Commit | Line | Data |
---|---|---|
af8cc960 PZ |
1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | ||
af8cc960 PZ |
3 | #include <linux/syscalls.h> |
4 | #include <linux/time_namespace.h> | |
5 | ||
6 | #include "futex.h" | |
7 | ||
8 | /* | |
9 | * Support for robust futexes: the kernel cleans up held futexes at | |
10 | * thread exit time. | |
11 | * | |
12 | * Implementation: user-space maintains a per-thread list of locks it | |
13 | * is holding. Upon do_exit(), the kernel carefully walks this list, | |
14 | * and marks all locks that are owned by this thread with the | |
15 | * FUTEX_OWNER_DIED bit, and wakes up a waiter (if any). The list is | |
16 | * always manipulated with the lock held, so the list is private and | |
17 | * per-thread. Userspace also maintains a per-thread 'list_op_pending' | |
18 | * field, to allow the kernel to clean up if the thread dies after | |
19 | * acquiring the lock, but just before it could have added itself to | |
20 | * the list. There can only be one such pending lock. | |
21 | */ | |
22 | ||
23 | /** | |
24 | * sys_set_robust_list() - Set the robust-futex list head of a task | |
25 | * @head: pointer to the list-head | |
26 | * @len: length of the list-head, as userspace expects | |
27 | */ | |
28 | SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head, | |
29 | size_t, len) | |
30 | { | |
af8cc960 PZ |
31 | /* |
32 | * The kernel knows only one size for now: | |
33 | */ | |
34 | if (unlikely(len != sizeof(*head))) | |
35 | return -EINVAL; | |
36 | ||
37 | current->robust_list = head; | |
38 | ||
39 | return 0; | |
40 | } | |
41 | ||
42 | /** | |
43 | * sys_get_robust_list() - Get the robust-futex list head of a task | |
44 | * @pid: pid of the process [zero for current task] | |
45 | * @head_ptr: pointer to a list-head pointer, the kernel fills it in | |
46 | * @len_ptr: pointer to a length field, the kernel fills in the header size | |
47 | */ | |
48 | SYSCALL_DEFINE3(get_robust_list, int, pid, | |
49 | struct robust_list_head __user * __user *, head_ptr, | |
50 | size_t __user *, len_ptr) | |
51 | { | |
52 | struct robust_list_head __user *head; | |
53 | unsigned long ret; | |
54 | struct task_struct *p; | |
55 | ||
af8cc960 PZ |
56 | rcu_read_lock(); |
57 | ||
58 | ret = -ESRCH; | |
59 | if (!pid) | |
60 | p = current; | |
61 | else { | |
62 | p = find_task_by_vpid(pid); | |
63 | if (!p) | |
64 | goto err_unlock; | |
65 | } | |
66 | ||
67 | ret = -EPERM; | |
68 | if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) | |
69 | goto err_unlock; | |
70 | ||
71 | head = p->robust_list; | |
72 | rcu_read_unlock(); | |
73 | ||
74 | if (put_user(sizeof(*head), len_ptr)) | |
75 | return -EFAULT; | |
76 | return put_user(head, head_ptr); | |
77 | ||
78 | err_unlock: | |
79 | rcu_read_unlock(); | |
80 | ||
81 | return ret; | |
82 | } | |
83 | ||
84 | long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, | |
85 | u32 __user *uaddr2, u32 val2, u32 val3) | |
86 | { | |
5694289c | 87 | unsigned int flags = futex_to_flags(op); |
af8cc960 | 88 | int cmd = op & FUTEX_CMD_MASK; |
af8cc960 | 89 | |
5694289c | 90 | if (flags & FLAGS_CLOCKRT) { |
91 | if (cmd != FUTEX_WAIT_BITSET && | |
92 | cmd != FUTEX_WAIT_REQUEUE_PI && | |
af8cc960 PZ |
93 | cmd != FUTEX_LOCK_PI2) |
94 | return -ENOSYS; | |
95 | } | |
96 | ||
af8cc960 PZ |
97 | switch (cmd) { |
98 | case FUTEX_WAIT: | |
99 | val3 = FUTEX_BITSET_MATCH_ANY; | |
100 | fallthrough; | |
101 | case FUTEX_WAIT_BITSET: | |
102 | return futex_wait(uaddr, flags, val, timeout, val3); | |
