1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 /* Watch queue and general notification mechan 2 /* Watch queue and general notification mechanism, built on pipes
3 * 3 *
4 * Copyright (C) 2020 Red Hat, Inc. All Rights 4 * Copyright (C) 2020 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.c 5 * Written by David Howells (dhowells@redhat.com)
6 * 6 *
7 * See Documentation/core-api/watch_queue.rst !! 7 * See Documentation/watch_queue.rst
8 */ 8 */
9 9
10 #define pr_fmt(fmt) "watchq: " fmt 10 #define pr_fmt(fmt) "watchq: " fmt
11 #include <linux/module.h> 11 #include <linux/module.h>
12 #include <linux/init.h> 12 #include <linux/init.h>
13 #include <linux/sched.h> 13 #include <linux/sched.h>
14 #include <linux/slab.h> 14 #include <linux/slab.h>
15 #include <linux/printk.h> 15 #include <linux/printk.h>
16 #include <linux/miscdevice.h> 16 #include <linux/miscdevice.h>
17 #include <linux/fs.h> 17 #include <linux/fs.h>
18 #include <linux/mm.h> 18 #include <linux/mm.h>
19 #include <linux/pagemap.h> 19 #include <linux/pagemap.h>
20 #include <linux/poll.h> 20 #include <linux/poll.h>
21 #include <linux/uaccess.h> 21 #include <linux/uaccess.h>
22 #include <linux/vmalloc.h> 22 #include <linux/vmalloc.h>
23 #include <linux/file.h> 23 #include <linux/file.h>
24 #include <linux/security.h> 24 #include <linux/security.h>
25 #include <linux/cred.h> 25 #include <linux/cred.h>
26 #include <linux/sched/signal.h> 26 #include <linux/sched/signal.h>
27 #include <linux/watch_queue.h> 27 #include <linux/watch_queue.h>
28 #include <linux/pipe_fs_i.h> 28 #include <linux/pipe_fs_i.h>
29 29
30 MODULE_DESCRIPTION("Watch queue"); 30 MODULE_DESCRIPTION("Watch queue");
31 MODULE_AUTHOR("Red Hat, Inc."); 31 MODULE_AUTHOR("Red Hat, Inc.");
>> 32 MODULE_LICENSE("GPL");
32 33
33 #define WATCH_QUEUE_NOTE_SIZE 128 34 #define WATCH_QUEUE_NOTE_SIZE 128
34 #define WATCH_QUEUE_NOTES_PER_PAGE (PAGE_SIZE 35 #define WATCH_QUEUE_NOTES_PER_PAGE (PAGE_SIZE / WATCH_QUEUE_NOTE_SIZE)
35 36
36 /* 37 /*
37 * This must be called under the RCU read-lock 38 * This must be called under the RCU read-lock, which makes
38 * sure that the wqueue still exists. It can t 39 * sure that the wqueue still exists. It can then take the lock,
39 * and check that the wqueue hasn't been destr 40 * and check that the wqueue hasn't been destroyed, which in
40 * turn makes sure that the notification pipe 41 * turn makes sure that the notification pipe still exists.
41 */ 42 */
42 static inline bool lock_wqueue(struct watch_qu 43 static inline bool lock_wqueue(struct watch_queue *wqueue)
43 { 44 {
44 spin_lock_bh(&wqueue->lock); 45 spin_lock_bh(&wqueue->lock);
45 if (unlikely(!wqueue->pipe)) { !! 46 if (unlikely(wqueue->defunct)) {
46 spin_unlock_bh(&wqueue->lock); 47 spin_unlock_bh(&wqueue->lock);
47 return false; 48 return false;
48 } 49 }
49 return true; 50 return true;
50 } 51 }
51 52
52 static inline void unlock_wqueue(struct watch_ 53 static inline void unlock_wqueue(struct watch_queue *wqueue)
53 { 54 {
54 spin_unlock_bh(&wqueue->lock); 55 spin_unlock_bh(&wqueue->lock);
55 } 56 }
56 57
57 static void watch_queue_pipe_buf_release(struc 58 static void watch_queue_pipe_buf_release(struct pipe_inode_info *pipe,
58 struc 59 struct pipe_buffer *buf)
59 { 60 {
60 struct watch_queue *wqueue = (struct w 61 struct watch_queue *wqueue = (struct watch_queue *)buf->private;
61 struct page *page; 62 struct page *page;
62 unsigned int bit; 63 unsigned int bit;
63 64
64 /* We need to work out which note with 65 /* We need to work out which note within the page this refers to, but
65 * the note might have been maximum si 66 * the note might have been maximum size, so merely ANDing the offset
66 * off doesn't work. OTOH, the note m 67 * off doesn't work. OTOH, the note must've been more than zero size.
67 */ 68 */
68 bit = buf->offset + buf->len; 69 bit = buf->offset + buf->len;
69 if ((bit & (WATCH_QUEUE_NOTE_SIZE - 1) 70 if ((bit & (WATCH_QUEUE_NOTE_SIZE - 1)) == 0)
70 bit -= WATCH_QUEUE_NOTE_SIZE; 71 bit -= WATCH_QUEUE_NOTE_SIZE;
71 bit /= WATCH_QUEUE_NOTE_SIZE; 72 bit /= WATCH_QUEUE_NOTE_SIZE;
72 73
73 page = buf->page; 74 page = buf->page;
74 bit += page->index; 75 bit += page->index;
75 76
76 set_bit(bit, wqueue->notes_bitmap); 77 set_bit(bit, wqueue->notes_bitmap);
77 generic_pipe_buf_release(pipe, buf); 78 generic_pipe_buf_release(pipe, buf);
78 } 79 }
79 80
80 // No try_steal function => no stealing 81 // No try_steal function => no stealing
81 #define watch_queue_pipe_buf_try_steal NULL 82 #define watch_queue_pipe_buf_try_steal NULL
82 83
83 /* New data written to a pipe may be appended 84 /* New data written to a pipe may be appended to a buffer with this type. */
84 static const struct pipe_buf_operations watch_ 85 static const struct pipe_buf_operations watch_queue_pipe_buf_ops = {
85 .release = watch_queue_pipe_buf 86 .release = watch_queue_pipe_buf_release,
86 .try_steal = watch_queue_pipe_buf 87 .try_steal = watch_queue_pipe_buf_try_steal,
87 .get = generic_pipe_buf_get 88 .get = generic_pipe_buf_get,
88 }; 89 };
89 90
90 /* 91 /*
91 * Post a notification to a watch queue. 92 * Post a notification to a watch queue.
