[linux-2.6-block.git] / kernel / futex / syscalls.c

// SPDX-License-Identifier: GPL-2.0-or-later

#include <linux/syscalls.h>
#include <linux/time_namespace.h>

#include "futex.h"

/*
 * Support for robust futexes: the kernel cleans up held futexes at
 * thread exit time.
 *
 * Implementation: user-space maintains a per-thread list of locks it
 * is holding. Upon do_exit(), the kernel carefully walks this list,
 * and marks all locks that are owned by this thread with the
 * FUTEX_OWNER_DIED bit, and wakes up a waiter (if any). The list is
 * always manipulated with the lock held, so the list is private and
 * per-thread. Userspace also maintains a per-thread 'list_op_pending'
 * field, to allow the kernel to clean up if the thread dies after
 * acquiring the lock, but just before it could have added itself to
 * the list. There can only be one such pending lock.
 */

/**
 * sys_set_robust_list() - Set the robust-futex list head of a task
 * @head:	pointer to the list-head
 * @len:	length of the list-head, as userspace expects
 */
SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
		size_t, len)
{
	/*
	 * The kernel knows only one size for now:
	 */
	if (unlikely(len != sizeof(*head)))
		return -EINVAL;

	current->robust_list = head;

	return 0;
}

/**
 * sys_get_robust_list() - Get the robust-futex list head of a task
 * @pid:	pid of the process [zero for current task]
 * @head_ptr:	pointer to a list-head pointer, the kernel fills it in
 * @len_ptr:	pointer to a length field, the kernel fills in the header size
 */
SYSCALL_DEFINE3(get_robust_list, int, pid,
		struct robust_list_head __user * __user *, head_ptr,
		size_t __user *, len_ptr)
{
	struct robust_list_head __user *head;
	unsigned long ret;
	struct task_struct *p;

	rcu_read_lock();

	ret = -ESRCH;
	if (!pid)
		p = current;
	else {
		p = find_task_by_vpid(pid);
		if (!p)
			goto err_unlock;
	}

	ret = -EPERM;
	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
		goto err_unlock;

	head = p->robust_list;
	rcu_read_unlock();

	if (put_user(sizeof(*head), len_ptr))
		return -EFAULT;
	return put_user(head, head_ptr);

err_unlock:
	rcu_read_unlock();

	return ret;
}

long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
		u32 __user *uaddr2, u32 val2, u32 val3)
{
	unsigned int flags = futex_to_flags(op);
	int cmd = op & FUTEX_CMD_MASK;

	if (flags & FLAGS_CLOCKRT) {
		if (cmd != FUTEX_WAIT_BITSET &&
		    cmd != FUTEX_WAIT_REQUEUE_PI &&
		    cmd != FUTEX_LOCK_PI2)
			return -ENOSYS;
	}

	switch (cmd) {
	case FUTEX_WAIT:
		val3 = FUTEX_BITSET_MATCH_ANY;
		fallthrough;
	case FUTEX_WAIT_BITSET:
		return futex_wait(uaddr, flags, val, timeout, val3);
	case FUTEX_WAKE:
		val3 = FUTEX_BITSET_MATCH_ANY;
		fallthrough;
	case FUTEX_WAKE_BITSET:
		return futex_wake(uaddr, flags, val, val3);
	case FUTEX_REQUEUE:
		return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, NULL, 0);
	case FUTEX_CMP_REQUEUE:
		return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 0);
	case FUTEX_WAKE_OP:
		return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3);
	case FUTEX_LOCK_PI:
		flags |= FLAGS_CLOCKRT;
		fallthrough;
	case FUTEX_LOCK_PI2:
		return futex_lock_pi(uaddr, flags, timeout, 0);
	case FUTEX_UNLOCK_PI:
		return futex_unlock_pi(uaddr, flags);
	case FUTEX_TRYLOCK_PI:
		return futex_lock_pi(uaddr, flags, NULL, 1);
	case FUTEX_WAIT_REQUEUE_PI:
		val3 = FUTEX_BITSET_MATCH_ANY;
		return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3,
					     uaddr2);
	case FUTEX_CMP_REQUEUE_PI:
		return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 1);
	}
	return -ENOSYS;
}

static __always_inline bool futex_cmd_has_timeout(u32 cmd)
{
	switch (cmd) {
	case FUTEX_WAIT:
	case FUTEX_LOCK_PI:
	case FUTEX_LOCK_PI2:
	case FUTEX_WAIT_BITSET:
	case FUTEX_WAIT_REQUEUE_PI:
		return true;
	}
	return false;
}

static __always_inline int
futex_init_timeout(u32 cmd, u32 op, struct timespec64 *ts, ktime_t *t)
{
	if (!timespec64_valid(ts))
		return -EINVAL;

