69  * Accesses to a message queue are synchronized by acquiring info->lock.
72  * - The actual wakeup of a sleeping task is performed using the wake_q
73  *   framework. info->lock is already released when wake_up_q is called.
74  * - The exit codepaths after sleeping check ext_wait_queue->state without
76  *   acquiring info->lock.
93  *				   ->state = STATE_READY (reordered)
101  * the smp_store_release() that does ->state = STATE_READY.
115  *				receiver->msg = message; (reordered)
119  * 3) There is intentionally no barrier when setting current->state
120  *    to TASK_INTERRUPTIBLE: spin_unlock(&info->lock) provides the
122  *    info->lock, i.e. spin_lock(&info->lock) provided a pairing
126 struct ext_wait_queue {		/* queue of sleeping tasks */
154 	unsigned long qsize; /* size of queue in memory (sum of all msgs) */
178 	return get_ipc_ns(inode->i_sb->s_fs_info);  in __get_ns_from_inode()
198 	p = &info->msg_tree.rb_node;  in msg_insert()
203 		if (likely(leaf->priority == msg->m_type))  in msg_insert()
205 		else if (msg->m_type < leaf->priority) {  in msg_insert()
206 			p = &(*p)->rb_left;  in msg_insert()
209 			p = &(*p)->rb_right;  in msg_insert()
211 	if (info->node_cache) {  in msg_insert()
212 		leaf = info->node_cache;  in msg_insert()
213 		info->node_cache = NULL;  in msg_insert()
217 			return -ENOMEM;  in msg_insert()
218 		INIT_LIST_HEAD(&leaf->msg_list);  in msg_insert()
220 	leaf->priority = msg->m_type;  in msg_insert()
223 		info->msg_tree_rightmost = &leaf->rb_node;  in msg_insert()
225 	rb_link_node(&leaf->rb_node, parent, p);  in msg_insert()
226 	rb_insert_color(&leaf->rb_node, &info->msg_tree);  in msg_insert()
228 	info->attr.mq_curmsgs++;  in msg_insert()
229 	info->qsize += msg->m_ts;  in msg_insert()
230 	list_add_tail(&msg->m_list, &leaf->msg_list);  in msg_insert()
237 	struct rb_node *node = &leaf->rb_node;  in msg_tree_erase()
239 	if (info->msg_tree_rightmost == node)  in msg_tree_erase()
240 		info->msg_tree_rightmost = rb_prev(node);  in msg_tree_erase()
242 	rb_erase(node, &info->msg_tree);  in msg_tree_erase()
243 	if (info->node_cache)  in msg_tree_erase()
246 		info->node_cache = leaf;  in msg_tree_erase()
261 	parent = info->msg_tree_rightmost;  in msg_get()
263 		if (info->attr.mq_curmsgs) {  in msg_get()
264 			pr_warn_once("Inconsistency in POSIX message queue, "  in msg_get()
267 			info->attr.mq_curmsgs = 0;  in msg_get()
272 	if (unlikely(list_empty(&leaf->msg_list))) {  in msg_get()
273 		pr_warn_once("Inconsistency in POSIX message queue, "  in msg_get()
279 		msg = list_first_entry(&leaf->msg_list,  in msg_get()
281 		list_del(&msg->m_list);  in msg_get()
282 		if (list_empty(&leaf->msg_list)) {  in msg_get()
286 	info->attr.mq_curmsgs--;  in msg_get()
287 	info->qsize -= msg->m_ts;  in msg_get()
296 	int ret = -ENOMEM;  in mqueue_get_inode()
302 	inode->i_ino = get_next_ino();  in mqueue_get_inode()
303 	inode->i_mode = mode;  in mqueue_get_inode()
304 	inode->i_uid = current_fsuid();  in mqueue_get_inode()
305 	inode->i_gid = current_fsgid();  in mqueue_get_inode()
306 	inode->i_mtime = inode->i_ctime = inode->i_atime = current_time(inode);  in mqueue_get_inode()
312 		inode->i_fop = &mqueue_file_operations;  in mqueue_get_inode()
313 		inode->i_size = FILENT_SIZE;  in mqueue_get_inode()