92 * 93 *
93 * Must be called with the RCU lock for readin 94 * Must be called with the RCU lock for reading, and the
94 * watch_queue lock held, which guarantees tha 95 * watch_queue lock held, which guarantees that the pipe
95 * hasn't been released. 96 * hasn't been released.
96 */ 97 */
97 static bool post_one_notification(struct watch 98 static bool post_one_notification(struct watch_queue *wqueue,
98 struct watch 99 struct watch_notification *n)
99 { 100 {
100 void *p; 101 void *p;
101 struct pipe_inode_info *pipe = wqueue- 102 struct pipe_inode_info *pipe = wqueue->pipe;
102 struct pipe_buffer *buf; 103 struct pipe_buffer *buf;
103 struct page *page; 104 struct page *page;
104 unsigned int head, tail, mask, note, o 105 unsigned int head, tail, mask, note, offset, len;
105 bool done = false; 106 bool done = false;
106 107
>> 108 if (!pipe)
>> 109 return false;
>> 110
107 spin_lock_irq(&pipe->rd_wait.lock); 111 spin_lock_irq(&pipe->rd_wait.lock);
108 112
109 mask = pipe->ring_size - 1; 113 mask = pipe->ring_size - 1;
110 head = pipe->head; 114 head = pipe->head;
111 tail = pipe->tail; 115 tail = pipe->tail;
112 if (pipe_full(head, tail, pipe->ring_s 116 if (pipe_full(head, tail, pipe->ring_size))
113 goto lost; 117 goto lost;
114 118
115 note = find_first_bit(wqueue->notes_bi 119 note = find_first_bit(wqueue->notes_bitmap, wqueue->nr_notes);
116 if (note >= wqueue->nr_notes) 120 if (note >= wqueue->nr_notes)
117 goto lost; 121 goto lost;
118 122
119 page = wqueue->notes[note / WATCH_QUEU 123 page = wqueue->notes[note / WATCH_QUEUE_NOTES_PER_PAGE];
120 offset = note % WATCH_QUEUE_NOTES_PER_ 124 offset = note % WATCH_QUEUE_NOTES_PER_PAGE * WATCH_QUEUE_NOTE_SIZE;
121 get_page(page); 125 get_page(page);
122 len = n->info & WATCH_INFO_LENGTH; 126 len = n->info & WATCH_INFO_LENGTH;
123 p = kmap_atomic(page); 127 p = kmap_atomic(page);
124 memcpy(p + offset, n, len); 128 memcpy(p + offset, n, len);
125 kunmap_atomic(p); 129 kunmap_atomic(p);
126 130
127 buf = &pipe->bufs[head & mask]; 131 buf = &pipe->bufs[head & mask];
128 buf->page = page; 132 buf->page = page;
129 buf->private = (unsigned long)wqueue; 133 buf->private = (unsigned long)wqueue;
130 buf->ops = &watch_queue_pipe_buf_ops; 134 buf->ops = &watch_queue_pipe_buf_ops;
131 buf->offset = offset; 135 buf->offset = offset;
132 buf->len = len; 136 buf->len = len;
133 buf->flags = PIPE_BUF_FLAG_WHOLE; 137 buf->flags = PIPE_BUF_FLAG_WHOLE;
134 smp_store_release(&pipe->head, head + 138 smp_store_release(&pipe->head, head + 1); /* vs pipe_read() */
135 139
136 if (!test_and_clear_bit(note, wqueue-> 140 if (!test_and_clear_bit(note, wqueue->notes_bitmap)) {
137 spin_unlock_irq(&pipe->rd_wait 141 spin_unlock_irq(&pipe->rd_wait.lock);
138 BUG(); 142 BUG();
139 } 143 }
140 wake_up_interruptible_sync_poll_locked 144 wake_up_interruptible_sync_poll_locked(&pipe->rd_wait, EPOLLIN | EPOLLRDNORM);
141 done = true; 145 done = true;
142 146
143 out: 147 out:
144 spin_unlock_irq(&pipe->rd_wait.lock); 148 spin_unlock_irq(&pipe->rd_wait.lock);
145 if (done) 149 if (done)
146 kill_fasync(&pipe->fasync_read 150 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
147 return done; 151 return done;
148 152
149 lost: 153 lost:
150 buf = &pipe->bufs[(head - 1) & mask]; 154 buf = &pipe->bufs[(head - 1) & mask];
151 buf->flags |= PIPE_BUF_FLAG_LOSS; 155 buf->flags |= PIPE_BUF_FLAG_LOSS;
152 goto out; 156 goto out;
153 } 157 }
154 158
155 /* 159 /*
156 * Apply filter rules to a notification. 160 * Apply filter rules to a notification.
