2.6.24-rc5

 ipc

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 145d5a0..6ca7b97 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -29,6 +29,8 @@
 #include <linux/audit.h>
 #include <linux/signal.h>
 #include <linux/mutex.h>
+#include <linux/nsproxy.h>
+#include <linux/pid.h>
 
 #include <net/sock.h>
 #include "util.h"
@@ -44,12 +46,6 @@
 #define STATE_PENDING   1
 #define STATE_READY   2
 
-/* used by sysctl */
-#define FS_MQUEUE    1
-#define CTL_QUEUESMAX    2
-#define CTL_MSGMAX    3
-#define CTL_MSGSIZEMAX    4
-
 /* default values */
 #define DFLT_QUEUESMAX   256   /* max number of message queues */
 #define DFLT_MSGMAX    10   /* max number of messages in each queue */
@@ -211,7 +207,7 @@ static int mqueue_get_sb(struct file_system_type *fs_type,
    return get_sb_single(fs_type, flags, data, mqueue_fill_super, mnt);
 }
 
-static void init_once(void *foo, struct kmem_cache * cachep, unsigned long flags)
+static void init_once(struct kmem_cache *cachep, void *foo)
 {
    struct mqueue_inode_info *p = (struct mqueue_inode_info *) foo;
 
@@ -336,7 +332,8 @@ static ssize_t mqueue_read_file(struct file *filp, char __user *u_data,
          (info->notify_owner &&
           info->notify.sigev_notify == SIGEV_SIGNAL) ?
             info->notify.sigev_signo : 0,
-         pid_nr(info->notify_owner));
+         pid_nr_ns(info->notify_owner,
+            current->nsproxy->pid_ns));
    spin_unlock(&info->lock);
    buffer[sizeof(buffer)-1] = '\0';
    slen = strlen(buffer)+1;
@@ -513,7 +510,7 @@ static void __do_notify(struct mqueue_inode_info *info)
          sig_i.si_errno = 0;
          sig_i.si_code = SI_MESGQ;
          sig_i.si_value = info->notify.sigev_value;
-         sig_i.si_pid = current->tgid;
+         sig_i.si_pid = task_pid_vnr(current);
          sig_i.si_uid = current->uid;
 
          kill_pid_info(info->notify.sigev_signo,
@@ -521,8 +518,7 @@ static void __do_notify(struct mqueue_inode_info *info)
          break;
       case SIGEV_THREAD:
          set_cookie(info->notify_cookie, NOTIFY_WOKENUP);
-         netlink_sendskb(info->notify_sock,
-               info->notify_cookie, 0);
+         netlink_sendskb(info->notify_sock, info->notify_cookie);
          break;
       }
       /* after notification unregisters process */
@@ -568,7 +564,7 @@ static void remove_notification(struct mqueue_inode_info *info)
    if (info->notify_owner != NULL &&
        info->notify.sigev_notify == SIGEV_THREAD) {
       set_cookie(info->notify_cookie, NOTIFY_REMOVED);
-      netlink_sendskb(info->notify_sock, info->notify_cookie, 0);
+      netlink_sendskb(info->notify_sock, info->notify_cookie);
    }
    put_pid(info->notify_owner);
    info->notify_owner = NULL;
@@ -680,7 +676,7 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
 
    if (oflag & O_CREAT) {
       if (dentry->d_inode) {   /* entry already exists */
-         audit_inode(name, dentry->d_inode);
+         audit_inode(name, dentry);
          error = -EEXIST;
          if (oflag & O_EXCL)
             goto out;
@@ -693,7 +689,7 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
       error = -ENOENT;
       if (!dentry->d_inode)
          goto out;
-      audit_inode(name, dentry->d_inode);
+      audit_inode(name, dentry);
       filp = do_open(dentry, oflag);
    }
 
@@ -841,7 +837,7 @@ asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr,
    if (unlikely(filp->f_op != &mqueue_file_operations))
       goto out_fput;
    info = MQUEUE_I(inode);
-   audit_inode(NULL, inode);
+   audit_inode(NULL, filp->f_path.dentry);
 
    if (unlikely(!(filp->f_mode & FMODE_WRITE)))
       goto out_fput;
@@ -925,7 +921,7 @@ asmlinkage ssize_t sys_mq_timedreceive(mqd_t mqdes, char __user *u_msg_ptr,
    if (unlikely(filp->f_op != &mqueue_file_operations))
       goto out_fput;
    info = MQUEUE_I(inode);
-   audit_inode(NULL, inode);
+   audit_inode(NULL, filp->f_path.dentry);
 
    if (unlikely(!(filp->f_mode & FMODE_READ)))
       goto out_fput;
@@ -1014,6 +1010,8 @@ asmlinkage long sys_mq_notify(mqd_t mqdes,
          return -EINVAL;
       }
       if (notification.sigev_notify == SIGEV_THREAD) {
+         long timeo;
+
          /* create the notify skb */
          nc = alloc_skb(NOTIFY_COOKIE_LEN, GFP_KERNEL);
          ret = -ENOMEM;
@@ -1042,8 +1040,8 @@ retry:
             goto out;
          }
 
-         ret = netlink_attachskb(sock, nc, 0,
-               MAX_SCHEDULE_TIMEOUT, NULL);
+         timeo = MAX_SCHEDULE_TIMEOUT;
+         ret = netlink_attachskb(sock, nc, 0, &timeo, NULL);
          if (ret == 1)
                    goto retry;
          if (ret) {
@@ -1140,8 +1138,10 @@ asmlinkage long sys_mq_getsetattr(mqd_t mqdes,
    omqstat.mq_flags = filp->f_flags & O_NONBLOCK;
    if (u_mqstat) {
       ret = audit_mq_getsetattr(mqdes, &mqstat);
-      if (ret != 0)
-         goto out;
+      if (ret != 0) {
+         spin_unlock(&info->lock);
+         goto out_fput;
+      }
       if (mqstat.mq_flags & O_NONBLOCK)
          filp->f_flags |= O_NONBLOCK;
       else
@@ -1197,7 +1197,6 @@ static int msg_maxsize_limit_max = INT_MAX;
 
 static ctl_table mq_sysctls[] = {
    {
-      .ctl_name   = CTL_QUEUESMAX,
       .procname   = "queues_max",
       .data      = &queues_max,
       .maxlen      = sizeof(int),
@@ -1205,7 +1204,6 @@ static ctl_table mq_sysctls[] = {
       .proc_handler   = &proc_dointvec,
    },
    {
-      .ctl_name   = CTL_MSGMAX,
       .procname   = "msg_max",
       .data      = &msg_max,
       .maxlen      = sizeof(int),
@@ -1215,7 +1213,6 @@ static ctl_table mq_sysctls[] = {
       .extra2      = &msg_max_limit_max,
    },
    {
-      .ctl_name   = CTL_MSGSIZEMAX,
       .procname   = "msgsize_max",
       .data      = &msgsize_max,
       .maxlen      = sizeof(int),
@@ -1229,7 +1226,6 @@ static ctl_table mq_sysctls[] = {
 
 static ctl_table mq_sysctl_dir[] = {
    {
-      .ctl_name   = FS_MQUEUE,
       .procname   = "mqueue",
       .mode      = 0555,
       .child      = mq_sysctls,