| 1 | |
| 2 |
|
| 3 | #include <linux/syscalls.h>
|
| 4 | #include <linux/time_namespace.h>
|
| 5 |
|
| 6 | #include "futex.h"
|
| 7 |
|
| 8 | |
| 9 | * Support for robust futexes: the kernel cleans up held futexes at
|
| 10 | * thread exit time.
|
| 11 | *
|
| 12 | * Implementation: user-space maintains a per-thread list of locks it
|
| 13 | * is holding. Upon do_exit(), the kernel carefully walks this list,
|
| 14 | * and marks all locks that are owned by this thread with the
|
| 15 | * FUTEX_OWNER_DIED bit, and wakes up a waiter (if any). The list is
|
| 16 | * always manipulated with the lock held, so the list is private and
|
| 17 | * per-thread. Userspace also maintains a per-thread 'list_op_pending'
|
| 18 | * field, to allow the kernel to clean up if the thread dies after
|
| 19 | * acquiring the lock, but just before it could have added itself to
|
| 20 | * the list. There can only be one such pending lock.
|
| 21 |
|
| 22 |
|
| 23 | |
| 24 | * sys_set_robust_list() - Set the robust-futex list head of a task
|
| 25 | * @head: pointer to the list-head
|
| 26 | * @len: length of the list-head, as userspace expects
|
| 27 |
|
| 28 | SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
|
| 29 | size_t, len)
|
| 30 | {
|
| 31 | |
| 32 | * The kernel knows only one size for now:
|
| 33 |
|
| 34 | if (unlikely(len != sizeof(*head)))
|
| 35 | return -EINVAL;
|
| 36 |
|
| 37 | current->robust_list = head;
|
| 38 |
|
| 39 | return 0;
|
| 40 | }
|
| 41 |
|
| 42 | |
| 43 | * sys_get_robust_list() - Get the robust-futex list head of a task
|
| 44 | * @pid: pid of the process [zero for current task]
|
| 45 | * @head_ptr: pointer to a list-head pointer, the kernel fills it in
|
| 46 | * @len_ptr: pointer to a length field, the kernel fills in the header size
|
| 47 |
|
| 48 | SYSCALL_DEFINE3(get_robust_list, int, pid,
|
| 49 | struct robust_list_head __user * __user *, head_ptr,
|
| 50 | size_t __user *, len_ptr)
|
| 51 | {
|
| 52 | struct robust_list_head __user *head;
|
| 53 | unsigned long ret;
|
| 54 | struct task_struct *p;
|
| 55 |
|
| 56 | rcu_read_lock();
|
| 57 |
|
| 58 | ret = -ESRCH;
|
| 59 | if (!pid)
|
| 60 | p = current;
|
| 61 | else {
|
| 62 | p = find_task_by_vpid(pid);
|
| 63 | if (!p)
|
| 64 | goto err_unlock;
|
| 65 | }
|
| 66 |
|
| 67 | ret = -EPERM;
|
| 68 | if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
|
| 69 | goto err_unlock;
|
| 70 |
|
| 71 | head = p->robust_list;
|
| 72 | rcu_read_unlock();
|
| 73 |
|
| 74 | if (put_user(sizeof(*head), len_ptr))
|
| 75 | return -EFAULT;
|
| 76 | return put_user(head, head_ptr);
|
| 77 |
|
| 78 | err_unlock:
|
| 79 | rcu_read_unlock();
|
| 80 |
|
| 81 | return ret;
|
| 82 | }
|
| 83 |
|
| 84 | long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
|
| 85 | u32 __user *uaddr2, u32 val2, u32 val3)
|
| 86 | {
|
| 87 | unsigned int flags = futex_to_flags(op);
|
| 88 | int cmd = op & FUTEX_CMD_MASK;
|
| 89 |
|
| 90 | if (flags & FLAGS_CLOCKRT) {
|
| 91 | if (cmd != FUTEX_WAIT_BITSET &&
|
| 92 | cmd != FUTEX_WAIT_REQUEUE_PI &&