157 */ 161 */
158 static bool filter_watch_notification(const st 162 static bool filter_watch_notification(const struct watch_filter *wf,
159 const st 163 const struct watch_notification *n)
160 { 164 {
161 const struct watch_type_filter *wt; 165 const struct watch_type_filter *wt;
162 unsigned int st_bits = sizeof(wt->subt 166 unsigned int st_bits = sizeof(wt->subtype_filter[0]) * 8;
163 unsigned int st_index = n->subtype / s 167 unsigned int st_index = n->subtype / st_bits;
164 unsigned int st_bit = 1U << (n->subtyp 168 unsigned int st_bit = 1U << (n->subtype % st_bits);
165 int i; 169 int i;
166 170
167 if (!test_bit(n->type, wf->type_filter 171 if (!test_bit(n->type, wf->type_filter))
168 return false; 172 return false;
169 173
170 for (i = 0; i < wf->nr_filters; i++) { 174 for (i = 0; i < wf->nr_filters; i++) {
171 wt = &wf->filters[i]; 175 wt = &wf->filters[i];
172 if (n->type == wt->type && 176 if (n->type == wt->type &&
173 (wt->subtype_filter[st_ind 177 (wt->subtype_filter[st_index] & st_bit) &&
174 (n->info & wt->info_mask) 178 (n->info & wt->info_mask) == wt->info_filter)
175 return true; 179 return true;
176 } 180 }
177 181
178 return false; /* If there is a filter, 182 return false; /* If there is a filter, the default is to reject. */
179 } 183 }
180 184
181 /** 185 /**
182 * __post_watch_notification - Post an event n 186 * __post_watch_notification - Post an event notification
183 * @wlist: The watch list to post the event to 187 * @wlist: The watch list to post the event to.
184 * @n: The notification record to post. 188 * @n: The notification record to post.
185 * @cred: The creds of the process that trigge 189 * @cred: The creds of the process that triggered the notification.
186 * @id: The ID to match on the watch. 190 * @id: The ID to match on the watch.
187 * 191 *
188 * Post a notification of an event into a set 192 * Post a notification of an event into a set of watch queues and let the users
189 * know. 193 * know.
190 * 194 *
191 * The size of the notification should be set 195 * The size of the notification should be set in n->info & WATCH_INFO_LENGTH and
192 * should be in units of sizeof(*n). 196 * should be in units of sizeof(*n).
193 */ 197 */
194 void __post_watch_notification(struct watch_li 198 void __post_watch_notification(struct watch_list *wlist,
195 struct watch_no 199 struct watch_notification *n,
196 const struct cr 200 const struct cred *cred,
197 u64 id) 201 u64 id)
198 { 202 {
199 const struct watch_filter *wf; 203 const struct watch_filter *wf;
200 struct watch_queue *wqueue; 204 struct watch_queue *wqueue;
201 struct watch *watch; 205 struct watch *watch;
202 206
203 if (((n->info & WATCH_INFO_LENGTH) >> 207 if (((n->info & WATCH_INFO_LENGTH) >> WATCH_INFO_LENGTH__SHIFT) == 0) {
204 WARN_ON(1); 208 WARN_ON(1);
205 return; 209 return;
206 } 210 }
207 211
208 rcu_read_lock(); 212 rcu_read_lock();
209 213
210 hlist_for_each_entry_rcu(watch, &wlist 214 hlist_for_each_entry_rcu(watch, &wlist->watchers, list_node) {
211 if (watch->id != id) 215 if (watch->id != id)
212 continue; 216 continue;
213 n->info &= ~WATCH_INFO_ID; 217 n->info &= ~WATCH_INFO_ID;
214 n->info |= watch->info_id; 218 n->info |= watch->info_id;
215 219
216 wqueue = rcu_dereference(watch 220 wqueue = rcu_dereference(watch->queue);
217 wf = rcu_dereference(wqueue->f 221 wf = rcu_dereference(wqueue->filter);
218 if (wf && !filter_watch_notifi 222 if (wf && !filter_watch_notification(wf, n))
219 continue; 223 continue;
220 224
221 if (security_post_notification 225 if (security_post_notification(watch->cred, cred, n) < 0)
222 continue; 226 continue;
223 227
224 if (lock_wqueue(wqueue)) { 228 if (lock_wqueue(wqueue)) {
225 post_one_notification( 229 post_one_notification(wqueue, n);
226 unlock_wqueue(wqueue); 230 unlock_wqueue(wqueue);
227 } 231 }
228 } 232 }
229 233
230 rcu_read_unlock(); 234 rcu_read_unlock();
231 } 235 }
232 EXPORT_SYMBOL(__post_watch_notification); 236 EXPORT_SYMBOL(__post_watch_notification);
233 237
234 /* 238 /*
235 * Allocate sufficient pages to preallocation 239 * Allocate sufficient pages to preallocation for the requested number of
236 * notifications. 240 * notifications.