103 | case FUTEX_WAKE: | |
104 | val3 = FUTEX_BITSET_MATCH_ANY; | |
105 | fallthrough; | |
106 | case FUTEX_WAKE_BITSET: | |
107 | return futex_wake(uaddr, flags, val, val3); | |
108 | case FUTEX_REQUEUE: | |
27b88f35 | 109 | return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, NULL, 0); |
af8cc960 | 110 | case FUTEX_CMP_REQUEUE: |
27b88f35 | 111 | return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 0); |
af8cc960 PZ |
112 | case FUTEX_WAKE_OP: |
113 | return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3); | |
114 | case FUTEX_LOCK_PI: | |
115 | flags |= FLAGS_CLOCKRT; | |
116 | fallthrough; | |
117 | case FUTEX_LOCK_PI2: | |
118 | return futex_lock_pi(uaddr, flags, timeout, 0); | |
119 | case FUTEX_UNLOCK_PI: | |
120 | return futex_unlock_pi(uaddr, flags); | |
121 | case FUTEX_TRYLOCK_PI: | |
122 | return futex_lock_pi(uaddr, flags, NULL, 1); | |
123 | case FUTEX_WAIT_REQUEUE_PI: | |
124 | val3 = FUTEX_BITSET_MATCH_ANY; | |
125 | return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3, | |
126 | uaddr2); | |
127 | case FUTEX_CMP_REQUEUE_PI: | |
27b88f35 | 128 | return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 1); |
af8cc960 PZ |
129 | } |
130 | return -ENOSYS; | |
131 | } | |
132 | ||
133 | static __always_inline bool futex_cmd_has_timeout(u32 cmd) | |
134 | { | |
135 | switch (cmd) { | |
136 | case FUTEX_WAIT: | |
137 | case FUTEX_LOCK_PI: | |
138 | case FUTEX_LOCK_PI2: | |
139 | case FUTEX_WAIT_BITSET: | |
140 | case FUTEX_WAIT_REQUEUE_PI: | |
141 | return true; | |
142 | } | |
143 | return false; | |
144 | } | |
145 | ||
146 | static __always_inline int | |
147 | futex_init_timeout(u32 cmd, u32 op, struct timespec64 *ts, ktime_t *t) | |
148 | { | |
149 | if (!timespec64_valid(ts)) | |
150 | return -EINVAL; | |
151 | ||
152 | *t = timespec64_to_ktime(*ts); | |
153 | if (cmd == FUTEX_WAIT) | |
154 | *t = ktime_add_safe(ktime_get(), *t); | |
155 | else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME)) | |
156 | *t = timens_ktime_to_host(CLOCK_MONOTONIC, *t); | |
157 | return 0; | |
158 | } | |
159 | ||
160 | SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, | |
161 | const struct __kernel_timespec __user *, utime, | |
162 | u32 __user *, uaddr2, u32, val3) | |
163 | { | |
164 | int ret, cmd = op & FUTEX_CMD_MASK; | |
165 | ktime_t t, *tp = NULL; | |
166 | struct timespec64 ts; | |
167 | ||
168 | if (utime && futex_cmd_has_timeout(cmd)) { | |
169 | if (unlikely(should_fail_futex(!(op & FUTEX_PRIVATE_FLAG)))) | |
170 | return -EFAULT; | |
171 | if (get_timespec64(&ts, utime)) | |
172 | return -EFAULT; | |
173 | ret = futex_init_timeout(cmd, op, &ts, &t); | |
174 | if (ret) | |
175 | return ret; | |
176 | tp = &t; | |
177 | } | |
178 | ||
179 | return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3); | |
180 | } | |
181 | ||
bf69bad3 AA |
182 | /** |
183 | * futex_parse_waitv - Parse a waitv array from userspace | |
184 | * @futexv: Kernel side list of waiters to be filled | |
185 | * @uwaitv: Userspace list to be parsed | |
186 | * @nr_futexes: Length of futexv | |
5177c0cb JA |
187 | * @wake: Wake to call when futex is woken |
188 | * @wake_data: Data for the wake handler | |
bf69bad3 AA |
189 | * |
190 | * Return: Error code on failure, 0 on success | |
191 | */ | |
5177c0cb JA |
192 | int futex_parse_waitv(struct futex_vector *futexv, |
193 | struct futex_waitv __user *uwaitv, | |
194 | unsigned int nr_futexes, futex_wake_fn *wake, | |
195 | void *wake_data) | |
bf69bad3 AA |
196 | { |
197 | struct futex_waitv aux; | |