316 		spin_lock_init(&info->lock);  in mqueue_get_inode()
317 		init_waitqueue_head(&info->wait_q);  in mqueue_get_inode()
318 		INIT_LIST_HEAD(&info->e_wait_q[0].list);  in mqueue_get_inode()
319 		INIT_LIST_HEAD(&info->e_wait_q[1].list);  in mqueue_get_inode()
320 		info->notify_owner = NULL;  in mqueue_get_inode()
321 		info->notify_user_ns = NULL;  in mqueue_get_inode()
322 		info->qsize = 0;  in mqueue_get_inode()
323 		info->ucounts = NULL;	/* set when all is ok */  in mqueue_get_inode()
324 		info->msg_tree = RB_ROOT;  in mqueue_get_inode()
325 		info->msg_tree_rightmost = NULL;  in mqueue_get_inode()
326 		info->node_cache = NULL;  in mqueue_get_inode()
327 		memset(&info->attr, 0, sizeof(info->attr));  in mqueue_get_inode()
328 		info->attr.mq_maxmsg = min(ipc_ns->mq_msg_max,  in mqueue_get_inode()
329 					   ipc_ns->mq_msg_default);  in mqueue_get_inode()
330 		info->attr.mq_msgsize = min(ipc_ns->mq_msgsize_max,  in mqueue_get_inode()
331 					    ipc_ns->mq_msgsize_default);  in mqueue_get_inode()
333 			info->attr.mq_maxmsg = attr->mq_maxmsg;  in mqueue_get_inode()
334 			info->attr.mq_msgsize = attr->mq_msgsize;  in mqueue_get_inode()
339 		 * possible message into the queue size. That's no longer  in mqueue_get_inode()
340 		 * accurate as the queue is now an rbtree and will grow and  in mqueue_get_inode()
350 		ret = -EINVAL;  in mqueue_get_inode()
351 		if (info->attr.mq_maxmsg <= 0 || info->attr.mq_msgsize <= 0)  in mqueue_get_inode()
354 			if (info->attr.mq_maxmsg > HARD_MSGMAX ||  in mqueue_get_inode()
355 			    info->attr.mq_msgsize > HARD_MSGSIZEMAX)  in mqueue_get_inode()
358 			if (info->attr.mq_maxmsg > ipc_ns->mq_msg_max ||  in mqueue_get_inode()
359 					info->attr.mq_msgsize > ipc_ns->mq_msgsize_max)  in mqueue_get_inode()
362 		ret = -EOVERFLOW;  in mqueue_get_inode()
364 		if (info->attr.mq_msgsize > ULONG_MAX/info->attr.mq_maxmsg)  in mqueue_get_inode()
366 		mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +  in mqueue_get_inode()
367 			min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *  in mqueue_get_inode()
369 		mq_bytes = info->attr.mq_maxmsg * info->attr.mq_msgsize;  in mqueue_get_inode()
373 		info->ucounts = get_ucounts(current_ucounts());  in mqueue_get_inode()
374 		if (info->ucounts) {  in mqueue_get_inode()
378 			msgqueue = inc_rlimit_ucounts(info->ucounts, UCOUNT_RLIMIT_MSGQUEUE, mq_bytes);  in mqueue_get_inode()
380 				dec_rlimit_ucounts(info->ucounts, UCOUNT_RLIMIT_MSGQUEUE, mq_bytes);  in mqueue_get_inode()
382 				put_ucounts(info->ucounts);  in mqueue_get_inode()
383 				info->ucounts = NULL;  in mqueue_get_inode()
384 				/* mqueue_evict_inode() releases info->messages */  in mqueue_get_inode()
385 				ret = -EMFILE;  in mqueue_get_inode()
393 		inode->i_size = 2 * DIRENT_SIZE;  in mqueue_get_inode()
394 		inode->i_op = &mqueue_dir_inode_operations;  in mqueue_get_inode()
395 		inode->i_fop = &simple_dir_operations;  in mqueue_get_inode()
408 	struct ipc_namespace *ns = sb->s_fs_info;  in mqueue_fill_super()
410 	sb->s_iflags |= SB_I_NOEXEC | SB_I_NODEV;  in mqueue_fill_super()
411 	sb->s_blocksize = PAGE_SIZE;  in mqueue_fill_super()
412 	sb->s_blocksize_bits = PAGE_SHIFT;  in mqueue_fill_super()
413 	sb->s_magic = MQUEUE_MAGIC;  in mqueue_fill_super()
414 	sb->s_op = &mqueue_super_ops;  in mqueue_fill_super()