	*t = timespec64_to_ktime(*ts);
	if (cmd == FUTEX_WAIT)
		*t = ktime_add_safe(ktime_get(), *t);
	else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME))
		*t = timens_ktime_to_host(CLOCK_MONOTONIC, *t);
	return 0;
}

SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
		const struct __kernel_timespec __user *, utime,
		u32 __user *, uaddr2, u32, val3)
{
	int ret, cmd = op & FUTEX_CMD_MASK;
	ktime_t t, *tp = NULL;
	struct timespec64 ts;

	if (utime && futex_cmd_has_timeout(cmd)) {
		if (unlikely(should_fail_futex(!(op & FUTEX_PRIVATE_FLAG))))
			return -EFAULT;
		if (get_timespec64(&ts, utime))
			return -EFAULT;
		ret = futex_init_timeout(cmd, op, &ts, &t);
		if (ret)
			return ret;
		tp = &t;
	}

	return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
}

/**
 * futex_parse_waitv - Parse a waitv array from userspace
 * @futexv:	Kernel side list of waiters to be filled
 * @uwaitv:     Userspace list to be parsed
 * @nr_futexes: Length of futexv
 * @wake:	Wake to call when futex is woken
 * @wake_data:	Data for the wake handler
 *
 * Return: Error code on failure, 0 on success
 */
int futex_parse_waitv(struct futex_vector *futexv,
		      struct futex_waitv __user *uwaitv,
		      unsigned int nr_futexes, futex_wake_fn *wake,
		      void *wake_data)
{
	struct futex_waitv aux;
	unsigned int i;

	for (i = 0; i < nr_futexes; i++) {
		unsigned int flags;

		if (copy_from_user(&aux, &uwaitv[i], sizeof(aux)))
			return -EFAULT;

		if ((aux.flags & ~FUTEX2_VALID_MASK) || aux.__reserved)
			return -EINVAL;

		flags = futex2_to_flags(aux.flags);
		if (!futex_flags_valid(flags))
			return -EINVAL;

		if (!futex_validate_input(flags, aux.val))
			return -EINVAL;

		futexv[i].w.flags = flags;
		futexv[i].w.val = aux.val;
		futexv[i].w.uaddr = aux.uaddr;
		futexv[i].q = futex_q_init;
		futexv[i].q.wake = wake;
		futexv[i].q.wake_data = wake_data;
	}

	return 0;
}

static int futex2_setup_timeout(struct __kernel_timespec __user *timeout,
				clockid_t clockid, struct hrtimer_sleeper *to)
{
	int flag_clkid = 0, flag_init = 0;
	struct timespec64 ts;
	ktime_t time;
	int ret;

	if (!timeout)
		return 0;

	if (clockid == CLOCK_REALTIME) {
		flag_clkid = FLAGS_CLOCKRT;
		flag_init = FUTEX_CLOCK_REALTIME;
	}

	if (clockid != CLOCK_REALTIME && clockid != CLOCK_MONOTONIC)
		return -EINVAL;

	if (get_timespec64(&ts, timeout))
		return -EFAULT;

	/*
	 * Since there's no opcode for futex_waitv, use
	 * FUTEX_WAIT_BITSET that uses absolute timeout as well
	 */
	ret = futex_init_timeout(FUTEX_WAIT_BITSET, flag_init, &ts, &time);
	if (ret)
		return ret;

	futex_setup_timer(&time, to, flag_clkid, 0);
	return 0;
}

static inline void futex2_destroy_timeout(struct hrtimer_sleeper *to)
{
	hrtimer_cancel(&to->timer);
	destroy_hrtimer_on_stack(&to->timer);
}

