mqueue: apply mathematics distributivity on mq_bytes calculation
[safe/jmp/linux-2.6] / ipc / mqueue.c
index 1e04cd4..15eabf9 100644 (file)
@@ -31,6 +31,7 @@
 #include <linux/mutex.h>
 #include <linux/nsproxy.h>
 #include <linux/pid.h>
+#include <linux/ipc_namespace.h>
 
 #include <net/sock.h>
 #include "util.h"
 #define STATE_PENDING  1
 #define STATE_READY    2
 
-/* default values */
-#define DFLT_QUEUESMAX 256     /* max number of message queues */
-#define DFLT_MSGMAX    10      /* max number of messages in each queue */
-#define HARD_MSGMAX    (131072/sizeof(void*))
-#define DFLT_MSGSIZEMAX 8192   /* max message size */
-
-
 struct ext_wait_queue {                /* queue of sleeping tasks */
        struct task_struct *task;
        struct list_head list;
@@ -82,17 +76,10 @@ struct mqueue_inode_info {
 
 static const struct inode_operations mqueue_dir_inode_operations;
 static const struct file_operations mqueue_file_operations;
-static struct super_operations mqueue_super_ops;
+static const struct super_operations mqueue_super_ops;
 static void remove_notification(struct mqueue_inode_info *info);
 
-static spinlock_t mq_lock;
 static struct kmem_cache *mqueue_inode_cachep;
-static struct vfsmount *mqueue_mnt;
-
-static unsigned int queues_count;
-static unsigned int queues_max         = DFLT_QUEUESMAX;
-static unsigned int msg_max    = DFLT_MSGMAX;
-static unsigned int msgsize_max = DFLT_MSGSIZEMAX;
 
 static struct ctl_table_header * mq_sysctl_table;
 
@@ -101,24 +88,42 @@ static inline struct mqueue_inode_info *MQUEUE_I(struct inode *inode)
        return container_of(inode, struct mqueue_inode_info, vfs_inode);
 }
 
-static struct inode *mqueue_get_inode(struct super_block *sb, int mode,
-                                                       struct mq_attr *attr)
+/*
+ * This routine should be called with the mq_lock held.
+ */
+static inline struct ipc_namespace *__get_ns_from_inode(struct inode *inode)
+{
+       return get_ipc_ns(inode->i_sb->s_fs_info);
+}
+
+static struct ipc_namespace *get_ns_from_inode(struct inode *inode)
+{
+       struct ipc_namespace *ns;
+
+       spin_lock(&mq_lock);
+       ns = __get_ns_from_inode(inode);
+       spin_unlock(&mq_lock);
+       return ns;
+}
+
+static struct inode *mqueue_get_inode(struct super_block *sb,
+               struct ipc_namespace *ipc_ns, int mode,
+               struct mq_attr *attr)
 {
+       struct user_struct *u = current_user();
        struct inode *inode;
 
        inode = new_inode(sb);
        if (inode) {
                inode->i_mode = mode;
-               inode->i_uid = current->fsuid;
-               inode->i_gid = current->fsgid;
-               inode->i_blocks = 0;
+               inode->i_uid = current_fsuid();
+               inode->i_gid = current_fsgid();
                inode->i_mtime = inode->i_ctime = inode->i_atime =
                                CURRENT_TIME;
 
                if (S_ISREG(mode)) {
                        struct mqueue_inode_info *info;
                        struct task_struct *p = current;
-                       struct user_struct *u = p->user;
                        unsigned long mq_bytes, mq_msg_tblsz;
 
                        inode->i_fop = &mqueue_file_operations;
@@ -129,18 +134,21 @@ static struct inode *mqueue_get_inode(struct super_block *sb, int mode,
                        init_waitqueue_head(&info->wait_q);
                        INIT_LIST_HEAD(&info->e_wait_q[0].list);
                        INIT_LIST_HEAD(&info->e_wait_q[1].list);
-                       info->messages = NULL;
                        info->notify_owner = NULL;
                        info->qsize = 0;
                        info->user = NULL;      /* set when all is ok */
                        memset(&info->attr, 0, sizeof(info->attr));
-                       info->attr.mq_maxmsg = DFLT_MSGMAX;
-                       info->attr.mq_msgsize = DFLT_MSGSIZEMAX;
+                       info->attr.mq_maxmsg = ipc_ns->mq_msg_max;
+                       info->attr.mq_msgsize = ipc_ns->mq_msgsize_max;
                        if (attr) {
                                info->attr.mq_maxmsg = attr->mq_maxmsg;
                                info->attr.mq_msgsize = attr->mq_msgsize;
                        }
                        mq_msg_tblsz = info->attr.mq_maxmsg * sizeof(struct msg_msg *);
+                       info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL);
+                       if (!info->messages)
+                               goto out_inode;
+
                        mq_bytes = (mq_msg_tblsz +
                                (info->attr.mq_maxmsg * info->attr.mq_msgsize));
 