198 | unsigned int i; | |
199 | ||
200 | for (i = 0; i < nr_futexes; i++) { | |
5694289c | 201 | unsigned int flags; |
202 | ||
bf69bad3 AA |
203 | if (copy_from_user(&aux, &uwaitv[i], sizeof(aux))) |
204 | return -EFAULT; | |
205 | ||
4923954b | 206 | if ((aux.flags & ~FUTEX2_VALID_MASK) || aux.__reserved) |
bf69bad3 AA |
207 | return -EINVAL; |
208 | ||
5694289c | 209 | flags = futex2_to_flags(aux.flags); |
210 | if (!futex_flags_valid(flags)) | |
bf69bad3 AA |
211 | return -EINVAL; |
212 | ||
698eb826 | 213 | if (!futex_validate_input(flags, aux.val)) |
214 | return -EINVAL; | |
215 | ||
5694289c | 216 | futexv[i].w.flags = flags; |
bf69bad3 AA |
217 | futexv[i].w.val = aux.val; |
218 | futexv[i].w.uaddr = aux.uaddr; | |
219 | futexv[i].q = futex_q_init; | |
5177c0cb JA |
220 | futexv[i].q.wake = wake; |
221 | futexv[i].q.wake_data = wake_data; | |
bf69bad3 AA |
222 | } |
223 | ||
224 | return 0; | |
225 | } | |
226 | ||
cb8c4312 | 227 | static int futex2_setup_timeout(struct __kernel_timespec __user *timeout, |
228 | clockid_t clockid, struct hrtimer_sleeper *to) | |
229 | { | |
230 | int flag_clkid = 0, flag_init = 0; | |
231 | struct timespec64 ts; | |
232 | ktime_t time; | |
233 | int ret; | |
234 | ||
235 | if (!timeout) | |
236 | return 0; | |
237 | ||
238 | if (clockid == CLOCK_REALTIME) { | |
239 | flag_clkid = FLAGS_CLOCKRT; | |
240 | flag_init = FUTEX_CLOCK_REALTIME; | |
241 | } | |
242 | ||
243 | if (clockid != CLOCK_REALTIME && clockid != CLOCK_MONOTONIC) | |
244 | return -EINVAL; | |
245 | ||
246 | if (get_timespec64(&ts, timeout)) | |
247 | return -EFAULT; | |
248 | ||
249 | /* | |
250 | * Since there's no opcode for futex_waitv, use | |
251 | * FUTEX_WAIT_BITSET that uses absolute timeout as well | |
252 | */ | |
253 | ret = futex_init_timeout(FUTEX_WAIT_BITSET, flag_init, &ts, &time); | |
254 | if (ret) | |
255 | return ret; | |
256 | ||
257 | futex_setup_timer(&time, to, flag_clkid, 0); | |
258 | return 0; | |
259 | } | |
260 | ||
261 | static inline void futex2_destroy_timeout(struct hrtimer_sleeper *to) | |
262 | { | |
263 | hrtimer_cancel(&to->timer); | |
264 | destroy_hrtimer_on_stack(&to->timer); | |
265 | } | |
266 | ||
bf69bad3 AA |
267 | /** |
268 | * sys_futex_waitv - Wait on a list of futexes | |
269 | * @waiters: List of futexes to wait on | |
270 | * @nr_futexes: Length of futexv | |
271 | * @flags: Flag for timeout (monotonic/realtime) | |
272 | * @timeout: Optional absolute timeout. | |
273 | * @clockid: Clock to be used for the timeout, realtime or monotonic. | |
274 | * | |
275 | * Given an array of `struct futex_waitv`, wait on each uaddr. The thread wakes | |
276 | * if a futex_wake() is performed at any uaddr. The syscall returns immediately | |
277 | * if any waiter has *uaddr != val. *timeout is an optional timeout value for | |
278 | * the operation. Each waiter has individual flags. The `flags` argument for | |
279 | * the syscall should be used solely for specifying the timeout as realtime, if | |
280 | * needed. Flags for private futexes, sizes, etc. should be used on the | |
281 | * individual flags of each waiter. | |
282 | * | |
283 | * Returns the array index of one of the woken futexes. No further information | |
284 | * is provided: any number of other futexes may also have been woken by the | |
285 | * same event, and if more than one futex was woken, the retrned index may | |
286 | * refer to any one of them. (It is not necessaryily the futex with the | |
287 | * smallest index, nor the one most recently woken, nor...) | |
288 | */ | |