/**
 * sys_futex_waitv - Wait on a list of futexes
 * @waiters:    List of futexes to wait on
 * @nr_futexes: Length of futexv
 * @flags:      Flag for timeout (monotonic/realtime)
 * @timeout:	Optional absolute timeout.
 * @clockid:	Clock to be used for the timeout, realtime or monotonic.
 *
 * Given an array of `struct futex_waitv`, wait on each uaddr. The thread wakes
 * if a futex_wake() is performed at any uaddr. The syscall returns immediately
 * if any waiter has *uaddr != val. *timeout is an optional timeout value for
 * the operation. Each waiter has individual flags. The `flags` argument for
 * the syscall should be used solely for specifying the timeout as realtime, if
 * needed. Flags for private futexes, sizes, etc. should be used on the
 * individual flags of each waiter.
 *
 * Returns the array index of one of the woken futexes. No further information
 * is provided: any number of other futexes may also have been woken by the
 * same event, and if more than one futex was woken, the retrned index may
 * refer to any one of them. (It is not necessaryily the futex with the
 * smallest index, nor the one most recently woken, nor...)
 */

SYSCALL_DEFINE5(futex_waitv, struct futex_waitv __user *, waiters,
		unsigned int, nr_futexes, unsigned int, flags,
		struct __kernel_timespec __user *, timeout, clockid_t, clockid)
{
	struct hrtimer_sleeper to;
	struct futex_vector *futexv;
	int ret;

	/* This syscall supports no flags for now */
	if (flags)
		return -EINVAL;

	if (!nr_futexes || nr_futexes > FUTEX_WAITV_MAX || !waiters)
		return -EINVAL;

	if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to)))
		return ret;

	futexv = kcalloc(nr_futexes, sizeof(*futexv), GFP_KERNEL);
	if (!futexv) {
		ret = -ENOMEM;
		goto destroy_timer;
	}

	ret = futex_parse_waitv(futexv, waiters, nr_futexes, futex_wake_mark,
				NULL);
	if (!ret)
		ret = futex_wait_multiple(futexv, nr_futexes, timeout ? &to : NULL);

	kfree(futexv);

destroy_timer:
	if (timeout)
		futex2_destroy_timeout(&to);
	return ret;
}

/*
 * sys_futex_wake - Wake a number of futexes
 * @uaddr:	Address of the futex(es) to wake
 * @mask:	bitmask
 * @nr:		Number of the futexes to wake
 * @flags:	FUTEX2 flags
 *
 * Identical to the traditional FUTEX_WAKE_BITSET op, except it is part of the
 * futex2 family of calls.
 */

SYSCALL_DEFINE4(futex_wake,
		void __user *, uaddr,
		unsigned long, mask,
		int, nr,
		unsigned int, flags)
{
	if (flags & ~FUTEX2_VALID_MASK)
		return -EINVAL;

	flags = futex2_to_flags(flags);
	if (!futex_flags_valid(flags))
		return -EINVAL;

	if (!futex_validate_input(flags, mask))
		return -EINVAL;

	return futex_wake(uaddr, FLAGS_STRICT | flags, nr, mask);
}

/*
 * sys_futex_wait - Wait on a futex
 * @uaddr:	Address of the futex to wait on
 * @val:	Value of @uaddr
 * @mask:	bitmask
 * @flags:	FUTEX2 flags
 * @timeout:	Optional absolute timeout
 * @clockid:	Clock to be used for the timeout, realtime or monotonic
 *
 * Identical to the traditional FUTEX_WAIT_BITSET op, except it is part of the
 * futex2 familiy of calls.
 */

SYSCALL_DEFINE6(futex_wait,
		void __user *, uaddr,
		unsigned long, val,
		unsigned long, mask,
		unsigned int, flags,
		struct __kernel_timespec __user *, timeout,
		clockid_t, clockid)
{
	struct hrtimer_sleeper to;
	int ret;

	if (flags & ~FUTEX2_VALID_MASK)
		return -EINVAL;

	flags = futex2_to_flags(flags);
	if (!futex_flags_valid(flags))
		return -EINVAL;

	if (!futex_validate_input(flags, val) ||
	    !futex_validate_input(flags, mask))
		return -EINVAL;

	if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to)))
		return ret;

	ret = __futex_wait(uaddr, flags, val, timeout ? &to : NULL, mask);

	if (timeout)
		futex2_destroy_timeout(&to);

	return ret;
}

/*
 * sys_futex_requeue - Requeue a waiter from one futex to another
 * @waiters:	array describing the source and destination futex
 * @flags:	unused
 * @nr_wake:	number of futexes to wake
 * @nr_requeue:	number of futexes to requeue
 *
 * Identical to the traditional FUTEX_CMP_REQUEUE op, except it is part of the
 * futex2 family of calls.
 */