|
| 93 | cmd != FUTEX_LOCK_PI2)
|
| 94 | return -ENOSYS;
|
| 95 | }
|
| 96 |
|
| 97 | switch (cmd) {
|
| 98 | case FUTEX_WAIT:
|
| 99 | val3 = FUTEX_BITSET_MATCH_ANY;
|
| 100 | fallthrough;
|
| 101 | case FUTEX_WAIT_BITSET:
|
| 102 | return futex_wait(uaddr, flags, val, timeout, val3);
|
| 103 | case FUTEX_WAKE:
|
| 104 | val3 = FUTEX_BITSET_MATCH_ANY;
|
| 105 | fallthrough;
|
| 106 | case FUTEX_WAKE_BITSET:
|
| 107 | return futex_wake(uaddr, flags, val, val3);
|
| 108 | case FUTEX_REQUEUE:
|
| 109 | return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, NULL, 0);
|
| 110 | case FUTEX_CMP_REQUEUE:
|
| 111 | return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 0);
|
| 112 | case FUTEX_WAKE_OP:
|
| 113 | return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3);
|
| 114 | case FUTEX_LOCK_PI:
|
| 115 | flags |= FLAGS_CLOCKRT;
|
| 116 | fallthrough;
|
| 117 | case FUTEX_LOCK_PI2:
|
| 118 | return futex_lock_pi(uaddr, flags, timeout, 0);
|
| 119 | case FUTEX_UNLOCK_PI:
|
| 120 | return futex_unlock_pi(uaddr, flags);
|
| 121 | case FUTEX_TRYLOCK_PI:
|
| 122 | return futex_lock_pi(uaddr, flags, NULL, 1);
|
| 123 | case FUTEX_WAIT_REQUEUE_PI:
|
| 124 | val3 = FUTEX_BITSET_MATCH_ANY;
|
| 125 | return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3,
|
| 126 | uaddr2);
|
| 127 | case FUTEX_CMP_REQUEUE_PI:
|
| 128 | return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 1);
|
| 129 | }
|
| 130 | return -ENOSYS;
|
| 131 | }
|
| 132 |
|
| 133 | static __always_inline bool futex_cmd_has_timeout(u32 cmd)
|
| 134 | {
|
| 135 | switch (cmd) {
|
| 136 | case FUTEX_WAIT:
|
| 137 | case FUTEX_LOCK_PI:
|
| 138 | case FUTEX_LOCK_PI2:
|
| 139 | case FUTEX_WAIT_BITSET:
|
| 140 | case FUTEX_WAIT_REQUEUE_PI:
|
| 141 | return true;
|
| 142 | }
|
| 143 | return false;
|
| 144 | }
|
| 145 |
|
| 146 | static __always_inline int
|
| 147 | futex_init_timeout(u32 cmd, u32 op, struct timespec64 *ts, ktime_t *t)
|
| 148 | {
|
| 149 | if (!timespec64_valid(ts))
|
| 150 | return -EINVAL;
|
| 151 |
|
| 152 | *t = timespec64_to_ktime(*ts);
|
| 153 | if (cmd == FUTEX_WAIT)
|
| 154 | *t = ktime_add_safe(ktime_get(), *t);
|
| 155 | else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME))
|
| 156 | *t = timens_ktime_to_host(CLOCK_MONOTONIC, *t);
|
| 157 | return 0;
|
| 158 | }
|
| 159 |
|
| 160 | SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
|
| 161 | const struct __kernel_timespec __user *, utime,
|
| 162 | u32 __user *, uaddr2, u32, val3)
|
| 163 | {
|
| 164 | int ret, cmd = op & FUTEX_CMD_MASK;
|
| 165 | ktime_t t, *tp = NULL;
|
| 166 | struct timespec64 ts;
|
| 167 |
|
| 168 | if (utime && futex_cmd_has_timeout(cmd)) {
|
| 169 | if (unlikely(should_fail_futex(!(op & FUTEX_PRIVATE_FLAG))))
|
| 170 | return -EFAULT;
|
| 171 | if (get_timespec64(&ts, utime))
|
| 172 | return -EFAULT;
|
| 173 | ret = futex_init_timeout(cmd, op, &ts, &t);
|
| 174 | if (ret)
|
| 175 | return ret;
|
| 176 | tp = &t;
|
| 177 | }
|
| 178 |
|
| 179 | return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
