Commit | Line | Data |
---|---|---|
af8cc960 PZ |
1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | ||
af8cc960 PZ |
3 | #include <linux/syscalls.h> |
4 | #include <linux/time_namespace.h> | |
5 | ||
6 | #include "futex.h" | |
7 | ||
8 | /* | |
9 | * Support for robust futexes: the kernel cleans up held futexes at | |
10 | * thread exit time. | |
11 | * | |
12 | * Implementation: user-space maintains a per-thread list of locks it | |
13 | * is holding. Upon do_exit(), the kernel carefully walks this list, | |
14 | * and marks all locks that are owned by this thread with the | |
15 | * FUTEX_OWNER_DIED bit, and wakes up a waiter (if any). The list is | |
16 | * always manipulated with the lock held, so the list is private and | |
17 | * per-thread. Userspace also maintains a per-thread 'list_op_pending' | |
18 | * field, to allow the kernel to clean up if the thread dies after | |
19 | * acquiring the lock, but just before it could have added itself to | |
20 | * the list. There can only be one such pending lock. | |
21 | */ | |
22 | ||
23 | /** | |
24 | * sys_set_robust_list() - Set the robust-futex list head of a task | |
25 | * @head: pointer to the list-head | |
26 | * @len: length of the list-head, as userspace expects | |
27 | */ | |
28 | SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head, | |
29 | size_t, len) | |
30 | { | |
af8cc960 PZ |
31 | /* |
32 | * The kernel knows only one size for now: | |
33 | */ | |
34 | if (unlikely(len != sizeof(*head))) | |
35 | return -EINVAL; | |
36 | ||
37 | current->robust_list = head; | |
38 | ||
39 | return 0; | |
40 | } | |
41 | ||
42 | /** | |
43 | * sys_get_robust_list() - Get the robust-futex list head of a task | |
44 | * @pid: pid of the process [zero for current task] | |
45 | * @head_ptr: pointer to a list-head pointer, the kernel fills it in | |
46 | * @len_ptr: pointer to a length field, the kernel fills in the header size | |
47 | */ | |
48 | SYSCALL_DEFINE3(get_robust_list, int, pid, | |
49 | struct robust_list_head __user * __user *, head_ptr, | |
50 | size_t __user *, len_ptr) | |
51 | { | |
52 | struct robust_list_head __user *head; | |
53 | unsigned long ret; | |
54 | struct task_struct *p; | |
55 | ||
af8cc960 PZ |
56 | rcu_read_lock(); |
57 | ||
58 | ret = -ESRCH; | |
59 | if (!pid) | |
60 | p = current; | |
61 | else { | |
62 | p = find_task_by_vpid(pid); | |
63 | if (!p) | |
64 | goto err_unlock; | |
65 | } | |
66 | ||
67 | ret = -EPERM; | |
68 | if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) | |
69 | goto err_unlock; | |
70 | ||
71 | head = p->robust_list; | |
72 | rcu_read_unlock(); | |
73 | ||
74 | if (put_user(sizeof(*head), len_ptr)) | |
75 | return -EFAULT; | |
76 | return put_user(head, head_ptr); | |
77 | ||
78 | err_unlock: | |
79 | rcu_read_unlock(); | |
80 | ||
81 | return ret; | |
82 | } | |
83 | ||
84 | long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, | |
85 | u32 __user *uaddr2, u32 val2, u32 val3) | |
86 | { | |
5694289c | 87 | unsigned int flags = futex_to_flags(op); |
af8cc960 | 88 | int cmd = op & FUTEX_CMD_MASK; |
af8cc960 | 89 | |
5694289c | 90 | if (flags & FLAGS_CLOCKRT) { |
91 | if (cmd != FUTEX_WAIT_BITSET && | |
92 | cmd != FUTEX_WAIT_REQUEUE_PI && | |
af8cc960 PZ |
93 | cmd != FUTEX_LOCK_PI2) |