289 | ||
290 | SYSCALL_DEFINE5(futex_waitv, struct futex_waitv __user *, waiters, | |
291 | unsigned int, nr_futexes, unsigned int, flags, | |
292 | struct __kernel_timespec __user *, timeout, clockid_t, clockid) | |
293 | { | |
294 | struct hrtimer_sleeper to; | |
295 | struct futex_vector *futexv; | |
bf69bad3 AA |
296 | int ret; |
297 | ||
298 | /* This syscall supports no flags for now */ | |
299 | if (flags) | |
300 | return -EINVAL; | |
301 | ||
302 | if (!nr_futexes || nr_futexes > FUTEX_WAITV_MAX || !waiters) | |
303 | return -EINVAL; | |
304 | ||
cb8c4312 | 305 | if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to))) |
306 | return ret; | |
bf69bad3 AA |
307 | |
308 | futexv = kcalloc(nr_futexes, sizeof(*futexv), GFP_KERNEL); | |
94cd8fa0 MD |
309 | if (!futexv) { |
310 | ret = -ENOMEM; | |
311 | goto destroy_timer; | |
312 | } | |
bf69bad3 | 313 | |
5177c0cb JA |
314 | ret = futex_parse_waitv(futexv, waiters, nr_futexes, futex_wake_mark, |
315 | NULL); | |
bf69bad3 AA |
316 | if (!ret) |
317 | ret = futex_wait_multiple(futexv, nr_futexes, timeout ? &to : NULL); | |
318 | ||
94cd8fa0 MD |
319 | kfree(futexv); |
320 | ||
321 | destroy_timer: | |
cb8c4312 | 322 | if (timeout) |
323 | futex2_destroy_timeout(&to); | |
bf69bad3 AA |
324 | return ret; |
325 | } | |
326 | ||
9f6c532f | 327 | /* |
328 | * sys_futex_wake - Wake a number of futexes | |
329 | * @uaddr: Address of the futex(es) to wake | |
330 | * @mask: bitmask | |
331 | * @nr: Number of the futexes to wake | |
332 | * @flags: FUTEX2 flags | |
333 | * | |
334 | * Identical to the traditional FUTEX_WAKE_BITSET op, except it is part of the | |
335 | * futex2 family of calls. | |
336 | */ | |
337 | ||
338 | SYSCALL_DEFINE4(futex_wake, | |
339 | void __user *, uaddr, | |
340 | unsigned long, mask, | |
341 | int, nr, | |
342 | unsigned int, flags) | |
343 | { | |
344 | if (flags & ~FUTEX2_VALID_MASK) | |
345 | return -EINVAL; | |
346 | ||
347 | flags = futex2_to_flags(flags); | |
348 | if (!futex_flags_valid(flags)) | |
349 | return -EINVAL; | |
350 | ||
351 | if (!futex_validate_input(flags, mask)) | |
352 | return -EINVAL; | |
353 | ||
43adf844 | 354 | return futex_wake(uaddr, FLAGS_STRICT | flags, nr, mask); |
9f6c532f | 355 | } |
356 | ||
cb8c4312 | 357 | /* |
358 | * sys_futex_wait - Wait on a futex | |
359 | * @uaddr: Address of the futex to wait on | |
360 | * @val: Value of @uaddr | |
361 | * @mask: bitmask | |
362 | * @flags: FUTEX2 flags | |
363 | * @timeout: Optional absolute timeout | |
364 | * @clockid: Clock to be used for the timeout, realtime or monotonic | |
365 | * | |
366 | * Identical to the traditional FUTEX_WAIT_BITSET op, except it is part of the | |
367 | * futex2 familiy of calls. | |
368 | */ | |
369 | ||
370 | SYSCALL_DEFINE6(futex_wait, | |
371 | void __user *, uaddr, | |
372 | unsigned long, val, | |
373 | unsigned long, mask, | |
374 | unsigned int, flags, | |
375 | struct __kernel_timespec __user *, timeout, | |
376 | clockid_t, clockid) | |
377 | { | |
378 | struct hrtimer_sleeper to; | |
379 | int ret; | |
380 | ||
381 | if (flags & ~FUTEX2_VALID_MASK) | |
382 | return -EINVAL; | |
383 | ||
384 | flags = futex2_to_flags(flags); | |
385 | if (!futex_flags_valid(flags)) | |
386 | return -EINVAL; | |
387 | ||
388 | if (!futex_validate_input(flags, val) || | |
389 | !futex_validate_input(flags, mask)) | |
390 | return -EINVAL; | |
391 | ||
392 | if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to))) | |
393 | return ret; | |
394 | ||
395 | ret = __futex_wait(uaddr, flags, val, timeout ? &to : NULL, mask); | |