|
| 180 | }
|
| 181 |
|
| 182 | |
| 183 | * futex_parse_waitv - Parse a waitv array from userspace
|
| 184 | * @futexv: Kernel side list of waiters to be filled
|
| 185 | * @uwaitv: Userspace list to be parsed
|
| 186 | * @nr_futexes: Length of futexv
|
| 187 | * @wake: Wake to call when futex is woken
|
| 188 | * @wake_data: Data for the wake handler
|
| 189 | *
|
| 190 | * Return: Error code on failure, 0 on success
|
| 191 |
|
| 192 | int futex_parse_waitv(struct futex_vector *futexv,
|
| 193 | struct futex_waitv __user *uwaitv,
|
| 194 | unsigned int nr_futexes, futex_wake_fn *wake,
|
| 195 | void *wake_data)
|
| 196 | {
|
| 197 | struct futex_waitv aux;
|
| 198 | unsigned int i;
|
| 199 |
|
| 200 | for (i = 0; i < nr_futexes; i++) {
|
| 201 | unsigned int flags;
|
| 202 |
|
| 203 | if (copy_from_user(&aux, &uwaitv[i], sizeof(aux)))
|
| 204 | return -EFAULT;
|
| 205 |
|
| 206 | if ((aux.flags & ~FUTEX2_VALID_MASK) || aux.__reserved)
|
| 207 | return -EINVAL;
|
| 208 |
|
| 209 | flags = futex2_to_flags(aux.flags);
|
| 210 | if (!futex_flags_valid(flags))
|
| 211 | return -EINVAL;
|
| 212 |
|
| 213 | if (!futex_validate_input(flags, aux.val))
|
| 214 | return -EINVAL;
|
| 215 |
|
| 216 | futexv[i].w.flags = flags;
|
| 217 | futexv[i].w.val = aux.val;
|
| 218 | futexv[i].w.uaddr = aux.uaddr;
|
| 219 | futexv[i].q = futex_q_init;
|
| 220 | futexv[i].q.wake = wake;
|
| 221 | futexv[i].q.wake_data = wake_data;
|
| 222 | }
|
| 223 |
|
| 224 | return 0;
|
| 225 | }
|
| 226 |
|
| 227 | static int futex2_setup_timeout(struct __kernel_timespec __user *timeout,
|
| 228 | clockid_t clockid, struct hrtimer_sleeper *to)
|
| 229 | {
|
| 230 | int flag_clkid = 0, flag_init = 0;
|
| 231 | struct timespec64 ts;
|
| 232 | ktime_t time;
|
| 233 | int ret;
|
| 234 |
|
| 235 | if (!timeout)
|
| 236 | return 0;
|
| 237 |
|
| 238 | if (clockid == CLOCK_REALTIME) {
|
| 239 | flag_clkid = FLAGS_CLOCKRT;
|
| 240 | flag_init = FUTEX_CLOCK_REALTIME;
|
| 241 | }
|
| 242 |
|
| 243 | if (clockid != CLOCK_REALTIME && clockid != CLOCK_MONOTONIC)
|
| 244 | return -EINVAL;
|
| 245 |
|
| 246 | if (get_timespec64(&ts, timeout))
|
| 247 | return -EFAULT;
|
| 248 |
|
| 249 | |
| 250 | * Since there's no opcode for futex_waitv, use
|
| 251 | * FUTEX_WAIT_BITSET that uses absolute timeout as well
|
| 252 |
|
| 253 | ret = futex_init_timeout(FUTEX_WAIT_BITSET, flag_init, &ts, &time);
|
| 254 | if (ret)
|
| 255 | return ret;
|
| 256 |
|
| 257 | futex_setup_timer(&time, to, flag_clkid, 0);
|
| 258 | return 0;
|
| 259 | }
|
| 260 |
|
| 261 | static inline void futex2_destroy_timeout(struct hrtimer_sleeper *to)
|
| 262 | {
|
| 263 | hrtimer_cancel(&to->timer);
|
| 264 | destroy_hrtimer_on_stack(&to->timer);
|
| 265 | }
|
| 266 |
|
| 267 | |
| 268 | * sys_futex_waitv - Wait on a list of futexes
|
| 269 | * @waiters: List of futexes to wait on
|
| 270 | * @nr_futexes: Length of futexv
|
| 271 | * @flags: Flag for timeout (monotonic/realtime)
|
| 272 | * @timeout: Optional absolute timeout.