237 */ 241 */
238 long watch_queue_set_size(struct pipe_inode_in 242 long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)
239 { 243 {
240 struct watch_queue *wqueue = pipe->wat 244 struct watch_queue *wqueue = pipe->watch_queue;
241 struct page **pages; 245 struct page **pages;
242 unsigned long *bitmap; 246 unsigned long *bitmap;
243 unsigned long user_bufs; 247 unsigned long user_bufs;
244 int ret, i, nr_pages; 248 int ret, i, nr_pages;
245 249
246 if (!wqueue) 250 if (!wqueue)
247 return -ENODEV; 251 return -ENODEV;
248 if (wqueue->notes) 252 if (wqueue->notes)
249 return -EBUSY; 253 return -EBUSY;
250 254
251 if (nr_notes < 1 || 255 if (nr_notes < 1 ||
252 nr_notes > 512) /* TODO: choose a 256 nr_notes > 512) /* TODO: choose a better hard limit */
253 return -EINVAL; 257 return -EINVAL;
254 258
255 nr_pages = (nr_notes + WATCH_QUEUE_NOT 259 nr_pages = (nr_notes + WATCH_QUEUE_NOTES_PER_PAGE - 1);
256 nr_pages /= WATCH_QUEUE_NOTES_PER_PAGE 260 nr_pages /= WATCH_QUEUE_NOTES_PER_PAGE;
257 user_bufs = account_pipe_buffers(pipe- 261 user_bufs = account_pipe_buffers(pipe->user, pipe->nr_accounted, nr_pages);
258 262
259 if (nr_pages > pipe->max_usage && 263 if (nr_pages > pipe->max_usage &&
260 (too_many_pipe_buffers_hard(user_b 264 (too_many_pipe_buffers_hard(user_bufs) ||
261 too_many_pipe_buffers_soft(user_b 265 too_many_pipe_buffers_soft(user_bufs)) &&
262 pipe_is_unprivileged_user()) { 266 pipe_is_unprivileged_user()) {
263 ret = -EPERM; 267 ret = -EPERM;
264 goto error; 268 goto error;
265 } 269 }
266 270
267 nr_notes = nr_pages * WATCH_QUEUE_NOTE 271 nr_notes = nr_pages * WATCH_QUEUE_NOTES_PER_PAGE;
268 ret = pipe_resize_ring(pipe, roundup_p 272 ret = pipe_resize_ring(pipe, roundup_pow_of_two(nr_notes));
269 if (ret < 0) 273 if (ret < 0)
270 goto error; 274 goto error;
271 275
272 ret = -ENOMEM; !! 276 pages = kcalloc(sizeof(struct page *), nr_pages, GFP_KERNEL);
273 pages = kcalloc(nr_pages, sizeof(struc <<
274 if (!pages) 277 if (!pages)
275 goto error; 278 goto error;
276 279
277 for (i = 0; i < nr_pages; i++) { 280 for (i = 0; i < nr_pages; i++) {
278 pages[i] = alloc_page(GFP_KERN 281 pages[i] = alloc_page(GFP_KERNEL);
279 if (!pages[i]) 282 if (!pages[i])
280 goto error_p; 283 goto error_p;
281 pages[i]->index = i * WATCH_QU 284 pages[i]->index = i * WATCH_QUEUE_NOTES_PER_PAGE;
282 } 285 }
283 286
284 bitmap = bitmap_alloc(nr_notes, GFP_KE 287 bitmap = bitmap_alloc(nr_notes, GFP_KERNEL);
285 if (!bitmap) 288 if (!bitmap)
286 goto error_p; 289 goto error_p;
287 290
288 bitmap_fill(bitmap, nr_notes); 291 bitmap_fill(bitmap, nr_notes);
289 wqueue->notes = pages; 292 wqueue->notes = pages;
290 wqueue->notes_bitmap = bitmap; 293 wqueue->notes_bitmap = bitmap;
291 wqueue->nr_pages = nr_pages; 294 wqueue->nr_pages = nr_pages;
292 wqueue->nr_notes = nr_notes; 295 wqueue->nr_notes = nr_notes;
293 return 0; 296 return 0;
294 297
295 error_p: 298 error_p:
296 while (--i >= 0) 299 while (--i >= 0)
297 __free_page(pages[i]); 300 __free_page(pages[i]);
298 kfree(pages); 301 kfree(pages);
299 error: 302 error:
300 (void) account_pipe_buffers(pipe->user 303 (void) account_pipe_buffers(pipe->user, nr_pages, pipe->nr_accounted);
301 return ret; 304 return ret;
302 } 305 }
303 306
304 /* 307 /*
305 * Set the filter on a watch queue. 308 * Set the filter on a watch queue.
306 */ 309 */
307 long watch_queue_set_filter(struct pipe_inode_ 310 long watch_queue_set_filter(struct pipe_inode_info *pipe,
308 struct watch_notif 311 struct watch_notification_filter __user *_filter)
309 { 312 {
310 struct watch_notification_type_filter 313 struct watch_notification_type_filter *tf;
311 struct watch_notification_filter filte 314 struct watch_notification_filter filter;
312 struct watch_type_filter *q; 315 struct watch_type_filter *q;
313 struct watch_filter *wfilter; 316 struct watch_filter *wfilter;
314 struct watch_queue *wqueue = pipe->wat 317 struct watch_queue *wqueue = pipe->watch_queue;
315 int ret, nr_filter = 0, i; 318 int ret, nr_filter = 0, i;
316 319
317 if (!wqueue) 320 if (!wqueue)
318 return -ENODEV; 321 return -ENODEV;
319 322
320 if (!_filter) { 323 if (!_filter) {
321 /* Remove the old filter */ 324 /* Remove the old filter */
322 wfilter = NULL; 325 wfilter = NULL;
323 goto set; 326 goto set;
324 } 327 }
325 328
326 /* Grab the user's filter specificatio 329 /* Grab the user's filter specification */
327 if (copy_from_user(&filter, _filter, s 330 if (copy_from_user(&filter, _filter, sizeof(filter)) != 0)
328 return -EFAULT; 331 return -EFAULT;
329 if (filter.nr_filters == 0 || 332 if (filter.nr_filters == 0 ||
330 filter.nr_filters > 16 || 333 filter.nr_filters > 16 ||
331 filter.__reserved != 0) 334 filter.__reserved != 0)
332 return -EINVAL; 335 return -EINVAL;
333 336
334 tf = memdup_array_user(_filter->filter !! 337 tf = memdup_user(_filter->filters, filter.nr_filters * sizeof(*tf));
335 if (IS_ERR(tf)) 338 if (IS_ERR(tf))
336 return PTR_ERR(tf); 339 return PTR_ERR(tf);
337 340
338 ret = -EINVAL; 341 ret = -EINVAL;
339 for (i = 0; i < filter.nr_filters; i++ 342 for (i = 0; i < filter.nr_filters; i++) {
340 if ((tf[i].info_filter & ~tf[i 343 if ((tf[i].info_filter & ~tf[i].info_mask) ||
341 tf[i].info_mask & WATCH_IN 344 tf[i].info_mask & WATCH_INFO_LENGTH)
342 goto err_filter; 345 goto err_filter;
343 /* Ignore any unknown types */ 346 /* Ignore any unknown types */
344 if (tf[i].type >= WATCH_TYPE__ 347 if (tf[i].type >= WATCH_TYPE__NR)
345 continue; 348 continue;
346 nr_filter++; 349 nr_filter++;
347 } 350 }
348 351
349 /* Now we need to build the internal f 352 /* Now we need to build the internal filter from only the relevant
350 * user-specified filters. 353 * user-specified filters.