@@ -149,18 +157,12 @@ static struct inode *mqueue_get_inode(struct super_block *sb, int mode,
                            u->mq_bytes + mq_bytes >
                            p->signal->rlim[RLIMIT_MSGQUEUE].rlim_cur) {
                                spin_unlock(&mq_lock);
+                               kfree(info->messages);
                                goto out_inode;
                        }
                        u->mq_bytes += mq_bytes;
                        spin_unlock(&mq_lock);
 
-                       info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL);
-                       if (!info->messages) {
-                               spin_lock(&mq_lock);
-                               u->mq_bytes -= mq_bytes;
-                               spin_unlock(&mq_lock);
-                               goto out_inode;
-                       }
                        /* all is ok */
                        info->user = get_uid(u);
                } else if (S_ISDIR(mode)) {
@@ -181,33 +183,41 @@ out_inode:
 static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
 {
        struct inode *inode;
+       struct ipc_namespace *ns = data;
+       int error = 0;
 
        sb->s_blocksize = PAGE_CACHE_SIZE;
        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
        sb->s_magic = MQUEUE_MAGIC;
        sb->s_op = &mqueue_super_ops;
 
-       inode = mqueue_get_inode(sb, S_IFDIR | S_ISVTX | S_IRWXUGO, NULL);
-       if (!inode)
-               return -ENOMEM;
+       inode = mqueue_get_inode(sb, ns, S_IFDIR | S_ISVTX | S_IRWXUGO,
+                               NULL);
+       if (!inode) {
+               error = -ENOMEM;
+               goto out;
+       }
 
        sb->s_root = d_alloc_root(inode);
        if (!sb->s_root) {
                iput(inode);
-               return -ENOMEM;
+               error = -ENOMEM;
        }
 
-       return 0;
+out:
+       return error;
 }
 
 static int mqueue_get_sb(struct file_system_type *fs_type,
                         int flags, const char *dev_name,
                         void *data, struct vfsmount *mnt)
 {
-       return get_sb_single(fs_type, flags, data, mqueue_fill_super, mnt);
+       if (!(flags & MS_KERNMOUNT))
+               data = current->nsproxy->ipc_ns;
+       return get_sb_ns(fs_type, flags, data, mqueue_fill_super, mnt);
 }
 
-static void init_once(struct kmem_cache *cachep, void *foo)
+static void init_once(void *foo)
 {
        struct mqueue_inode_info *p = (struct mqueue_inode_info *) foo;
 
@@ -235,11 +245,13 @@ static void mqueue_delete_inode(struct inode *inode)
        struct user_struct *user;
        unsigned long mq_bytes;
        int i;
+       struct ipc_namespace *ipc_ns;
 
        if (S_ISDIR(inode->i_mode)) {
                clear_inode(inode);
                return;
        }
+       ipc_ns = get_ns_from_inode(inode);
        info = MQUEUE_I(inode);
        spin_lock(&info->lock);
        for (i = 0; i < info->attr.mq_curmsgs; i++)
@@ -249,16 +261,26 @@ static void mqueue_delete_inode(struct inode *inode)
 
        clear_inode(inode);
 