|
| 273 | * @clockid: Clock to be used for the timeout, realtime or monotonic.
|
| 274 | *
|
| 275 | * Given an array of `struct futex_waitv`, wait on each uaddr. The thread wakes
|
| 276 | * if a futex_wake() is performed at any uaddr. The syscall returns immediately
|
| 277 | * if any waiter has *uaddr != val. *timeout is an optional timeout value for
|
| 278 | * the operation. Each waiter has individual flags. The `flags` argument for
|
| 279 | * the syscall should be used solely for specifying the timeout as realtime, if
|
| 280 | * needed. Flags for private futexes, sizes, etc. should be used on the
|
| 281 | * individual flags of each waiter.
|
| 282 | *
|
| 283 | * Returns the array index of one of the woken futexes. No further information
|
| 284 | * is provided: any number of other futexes may also have been woken by the
|
| 285 | * same event, and if more than one futex was woken, the retrned index may
|
| 286 | * refer to any one of them. (It is not necessaryily the futex with the
|
| 287 | * smallest index, nor the one most recently woken, nor...)
|
| 288 |
|
| 289 |
|
| 290 | SYSCALL_DEFINE5(futex_waitv, struct futex_waitv __user *, waiters,
|
| 291 | unsigned int, nr_futexes, unsigned int, flags,
|
| 292 | struct __kernel_timespec __user *, timeout, clockid_t, clockid)
|
| 293 | {
|
| 294 | struct hrtimer_sleeper to;
|
| 295 | struct futex_vector *futexv;
|
| 296 | int ret;
|
| 297 |
|
| 298 |
|
| 299 | if (flags)
|
| 300 | return -EINVAL;
|
| 301 |
|
| 302 | if (!nr_futexes || nr_futexes > FUTEX_WAITV_MAX || !waiters)
|
| 303 | return -EINVAL;
|
| 304 |
|
| 305 | if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to)))
|
| 306 | return ret;
|
| 307 |
|
| 308 | futexv = kcalloc(nr_futexes, sizeof(*futexv), GFP_KERNEL);
|
| 309 | if (!futexv) {
|
| 310 | ret = -ENOMEM;
|
| 311 | goto destroy_timer;
|
| 312 | }
|
| 313 |
|
| 314 | ret = futex_parse_waitv(futexv, waiters, nr_futexes, futex_wake_mark,
|
| 315 | NULL);
|
| 316 | if (!ret)
|
| 317 | ret = futex_wait_multiple(futexv, nr_futexes, timeout ? &to : NULL);
|
| 318 |
|
| 319 | kfree(futexv);
|
| 320 |
|
| 321 | destroy_timer:
|
| 322 | if (timeout)
|
| 323 | futex2_destroy_timeout(&to);
|
| 324 | return ret;
|
| 325 | }
|
| 326 |
|
| 327 | |
| 328 | * sys_futex_wake - Wake a number of futexes
|
| 329 | * @uaddr: Address of the futex(es) to wake
|
| 330 | * @mask: bitmask
|
| 331 | * @nr: Number of the futexes to wake
|
| 332 | * @flags: FUTEX2 flags
|
| 333 | *
|
| 334 | * Identical to the traditional FUTEX_WAKE_BITSET op, except it is part of the
|
| 335 | * futex2 family of calls.
