1 // SPDX-License-Identifier: GPL-2.0-or-later
2
3 #include <linux/compat.h>
4 #include <linux/syscalls.h>
5 #include <linux/time_namespace.h>
6
7 #include "futex.h"
8
9 /*
10 * Support for robust futexes: the kernel cleans up held futexes at
11 * thread exit time.
12 *
13 * Implementation: user-space maintains a per-thread list of locks it
14 * is holding. Upon do_exit(), the kernel carefully walks this list,
15 * and marks all locks that are owned by this thread with the
16 * FUTEX_OWNER_DIED bit, and wakes up a waiter (if any). The list is
17 * always manipulated with the lock held, so the list is private and
18 * per-thread. Userspace also maintains a per-thread 'list_op_pending'
19 * field, to allow the kernel to clean up if the thread dies after
20 * acquiring the lock, but just before it could have added itself to
21 * the list. There can only be one such pending lock.
22 */
23
24 /**
25 * sys_set_robust_list() - Set the robust-futex list head of a task
26 * @head: pointer to the list-head
27 * @len: length of the list-head, as userspace expects
28 */
SYSCALL_DEFINE2(set_robust_list,struct robust_list_head __user *,head,size_t,len)29 SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
30 size_t, len)
31 {
32 /*
33 * The kernel knows only one size for now:
34 */
35 if (unlikely(len != sizeof(*head)))
36 return -EINVAL;
37
38 current->robust_list = head;
39
40 return 0;
41 }
42
43 /**
44 * sys_get_robust_list() - Get the robust-futex list head of a task
45 * @pid: pid of the process [zero for current task]
46 * @head_ptr: pointer to a list-head pointer, the kernel fills it in
47 * @len_ptr: pointer to a length field, the kernel fills in the header size
48 */
SYSCALL_DEFINE3(get_robust_list,int,pid,struct robust_list_head __user * __user *,head_ptr,size_t __user *,len_ptr)49 SYSCALL_DEFINE3(get_robust_list, int, pid,
50 struct robust_list_head __user * __user *, head_ptr,
51 size_t __user *, len_ptr)
52 {
53 struct robust_list_head __user *head;
54 unsigned long ret;
55 struct task_struct *p;
56
57 rcu_read_lock();
58
59 ret = -ESRCH;
60 if (!pid)
61 p = current;
62 else {
63 p = find_task_by_vpid(pid);
64 if (!p)
65 goto err_unlock;
66 }
67
68 ret = -EPERM;
69 if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
70 goto err_unlock;
71
72 head = p->robust_list;
73 rcu_read_unlock();
74
75 if (put_user(sizeof(*head), len_ptr))
76 return -EFAULT;
77 return put_user(head, head_ptr);
78
79 err_unlock:
80 rcu_read_unlock();
81
82 return ret;
83 }
84
do_futex(u32 __user * uaddr,int op,u32 val,ktime_t * timeout,u32 __user * uaddr2,u32 val2,u32 val3)85 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
86 u32 __user *uaddr2, u32 val2, u32 val3)
87 {
88 int cmd = op & FUTEX_CMD_MASK;
89 unsigned int flags = 0;
90
91 if (!(op & FUTEX_PRIVATE_FLAG))
92 flags |= FLAGS_SHARED;
93
94 if (op & FUTEX_CLOCK_REALTIME) {
95 flags |= FLAGS_CLOCKRT;
96 if (cmd != FUTEX_WAIT_BITSET && cmd != FUTEX_WAIT_REQUEUE_PI &&
97 cmd != FUTEX_LOCK_PI2)
98 return -ENOSYS;
99 }
100
101 switch (cmd) {
102 case FUTEX_WAIT:
103 val3 = FUTEX_BITSET_MATCH_ANY;
104 fallthrough;
105 case FUTEX_WAIT_BITSET:
106 return futex_wait(uaddr, flags, val, timeout, val3);
107 case FUTEX_WAKE:
108 val3 = FUTEX_BITSET_MATCH_ANY;
109 fallthrough;
110 case FUTEX_WAKE_BITSET:
111 return futex_wake(uaddr, flags, val, val3);
112 case FUTEX_REQUEUE:
113 return futex_requeue(uaddr, flags, uaddr2, val, val2, NULL, 0);
114 case FUTEX_CMP_REQUEUE:
115 return futex_requeue(uaddr, flags, uaddr2, val, val2, &val3, 0);
116 case FUTEX_WAKE_OP:
117 return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3);
118 case FUTEX_LOCK_PI:
119 flags |= FLAGS_CLOCKRT;
120 fallthrough;
121 case FUTEX_LOCK_PI2:
122 return futex_lock_pi(uaddr, flags, timeout, 0);
123 case FUTEX_UNLOCK_PI:
124 return futex_unlock_pi(uaddr, flags);
125 case FUTEX_TRYLOCK_PI:
126 return futex_lock_pi(uaddr, flags, NULL, 1);
127 case FUTEX_WAIT_REQUEUE_PI:
128 val3 = FUTEX_BITSET_MATCH_ANY;
129 return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3,
130 uaddr2);
131 case FUTEX_CMP_REQUEUE_PI:
132 return futex_requeue(uaddr, flags, uaddr2, val, val2, &val3, 1);
133 }
134 return -ENOSYS;
135 }
136
futex_cmd_has_timeout(u32 cmd)137 static __always_inline bool futex_cmd_has_timeout(u32 cmd)
138 {
139 switch (cmd) {
140 case FUTEX_WAIT:
141 case FUTEX_LOCK_PI:
142 case FUTEX_LOCK_PI2:
143 case FUTEX_WAIT_BITSET:
144 case FUTEX_WAIT_REQUEUE_PI:
145 return true;
146 }
147 return false;
148 }
149
150 static __always_inline int