94 | return -ENOSYS; | |
95 | } | |
96 | ||
af8cc960 PZ |
97 | switch (cmd) { |
98 | case FUTEX_WAIT: | |
99 | val3 = FUTEX_BITSET_MATCH_ANY; | |
100 | fallthrough; | |
101 | case FUTEX_WAIT_BITSET: | |
102 | return futex_wait(uaddr, flags, val, timeout, val3); | |
103 | case FUTEX_WAKE: | |
104 | val3 = FUTEX_BITSET_MATCH_ANY; | |
105 | fallthrough; | |
106 | case FUTEX_WAKE_BITSET: | |
107 | return futex_wake(uaddr, flags, val, val3); | |
108 | case FUTEX_REQUEUE: | |
109 | return futex_requeue(uaddr, flags, uaddr2, val, val2, NULL, 0); | |
110 | case FUTEX_CMP_REQUEUE: | |
111 | return futex_requeue(uaddr, flags, uaddr2, val, val2, &val3, 0); | |
112 | case FUTEX_WAKE_OP: | |
113 | return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3); | |
114 | case FUTEX_LOCK_PI: | |
115 | flags |= FLAGS_CLOCKRT; | |
116 | fallthrough; | |
117 | case FUTEX_LOCK_PI2: | |
118 | return futex_lock_pi(uaddr, flags, timeout, 0); | |
119 | case FUTEX_UNLOCK_PI: | |
120 | return futex_unlock_pi(uaddr, flags); | |
121 | case FUTEX_TRYLOCK_PI: | |
122 | return futex_lock_pi(uaddr, flags, NULL, 1); | |
123 | case FUTEX_WAIT_REQUEUE_PI: | |
124 | val3 = FUTEX_BITSET_MATCH_ANY; | |
125 | return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3, | |
126 | uaddr2); | |
127 | case FUTEX_CMP_REQUEUE_PI: | |
128 | return futex_requeue(uaddr, flags, uaddr2, val, val2, &val3, 1); | |
129 | } | |
130 | return -ENOSYS; | |
131 | } | |
132 | ||
133 | static __always_inline bool futex_cmd_has_timeout(u32 cmd) | |
134 | { | |
135 | switch (cmd) { | |
136 | case FUTEX_WAIT: | |
137 | case FUTEX_LOCK_PI: | |
138 | case FUTEX_LOCK_PI2: | |
139 | case FUTEX_WAIT_BITSET: | |
140 | case FUTEX_WAIT_REQUEUE_PI: | |
141 | return true; | |
142 | } | |
143 | return false; | |
144 | } | |
145 | ||
146 | static __always_inline int | |
147 | futex_init_timeout(u32 cmd, u32 op, struct timespec64 *ts, ktime_t *t) | |
148 | { | |
149 | if (!timespec64_valid(ts)) | |
150 | return -EINVAL; | |
151 | ||
152 | *t = timespec64_to_ktime(*ts); | |
153 | if (cmd == FUTEX_WAIT) | |
154 | *t = ktime_add_safe(ktime_get(), *t); | |
155 | else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME)) | |
156 | *t = timens_ktime_to_host(CLOCK_MONOTONIC, *t); | |
157 | return 0; | |
158 | } | |
159 | ||
160 | SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, | |
161 | const struct __kernel_timespec __user *, utime, | |
162 | u32 __user *, uaddr2, u32, val3) | |
163 | { | |
164 | int ret, cmd = op & FUTEX_CMD_MASK; | |
165 | ktime_t t, *tp = NULL; | |
166 | struct timespec64 ts; | |
167 | ||
168 | if (utime && futex_cmd_has_timeout(cmd)) { | |
169 | if (unlikely(should_fail_futex(!(op & FUTEX_PRIVATE_FLAG)))) | |
170 | return -EFAULT; | |
171 | if (get_timespec64(&ts, utime)) | |
172 | return -EFAULT; | |
173 | ret = futex_init_timeout(cmd, op, &ts, &t); | |
174 | if (ret) | |
175 | return ret; | |
176 | tp = &t; | |
177 | } | |
178 | ||
179 | return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3); | |
180 | } | |
181 | ||
d6d08d24 | 182 | #define FUTEX2_VALID_MASK (FUTEX2_SIZE_MASK | FUTEX2_PRIVATE) |
bf69bad3 AA |
183 | |
184 | /** | |
185 | * futex_parse_waitv - Parse a waitv array from userspace | |
186 | * @futexv: Kernel side list of waiters to be filled | |