SYSCALL_DEFINE4(futex_requeue,
		struct futex_waitv __user *, waiters,
		unsigned int, flags,
		int, nr_wake,
		int, nr_requeue)
{
	struct futex_vector futexes[2];
	u32 cmpval;
	int ret;

	if (flags)
		return -EINVAL;

	if (!waiters)
		return -EINVAL;

	ret = futex_parse_waitv(futexes, waiters, 2, futex_wake_mark, NULL);
	if (ret)
		return ret;

	cmpval = futexes[0].w.val;

	return futex_requeue(u64_to_user_ptr(futexes[0].w.uaddr), futexes[0].w.flags,
			     u64_to_user_ptr(futexes[1].w.uaddr), futexes[1].w.flags,
			     nr_wake, nr_requeue, &cmpval, 0);
}

#ifdef CONFIG_COMPAT
COMPAT_SYSCALL_DEFINE2(set_robust_list,
		struct compat_robust_list_head __user *, head,
		compat_size_t, len)
{
	if (unlikely(len != sizeof(*head)))
		return -EINVAL;

	current->compat_robust_list = head;

	return 0;
}

COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
			compat_uptr_t __user *, head_ptr,
			compat_size_t __user *, len_ptr)
{
	struct compat_robust_list_head __user *head;
	unsigned long ret;
	struct task_struct *p;

	rcu_read_lock();

	ret = -ESRCH;
	if (!pid)
		p = current;
	else {
		p = find_task_by_vpid(pid);
		if (!p)
			goto err_unlock;
	}

	ret = -EPERM;
	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
		goto err_unlock;

	head = p->compat_robust_list;
	rcu_read_unlock();

	if (put_user(sizeof(*head), len_ptr))
		return -EFAULT;
	return put_user(ptr_to_compat(head), head_ptr);

err_unlock:
	rcu_read_unlock();

	return ret;
}
#endif /* CONFIG_COMPAT */

#ifdef CONFIG_COMPAT_32BIT_TIME
SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val,
		const struct old_timespec32 __user *, utime, u32 __user *, uaddr2,
		u32, val3)
{
	int ret, cmd = op & FUTEX_CMD_MASK;
	ktime_t t, *tp = NULL;
	struct timespec64 ts;

	if (utime && futex_cmd_has_timeout(cmd)) {
		if (get_old_timespec32(&ts, utime))
			return -EFAULT;
		ret = futex_init_timeout(cmd, op, &ts, &t);
		if (ret)
			return ret;
		tp = &t;
	}