420 	sb->s_root = d_make_root(inode);  in mqueue_fill_super()
421 	if (!sb->s_root)  in mqueue_fill_super()
422 		return -ENOMEM;  in mqueue_fill_super()
428 	struct mqueue_fs_context *ctx = fc->fs_private;  in mqueue_get_tree()
430 	return get_tree_keyed(fc, mqueue_fill_super, ctx->ipc_ns);  in mqueue_get_tree()
435 	struct mqueue_fs_context *ctx = fc->fs_private;  in mqueue_fs_context_free()
437 	put_ipc_ns(ctx->ipc_ns);  in mqueue_fs_context_free()
447 		return -ENOMEM;  in mqueue_init_fs_context()
449 	ctx->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);  in mqueue_init_fs_context()
450 	put_user_ns(fc->user_ns);  in mqueue_init_fs_context()
451 	fc->user_ns = get_user_ns(ctx->ipc_ns->user_ns);  in mqueue_init_fs_context()
452 	fc->fs_private = ctx;  in mqueue_init_fs_context()
453 	fc->ops = &mqueue_fs_context_ops;  in mqueue_init_fs_context()
467 	ctx = fc->fs_private;  in mq_create_mount()
468 	put_ipc_ns(ctx->ipc_ns);  in mq_create_mount()
469 	ctx->ipc_ns = get_ipc_ns(ns);  in mq_create_mount()
470 	put_user_ns(fc->user_ns);  in mq_create_mount()
471 	fc->user_ns = get_user_ns(ctx->ipc_ns->user_ns);  in mq_create_mount()
478 static void init_once(void *foo)  in init_once()  argument
480 	struct mqueue_inode_info *p = (struct mqueue_inode_info *) foo;  in init_once()
482 	inode_init_once(&p->vfs_inode);  in init_once()
492 	return &ei->vfs_inode;  in mqueue_alloc_inode()
509 	if (S_ISDIR(inode->i_mode))  in mqueue_evict_inode()
514 	spin_lock(&info->lock);  in mqueue_evict_inode()
516 		list_add_tail(&msg->m_list, &tmp_msg);  in mqueue_evict_inode()
517 	kfree(info->node_cache);  in mqueue_evict_inode()
518 	spin_unlock(&info->lock);  in mqueue_evict_inode()
521 		list_del(&msg->m_list);  in mqueue_evict_inode()
525 	if (info->ucounts) {  in mqueue_evict_inode()
529 		mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +  in mqueue_evict_inode()
530 			min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *  in mqueue_evict_inode()
533 		mq_bytes = mq_treesize + (info->attr.mq_maxmsg *  in mqueue_evict_inode()
534 					  info->attr.mq_msgsize);  in mqueue_evict_inode()
537 		dec_rlimit_ucounts(info->ucounts, UCOUNT_RLIMIT_MSGQUEUE, mq_bytes);  in mqueue_evict_inode()
540 		 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns  in mqueue_evict_inode()
545 			ipc_ns->mq_queues_count--;  in mqueue_evict_inode()
547 		put_ucounts(info->ucounts);  in mqueue_evict_inode()
548 		info->ucounts = NULL;  in mqueue_evict_inode()
556 	struct inode *dir = dentry->d_parent->d_inode;  in mqueue_create_attr()
565 		error = -EACCES;  in mqueue_create_attr()
569 	if (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&  in mqueue_create_attr()
571 		error = -ENOSPC;  in mqueue_create_attr()
574 	ipc_ns->mq_queues_count++;  in mqueue_create_attr()
577 	inode = mqueue_get_inode(dir->i_sb, ipc_ns, mode, attr);  in mqueue_create_attr()
581 		ipc_ns->mq_queues_count--;  in mqueue_create_attr()
586 	dir->i_size += DIRENT_SIZE;  in mqueue_create_attr()
587 	dir->i_ctime = dir->i_mtime = dir->i_atime = current_time(dir);  in mqueue_create_attr()
609 	dir->i_ctime = dir->i_mtime = dir->i_atime = current_time(dir);  in mqueue_unlink()
610 	dir->i_size -= DIRENT_SIZE;  in mqueue_unlink()
617 *	This is routine for system read from queue file.