351 */ 354 */
352 ret = -ENOMEM; 355 ret = -ENOMEM;
353 wfilter = kzalloc(struct_size(wfilter, 356 wfilter = kzalloc(struct_size(wfilter, filters, nr_filter), GFP_KERNEL);
354 if (!wfilter) 357 if (!wfilter)
355 goto err_filter; 358 goto err_filter;
356 wfilter->nr_filters = nr_filter; 359 wfilter->nr_filters = nr_filter;
357 360
358 q = wfilter->filters; 361 q = wfilter->filters;
359 for (i = 0; i < filter.nr_filters; i++ 362 for (i = 0; i < filter.nr_filters; i++) {
360 if (tf[i].type >= WATCH_TYPE__ 363 if (tf[i].type >= WATCH_TYPE__NR)
361 continue; 364 continue;
362 365
363 q->type = tf[i 366 q->type = tf[i].type;
364 q->info_filter = tf[i 367 q->info_filter = tf[i].info_filter;
365 q->info_mask = tf[i 368 q->info_mask = tf[i].info_mask;
366 q->subtype_filter[0] = tf[i 369 q->subtype_filter[0] = tf[i].subtype_filter[0];
367 __set_bit(q->type, wfilter->ty 370 __set_bit(q->type, wfilter->type_filter);
368 q++; 371 q++;
369 } 372 }
370 373
371 kfree(tf); 374 kfree(tf);
372 set: 375 set:
373 pipe_lock(pipe); 376 pipe_lock(pipe);
374 wfilter = rcu_replace_pointer(wqueue-> 377 wfilter = rcu_replace_pointer(wqueue->filter, wfilter,
375 lockdep_ 378 lockdep_is_held(&pipe->mutex));
376 pipe_unlock(pipe); 379 pipe_unlock(pipe);
377 if (wfilter) 380 if (wfilter)
378 kfree_rcu(wfilter, rcu); 381 kfree_rcu(wfilter, rcu);
379 return 0; 382 return 0;
380 383
381 err_filter: 384 err_filter:
382 kfree(tf); 385 kfree(tf);
383 return ret; 386 return ret;
384 } 387 }
385 388
386 static void __put_watch_queue(struct kref *kre 389 static void __put_watch_queue(struct kref *kref)
387 { 390 {
388 struct watch_queue *wqueue = 391 struct watch_queue *wqueue =
389 container_of(kref, struct watc 392 container_of(kref, struct watch_queue, usage);
390 struct watch_filter *wfilter; 393 struct watch_filter *wfilter;
391 int i; 394 int i;
392 395
393 for (i = 0; i < wqueue->nr_pages; i++) 396 for (i = 0; i < wqueue->nr_pages; i++)
394 __free_page(wqueue->notes[i]); 397 __free_page(wqueue->notes[i]);
395 kfree(wqueue->notes); 398 kfree(wqueue->notes);
396 bitmap_free(wqueue->notes_bitmap); 399 bitmap_free(wqueue->notes_bitmap);
397 400
398 wfilter = rcu_access_pointer(wqueue->f 401 wfilter = rcu_access_pointer(wqueue->filter);
399 if (wfilter) 402 if (wfilter)
400 kfree_rcu(wfilter, rcu); 403 kfree_rcu(wfilter, rcu);
401 kfree_rcu(wqueue, rcu); 404 kfree_rcu(wqueue, rcu);
402 } 405 }
403 406
404 /** 407 /**
405 * put_watch_queue - Dispose of a ref on a wat 408 * put_watch_queue - Dispose of a ref on a watchqueue.
406 * @wqueue: The watch queue to unref. 409 * @wqueue: The watch queue to unref.
407 */ 410 */
408 void put_watch_queue(struct watch_queue *wqueu 411 void put_watch_queue(struct watch_queue *wqueue)
409 { 412 {
410 kref_put(&wqueue->usage, __put_watch_q 413 kref_put(&wqueue->usage, __put_watch_queue);
411 } 414 }
412 EXPORT_SYMBOL(put_watch_queue); 415 EXPORT_SYMBOL(put_watch_queue);
413 416
414 static void free_watch(struct rcu_head *rcu) 417 static void free_watch(struct rcu_head *rcu)
415 { 418 {
416 struct watch *watch = container_of(rcu 419 struct watch *watch = container_of(rcu, struct watch, rcu);
417 420
418 put_watch_queue(rcu_access_pointer(wat 421 put_watch_queue(rcu_access_pointer(watch->queue));
419 atomic_dec(&watch->cred->user->nr_watc 422 atomic_dec(&watch->cred->user->nr_watches);
420 put_cred(watch->cred); 423 put_cred(watch->cred);
421 kfree(watch); 424 kfree(watch);
422 } 425 }
423 426
424 static void __put_watch(struct kref *kref) 427 static void __put_watch(struct kref *kref)
425 { 428 {
426 struct watch *watch = container_of(kre 429 struct watch *watch = container_of(kref, struct watch, usage);
427 430
428 call_rcu(&watch->rcu, free_watch); 431 call_rcu(&watch->rcu, free_watch);
429 } 432 }
430 433
431 /* 434 /*
432 * Discard a watch. 435 * Discard a watch.