-       mq_bytes = (info->attr.mq_maxmsg * sizeof(struct msg_msg *) +
-                  (info->attr.mq_maxmsg * info->attr.mq_msgsize));
+       /* Total amount of bytes accounted for the mqueue */
+       mq_bytes = info->attr.mq_maxmsg * (sizeof(struct msg_msg *)
+           + info->attr.mq_msgsize);
        user = info->user;
        if (user) {
                spin_lock(&mq_lock);
                user->mq_bytes -= mq_bytes;
-               queues_count--;
+               /*
+                * get_ns_from_inode() ensures that the
+                * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
+                * to which we now hold a reference, or it is NULL.
+                * We can't put it here under mq_lock, though.
+                */
+               if (ipc_ns)
+                       ipc_ns->mq_queues_count--;
                spin_unlock(&mq_lock);
                free_uid(user);
        }
+       if (ipc_ns)
+               put_ipc_ns(ipc_ns);
 }
 
 static int mqueue_create(struct inode *dir, struct dentry *dentry,
@@ -267,31 +289,41 @@ static int mqueue_create(struct inode *dir, struct dentry *dentry,
        struct inode *inode;
        struct mq_attr *attr = dentry->d_fsdata;
        int error;
+       struct ipc_namespace *ipc_ns;
 
        spin_lock(&mq_lock);
-       if (queues_count >= queues_max && !capable(CAP_SYS_RESOURCE)) {
+       ipc_ns = __get_ns_from_inode(dir);
+       if (!ipc_ns) {
+               error = -EACCES;
+               goto out_unlock;
+       }
+       if (ipc_ns->mq_queues_count >= ipc_ns->mq_queues_max &&
+                       !capable(CAP_SYS_RESOURCE)) {
                error = -ENOSPC;
-               goto out_lock;
+               goto out_unlock;
        }
-       queues_count++;
+       ipc_ns->mq_queues_count++;
        spin_unlock(&mq_lock);
 
-       inode = mqueue_get_inode(dir->i_sb, mode, attr);
+       inode = mqueue_get_inode(dir->i_sb, ipc_ns, mode, attr);
        if (!inode) {
                error = -ENOMEM;
                spin_lock(&mq_lock);
-               queues_count--;
-               goto out_lock;
+               ipc_ns->mq_queues_count--;
+               goto out_unlock;
        }
 
+       put_ipc_ns(ipc_ns);
        dir->i_size += DIRENT_SIZE;
        dir->i_ctime = dir->i_mtime = dir->i_atime = CURRENT_TIME;
 
        d_instantiate(dentry, inode);
        dget(dentry);
        return 0;
-out_lock:
+out_unlock:
        spin_unlock(&mq_lock);
+       if (ipc_ns)
+               put_ipc_ns(ipc_ns);
        return error;
 }
 
@@ -314,15 +346,11 @@ static int mqueue_unlink(struct inode *dir, struct dentry *dentry)
 *      through std routines)
 */
 static ssize_t mqueue_read_file(struct file *filp, char __user *u_data,
-                               size_t count, loff_t * off)
+                               size_t count, loff_t *off)
 {
        struct mqueue_inode_info *info = MQUEUE_I(filp->f_path.dentry->d_inode);
        char buffer[FILENT_SIZE];
-       size_t slen;
-       loff_t o;
-
-       if (!count)
-               return 0;
+       ssize_t ret;
 
        spin_lock(&info->lock);
        snprintf(buffer, sizeof(buffer),
@@ -332,25 +360,17 @@ static ssize_t mqueue_read_file(struct file *filp, char __user *u_data,
                        (info->notify_owner &&
                         info->notify.sigev_notify == SIGEV_SIGNAL) ?
                                info->notify.sigev_signo : 0,
-                       pid_nr_ns(info->notify_owner,
-                               current->nsproxy->pid_ns));
+                       pid_vnr(info->notify_owner));
        spin_unlock(&info->lock);
        buffer[sizeof(buffer)-1] = '\0';
-       slen = strlen(buffer)+1;
-
-       o = *off;
-       if (o > slen)
-               return 0;
-
-       if (o + count > slen)
-               count = slen - o;
 
-       if (copy_to_user(u_data, buffer + o, count))
-               return -EFAULT;
+       ret = simple_read_from_buffer(u_data, count, off, buffer,
+                               strlen(buffer));
+       if (ret <= 0)
+               return ret;
 