619 *	to read only queue size & notification info (the only values
630 	spin_lock(&info->lock);  in mqueue_read_file()
632 			"QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",  in mqueue_read_file()
633 			info->qsize,  in mqueue_read_file()
634 			info->notify_owner ? info->notify.sigev_notify : 0,  in mqueue_read_file()
635 			(info->notify_owner &&  in mqueue_read_file()
636 			 info->notify.sigev_notify == SIGEV_SIGNAL) ?  in mqueue_read_file()
637 				info->notify.sigev_signo : 0,  in mqueue_read_file()
638 			pid_vnr(info->notify_owner));  in mqueue_read_file()
639 	spin_unlock(&info->lock);  in mqueue_read_file()
640 	buffer[sizeof(buffer)-1] = '\0';  in mqueue_read_file()
647 	file_inode(filp)->i_atime = file_inode(filp)->i_ctime = current_time(file_inode(filp));  in mqueue_read_file()
655 	spin_lock(&info->lock);  in mqueue_flush_file()
656 	if (task_tgid(current) == info->notify_owner)  in mqueue_flush_file()
659 	spin_unlock(&info->lock);  in mqueue_flush_file()
668 	poll_wait(filp, &info->wait_q, poll_tab);  in mqueue_poll_file()
670 	spin_lock(&info->lock);  in mqueue_poll_file()
671 	if (info->attr.mq_curmsgs)  in mqueue_poll_file()
674 	if (info->attr.mq_curmsgs < info->attr.mq_maxmsg)  in mqueue_poll_file()
676 	spin_unlock(&info->lock);  in mqueue_poll_file()
681 /* Adds current to info->e_wait_q[sr] before element with smaller prio */
687 	list_for_each_entry(walk, &info->e_wait_q[sr].list, list) {  in wq_add()
688 		if (walk->task->prio <= current->prio) {  in wq_add()
689 			list_add_tail(&ewp->list, &walk->list);  in wq_add()
693 	list_add_tail(&ewp->list, &info->e_wait_q[sr].list);  in wq_add()
697  * Puts current task to sleep. Caller must hold queue lock. After return
703 	__releases(&info->lock)  in wq_sleep()
711 		/* memory barrier not required, we hold info->lock */  in wq_sleep()
714 		spin_unlock(&info->lock);  in wq_sleep()
718 		if (READ_ONCE(ewp->state) == STATE_READY) {  in wq_sleep()
724 		spin_lock(&info->lock);  in wq_sleep()
726 		/* we hold info->lock, so no memory barrier required */  in wq_sleep()
727 		if (READ_ONCE(ewp->state) == STATE_READY) {  in wq_sleep()
732 			retval = -ERESTARTSYS;  in wq_sleep()
736 			retval = -ETIMEDOUT;  in wq_sleep()
740 	list_del(&ewp->list);  in wq_sleep()
742 	spin_unlock(&info->lock);  in wq_sleep()
755 	ptr = info->e_wait_q[sr].list.prev;  in wq_get_first_waiter()
756 	if (ptr == &info->e_wait_q[sr].list)  in wq_get_first_waiter()
764 	((char *)skb->data)[NOTIFY_COOKIE_LEN-1] = code;  in set_cookie()
774 	 * waiting synchronously for message AND state of queue changed from  in __do_notify()
777 	if (info->notify_owner &&  in __do_notify()
778 	    info->attr.mq_curmsgs == 1) {  in __do_notify()
779 		switch (info->notify.sigev_notify) {  in __do_notify()
787 			if (!info->notify.sigev_signo)  in __do_notify()