396 | ||
397 | if (timeout) | |
398 | futex2_destroy_timeout(&to); | |
399 | ||
400 | return ret; | |
401 | } | |
402 | ||
0f4b5f97 | 403 | /* |
404 | * sys_futex_requeue - Requeue a waiter from one futex to another | |
405 | * @waiters: array describing the source and destination futex | |
406 | * @flags: unused | |
407 | * @nr_wake: number of futexes to wake | |
408 | * @nr_requeue: number of futexes to requeue | |
409 | * | |
410 | * Identical to the traditional FUTEX_CMP_REQUEUE op, except it is part of the | |
411 | * futex2 family of calls. | |
412 | */ | |
413 | ||
414 | SYSCALL_DEFINE4(futex_requeue, | |
415 | struct futex_waitv __user *, waiters, | |
416 | unsigned int, flags, | |
417 | int, nr_wake, | |
418 | int, nr_requeue) | |
419 | { | |
420 | struct futex_vector futexes[2]; | |
421 | u32 cmpval; | |
422 | int ret; | |
423 | ||
424 | if (flags) | |
425 | return -EINVAL; | |
426 | ||
427 | if (!waiters) | |
428 | return -EINVAL; | |
429 | ||
5177c0cb | 430 | ret = futex_parse_waitv(futexes, waiters, 2, futex_wake_mark, NULL); |
0f4b5f97 | 431 | if (ret) |
432 | return ret; | |
433 | ||
434 | cmpval = futexes[0].w.val; | |
435 | ||
436 | return futex_requeue(u64_to_user_ptr(futexes[0].w.uaddr), futexes[0].w.flags, | |
437 | u64_to_user_ptr(futexes[1].w.uaddr), futexes[1].w.flags, | |
438 | nr_wake, nr_requeue, &cmpval, 0); | |
439 | } | |
440 | ||
af8cc960 PZ |
441 | #ifdef CONFIG_COMPAT |
442 | COMPAT_SYSCALL_DEFINE2(set_robust_list, | |
443 | struct compat_robust_list_head __user *, head, | |
444 | compat_size_t, len) | |
445 | { | |
af8cc960 PZ |
446 | if (unlikely(len != sizeof(*head))) |
447 | return -EINVAL; | |
448 | ||
449 | current->compat_robust_list = head; | |
450 | ||
451 | return 0; | |
452 | } | |
453 | ||
454 | COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, | |
455 | compat_uptr_t __user *, head_ptr, | |
456 | compat_size_t __user *, len_ptr) | |
457 | { | |
458 | struct compat_robust_list_head __user *head; | |
459 | unsigned long ret; | |
460 | struct task_struct *p; | |
461 | ||
af8cc960 PZ |
462 | rcu_read_lock(); |
463 | ||
464 | ret = -ESRCH; | |
465 | if (!pid) | |
466 | p = current; | |
467 | else { | |
468 | p = find_task_by_vpid(pid); | |
469 | if (!p) | |
470 | goto err_unlock; | |
471 | } | |
472 | ||
473 | ret = -EPERM; | |
474 | if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) | |
475 | goto err_unlock; | |
476 | ||
477 | head = p->compat_robust_list; | |
478 | rcu_read_unlock(); | |
479 | ||
480 | if (put_user(sizeof(*head), len_ptr)) | |
481 | return -EFAULT; | |
482 | return put_user(ptr_to_compat(head), head_ptr); | |
483 | ||
484 | err_unlock: | |
485 | rcu_read_unlock(); | |
486 | ||
487 | return ret; | |
488 | } | |
489 | #endif /* CONFIG_COMPAT */ | |
490 | ||
491 | #ifdef CONFIG_COMPAT_32BIT_TIME | |
492 | SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val, | |
493 | const struct old_timespec32 __user *, utime, u32 __user *, uaddr2, | |
494 | u32, val3) | |
495 | { | |
496 | int ret, cmd = op & FUTEX_CMD_MASK; | |
497 | ktime_t t, *tp = NULL; | |
498 | struct timespec64 ts; | |
499 | ||
500 | if (utime && futex_cmd_has_timeout(cmd)) { | |
501 | if (get_old_timespec32(&ts, utime)) | |
502 | return -EFAULT; | |
503 | ret = futex_init_timeout(cmd, op, &ts, &t); | |
504 | if (ret) | |
505 | return ret; | |
506 | tp = &t; | |
507 | } | |
508 | ||
509 | return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3); | |
510 | } | |
511 | #endif /* CONFIG_COMPAT_32BIT_TIME */ | |
512 |