-       *off = o + count;
        filp->f_path.dentry->d_inode->i_atime = filp->f_path.dentry->d_inode->i_ctime = CURRENT_TIME;
-       return count;
+       return ret;
 }
 
 static int mqueue_flush_file(struct file *filp, fl_owner_t id)
@@ -510,8 +530,9 @@ static void __do_notify(struct mqueue_inode_info *info)
                        sig_i.si_errno = 0;
                        sig_i.si_code = SI_MESGQ;
                        sig_i.si_value = info->notify.sigev_value;
-                       sig_i.si_pid = task_pid_vnr(current);
-                       sig_i.si_uid = current->uid;
+                       sig_i.si_pid = task_tgid_nr_ns(current,
+                                               ns_of_pid(info->notify_owner));
+                       sig_i.si_uid = current_uid();
 
                        kill_pid_info(info->notify.sigev_signo,
                                      &sig_i, info->notify_owner);
@@ -528,31 +549,27 @@ static void __do_notify(struct mqueue_inode_info *info)
        wake_up(&info->wait_q);
 }
 
-static long prepare_timeout(const struct timespec __user *u_arg)
+static long prepare_timeout(struct timespec *p)
 {
-       struct timespec ts, nowts;
+       struct timespec nowts;
        long timeout;
 
-       if (u_arg) {
-               if (unlikely(copy_from_user(&ts, u_arg,
-                                       sizeof(struct timespec))))
-                       return -EFAULT;
-
-               if (unlikely(ts.tv_nsec < 0 || ts.tv_sec < 0
-                       || ts.tv_nsec >= NSEC_PER_SEC))
+       if (p) {
+               if (unlikely(p->tv_nsec < 0 || p->tv_sec < 0
+                       || p->tv_nsec >= NSEC_PER_SEC))
                        return -EINVAL;
                nowts = CURRENT_TIME;
                /* first subtract as jiffies can't be too big */
-               ts.tv_sec -= nowts.tv_sec;
-               if (ts.tv_nsec < nowts.tv_nsec) {
-                       ts.tv_nsec += NSEC_PER_SEC;
-                       ts.tv_sec--;
+               p->tv_sec -= nowts.tv_sec;
+               if (p->tv_nsec < nowts.tv_nsec) {
+                       p->tv_nsec += NSEC_PER_SEC;
+                       p->tv_sec--;
                }
-               ts.tv_nsec -= nowts.tv_nsec;
-               if (ts.tv_sec < 0)
+               p->tv_nsec -= nowts.tv_nsec;
+               if (p->tv_sec < 0)
                        return 0;
 
-               timeout = timespec_to_jiffies(&ts) + 1;
+               timeout = timespec_to_jiffies(p) + 1;
        } else
                return MAX_SCHEDULE_TIMEOUT;
 
@@ -570,7 +587,7 @@ static void remove_notification(struct mqueue_inode_info *info)
        info->notify_owner = NULL;
 }
 
-static int mq_attr_ok(struct mq_attr *attr)
+static int mq_attr_ok(struct ipc_namespace *ipc_ns, struct mq_attr *attr)
 {
        if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0)
                return 0;
@@ -578,15 +595,15 @@ static int mq_attr_ok(struct mq_attr *attr)
                if (attr->mq_maxmsg > HARD_MSGMAX)
                        return 0;
        } else {
-               if (attr->mq_maxmsg > msg_max ||
-                               attr->mq_msgsize > msgsize_max)
+               if (attr->mq_maxmsg > ipc_ns->mq_msg_max ||
+                               attr->mq_msgsize > ipc_ns->mq_msgsize_max)
                        return 0;
        }
        /* check for overflow */
        if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg)
                return 0;
-       if ((unsigned long)(attr->mq_maxmsg * attr->mq_msgsize) +
-           (attr->mq_maxmsg * sizeof (struct msg_msg *)) <
+       if ((unsigned long)(attr->mq_maxmsg * (attr->mq_msgsize
+           + sizeof (struct msg_msg *))) <
            (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize))
                return 0;
        return 1;
@@ -595,84 +612,100 @@ static int mq_attr_ok(struct mq_attr *attr)
 /*
  * Invoked when creating a new queue via sys_mq_open
  */
-static struct file *do_create(struct dentry *dir, struct dentry *dentry,
-                       int oflag, mode_t mode, struct mq_attr __user *u_attr)
+static struct file *do_create(struct ipc_namespace *ipc_ns, struct dentry *dir,
+                       struct dentry *dentry, int oflag, mode_t mode,
+                       struct mq_attr *attr)
 {
-       struct mq_attr attr;
+       const struct cred *cred = current_cred();
+       struct file *result;
        int ret;
 