433 */ 436 */
434 static void put_watch(struct watch *watch) 437 static void put_watch(struct watch *watch)
435 { 438 {
436 kref_put(&watch->usage, __put_watch); 439 kref_put(&watch->usage, __put_watch);
437 } 440 }
438 441
439 /** 442 /**
440 * init_watch - Initialise a watch 443 * init_watch - Initialise a watch
441 * @watch: The watch to initialise. 444 * @watch: The watch to initialise.
442 * @wqueue: The queue to assign. 445 * @wqueue: The queue to assign.
443 * 446 *
444 * Initialise a watch and set the watch queue. 447 * Initialise a watch and set the watch queue.
445 */ 448 */
446 void init_watch(struct watch *watch, struct wa 449 void init_watch(struct watch *watch, struct watch_queue *wqueue)
447 { 450 {
448 kref_init(&watch->usage); 451 kref_init(&watch->usage);
449 INIT_HLIST_NODE(&watch->list_node); 452 INIT_HLIST_NODE(&watch->list_node);
450 INIT_HLIST_NODE(&watch->queue_node); 453 INIT_HLIST_NODE(&watch->queue_node);
451 rcu_assign_pointer(watch->queue, wqueu 454 rcu_assign_pointer(watch->queue, wqueue);
452 } 455 }
453 456
454 static int add_one_watch(struct watch *watch, 457 static int add_one_watch(struct watch *watch, struct watch_list *wlist, struct watch_queue *wqueue)
455 { 458 {
456 const struct cred *cred; 459 const struct cred *cred;
457 struct watch *w; 460 struct watch *w;
458 461
459 hlist_for_each_entry(w, &wlist->watche 462 hlist_for_each_entry(w, &wlist->watchers, list_node) {
460 struct watch_queue *wq = rcu_a 463 struct watch_queue *wq = rcu_access_pointer(w->queue);
461 if (wqueue == wq && watch->id 464 if (wqueue == wq && watch->id == w->id)
462 return -EBUSY; 465 return -EBUSY;
463 } 466 }
464 467
465 cred = current_cred(); 468 cred = current_cred();
466 if (atomic_inc_return(&cred->user->nr_ 469 if (atomic_inc_return(&cred->user->nr_watches) > task_rlimit(current, RLIMIT_NOFILE)) {
467 atomic_dec(&cred->user->nr_wat 470 atomic_dec(&cred->user->nr_watches);
468 return -EAGAIN; 471 return -EAGAIN;
469 } 472 }
470 473
471 watch->cred = get_cred(cred); 474 watch->cred = get_cred(cred);
472 rcu_assign_pointer(watch->watch_list, 475 rcu_assign_pointer(watch->watch_list, wlist);
473 476
474 kref_get(&wqueue->usage); 477 kref_get(&wqueue->usage);
475 kref_get(&watch->usage); 478 kref_get(&watch->usage);
476 hlist_add_head(&watch->queue_node, &wq 479 hlist_add_head(&watch->queue_node, &wqueue->watches);
477 hlist_add_head_rcu(&watch->list_node, 480 hlist_add_head_rcu(&watch->list_node, &wlist->watchers);
478 return 0; 481 return 0;
479 } 482 }
480 483
481 /** 484 /**
482 * add_watch_to_object - Add a watch on an obj 485 * add_watch_to_object - Add a watch on an object to a watch list
483 * @watch: The watch to add 486 * @watch: The watch to add
484 * @wlist: The watch list to add to 487 * @wlist: The watch list to add to
485 * 488 *
486 * @watch->queue must have been set to point t 489 * @watch->queue must have been set to point to the queue to post notifications
487 * to and the watch list of the object to be w 490 * to and the watch list of the object to be watched. @watch->cred must also
488 * have been set to the appropriate credential 491 * have been set to the appropriate credentials and a ref taken on them.
489 * 492 *
490 * The caller must pin the queue and the list 493 * The caller must pin the queue and the list both and must hold the list
491 * locked against racing watch additions/remov 494 * locked against racing watch additions/removals.
492 */ 495 */
493 int add_watch_to_object(struct watch *watch, s 496 int add_watch_to_object(struct watch *watch, struct watch_list *wlist)
494 { 497 {
495 struct watch_queue *wqueue; 498 struct watch_queue *wqueue;
496 int ret = -ENOENT; 499 int ret = -ENOENT;
497 500
498 rcu_read_lock(); 501 rcu_read_lock();
499 502
500 wqueue = rcu_access_pointer(watch->que 503 wqueue = rcu_access_pointer(watch->queue);
501 if (lock_wqueue(wqueue)) { 504 if (lock_wqueue(wqueue)) {
502 spin_lock(&wlist->lock); 505 spin_lock(&wlist->lock);
503 ret = add_one_watch(watch, wli 506 ret = add_one_watch(watch, wlist, wqueue);
504 spin_unlock(&wlist->lock); 507 spin_unlock(&wlist->lock);
505 unlock_wqueue(wqueue); 508 unlock_wqueue(wqueue);
506 } 509 }
507 510
508 rcu_read_unlock(); 511 rcu_read_unlock();
509 return ret; 512 return ret;
510 } 513 }
511 EXPORT_SYMBOL(add_watch_to_object); 514 EXPORT_SYMBOL(add_watch_to_object);
512 515
513 /** 516 /**
514 * remove_watch_from_object - Remove a watch o 517 * remove_watch_from_object - Remove a watch or all watches from an object.