791 			sig_i.si_signo = info->notify.sigev_signo;  in __do_notify()
794 			sig_i.si_value = info->notify.sigev_value;  in __do_notify()
796 			/* map current pid/uid into info->owner's namespaces */  in __do_notify()
798 						ns_of_pid(info->notify_owner));  in __do_notify()
799 			sig_i.si_uid = from_kuid_munged(info->notify_user_ns,  in __do_notify()
808 			task = pid_task(info->notify_owner, PIDTYPE_TGID);  in __do_notify()
809 			if (task && task->self_exec_id ==  in __do_notify()
810 						info->notify_self_exec_id) {  in __do_notify()
811 				do_send_sig_info(info->notify.sigev_signo,  in __do_notify()
818 			set_cookie(info->notify_cookie, NOTIFY_WOKENUP);  in __do_notify()
819 			netlink_sendskb(info->notify_sock, info->notify_cookie);  in __do_notify()
823 		put_pid(info->notify_owner);  in __do_notify()
824 		put_user_ns(info->notify_user_ns);  in __do_notify()
825 		info->notify_owner = NULL;  in __do_notify()
826 		info->notify_user_ns = NULL;  in __do_notify()
828 	wake_up(&info->wait_q);  in __do_notify()
835 		return -EFAULT;  in prepare_timeout()
837 		return -EINVAL;  in prepare_timeout()
843 	if (info->notify_owner != NULL &&  in remove_notification()
844 	    info->notify.sigev_notify == SIGEV_THREAD) {  in remove_notification()
845 		set_cookie(info->notify_cookie, NOTIFY_REMOVED);  in remove_notification()
846 		netlink_sendskb(info->notify_sock, info->notify_cookie);  in remove_notification()
848 	put_pid(info->notify_owner);  in remove_notification()
849 	put_user_ns(info->notify_user_ns);  in remove_notification()
850 	info->notify_owner = NULL;  in remove_notification()
851 	info->notify_user_ns = NULL;  in remove_notification()
864 			return -ENOENT;  in prepare_open()
867 		audit_inode_parent_hidden(name, dentry->d_parent);  in prepare_open()
874 		return -EEXIST;  in prepare_open()
876 		return -EINVAL;  in prepare_open()
884 	struct vfsmount *mnt = current->nsproxy->ipc_ns->mq_mnt;  in do_mq_open()
885 	struct dentry *root = mnt->mnt_root;  in do_mq_open()
902 	path.dentry = lookup_one_len(name->name, root, strlen(name->name));  in do_mq_open()
935 		return -EFAULT;  in SYSCALL_DEFINE4()
946 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;  in SYSCALL_DEFINE1()
947 	struct vfsmount *mnt = ipc_ns->mq_mnt;  in SYSCALL_DEFINE1()
953 	audit_inode_parent_hidden(name, mnt->mnt_root);  in SYSCALL_DEFINE1()
957 	inode_lock_nested(d_inode(mnt->mnt_root), I_MUTEX_PARENT);  in SYSCALL_DEFINE1()
958 	dentry = lookup_one_len(name->name, mnt->mnt_root,  in SYSCALL_DEFINE1()
959 				strlen(name->name));  in SYSCALL_DEFINE1()
967 		err = -ENOENT;  in SYSCALL_DEFINE1()
970 		err = vfs_unlink(&init_user_ns, d_inode(dentry->d_parent),  in SYSCALL_DEFINE1()
976 	inode_unlock(d_inode(mnt->mnt_root));  in SYSCALL_DEFINE1()
993  * queue spinlock:
995  * - Set pointer to message.