-       if (u_attr) {
-               ret = -EFAULT;
-               if (copy_from_user(&attr, u_attr, sizeof(attr)))
-                       goto out;
+       if (attr) {
                ret = -EINVAL;
-               if (!mq_attr_ok(&attr))
+               if (!mq_attr_ok(ipc_ns, attr))
                        goto out;
                /* store for use during create */
-               dentry->d_fsdata = &attr;
+               dentry->d_fsdata = attr;
        }
 
-       mode &= ~current->fs->umask;
+       mode &= ~current_umask();
+       ret = mnt_want_write(ipc_ns->mq_mnt);
+       if (ret)
+               goto out;
        ret = vfs_create(dir->d_inode, dentry, mode, NULL);
        dentry->d_fsdata = NULL;
        if (ret)
-               goto out;
-
-       return dentry_open(dentry, mqueue_mnt, oflag);
-
+               goto out_drop_write;
+
+       result = dentry_open(dentry, ipc_ns->mq_mnt, oflag, cred);
+       /*
+        * dentry_open() took a persistent mnt_want_write(),
+        * so we can now drop this one.
+        */
+       mnt_drop_write(ipc_ns->mq_mnt);
+       return result;
+
+out_drop_write:
+       mnt_drop_write(ipc_ns->mq_mnt);
 out:
        dput(dentry);
-       mntput(mqueue_mnt);
+       mntput(ipc_ns->mq_mnt);
        return ERR_PTR(ret);
 }
 
 /* Opens existing queue */
-static struct file *do_open(struct dentry *dentry, int oflag)
+static struct file *do_open(struct ipc_namespace *ipc_ns,
+                               struct dentry *dentry, int oflag)
 {
-static int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
-                                       MAY_READ | MAY_WRITE };
+       const struct cred *cred = current_cred();
+
+       static const int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
+                                                 MAY_READ | MAY_WRITE };
 
        if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) {
                dput(dentry);
-               mntput(mqueue_mnt);
+               mntput(ipc_ns->mq_mnt);
                return ERR_PTR(-EINVAL);
        }
 
-       if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL)) {
+       if (inode_permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE])) {
                dput(dentry);
-               mntput(mqueue_mnt);
+               mntput(ipc_ns->mq_mnt);
                return ERR_PTR(-EACCES);
        }
 
-       return dentry_open(dentry, mqueue_mnt, oflag);
+       return dentry_open(dentry, ipc_ns->mq_mnt, oflag, cred);
 }
 
-asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
-                               struct mq_attr __user *u_attr)
+SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode,
+               struct mq_attr __user *, u_attr)
 {
        struct dentry *dentry;
        struct file *filp;
        char *name;
+       struct mq_attr attr;
        int fd, error;
+       struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
 
-       error = audit_mq_open(oflag, mode, u_attr);
-       if (error != 0)
-               return error;
+       if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
+               return -EFAULT;
+
+       audit_mq_open(oflag, mode, u_attr ? &attr : NULL);
 
        if (IS_ERR(name = getname(u_name)))
                return PTR_ERR(name);
 
-       fd = get_unused_fd();
+       fd = get_unused_fd_flags(O_CLOEXEC);
        if (fd < 0)
                goto out_putname;
 
-       mutex_lock(&mqueue_mnt->mnt_root->d_inode->i_mutex);
-       dentry = lookup_one_len(name, mqueue_mnt->mnt_root, strlen(name));
+       mutex_lock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
+       dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));
        if (IS_ERR(dentry)) {
                error = PTR_ERR(dentry);
-               goto out_err;
+               goto out_putfd;
        }
-       mntget(mqueue_mnt);
+       mntget(ipc_ns->mq_mnt);
 
        if (oflag & O_CREAT) {
                if (dentry->d_inode) {  /* entry already exists */
@@ -680,17 +713,18 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
                        error = -EEXIST;
                        if (oflag & O_EXCL)
                                goto out;
-                       filp = do_open(dentry, oflag);
+                       filp = do_open(ipc_ns, dentry, oflag);
                } else {
-                       filp = do_create(mqueue_mnt->mnt_root, dentry,
-                                               oflag, mode, u_attr);
+                       filp = do_create(ipc_ns, ipc_ns->mq_mnt->mnt_root,
+                                               dentry, oflag, mode,
+                                               u_attr ? &attr : NULL);
                }
        } else {
                error = -ENOENT;
                if (!dentry->d_inode)
                        goto out;
                audit_inode(name, dentry);
-               filp = do_open(dentry, oflag);
+               filp = do_open(ipc_ns, dentry, oflag);
        }
 
        if (IS_ERR(filp)) {
@@ -698,38 +732,37 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
                goto out_putfd;
        }
 