515 * @wlist: The watch list to remove from 518 * @wlist: The watch list to remove from
516 * @wq: The watch queue of interest (ignored i 519 * @wq: The watch queue of interest (ignored if @all is true)
517 * @id: The ID of the watch to remove (ignored 520 * @id: The ID of the watch to remove (ignored if @all is true)
518 * @all: True to remove all objects 521 * @all: True to remove all objects
519 * 522 *
520 * Remove a specific watch or all watches from 523 * Remove a specific watch or all watches from an object. A notification is
521 * sent to the watcher to tell them that this 524 * sent to the watcher to tell them that this happened.
522 */ 525 */
523 int remove_watch_from_object(struct watch_list 526 int remove_watch_from_object(struct watch_list *wlist, struct watch_queue *wq,
524 u64 id, bool all) 527 u64 id, bool all)
525 { 528 {
526 struct watch_notification_removal n; 529 struct watch_notification_removal n;
527 struct watch_queue *wqueue; 530 struct watch_queue *wqueue;
528 struct watch *watch; 531 struct watch *watch;
529 int ret = -EBADSLT; 532 int ret = -EBADSLT;
530 533
531 rcu_read_lock(); 534 rcu_read_lock();
532 535
533 again: 536 again:
534 spin_lock(&wlist->lock); 537 spin_lock(&wlist->lock);
535 hlist_for_each_entry(watch, &wlist->wa 538 hlist_for_each_entry(watch, &wlist->watchers, list_node) {
536 if (all || 539 if (all ||
537 (watch->id == id && rcu_ac 540 (watch->id == id && rcu_access_pointer(watch->queue) == wq))
538 goto found; 541 goto found;
539 } 542 }
540 spin_unlock(&wlist->lock); 543 spin_unlock(&wlist->lock);
541 goto out; 544 goto out;
542 545
543 found: 546 found:
544 ret = 0; 547 ret = 0;
545 hlist_del_init_rcu(&watch->list_node); 548 hlist_del_init_rcu(&watch->list_node);
546 rcu_assign_pointer(watch->watch_list, 549 rcu_assign_pointer(watch->watch_list, NULL);
547 spin_unlock(&wlist->lock); 550 spin_unlock(&wlist->lock);
548 551
549 /* We now own the reference on watch t 552 /* We now own the reference on watch that used to belong to wlist. */
550 553
551 n.watch.type = WATCH_TYPE_META; 554 n.watch.type = WATCH_TYPE_META;
552 n.watch.subtype = WATCH_META_REMOVAL_N 555 n.watch.subtype = WATCH_META_REMOVAL_NOTIFICATION;
553 n.watch.info = watch->info_id | watch_ 556 n.watch.info = watch->info_id | watch_sizeof(n.watch);
554 n.id = id; 557 n.id = id;
555 if (id != 0) 558 if (id != 0)
556 n.watch.info = watch->info_id 559 n.watch.info = watch->info_id | watch_sizeof(n);
557 560
558 wqueue = rcu_dereference(watch->queue) 561 wqueue = rcu_dereference(watch->queue);
559 562
560 if (lock_wqueue(wqueue)) { 563 if (lock_wqueue(wqueue)) {
561 post_one_notification(wqueue, 564 post_one_notification(wqueue, &n.watch);
562 565
563 if (!hlist_unhashed(&watch->qu 566 if (!hlist_unhashed(&watch->queue_node)) {
564 hlist_del_init_rcu(&wa 567 hlist_del_init_rcu(&watch->queue_node);
565 put_watch(watch); 568 put_watch(watch);
566 } 569 }
567 570
568 unlock_wqueue(wqueue); 571 unlock_wqueue(wqueue);
569 } 572 }
570 573
571 if (wlist->release_watch) { 574 if (wlist->release_watch) {
572 void (*release_watch)(struct w 575 void (*release_watch)(struct watch *);
573 576
574 release_watch = wlist->release 577 release_watch = wlist->release_watch;
575 rcu_read_unlock(); 578 rcu_read_unlock();
576 (*release_watch)(watch); 579 (*release_watch)(watch);
577 rcu_read_lock(); 580 rcu_read_lock();
578 } 581 }
579 put_watch(watch); 582 put_watch(watch);
580 583
581 if (all && !hlist_empty(&wlist->watche 584 if (all && !hlist_empty(&wlist->watchers))
582 goto again; 585 goto again;
583 out: 586 out:
584 rcu_read_unlock(); 587 rcu_read_unlock();
585 return ret; 588 return ret;
586 } 589 }
587 EXPORT_SYMBOL(remove_watch_from_object); 590 EXPORT_SYMBOL(remove_watch_from_object);
588 591
589 /* 592 /*
590 * Remove all the watches that are contributor 593 * Remove all the watches that are contributory to a queue. This has the
591 * potential to race with removal of the watch 594 * potential to race with removal of the watches by the destruction of the
592 * objects being watched or with the distribut 595 * objects being watched or with the distribution of notifications.