|
| 336 |
|
| 337 |
|
| 338 | SYSCALL_DEFINE4(futex_wake,
|
| 339 | void __user *, uaddr,
|
| 340 | unsigned long, mask,
|
| 341 | int, nr,
|
| 342 | unsigned int, flags)
|
| 343 | {
|
| 344 | if (flags & ~FUTEX2_VALID_MASK)
|
| 345 | return -EINVAL;
|
| 346 |
|
| 347 | flags = futex2_to_flags(flags);
|
| 348 | if (!futex_flags_valid(flags))
|
| 349 | return -EINVAL;
|
| 350 |
|
| 351 | if (!futex_validate_input(flags, mask))
|
| 352 | return -EINVAL;
|
| 353 |
|
| 354 | return futex_wake(uaddr, FLAGS_STRICT | flags, nr, mask);
|
| 355 | }
|
| 356 |
|
| 357 | |
| 358 | * sys_futex_wait - Wait on a futex
|
| 359 | * @uaddr: Address of the futex to wait on
|
| 360 | * @val: Value of @uaddr
|
| 361 | * @mask: bitmask
|
| 362 | * @flags: FUTEX2 flags
|
| 363 | * @timeout: Optional absolute timeout
|
| 364 | * @clockid: Clock to be used for the timeout, realtime or monotonic
|
| 365 | *
|
| 366 | * Identical to the traditional FUTEX_WAIT_BITSET op, except it is part of the
|
| 367 | * futex2 familiy of calls.
|
| 368 |
|
| 369 |
|
| 370 | SYSCALL_DEFINE6(futex_wait,
|
| 371 | void __user *, uaddr,
|
| 372 | unsigned long, val,
|
| 373 | unsigned long, mask,
|
| 374 | unsigned int, flags,
|
| 375 | struct __kernel_timespec __user *, timeout,
|
| 376 | clockid_t, clockid)
|
| 377 | {
|
| 378 | struct hrtimer_sleeper to;
|
| 379 | int ret;
|
| 380 |
|
| 381 | if (flags & ~FUTEX2_VALID_MASK)
|
| 382 | return -EINVAL;
|
| 383 |
|
| 384 | flags = futex2_to_flags(flags);
|
| 385 | if (!futex_flags_valid(flags))
|
| 386 | return -EINVAL;
|
| 387 |
|
| 388 | if (!futex_validate_input(flags, val) ||
|
| 389 | !futex_validate_input(flags, mask))
|
| 390 | return -EINVAL;
|
| 391 |
|
| 392 | if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to)))
|
| 393 | return ret;
|
| 394 |
|
| 395 | ret = __futex_wait(uaddr, flags, val, timeout ? &to : NULL, mask);
|
| 396 |
|
| 397 | if (timeout)
|
| 398 | futex2_destroy_timeout(&to);
|
| 399 |
|
| 400 | return ret;
|
| 401 | }
|
| 402 |
|
| 403 | |
| 404 | * sys_futex_requeue - Requeue a waiter from one futex to another
|
| 405 | * @waiters: array describing the source and destination futex
|
| 406 | * @flags: unused
|
| 407 | * @nr_wake: number of futexes to wake
|
| 408 | * @nr_requeue: number of futexes to requeue
|
| 409 | *
|
| 410 | * Identical to the traditional FUTEX_CMP_REQUEUE op, except it is part of the
|
| 411 | * futex2 family of calls.