996  * - Queue the receiver task for later wakeup (without the info->lock).
997  * - Update its state to STATE_READY. Now the receiver can continue.
998  * - Wake up the process after the lock is dropped. Should the process wake up
1011 	list_del(&this->list);  in __pipelined_op()
1012 	task = get_task_struct(this->task);  in __pipelined_op()
1015 	smp_store_release(&this->state, STATE_READY);  in __pipelined_op()
1019 /* pipelined_send() - send a message directly to the task waiting in
1020  * sys_mq_timedreceive() (without inserting message into a queue).
1027 	receiver->msg = message;  in pipelined_send()
1031 /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
1032  * gets its message and put to the queue (we have one free place for sure). */
1040 		wake_up_interruptible(&info->wait_q);  in pipelined_receive()
1043 	if (msg_insert(sender->msg, info))  in pipelined_receive()
1065 		return -EINVAL;  in do_mq_timedsend()
1076 		ret = -EBADF;  in do_mq_timedsend()
1081 	if (unlikely(f.file->f_op != &mqueue_file_operations)) {  in do_mq_timedsend()
1082 		ret = -EBADF;  in do_mq_timedsend()
1088 	if (unlikely(!(f.file->f_mode & FMODE_WRITE))) {  in do_mq_timedsend()
1089 		ret = -EBADF;  in do_mq_timedsend()
1093 	if (unlikely(msg_len > info->attr.mq_msgsize)) {  in do_mq_timedsend()
1094 		ret = -EMSGSIZE;  in do_mq_timedsend()
1105 	msg_ptr->m_ts = msg_len;  in do_mq_timedsend()
1106 	msg_ptr->m_type = msg_prio;  in do_mq_timedsend()
1113 	if (!info->node_cache)  in do_mq_timedsend()
1116 	spin_lock(&info->lock);  in do_mq_timedsend()
1118 	if (!info->node_cache && new_leaf) {  in do_mq_timedsend()
1120 		INIT_LIST_HEAD(&new_leaf->msg_list);  in do_mq_timedsend()
1121 		info->node_cache = new_leaf;  in do_mq_timedsend()
1127 	if (info->attr.mq_curmsgs == info->attr.mq_maxmsg) {  in do_mq_timedsend()
1128 		if (f.file->f_flags & O_NONBLOCK) {  in do_mq_timedsend()
1129 			ret = -EAGAIN;  in do_mq_timedsend()
1134 			/* memory barrier not required, we hold info->lock */  in do_mq_timedsend()
1138 			 * wq_sleep must be called with info->lock held, and  in do_mq_timedsend()
1148 			/* adds message to the queue */  in do_mq_timedsend()
1154 		inode->i_atime = inode->i_mtime = inode->i_ctime =  in do_mq_timedsend()
1158 	spin_unlock(&info->lock);  in do_mq_timedsend()
1191 		ret = -EBADF;  in do_mq_timedreceive()
1196 	if (unlikely(f.file->f_op != &mqueue_file_operations)) {  in do_mq_timedreceive()
1197 		ret = -EBADF;  in do_mq_timedreceive()
1203 	if (unlikely(!(f.file->f_mode & FMODE_READ))) {  in do_mq_timedreceive()
1204 		ret = -EBADF;  in do_mq_timedreceive()
1209 	if (unlikely(msg_len < info->attr.mq_msgsize)) {  in do_mq_timedreceive()
1210 		ret = -EMSGSIZE;  in do_mq_timedreceive()
1219 	if (!info->node_cache)  in do_mq_timedreceive()
1222 	spin_lock(&info->lock);  in do_mq_timedreceive()
1224 	if (!info->node_cache && new_leaf) {  in do_mq_timedreceive()