	return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
}
#endif /* CONFIG_COMPAT_32BIT_TIME */
Commit	Line	Data
af8cc960 PZ	1	// SPDX-License-Identifier: GPL-2.0-or-later
af8cc960 PZ	2
af8cc960 PZ	3	#include <linux/syscalls.h>
	4	#include <linux/time_namespace.h>
	5
	6	#include "futex.h"
	7
	8	/*
	9	* Support for robust futexes: the kernel cleans up held futexes at
	10	* thread exit time.
	11	*
	12	* Implementation: user-space maintains a per-thread list of locks it
	13	* is holding. Upon do_exit(), the kernel carefully walks this list,
	14	* and marks all locks that are owned by this thread with the
	15	* FUTEX_OWNER_DIED bit, and wakes up a waiter (if any). The list is
	16	* always manipulated with the lock held, so the list is private and
	17	* per-thread. Userspace also maintains a per-thread 'list_op_pending'
	18	* field, to allow the kernel to clean up if the thread dies after
	19	* acquiring the lock, but just before it could have added itself to
	20	* the list. There can only be one such pending lock.
	21	*/
	22
	23	/**
	24	* sys_set_robust_list() - Set the robust-futex list head of a task
	25	* @head: pointer to the list-head
	26	* @len: length of the list-head, as userspace expects
	27	*/
	28	SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
	29	size_t, len)
	30	{
af8cc960 PZ	31	/*
	32	* The kernel knows only one size for now:
	33	*/
	34	if (unlikely(len != sizeof(*head)))
	35	return -EINVAL;
	36
	37	current->robust_list = head;
	38
	39	return 0;
	40	}
	41
	42	/**
	43	* sys_get_robust_list() - Get the robust-futex list head of a task
	44	* @pid: pid of the process [zero for current task]
	45	* @head_ptr: pointer to a list-head pointer, the kernel fills it in
	46	* @len_ptr: pointer to a length field, the kernel fills in the header size
	47	*/
	48	SYSCALL_DEFINE3(get_robust_list, int, pid,
	49	struct robust_list_head __user * __user *, head_ptr,
	50	size_t __user *, len_ptr)
	51	{
	52	struct robust_list_head __user *head;
	53	unsigned long ret;
	54	struct task_struct *p;
	55
af8cc960 PZ	56	rcu_read_lock();
	57
	58	ret = -ESRCH;
	59	if (!pid)
	60	p = current;
	61	else {
	62	p = find_task_by_vpid(pid);
	63	if (!p)
	64	goto err_unlock;
	65	}
	66
	67	ret = -EPERM;
	68	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
	69	goto err_unlock;
	70
	71	head = p->robust_list;
	72	rcu_read_unlock();
	73
	74	if (put_user(sizeof(*head), len_ptr))
	75	return -EFAULT;
	76	return put_user(head, head_ptr);
	77
	78	err_unlock:
	79	rcu_read_unlock();
	80
	81	return ret;
	82	}
	83
	84	long do_futex(u32 __user uaddr, int op, u32 val, ktime_t timeout,
	85	u32 __user *uaddr2, u32 val2, u32 val3)
	86	{
5694289c	87	unsigned int flags = futex_to_flags(op);
af8cc960	88	int cmd = op & FUTEX_CMD_MASK;
af8cc960	89
5694289c	90	if (flags & FLAGS_CLOCKRT) {
	91	if (cmd != FUTEX_WAIT_BITSET &&
	92	cmd != FUTEX_WAIT_REQUEUE_PI &&
af8cc960 PZ	93	cmd != FUTEX_LOCK_PI2)
	94	return -ENOSYS;
	95	}
	96
af8cc960 PZ	97	switch (cmd) {
	98	case FUTEX_WAIT:
	99	val3 = FUTEX_BITSET_MATCH_ANY;
	100	fallthrough;
	101	case FUTEX_WAIT_BITSET:
	102	return futex_wait(uaddr, flags, val, timeout, val3);
	103	case FUTEX_WAKE:
	104	val3 = FUTEX_BITSET_MATCH_ANY;
	105	fallthrough;
	106	case FUTEX_WAKE_BITSET:
	107	return futex_wake(uaddr, flags, val, val3);
	108	case FUTEX_REQUEUE:
27b88f35	109	return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, NULL, 0);
af8cc960	110	case FUTEX_CMP_REQUEUE:
27b88f35	111	return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 0);
af8cc960 PZ	112	case FUTEX_WAKE_OP:
	113	return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3);
	114	case FUTEX_LOCK_PI:
	115	flags \|= FLAGS_CLOCKRT;
	116	fallthrough;
	117	case FUTEX_LOCK_PI2:
	118	return futex_lock_pi(uaddr, flags, timeout, 0);
	119	case FUTEX_UNLOCK_PI:
	120	return futex_unlock_pi(uaddr, flags);
	121	case FUTEX_TRYLOCK_PI:
	122	return futex_lock_pi(uaddr, flags, NULL, 1);
	123	case FUTEX_WAIT_REQUEUE_PI:
	124	val3 = FUTEX_BITSET_MATCH_ANY;
	125	return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3,
	126	uaddr2);
	127	case FUTEX_CMP_REQUEUE_PI:
27b88f35	128	return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 1);
af8cc960 PZ	129	}
	130	return -ENOSYS;
	131	}
	132
	133	static __always_inline bool futex_cmd_has_timeout(u32 cmd)
	134	{
	135	switch (cmd) {
	136	case FUTEX_WAIT:
	137	case FUTEX_LOCK_PI:
	138	case FUTEX_LOCK_PI2:
	139	case FUTEX_WAIT_BITSET:
	140	case FUTEX_WAIT_REQUEUE_PI:
	141	return true;
	142	}
	143	return false;
	144	}
	145
	146	static __always_inline int
	147	futex_init_timeout(u32 cmd, u32 op, struct timespec64 ts, ktime_t t)
	148	{
	149	if (!timespec64_valid(ts))
	150	return -EINVAL;
	151
	152	t = timespec64_to_ktime(ts);
	153	if (cmd == FUTEX_WAIT)
	154	t = ktime_add_safe(ktime_get(), t);
	155	else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME))
	156	t = timens_ktime_to_host(CLOCK_MONOTONIC, t);
	157	return 0;
	158	}
	159
	160	SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
	161	const struct __kernel_timespec __user *, utime,
	162	u32 __user *, uaddr2, u32, val3)
	163	{
	164	int ret, cmd = op & FUTEX_CMD_MASK;
	165	ktime_t t, *tp = NULL;
	166	struct timespec64 ts;
	167
	168	if (utime && futex_cmd_has_timeout(cmd)) {
	169	if (unlikely(should_fail_futex(!(op & FUTEX_PRIVATE_FLAG))))
	170	return -EFAULT;
	171	if (get_timespec64(&ts, utime))
	172	return -EFAULT;
	173	ret = futex_init_timeout(cmd, op, &ts, &t);
	174	if (ret)
	175	return ret;
	176	tp = &t;
	177	}
	178
	179	return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
	180	}
	181
bf69bad3 AA	182	/**
	183	* futex_parse_waitv - Parse a waitv array from userspace
	184	* @futexv: Kernel side list of waiters to be filled
	185	* @uwaitv: Userspace list to be parsed
	186	* @nr_futexes: Length of futexv
5177c0cb JA	187	* @wake: Wake to call when futex is woken
5177c0cb JA	188	* @wake_data: Data for the wake handler
bf69bad3 AA	189	*
	190	* Return: Error code on failure, 0 on success
	191	*/
5177c0cb JA	192	int futex_parse_waitv(struct futex_vector *futexv,
	193	struct futex_waitv __user *uwaitv,
	194	unsigned int nr_futexes, futex_wake_fn *wake,
	195	void *wake_data)
bf69bad3 AA	196	{
	197	struct futex_waitv aux;
	198	unsigned int i;
	199
	200	for (i = 0; i < nr_futexes; i++) {
5694289c	201	unsigned int flags;
5694289c	202
bf69bad3 AA	203	if (copy_from_user(&aux, &uwaitv[i], sizeof(aux)))
	204	return -EFAULT;
	205
4923954b	206	if ((aux.flags & ~FUTEX2_VALID_MASK) \|\| aux.__reserved)
bf69bad3 AA	207	return -EINVAL;
bf69bad3 AA	208
5694289c	209	flags = futex2_to_flags(aux.flags);
5694289c	210	if (!futex_flags_valid(flags))
bf69bad3 AA	211	return -EINVAL;
bf69bad3 AA	212
698eb826	213	if (!futex_validate_input(flags, aux.val))
	214	return -EINVAL;
	215
5694289c	216	futexv[i].w.flags = flags;
bf69bad3 AA	217	futexv[i].w.val = aux.val;
	218	futexv[i].w.uaddr = aux.uaddr;
	219	futexv[i].q = futex_q_init;
5177c0cb JA	220	futexv[i].q.wake = wake;
5177c0cb JA	221	futexv[i].q.wake_data = wake_data;
bf69bad3 AA	222	}
	223
	224	return 0;
	225	}
	226
cb8c4312	227	static int futex2_setup_timeout(struct __kernel_timespec __user *timeout,
	228	clockid_t clockid, struct hrtimer_sleeper *to)
	229	{
	230	int flag_clkid = 0, flag_init = 0;
	231	struct timespec64 ts;
	232	ktime_t time;
	233	int ret;
	234
	235	if (!timeout)
	236	return 0;
	237
	238	if (clockid == CLOCK_REALTIME) {
	239	flag_clkid = FLAGS_CLOCKRT;
	240	flag_init = FUTEX_CLOCK_REALTIME;
	241	}
	242
	243	if (clockid != CLOCK_REALTIME && clockid != CLOCK_MONOTONIC)
	244	return -EINVAL;
	245
	246	if (get_timespec64(&ts, timeout))
	247	return -EFAULT;
	248
	249	/*
	250	* Since there's no opcode for futex_waitv, use