-       set_close_on_exec(fd, 1);
        fd_install(fd, filp);
        goto out_upsem;
 
 out:
        dput(dentry);
-       mntput(mqueue_mnt);
+       mntput(ipc_ns->mq_mnt);
 out_putfd:
        put_unused_fd(fd);
-out_err:
        fd = error;
 out_upsem:
-       mutex_unlock(&mqueue_mnt->mnt_root->d_inode->i_mutex);
+       mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
 out_putname:
        putname(name);
        return fd;
 }
 
-asmlinkage long sys_mq_unlink(const char __user *u_name)
+SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
 {
        int err;
        char *name;
        struct dentry *dentry;
        struct inode *inode = NULL;
+       struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
 
        name = getname(u_name);
        if (IS_ERR(name))
                return PTR_ERR(name);
 
-       mutex_lock_nested(&mqueue_mnt->mnt_root->d_inode->i_mutex,
+       mutex_lock_nested(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex,
                        I_MUTEX_PARENT);
-       dentry = lookup_one_len(name, mqueue_mnt->mnt_root, strlen(name));
+       dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));
        if (IS_ERR(dentry)) {
                err = PTR_ERR(dentry);
                goto out_unlock;
@@ -743,13 +776,16 @@ asmlinkage long sys_mq_unlink(const char __user *u_name)
        inode = dentry->d_inode;
        if (inode)
                atomic_inc(&inode->i_count);
-
+       err = mnt_want_write(ipc_ns->mq_mnt);
+       if (err)
+               goto out_err;
        err = vfs_unlink(dentry->d_parent->d_inode, dentry);
+       mnt_drop_write(ipc_ns->mq_mnt);
 out_err:
        dput(dentry);
 
 out_unlock:
-       mutex_unlock(&mqueue_mnt->mnt_root->d_inode->i_mutex);
+       mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
        putname(name);
        if (inode)
                iput(inode);
@@ -806,9 +842,9 @@ static inline void pipelined_receive(struct mqueue_inode_info *info)
        sender->state = STATE_READY;
 }
 
-asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr,
-       size_t msg_len, unsigned int msg_prio,
-       const struct timespec __user *u_abs_timeout)
+SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr,
+               size_t, msg_len, unsigned int, msg_prio,
+               const struct timespec __user *, u_abs_timeout)
 {
        struct file *filp;
        struct inode *inode;
@@ -816,17 +852,22 @@ asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr,
        struct ext_wait_queue *receiver;
        struct msg_msg *msg_ptr;
        struct mqueue_inode_info *info;
+       struct timespec ts, *p = NULL;
        long timeout;
        int ret;
 
-       ret = audit_mq_timedsend(mqdes, msg_len, msg_prio, u_abs_timeout);
-       if (ret != 0)
-               return ret;
+       if (u_abs_timeout) {
+               if (copy_from_user(&ts, u_abs_timeout, 
+                                       sizeof(struct timespec)))
+                       return -EFAULT;
+               p = &ts;
+       }
 
        if (unlikely(msg_prio >= (unsigned long) MQ_PRIO_MAX))
                return -EINVAL;
 
-       timeout = prepare_timeout(u_abs_timeout);
+       audit_mq_sendrecv(mqdes, msg_len, msg_prio, p);
+       timeout = prepare_timeout(p);
 
        ret = -EBADF;
        filp = fget(mqdes);
@@ -894,9 +935,9 @@ out:
        return ret;
 }
 