187 | * @uwaitv: Userspace list to be parsed | |
188 | * @nr_futexes: Length of futexv | |
189 | * | |
190 | * Return: Error code on failure, 0 on success | |
191 | */ | |
192 | static int futex_parse_waitv(struct futex_vector *futexv, | |
193 | struct futex_waitv __user *uwaitv, | |
194 | unsigned int nr_futexes) | |
195 | { | |
196 | struct futex_waitv aux; | |
197 | unsigned int i; | |
198 | ||
199 | for (i = 0; i < nr_futexes; i++) { | |
5694289c | 200 | unsigned int flags; |
201 | ||
bf69bad3 AA |
202 | if (copy_from_user(&aux, &uwaitv[i], sizeof(aux))) |
203 | return -EFAULT; | |
204 | ||
4923954b | 205 | if ((aux.flags & ~FUTEX2_VALID_MASK) || aux.__reserved) |
bf69bad3 AA |
206 | return -EINVAL; |
207 | ||
5694289c | 208 | flags = futex2_to_flags(aux.flags); |
209 | if (!futex_flags_valid(flags)) | |
bf69bad3 AA |
210 | return -EINVAL; |
211 | ||
5694289c | 212 | futexv[i].w.flags = flags; |
bf69bad3 AA |
213 | futexv[i].w.val = aux.val; |
214 | futexv[i].w.uaddr = aux.uaddr; | |
215 | futexv[i].q = futex_q_init; | |
216 | } | |
217 | ||
218 | return 0; | |
219 | } | |
220 | ||
221 | /** | |
222 | * sys_futex_waitv - Wait on a list of futexes | |
223 | * @waiters: List of futexes to wait on | |
224 | * @nr_futexes: Length of futexv | |
225 | * @flags: Flag for timeout (monotonic/realtime) | |
226 | * @timeout: Optional absolute timeout. | |
227 | * @clockid: Clock to be used for the timeout, realtime or monotonic. | |
228 | * | |
229 | * Given an array of `struct futex_waitv`, wait on each uaddr. The thread wakes | |
230 | * if a futex_wake() is performed at any uaddr. The syscall returns immediately | |
231 | * if any waiter has *uaddr != val. *timeout is an optional timeout value for | |
232 | * the operation. Each waiter has individual flags. The `flags` argument for | |
233 | * the syscall should be used solely for specifying the timeout as realtime, if | |
234 | * needed. Flags for private futexes, sizes, etc. should be used on the | |
235 | * individual flags of each waiter. | |
236 | * | |
237 | * Returns the array index of one of the woken futexes. No further information | |
238 | * is provided: any number of other futexes may also have been woken by the | |
239 | * same event, and if more than one futex was woken, the retrned index may | |
240 | * refer to any one of them. (It is not necessaryily the futex with the | |
241 | * smallest index, nor the one most recently woken, nor...) | |
242 | */ | |
243 | ||
244 | SYSCALL_DEFINE5(futex_waitv, struct futex_waitv __user *, waiters, | |
245 | unsigned int, nr_futexes, unsigned int, flags, | |
246 | struct __kernel_timespec __user *, timeout, clockid_t, clockid) | |
247 | { | |
248 | struct hrtimer_sleeper to; | |
249 | struct futex_vector *futexv; | |
250 | struct timespec64 ts; | |
251 | ktime_t time; | |
252 | int ret; | |
253 | ||
254 | /* This syscall supports no flags for now */ | |
255 | if (flags) | |
256 | return -EINVAL; | |
257 | ||
258 | if (!nr_futexes || nr_futexes > FUTEX_WAITV_MAX || !waiters) | |
259 | return -EINVAL; | |
260 | ||
261 | if (timeout) { | |
262 | int flag_clkid = 0, flag_init = 0; | |
263 | ||
264 | if (clockid == CLOCK_REALTIME) { | |
265 | flag_clkid = FLAGS_CLOCKRT; | |
266 | flag_init = FUTEX_CLOCK_REALTIME; | |
267 | } | |
268 | ||