1226 		INIT_LIST_HEAD(&new_leaf->msg_list);  in do_mq_timedreceive()
1227 		info->node_cache = new_leaf;  in do_mq_timedreceive()
1232 	if (info->attr.mq_curmsgs == 0) {  in do_mq_timedreceive()
1233 		if (f.file->f_flags & O_NONBLOCK) {  in do_mq_timedreceive()
1234 			spin_unlock(&info->lock);  in do_mq_timedreceive()
1235 			ret = -EAGAIN;  in do_mq_timedreceive()
1239 			/* memory barrier not required, we hold info->lock */  in do_mq_timedreceive()
1249 		inode->i_atime = inode->i_mtime = inode->i_ctime =  in do_mq_timedreceive()
1252 		/* There is now free space in queue. */  in do_mq_timedreceive()
1254 		spin_unlock(&info->lock);  in do_mq_timedreceive()
1259 		ret = msg_ptr->m_ts;  in do_mq_timedreceive()
1261 		if ((u_msg_prio && put_user(msg_ptr->m_type, u_msg_prio)) ||  in do_mq_timedreceive()
1262 			store_msg(u_msg_ptr, msg_ptr, msg_ptr->m_ts)) {  in do_mq_timedreceive()
1263 			ret = -EFAULT;  in do_mq_timedreceive()
1320 		if (unlikely(notification->sigev_notify != SIGEV_NONE &&  in do_mq_notify()
1321 			     notification->sigev_notify != SIGEV_SIGNAL &&  in do_mq_notify()
1322 			     notification->sigev_notify != SIGEV_THREAD))  in do_mq_notify()
1323 			return -EINVAL;  in do_mq_notify()
1324 		if (notification->sigev_notify == SIGEV_SIGNAL &&  in do_mq_notify()
1325 			!valid_signal(notification->sigev_signo)) {  in do_mq_notify()
1326 			return -EINVAL;  in do_mq_notify()
1328 		if (notification->sigev_notify == SIGEV_THREAD) {  in do_mq_notify()
1334 				return -ENOMEM;  in do_mq_notify()
1336 			if (copy_from_user(nc->data,  in do_mq_notify()
1337 					notification->sigev_value.sival_ptr,  in do_mq_notify()
1339 				ret = -EFAULT;  in do_mq_notify()
1347 			f = fdget(notification->sigev_signo);  in do_mq_notify()
1349 				ret = -EBADF;  in do_mq_notify()
1372 		ret = -EBADF;  in do_mq_notify()
1377 	if (unlikely(f.file->f_op != &mqueue_file_operations)) {  in do_mq_notify()
1378 		ret = -EBADF;  in do_mq_notify()
1384 	spin_lock(&info->lock);  in do_mq_notify()
1386 		if (info->notify_owner == task_tgid(current)) {  in do_mq_notify()
1388 			inode->i_atime = inode->i_ctime = current_time(inode);  in do_mq_notify()
1390 	} else if (info->notify_owner != NULL) {  in do_mq_notify()
1391 		ret = -EBUSY;  in do_mq_notify()
1393 		switch (notification->sigev_notify) {  in do_mq_notify()
1395 			info->notify.sigev_notify = SIGEV_NONE;  in do_mq_notify()
1398 			info->notify_sock = sock;  in do_mq_notify()
1399 			info->notify_cookie = nc;  in do_mq_notify()
1402 			info->notify.sigev_notify = SIGEV_THREAD;  in do_mq_notify()
1405 			info->notify.sigev_signo = notification->sigev_signo;  in do_mq_notify()
1406 			info->notify.sigev_value = notification->sigev_value;  in do_mq_notify()
1407 			info->notify.sigev_notify = SIGEV_SIGNAL;  in do_mq_notify()
1408 			info->notify_self_exec_id = current->self_exec_id;  in do_mq_notify()