-asmlinkage ssize_t sys_mq_timedreceive(mqd_t mqdes, char __user *u_msg_ptr,
-       size_t msg_len, unsigned int __user *u_msg_prio,
-       const struct timespec __user *u_abs_timeout)
+SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr,
+               size_t, msg_len, unsigned int __user *, u_msg_prio,
+               const struct timespec __user *, u_abs_timeout)
 {
        long timeout;
        ssize_t ret;
@@ -905,12 +946,17 @@ asmlinkage ssize_t sys_mq_timedreceive(mqd_t mqdes, char __user *u_msg_ptr,
        struct inode *inode;
        struct mqueue_inode_info *info;
        struct ext_wait_queue wait;
+       struct timespec ts, *p = NULL;
 
-       ret = audit_mq_timedreceive(mqdes, msg_len, u_msg_prio, u_abs_timeout);
-       if (ret != 0)
-               return ret;
+       if (u_abs_timeout) {
+               if (copy_from_user(&ts, u_abs_timeout, 
+                                       sizeof(struct timespec)))
+                       return -EFAULT;
+               p = &ts;
+       }
 
-       timeout = prepare_timeout(u_abs_timeout);
+       audit_mq_sendrecv(mqdes, msg_len, 0, p);
+       timeout = prepare_timeout(p);
 
        ret = -EBADF;
        filp = fget(mqdes);
@@ -979,8 +1025,8 @@ out:
  * and he isn't currently owner of notification, will be silently discarded.
  * It isn't explicitly defined in the POSIX.
  */
-asmlinkage long sys_mq_notify(mqd_t mqdes,
-                               const struct sigevent __user *u_notification)
+SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
+               const struct sigevent __user *, u_notification)
 {
        int ret;
        struct file *filp;
@@ -990,17 +1036,17 @@ asmlinkage long sys_mq_notify(mqd_t mqdes,
        struct mqueue_inode_info *info;
        struct sk_buff *nc;
 
-       ret = audit_mq_notify(mqdes, u_notification);
-       if (ret != 0)
-               return ret;
-
-       nc = NULL;
-       sock = NULL;
-       if (u_notification != NULL) {
+       if (u_notification) {
                if (copy_from_user(&notification, u_notification,
                                        sizeof(struct sigevent)))
                        return -EFAULT;
+       }
+
+       audit_mq_notify(mqdes, u_notification ? &notification : NULL);
 
+       nc = NULL;
+       sock = NULL;
+       if (u_notification != NULL) {
                if (unlikely(notification.sigev_notify != SIGEV_NONE &&
                             notification.sigev_notify != SIGEV_SIGNAL &&
                             notification.sigev_notify != SIGEV_THREAD))
@@ -1041,7 +1087,7 @@ retry:
                        }
 
                        timeo = MAX_SCHEDULE_TIMEOUT;
-                       ret = netlink_attachskb(sock, nc, 0, &timeo, NULL);
+                       ret = netlink_attachskb(sock, nc, &timeo, NULL);
                        if (ret == 1)
                                goto retry;
                        if (ret) {
@@ -1105,9 +1151,9 @@ out:
        return ret;
 }
 
-asmlinkage long sys_mq_getsetattr(mqd_t mqdes,
-                       const struct mq_attr __user *u_mqstat,
-                       struct mq_attr __user *u_omqstat)
+SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mqdes,
+               const struct mq_attr __user *, u_mqstat,
+               struct mq_attr __user *, u_omqstat)
 {
        int ret;
        struct mq_attr mqstat, omqstat;
@@ -1137,13 +1183,13 @@ asmlinkage long sys_mq_getsetattr(mqd_t mqdes,
        omqstat = info->attr;
        omqstat.mq_flags = filp->f_flags & O_NONBLOCK;
        if (u_mqstat) {
-               ret = audit_mq_getsetattr(mqdes, &mqstat);
-               if (ret != 0)
-                       goto out;
+               audit_mq_getsetattr(mqdes, &mqstat);
+               spin_lock(&filp->f_lock);
                if (mqstat.mq_flags & O_NONBLOCK)
                        filp->f_flags |= O_NONBLOCK;
                else
                        filp->f_flags &= ~O_NONBLOCK;
+               spin_unlock(&filp->f_lock);
 
                inode->i_atime = inode->i_ctime = CURRENT_TIME;
        }
@@ -1173,7 +1219,7 @@ static const struct file_operations mqueue_file_operations = {
        .read = mqueue_read_file,
 };
 