269 | if (clockid != CLOCK_REALTIME && clockid != CLOCK_MONOTONIC) | |
270 | return -EINVAL; | |
271 | ||
272 | if (get_timespec64(&ts, timeout)) | |
273 | return -EFAULT; | |
274 | ||
275 | /* | |
276 | * Since there's no opcode for futex_waitv, use | |
277 | * FUTEX_WAIT_BITSET that uses absolute timeout as well | |
278 | */ | |
279 | ret = futex_init_timeout(FUTEX_WAIT_BITSET, flag_init, &ts, &time); | |
280 | if (ret) | |
281 | return ret; | |
282 | ||
283 | futex_setup_timer(&time, &to, flag_clkid, 0); | |
284 | } | |
285 | ||
286 | futexv = kcalloc(nr_futexes, sizeof(*futexv), GFP_KERNEL); | |
94cd8fa0 MD |
287 | if (!futexv) { |
288 | ret = -ENOMEM; | |
289 | goto destroy_timer; | |
290 | } | |
bf69bad3 AA |
291 | |
292 | ret = futex_parse_waitv(futexv, waiters, nr_futexes); | |
293 | if (!ret) | |
294 | ret = futex_wait_multiple(futexv, nr_futexes, timeout ? &to : NULL); | |
295 | ||
94cd8fa0 MD |
296 | kfree(futexv); |
297 | ||
298 | destroy_timer: | |
bf69bad3 AA |
299 | if (timeout) { |
300 | hrtimer_cancel(&to.timer); | |
301 | destroy_hrtimer_on_stack(&to.timer); | |
302 | } | |
bf69bad3 AA |
303 | return ret; |
304 | } | |
305 | ||
af8cc960 PZ |
306 | #ifdef CONFIG_COMPAT |
307 | COMPAT_SYSCALL_DEFINE2(set_robust_list, | |
308 | struct compat_robust_list_head __user *, head, | |
309 | compat_size_t, len) | |
310 | { | |
af8cc960 PZ |
311 | if (unlikely(len != sizeof(*head))) |
312 | return -EINVAL; | |
313 | ||
314 | current->compat_robust_list = head; | |
315 | ||
316 | return 0; | |
317 | } | |
318 | ||
319 | COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, | |
320 | compat_uptr_t __user *, head_ptr, | |
321 | compat_size_t __user *, len_ptr) | |
322 | { | |
323 | struct compat_robust_list_head __user *head; | |
324 | unsigned long ret; | |
325 | struct task_struct *p; | |
326 | ||
af8cc960 PZ |
327 | rcu_read_lock(); |
328 | ||
329 | ret = -ESRCH; | |
330 | if (!pid) | |
331 | p = current; | |
332 | else { | |
333 | p = find_task_by_vpid(pid); | |
334 | if (!p) | |
335 | goto err_unlock; | |
336 | } | |
337 | ||
338 | ret = -EPERM; | |
339 | if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) | |
340 | goto err_unlock; | |
341 | ||
342 | head = p->compat_robust_list; | |
343 | rcu_read_unlock(); | |
344 | ||
345 | if (put_user(sizeof(*head), len_ptr)) | |
346 | return -EFAULT; | |
347 | return put_user(ptr_to_compat(head), head_ptr); | |
348 | ||
349 | err_unlock: | |
350 | rcu_read_unlock(); | |
351 | ||
352 | return ret; | |
353 | } | |
354 | #endif /* CONFIG_COMPAT */ | |
355 | ||
356 | #ifdef CONFIG_COMPAT_32BIT_TIME | |
357 | SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val, | |
358 | const struct old_timespec32 __user *, utime, u32 __user *, uaddr2, | |
359 | u32, val3) | |
360 | { | |
361 | int ret, cmd = op & FUTEX_CMD_MASK; | |
362 | ktime_t t, *tp = NULL; | |
363 | struct timespec64 ts; | |
364 | ||
365 | if (utime && futex_cmd_has_timeout(cmd)) { | |
366 | if (get_old_timespec32(&ts, utime)) | |
367 | return -EFAULT; | |
368 | ret = futex_init_timeout(cmd, op, &ts, &t); | |
369 | if (ret) | |
370 | return ret; | |
371 | tp = &t; | |
372 | } | |
373 | ||
374 | return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3); | |
375 | } | |
376 | #endif /* CONFIG_COMPAT_32BIT_TIME */ | |
377 |