1412 		info->notify_owner = get_pid(task_tgid(current));  in do_mq_notify()
1413 		info->notify_user_ns = get_user_ns(current_user_ns());  in do_mq_notify()
1414 		inode->i_atime = inode->i_ctime = current_time(inode);  in do_mq_notify()
1416 	spin_unlock(&info->lock);  in do_mq_notify()
1435 			return -EFAULT;  in SYSCALL_DEFINE2()
1447 	if (new && (new->mq_flags & (~O_NONBLOCK)))  in do_mq_getsetattr()
1448 		return -EINVAL;  in do_mq_getsetattr()
1452 		return -EBADF;  in do_mq_getsetattr()
1454 	if (unlikely(f.file->f_op != &mqueue_file_operations)) {  in do_mq_getsetattr()
1456 		return -EBADF;  in do_mq_getsetattr()
1462 	spin_lock(&info->lock);  in do_mq_getsetattr()
1465 		*old = info->attr;  in do_mq_getsetattr()
1466 		old->mq_flags = f.file->f_flags & O_NONBLOCK;  in do_mq_getsetattr()
1470 		spin_lock(&f.file->f_lock);  in do_mq_getsetattr()
1471 		if (new->mq_flags & O_NONBLOCK)  in do_mq_getsetattr()
1472 			f.file->f_flags |= O_NONBLOCK;  in do_mq_getsetattr()
1474 			f.file->f_flags &= ~O_NONBLOCK;  in do_mq_getsetattr()
1475 		spin_unlock(&f.file->f_lock);  in do_mq_getsetattr()
1477 		inode->i_atime = inode->i_ctime = current_time(inode);  in do_mq_getsetattr()
1480 	spin_unlock(&info->lock);  in do_mq_getsetattr()
1496 			return -EFAULT;  in SYSCALL_DEFINE3()
1506 		return -EFAULT;  in SYSCALL_DEFINE3()
1513 	compat_long_t mq_flags;      /* message queue flags		     */
1526 		return -EFAULT;  in get_compat_mq_attr()
1529 	attr->mq_flags = v.mq_flags;  in get_compat_mq_attr()
1530 	attr->mq_maxmsg = v.mq_maxmsg;  in get_compat_mq_attr()
1531 	attr->mq_msgsize = v.mq_msgsize;  in get_compat_mq_attr()
1532 	attr->mq_curmsgs = v.mq_curmsgs;  in get_compat_mq_attr()
1542 	v.mq_flags = attr->mq_flags;  in put_compat_mq_attr()
1543 	v.mq_maxmsg = attr->mq_maxmsg;  in put_compat_mq_attr()
1544 	v.mq_msgsize = attr->mq_msgsize;  in put_compat_mq_attr()
1545 	v.mq_curmsgs = attr->mq_curmsgs;  in put_compat_mq_attr()
1547 		return -EFAULT;  in put_compat_mq_attr()
1559 			return -EFAULT;  in COMPAT_SYSCALL_DEFINE4()
1570 			return -EFAULT;  in COMPAT_SYSCALL_DEFINE2()
1589 			return -EFAULT;  in COMPAT_SYSCALL_DEFINE3()
1599 		return -EFAULT;  in COMPAT_SYSCALL_DEFINE3()
1609 		return -EFAULT;  in compat_prepare_timeout()
1611 		return -EINVAL;  in compat_prepare_timeout()
1682 	ns->mq_queues_count  = 0;  in mq_init_ns()
1683 	ns->mq_queues_max    = DFLT_QUEUESMAX;  in mq_init_ns()
1684 	ns->mq_msg_max       = DFLT_MSGMAX;  in mq_init_ns()
1685 	ns->mq_msgsize_max   = DFLT_MSGSIZEMAX;  in mq_init_ns()
1686 	ns->mq_msg_default   = DFLT_MSG;  in mq_init_ns()
1687 	ns->mq_msgsize_default  = DFLT_MSGSIZE;  in mq_init_ns()
1692 	ns->mq_mnt = m;  in mq_init_ns()
1698 	ns->mq_mnt->mnt_sb->s_fs_info = NULL;  in mq_clear_sbinfo()
1703 	kern_unmount(ns->mq_mnt);  in mq_put_mnt()
1714 		return -ENOMEM;  in init_mqueue_fs()
1716 	/* ignore failures - they are not fatal */  in init_mqueue_fs()