-static struct super_operations mqueue_super_ops = {
+static const struct super_operations mqueue_super_ops = {
        .alloc_inode = mqueue_alloc_inode,
        .destroy_inode = mqueue_destroy_inode,
        .statfs = simple_statfs,
@@ -1187,59 +1233,31 @@ static struct file_system_type mqueue_fs_type = {
        .kill_sb = kill_litter_super,
 };
 
-static int msg_max_limit_min = DFLT_MSGMAX;
-static int msg_max_limit_max = HARD_MSGMAX;
-
-static int msg_maxsize_limit_min = DFLT_MSGSIZEMAX;
-static int msg_maxsize_limit_max = INT_MAX;
-
-static ctl_table mq_sysctls[] = {
-       {
-               .procname       = "queues_max",
-               .data           = &queues_max,
-               .maxlen         = sizeof(int),
-               .mode           = 0644,
-               .proc_handler   = &proc_dointvec,
-       },
-       {
-               .procname       = "msg_max",
-               .data           = &msg_max,
-               .maxlen         = sizeof(int),
-               .mode           = 0644,
-               .proc_handler   = &proc_dointvec_minmax,
-               .extra1         = &msg_max_limit_min,
-               .extra2         = &msg_max_limit_max,
-       },
-       {
-               .procname       = "msgsize_max",
-               .data           = &msgsize_max,
-               .maxlen         = sizeof(int),
-               .mode           = 0644,
-               .proc_handler   = &proc_dointvec_minmax,
-               .extra1         = &msg_maxsize_limit_min,
-               .extra2         = &msg_maxsize_limit_max,
-       },
-       { .ctl_name = 0 }
-};
+int mq_init_ns(struct ipc_namespace *ns)
+{
+       ns->mq_queues_count  = 0;
+       ns->mq_queues_max    = DFLT_QUEUESMAX;
+       ns->mq_msg_max       = DFLT_MSGMAX;
+       ns->mq_msgsize_max   = DFLT_MSGSIZEMAX;
+
+       ns->mq_mnt = kern_mount_data(&mqueue_fs_type, ns);
+       if (IS_ERR(ns->mq_mnt)) {
+               int err = PTR_ERR(ns->mq_mnt);
+               ns->mq_mnt = NULL;
+               return err;
+       }
+       return 0;
+}
 
-static ctl_table mq_sysctl_dir[] = {
-       {
-               .procname       = "mqueue",
-               .mode           = 0555,
-               .child          = mq_sysctls,
-       },
-       { .ctl_name = 0 }
-};
+void mq_clear_sbinfo(struct ipc_namespace *ns)
+{
+       ns->mq_mnt->mnt_sb->s_fs_info = NULL;
+}
 
-static ctl_table mq_sysctl_root[] = {
-       {
-               .ctl_name       = CTL_FS,
-               .procname       = "fs",
-               .mode           = 0555,
-               .child          = mq_sysctl_dir,
-       },
-       { .ctl_name = 0 }
-};
+void mq_put_mnt(struct ipc_namespace *ns)
+{
+       mntput(ns->mq_mnt);
+}
 
 static int __init init_mqueue_fs(void)
 {
@@ -1252,21 +1270,20 @@ static int __init init_mqueue_fs(void)
                return -ENOMEM;
 
        /* ignore failues - they are not fatal */
-       mq_sysctl_table = register_sysctl_table(mq_sysctl_root);
+       mq_sysctl_table = mq_register_sysctl_table();
 
        error = register_filesystem(&mqueue_fs_type);
        if (error)
                goto out_sysctl;
 
-       if (IS_ERR(mqueue_mnt = kern_mount(&mqueue_fs_type))) {
-               error = PTR_ERR(mqueue_mnt);
+       spin_lock_init(&mq_lock);
+
+       init_ipc_ns.mq_mnt = kern_mount_data(&mqueue_fs_type, &init_ipc_ns);
+       if (IS_ERR(init_ipc_ns.mq_mnt)) {
+               error = PTR_ERR(init_ipc_ns.mq_mnt);
                goto out_filesystem;
        }
 
-       /* internal initialization - not common for vfs */
-       queues_count = 0;
-       spin_lock_init(&mq_lock);
-
        return 0;
 
 out_filesystem: