret = -EBADF; 1117 goto out_fput; 1118 } 1119 info = MQUEUE_I(inode); 1120 1121 ret = 0; 1122 spin_lock(&info->lock); 1123 if (u_notification == NULL) { 1124 if (info->notify_owner == task_tgid(current)) { 1125 remove_notification(info); 1126 inode->i_atime = inode->i_ctime = CURRENT_TIME; 1127 } 1128 } else if (info->notify_owner != NULL) { 1129 ret = -EBUSY; 1130 } else { 1131 switch (notification.sigev_notify) { 1132 case SIGEV_NONE: 1133 info->notify.sigev_notify = SIGEV_NONE; 1134 break; 1135 case SIGEV_THREAD: 1136 info->notify_sock = sock; 1137 info->notify_cookie = nc; 1138 sock = NULL; 1139 nc = NULL; 1140 info->notify.sigev_notify = SIGEV_THREAD; 1141 break; 1142 case SIGEV_SIGNAL: 1143 info->notify.sigev_signo = notification.sigev_signo; 1144 info->notify.sigev_value = notification.sigev_value; 1145 info->notify.sigev_notify = SIGEV_SIGNAL; 1146 break; 1147 } 1148 1149 info->notify_owner = get_pid(task_tgid(current)); 1150 inode->i_atime = inode->i_ctime = CURRENT_TIME; 1151 } 1152 spin_unlock(&info->lock); 1153 out_fput: 1154 fput(filp); 1155 out: 1156 if (sock) { 1157 netlink_detachskb(sock, nc); 1158 } else if (nc) { 1159 dev_kfree_skb(nc); 1160 } 1161 return ret; 1162 } 1163 1164 SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mqdes, 1165 const struct mq_attr __user *, u_mqstat, 1166 struct mq_attr __user *, u_omqstat) 1167 { 1168 int ret; 1169 struct mq_attr mqstat, omqstat; 1170 struct file *filp; 1171 struct inode *inode; 1172 struct mqueue_inode_info *info; 1173 1174 if (u_mqstat != NULL) { 1175 if (copy_from_user(&mqstat, u_mqstat, sizeof(struct mq_attr))) 1176 return -EFAULT; 1177 if (mqstat.mq_flags & (~O_NONBLOCK)) 1178 return -EINVAL; 1179 } 1180 1181 filp = fget(mqdes); 1182 if (!filp) { 1183 ret = -EBADF; 1184 goto out; 1185 } 1186 1187 inode = filp->f_path.dentry->d_inode; 1188 if (unlikely(filp->f_op != &mqueue_file_operations)) { 1189 ret = -EBADF; 1190 goto out_fput; 1191 } 1192 info = MQUEUE_I(inode); 1193 1194 spin_lock(&info->lock); 1195 1196 omqstat = info->attr; 1197 omqstat.mq_flags = filp->f_flags & O_NONBLOCK; 1198 if (u_mqstat) { 1199 audit_mq_getsetattr(mqdes, &mqstat); 1200 spin_lock(&filp->f_lock); 1201 if (mqstat.mq_flags & O_NONBLOCK) 1202 filp->f_flags |= O_NONBLOCK; 1203 else 1204 filp->f_flags &= ~O_NONBLOCK; 1205 spin_unlock(&filp->f_lock); 1206 1207 inode->i_atime = inode->i_ctime = CURRENT_TIME; 1208 } 1209 1210 spin_unlock(&info->lock); 1211 1212 ret = 0; 1213 if (u_omqstat != NULL && copy_to_user(u_omqstat, &omqstat, 1214 sizeof(struct mq_attr))) 1215 ret = -EFAULT; 1216 1217 out_fput: 1218 fput(filp); 1219 out: 1220 return ret; 1221 } 1222 1223 static const struct inode_operations mqueue_dir_inode_operations = { 1224 .lookup = simple_lookup, 1225 .create = mqueue_create, 1226 .unlink = mqueue_unlink, 1227 }; 1228 1229 static const struct file_operations mqueue_file_operations = { 1230 .flush = mqueue_flush_file, 1231 .poll = mqueue_poll_file, 1232 .read = mqueue_read_file, 1233 .llseek = default_llseek, 1234 }; 1235 1236 static const struct super_operations mqueue_super_ops = { 1237 .alloc_inode = mqueue_alloc_inode, 1238 .destroy_inode = mqueue_destroy_inode, 1239 .evict_inode = mqueue_evict_inode, 1240 .statfs = simple_statfs, 1241 }; 1242 1243 static struct file_system_type mqueue_fs_type = { 1244 .name = "mqueue", 1245 .mount = mqueue_mount, 1246 .kill_sb = kill_litter_super, 1247 }; 1248 1249 int mq_init_ns(struct ipc_namespace *ns) 1250 { 1251 ns->mq_queues_count = 0; 1252 ns->mq_queues_max = DFLT_QUEUESMAX; 1253 ns->mq_msg_max = DFLT_MSGMAX; 1254 ns->mq_msgsize_max = DFLT_MSGSIZEMAX; 1255 1256 ns->mq_mnt = kern_mount_data(&mqueue_fs_type, ns); 1257 if (IS_ERR(ns->mq_mnt)) { 1258 int err = PTR_ERR(ns->mq_mnt); 1259 ns->mq_mnt = NULL; 1260 return err; 1261 } 1262 return 0; 1263 } 1264 1265 void mq_clear_sbinfo(struct ipc_namespace *ns) 1266 { 1267 ns->mq_mnt->mnt_sb->s_fs_info = NULL; 1268 } 1269 1270 void mq_put_mnt(struct ipc_namespace *ns) 1271 { 1272 mntput(ns->mq_mnt); 1273 } 1274 1275 static int __init init_mqueue_fs(void) 1276 { 1277 int error; 1278 1279 mqueue_inode_cachep = kmem_cache_create("mqueue_inode_cache", 1280 sizeof(struct mqueue_inode_info), 0, 1281 SLAB_HWCACHE_ALIGN, init_once); 1282 if (mqueue_inode_cachep == NULL) 1283 return -ENOMEM; 1284 1285 /* ignore failures - they are not fatal */ 1286 mq_sysctl_table = mq_register_sysctl_table(); 1287 1288 error = register_filesystem(&mqueue_fs_type); 1289 if (error) 1290 goto out_sysctl; 1291 1292 spin_lock_init(&mq_lock); 1293 1294 init_ipc_ns.mq_mnt = kern_mount_data(&mqueue_fs_type, &init_ipc_ns); 1295 if (IS_ERR(init_ipc_ns.mq_mnt)) { 1296 error = PTR_ERR(init_ipc_ns.mq_mnt); 1297 goto out_filesystem; 1298 } 1299 1300 return 0; 1301 1302 out_filesystem: 1303 unregister_filesystem(&mqueue_fs_type); 1304 out_sysctl: 1305 if (mq_sysctl_table) 1306 unregister_sysctl_table(mq_sysctl_table); 1307 kmem_cache_destroy(mqueue_inode_cachep); 1308 return error; 1309 } 1310 1311 __initcall(init_mqueue_fs); 1312