|
| 412 |
|
| 413 |
|
| 414 | SYSCALL_DEFINE4(futex_requeue,
|
| 415 | struct futex_waitv __user *, waiters,
|
| 416 | unsigned int, flags,
|
| 417 | int, nr_wake,
|
| 418 | int, nr_requeue)
|
| 419 | {
|
| 420 | struct futex_vector futexes[2];
|
| 421 | u32 cmpval;
|
| 422 | int ret;
|
| 423 |
|
| 424 | if (flags)
|
| 425 | return -EINVAL;
|
| 426 |
|
| 427 | if (!waiters)
|
| 428 | return -EINVAL;
|
| 429 |
|
| 430 | ret = futex_parse_waitv(futexes, waiters, 2, futex_wake_mark, NULL);
|
| 431 | if (ret)
|
| 432 | return ret;
|
| 433 |
|
| 434 | cmpval = futexes[0].w.val;
|
| 435 |
|
| 436 | return futex_requeue(u64_to_user_ptr(futexes[0].w.uaddr), futexes[0].w.flags,
|
| 437 | u64_to_user_ptr(futexes[1].w.uaddr), futexes[1].w.flags,
|
| 438 | nr_wake, nr_requeue, &cmpval, 0);
|
| 439 | }
|
| 440 |
|
| 441 | #ifdef CONFIG_COMPAT
|
| 442 | COMPAT_SYSCALL_DEFINE2(set_robust_list,
|
| 443 | struct compat_robust_list_head __user *, head,
|
| 444 | compat_size_t, len)
|
| 445 | {
|
| 446 | if (unlikely(len != sizeof(*head)))
|
| 447 | return -EINVAL;
|
| 448 |
|
| 449 | current->compat_robust_list = head;
|
| 450 |
|
| 451 | return 0;
|
| 452 | }
|
| 453 |
|
| 454 | COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
|
| 455 | compat_uptr_t __user *, head_ptr,
|
| 456 | compat_size_t __user *, len_ptr)
|
| 457 | {
|
| 458 | struct compat_robust_list_head __user *head;
|
| 459 | unsigned long ret;
|
| 460 | struct task_struct *p;
|
| 461 |
|
| 462 | rcu_read_lock();
|
| 463 |
|
| 464 | ret = -ESRCH;
|
| 465 | if (!pid)
|
| 466 | p = current;
|
| 467 | else {
|
| 468 | p = find_task_by_vpid(pid);
|
| 469 | if (!p)
|
| 470 | goto err_unlock;
|
| 471 | }
|
| 472 |
|
| 473 | ret = -EPERM;
|
| 474 | if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
|
| 475 | goto err_unlock;
|
| 476 |
|
| 477 | head = p->compat_robust_list;
|
| 478 | rcu_read_unlock();
|
| 479 |
|
| 480 | if (put_user(sizeof(*head), len_ptr))
|
| 481 | return -EFAULT;
|
| 482 | return put_user(ptr_to_compat(head), head_ptr);
|
| 483 |
|
| 484 | err_unlock:
|
| 485 | rcu_read_unlock();
|
| 486 |
|
| 487 | return ret;
|
| 488 | }
|
| 489 | #endif
|
| 490 |
|
| 491 | #ifdef CONFIG_COMPAT_32BIT_TIME
|
| 492 | SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val,
|
| 493 | const struct old_timespec32 __user *, utime, u32 __user *, uaddr2,
|
| 494 | u32, val3)
|
| 495 | {
|
| 496 | int ret, cmd = op & FUTEX_CMD_MASK;
|
| 497 | ktime_t t, *tp = NULL;
|
| 498 | struct timespec64 ts;
|
| 499 |
|
| 500 | if (utime && futex_cmd_has_timeout(cmd)) {
|
| 501 | if (get_old_timespec32(&ts, utime))
|
| 502 | return -EFAULT;
|
| 503 | ret = futex_init_timeout(cmd, op, &ts, &t);
|
| 504 | if (ret)
|
| 505 | return ret;
|
| 506 | tp = &t;
|
| 507 | }
|
| 508 |
|
| 509 | return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
|
| 510 | }
|
| 511 | #endif
|
| 512 |
|