	251	* FUTEX_WAIT_BITSET that uses absolute timeout as well
	252	*/
	253	ret = futex_init_timeout(FUTEX_WAIT_BITSET, flag_init, &ts, &time);
	254	if (ret)
	255	return ret;
	256
	257	futex_setup_timer(&time, to, flag_clkid, 0);
	258	return 0;
	259	}
	260
	261	static inline void futex2_destroy_timeout(struct hrtimer_sleeper *to)
	262	{
	263	hrtimer_cancel(&to->timer);
	264	destroy_hrtimer_on_stack(&to->timer);
	265	}
	266
bf69bad3 AA	267	/**
	268	* sys_futex_waitv - Wait on a list of futexes
	269	* @waiters: List of futexes to wait on
	270	* @nr_futexes: Length of futexv
	271	* @flags: Flag for timeout (monotonic/realtime)
	272	* @timeout: Optional absolute timeout.
	273	* @clockid: Clock to be used for the timeout, realtime or monotonic.
	274	*
	275	* Given an array of `struct futex_waitv`, wait on each uaddr. The thread wakes
	276	* if a futex_wake() is performed at any uaddr. The syscall returns immediately
	277	* if any waiter has uaddr != val. timeout is an optional timeout value for
	278	* the operation. Each waiter has individual flags. The `flags` argument for
	279	* the syscall should be used solely for specifying the timeout as realtime, if
	280	* needed. Flags for private futexes, sizes, etc. should be used on the
	281	* individual flags of each waiter.
	282	*
	283	* Returns the array index of one of the woken futexes. No further information
	284	* is provided: any number of other futexes may also have been woken by the
	285	* same event, and if more than one futex was woken, the retrned index may
	286	* refer to any one of them. (It is not necessaryily the futex with the
	287	* smallest index, nor the one most recently woken, nor...)
	288	*/
	289
	290	SYSCALL_DEFINE5(futex_waitv, struct futex_waitv __user *, waiters,
	291	unsigned int, nr_futexes, unsigned int, flags,
	292	struct __kernel_timespec __user *, timeout, clockid_t, clockid)
	293	{
	294	struct hrtimer_sleeper to;
	295	struct futex_vector *futexv;
bf69bad3 AA	296	int ret;
	297
	298	/* This syscall supports no flags for now */
	299	if (flags)
	300	return -EINVAL;
	301
	302	if (!nr_futexes \|\| nr_futexes > FUTEX_WAITV_MAX \|\| !waiters)
	303	return -EINVAL;
	304
cb8c4312	305	if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to)))
cb8c4312	306	return ret;
bf69bad3 AA	307
bf69bad3 AA	308	futexv = kcalloc(nr_futexes, sizeof(*futexv), GFP_KERNEL);
94cd8fa0 MD	309	if (!futexv) {
	310	ret = -ENOMEM;
	311	goto destroy_timer;
	312	}
bf69bad3	313
5177c0cb JA	314	ret = futex_parse_waitv(futexv, waiters, nr_futexes, futex_wake_mark,
5177c0cb JA	315	NULL);
bf69bad3 AA	316	if (!ret)
	317	ret = futex_wait_multiple(futexv, nr_futexes, timeout ? &to : NULL);
	318
94cd8fa0 MD	319	kfree(futexv);
	320
	321	destroy_timer:
cb8c4312	322	if (timeout)
cb8c4312	323	futex2_destroy_timeout(&to);
bf69bad3 AA	324	return ret;
	325	}
	326
9f6c532f	327	/*
	328	* sys_futex_wake - Wake a number of futexes
	329	* @uaddr: Address of the futex(es) to wake
	330	* @mask: bitmask
	331	* @nr: Number of the futexes to wake
	332	* @flags: FUTEX2 flags
	333	*
	334	* Identical to the traditional FUTEX_WAKE_BITSET op, except it is part of the
	335	* futex2 family of calls.
	336	*/
	337
	338	SYSCALL_DEFINE4(futex_wake,
	339	void __user *, uaddr,
	340	unsigned long, mask,
	341	int, nr,
	342	unsigned int, flags)
	343	{
	344	if (flags & ~FUTEX2_VALID_MASK)
	345	return -EINVAL;
	346
	347	flags = futex2_to_flags(flags);
	348	if (!futex_flags_valid(flags))
	349	return -EINVAL;
	350
	351	if (!futex_validate_input(flags, mask))
	352	return -EINVAL;
	353
43adf844	354	return futex_wake(uaddr, FLAGS_STRICT \| flags, nr, mask);
9f6c532f	355	}
9f6c532f	356
cb8c4312	357	/*
	358	* sys_futex_wait - Wait on a futex
	359	* @uaddr: Address of the futex to wait on
	360	* @val: Value of @uaddr
	361	* @mask: bitmask
	362	* @flags: FUTEX2 flags
	363	* @timeout: Optional absolute timeout