593 */ 596 */
594 void watch_queue_clear(struct watch_queue *wqu 597 void watch_queue_clear(struct watch_queue *wqueue)
595 { 598 {
596 struct watch_list *wlist; 599 struct watch_list *wlist;
597 struct watch *watch; 600 struct watch *watch;
598 bool release; 601 bool release;
599 602
600 rcu_read_lock(); 603 rcu_read_lock();
601 spin_lock_bh(&wqueue->lock); 604 spin_lock_bh(&wqueue->lock);
602 605
603 /* !! 606 /* Prevent new notifications from being stored. */
604 * This pipe can be freed by callers l !! 607 wqueue->defunct = true;
605 * Removing this reference also preven <<
606 */ <<
607 wqueue->pipe = NULL; <<
608 608
609 while (!hlist_empty(&wqueue->watches)) 609 while (!hlist_empty(&wqueue->watches)) {
610 watch = hlist_entry(wqueue->wa 610 watch = hlist_entry(wqueue->watches.first, struct watch, queue_node);
611 hlist_del_init_rcu(&watch->que 611 hlist_del_init_rcu(&watch->queue_node);
612 /* We now own a ref on the wat 612 /* We now own a ref on the watch. */
613 spin_unlock_bh(&wqueue->lock); 613 spin_unlock_bh(&wqueue->lock);
614 614
615 /* We can't do the next bit un 615 /* We can't do the next bit under the queue lock as we need to
616 * get the list lock - which w 616 * get the list lock - which would cause a deadlock if someone
617 * was removing from the oppos 617 * was removing from the opposite direction at the same time or
618 * posting a notification. 618 * posting a notification.
619 */ 619 */
620 wlist = rcu_dereference(watch- 620 wlist = rcu_dereference(watch->watch_list);
621 if (wlist) { 621 if (wlist) {
622 void (*release_watch)( 622 void (*release_watch)(struct watch *);
623 623
624 spin_lock(&wlist->lock 624 spin_lock(&wlist->lock);
625 625
626 release = !hlist_unhas 626 release = !hlist_unhashed(&watch->list_node);
627 if (release) { 627 if (release) {
628 hlist_del_init 628 hlist_del_init_rcu(&watch->list_node);
629 rcu_assign_poi 629 rcu_assign_pointer(watch->watch_list, NULL);
630 630
631 /* We now own 631 /* We now own a second ref on the watch. */
632 } 632 }
633 633
634 release_watch = wlist- 634 release_watch = wlist->release_watch;
635 spin_unlock(&wlist->lo 635 spin_unlock(&wlist->lock);
636 636
637 if (release) { 637 if (release) {
638 if (release_wa 638 if (release_watch) {
639 rcu_re 639 rcu_read_unlock();
640 /* Thi 640 /* This might need to call dput(), so
641 * we 641 * we have to drop all the locks.
642 */ 642 */
643 (*rele 643 (*release_watch)(watch);
644 rcu_re 644 rcu_read_lock();
645 } 645 }
646 put_watch(watc 646 put_watch(watch);
647 } 647 }
648 } 648 }
649 649
650 put_watch(watch); 650 put_watch(watch);
651 spin_lock_bh(&wqueue->lock); 651 spin_lock_bh(&wqueue->lock);
652 } 652 }
653 653
654 spin_unlock_bh(&wqueue->lock); 654 spin_unlock_bh(&wqueue->lock);
655 rcu_read_unlock(); 655 rcu_read_unlock();
656 } 656 }
657 657
658 /** 658 /**
659 * get_watch_queue - Get a watch queue from it 659 * get_watch_queue - Get a watch queue from its file descriptor.
660 * @fd: The fd to query. 660 * @fd: The fd to query.
661 */ 661 */
662 struct watch_queue *get_watch_queue(int fd) 662 struct watch_queue *get_watch_queue(int fd)
663 { 663 {
664 struct pipe_inode_info *pipe; 664 struct pipe_inode_info *pipe;
665 struct watch_queue *wqueue = ERR_PTR(- 665 struct watch_queue *wqueue = ERR_PTR(-EINVAL);
666 struct fd f; 666 struct fd f;
667 667
668 f = fdget(fd); 668 f = fdget(fd);
669 if (fd_file(f)) { !! 669 if (f.file) {
670 pipe = get_pipe_info(fd_file(f !! 670 pipe = get_pipe_info(f.file, false);
671 if (pipe && pipe->watch_queue) 671 if (pipe && pipe->watch_queue) {
672 wqueue = pipe->watch_q 672 wqueue = pipe->watch_queue;
673 kref_get(&wqueue->usag 673 kref_get(&wqueue->usage);
674 } 674 }
675 fdput(f); 675 fdput(f);
676 } 676 }
677 677
678 return wqueue; 678 return wqueue;
679 } 679 }
680 EXPORT_SYMBOL(get_watch_queue); 680 EXPORT_SYMBOL(get_watch_queue);
681 681
682 /* 682 /*
683 * Initialise a watch queue 683 * Initialise a watch queue
684 */ 684 */
685 int watch_queue_init(struct pipe_inode_info *p 685 int watch_queue_init(struct pipe_inode_info *pipe)
686 { 686 {
687 struct watch_queue *wqueue; 687 struct watch_queue *wqueue;
688 688
689 wqueue = kzalloc(sizeof(*wqueue), GFP_ 689 wqueue = kzalloc(sizeof(*wqueue), GFP_KERNEL);
690 if (!wqueue) 690 if (!wqueue)
691 return -ENOMEM; 691 return -ENOMEM;
692 692
693 wqueue->pipe = pipe; 693 wqueue->pipe = pipe;
694 kref_init(&wqueue->usage); 694 kref_init(&wqueue->usage);
695 spin_lock_init(&wqueue->lock); 695 spin_lock_init(&wqueue->lock);
696 INIT_HLIST_HEAD(&wqueue->watches); 696 INIT_HLIST_HEAD(&wqueue->watches);
697 697
698 pipe->watch_queue = wqueue; 698 pipe->watch_queue = wqueue;
699 return 0; 699 return 0;
700 } 700 }
701 701
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.