	364	* @clockid: Clock to be used for the timeout, realtime or monotonic
	365	*
	366	* Identical to the traditional FUTEX_WAIT_BITSET op, except it is part of the
	367	* futex2 familiy of calls.
	368	*/
	369
	370	SYSCALL_DEFINE6(futex_wait,
	371	void __user *, uaddr,
	372	unsigned long, val,
	373	unsigned long, mask,
	374	unsigned int, flags,
	375	struct __kernel_timespec __user *, timeout,
	376	clockid_t, clockid)
	377	{
	378	struct hrtimer_sleeper to;
	379	int ret;
	380
	381	if (flags & ~FUTEX2_VALID_MASK)
	382	return -EINVAL;
	383
	384	flags = futex2_to_flags(flags);
	385	if (!futex_flags_valid(flags))
	386	return -EINVAL;
	387
	388	if (!futex_validate_input(flags, val) \|\|
	389	!futex_validate_input(flags, mask))
	390	return -EINVAL;
	391
	392	if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to)))
	393	return ret;
	394
	395	ret = __futex_wait(uaddr, flags, val, timeout ? &to : NULL, mask);
	396
	397	if (timeout)
	398	futex2_destroy_timeout(&to);
	399
	400	return ret;
	401	}
	402
0f4b5f97	403	/*
	404	* sys_futex_requeue - Requeue a waiter from one futex to another
	405	* @waiters: array describing the source and destination futex
	406	* @flags: unused
	407	* @nr_wake: number of futexes to wake
	408	* @nr_requeue: number of futexes to requeue
	409	*
	410	* Identical to the traditional FUTEX_CMP_REQUEUE op, except it is part of the
	411	* futex2 family of calls.
	412	*/
	413
	414	SYSCALL_DEFINE4(futex_requeue,
	415	struct futex_waitv __user *, waiters,
	416	unsigned int, flags,
	417	int, nr_wake,
	418	int, nr_requeue)
	419	{
	420	struct futex_vector futexes[2];
	421	u32 cmpval;
	422	int ret;
	423
	424	if (flags)
	425	return -EINVAL;
	426
	427	if (!waiters)
	428	return -EINVAL;
	429
5177c0cb	430	ret = futex_parse_waitv(futexes, waiters, 2, futex_wake_mark, NULL);
0f4b5f97	431	if (ret)
	432	return ret;
	433
	434	cmpval = futexes[0].w.val;
	435
	436	return futex_requeue(u64_to_user_ptr(futexes[0].w.uaddr), futexes[0].w.flags,
	437	u64_to_user_ptr(futexes[1].w.uaddr), futexes[1].w.flags,
	438	nr_wake, nr_requeue, &cmpval, 0);
	439	}
	440
af8cc960 PZ	441	#ifdef CONFIG_COMPAT
	442	COMPAT_SYSCALL_DEFINE2(set_robust_list,
	443	struct compat_robust_list_head __user *, head,
	444	compat_size_t, len)
	445	{
af8cc960 PZ	446	if (unlikely(len != sizeof(*head)))
	447	return -EINVAL;
	448
	449	current->compat_robust_list = head;
	450
	451	return 0;
	452	}
	453
	454	COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
	455	compat_uptr_t __user *, head_ptr,
	456	compat_size_t __user *, len_ptr)
	457	{
	458	struct compat_robust_list_head __user *head;
	459	unsigned long ret;
	460	struct task_struct *p;
	461
af8cc960 PZ	462	rcu_read_lock();
	463
	464	ret = -ESRCH;
	465	if (!pid)
	466	p = current;
	467	else {
	468	p = find_task_by_vpid(pid);
	469	if (!p)
	470	goto err_unlock;
	471	}
	472
	473	ret = -EPERM;
	474	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
	475	goto err_unlock;
	476
	477	head = p->compat_robust_list;
	478	rcu_read_unlock();
	479
	480	if (put_user(sizeof(*head), len_ptr))
	481	return -EFAULT;
	482	return put_user(ptr_to_compat(head), head_ptr);
	483
	484	err_unlock:
	485	rcu_read_unlock();
	486
	487	return ret;
	488	}
	489	#endif /* CONFIG_COMPAT */
	490
	491	#ifdef CONFIG_COMPAT_32BIT_TIME
	492	SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val,
	493	const struct old_timespec32 __user , utime, u32 __user , uaddr2,
	494	u32, val3)
	495	{
	496	int ret, cmd = op & FUTEX_CMD_MASK;
	497	ktime_t t, *tp = NULL;
	498	struct timespec64 ts;
	499
	500	if (utime && futex_cmd_has_timeout(cmd)) {
	501	if (get_old_timespec32(&ts, utime))
	502	return -EFAULT;
	503	ret = futex_init_timeout(cmd, op, &ts, &t);
	504	if (ret)
	505	return ret;
	506	tp = &t;
	507	}
	508
	509	return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
	510	}
	511	#endif /* CONFIG_COMPAT_32BIT_TIME */
	512