futex_init_timeout(u32 cmd,u32 op,struct timespec64 * ts,ktime_t * t)151 futex_init_timeout(u32 cmd, u32 op, struct timespec64 *ts, ktime_t *t)
152 {
153 if (!timespec64_valid(ts))
154 return -EINVAL;
155
156 *t = timespec64_to_ktime(*ts);
157 if (cmd == FUTEX_WAIT)
158 *t = ktime_add_safe(ktime_get(), *t);
159 else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME))
160 *t = timens_ktime_to_host(CLOCK_MONOTONIC, *t);
161 return 0;
162 }
163
SYSCALL_DEFINE6(futex,u32 __user *,uaddr,int,op,u32,val,const struct __kernel_timespec __user *,utime,u32 __user *,uaddr2,u32,val3)164 SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
165 const struct __kernel_timespec __user *, utime,
166 u32 __user *, uaddr2, u32, val3)
167 {
168 int ret, cmd = op & FUTEX_CMD_MASK;
169 ktime_t t, *tp = NULL;
170 struct timespec64 ts;
171
172 if (utime && futex_cmd_has_timeout(cmd)) {
173 if (unlikely(should_fail_futex(!(op & FUTEX_PRIVATE_FLAG))))
174 return -EFAULT;
175 if (get_timespec64(&ts, utime))
176 return -EFAULT;
177 ret = futex_init_timeout(cmd, op, &ts, &t);
178 if (ret)
179 return ret;
180 tp = &t;
181 }
182
183 return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
184 }
185
186 /* Mask of available flags for each futex in futex_waitv list */
187 #define FUTEXV_WAITER_MASK (FUTEX_32 | FUTEX_PRIVATE_FLAG)
188
189 /**
190 * futex_parse_waitv - Parse a waitv array from userspace
191 * @futexv: Kernel side list of waiters to be filled
192 * @uwaitv: Userspace list to be parsed
193 * @nr_futexes: Length of futexv
194 *
195 * Return: Error code on failure, 0 on success
196 */
futex_parse_waitv(struct futex_vector * futexv,struct futex_waitv __user * uwaitv,unsigned int nr_futexes)197 static int futex_parse_waitv(struct futex_vector *futexv,
198 struct futex_waitv __user *uwaitv,
199 unsigned int nr_futexes)
200 {
201 struct futex_waitv aux;
202 unsigned int i;
203
204 for (i = 0; i < nr_futexes; i++) {
205 if (copy_from_user(&aux, &uwaitv[i], sizeof(aux)))
206 return -EFAULT;
207
208 if ((aux.flags & ~FUTEXV_WAITER_MASK) || aux.__reserved)
209 return -EINVAL;
210
211 if (!(aux.flags & FUTEX_32))
212 return -EINVAL;
213
214 futexv[i].w.flags = aux.flags;
215 futexv[i].w.val = aux.val;
216 futexv[i].w.uaddr = aux.uaddr;
217 futexv[i].q = futex_q_init;
218 }
219
220 return 0;
221 }
222
223 /**
224 * sys_futex_waitv - Wait on a list of futexes
225 * @waiters: List of futexes to wait on
226 * @nr_futexes: Length of futexv
227 * @flags: Flag for timeout (monotonic/realtime)
228 * @timeout: Optional absolute timeout.
229 * @clockid: Clock to be used for the timeout, realtime or monotonic.
230 *
231 * Given an array of `struct futex_waitv`, wait on each uaddr. The thread wakes
232 * if a futex_wake() is performed at any uaddr. The syscall returns immediately
233 * if any waiter has *uaddr != val. *timeout is an optional timeout value for
234 * the operation. Each waiter has individual flags. The `flags` argument for
235 * the syscall should be used solely for specifying the timeout as realtime, if
236 * needed. Flags for private futexes, sizes, etc. should be used on the
237 * individual flags of each waiter.
238 *
239 * Returns the array index of one of the woken futexes. No further information
240 * is provided: any number of other futexes may also have been woken by the
241 * same event, and if more than one futex was woken, the retrned index may
242 * refer to any one of them. (It is not necessaryily the futex with the
243 * smallest index, nor the one most recently woken, nor...)
244 */
245
SYSCALL_DEFINE5(futex_waitv,struct futex_waitv __user *,waiters,unsigned int,nr_futexes,unsigned int,flags,struct __kernel_timespec __user *,timeout,clockid_t,clockid)246 SYSCALL_DEFINE5(futex_waitv, struct futex_waitv __user *, waiters,
247 unsigned int, nr_futexes, unsigned int, flags,
248 struct __kernel_timespec __user *, timeout, clockid_t, clockid)
249 {
250 struct hrtimer_sleeper to;
251 struct futex_vector *futexv;
252 struct timespec64 ts;
253 ktime_t time;
254 int ret;
255
256 /* This syscall supports no flags for now */
257 if (flags)
258 return -EINVAL;
259
260 if (!nr_futexes || nr_futexes > FUTEX_WAITV_MAX || !waiters)
261 return -EINVAL;
262
263 if (timeout) {
264 int flag_clkid = 0, flag_init = 0;
265
266 if (clockid == CLOCK_REALTIME) {
267 flag_clkid = FLAGS_CLOCKRT;
268 flag_init = FUTEX_CLOCK_REALTIME;
269 }
270
271 if (clockid != CLOCK_REALTIME && clockid != CLOCK_MONOTONIC)
272 return -EINVAL;
273
274 if (get_timespec64(&ts, timeout))
275 return -EFAULT;
276
277 /*
278 * Since there's no opcode for futex_waitv, use
279 * FUTEX_WAIT_BITSET that uses absolute timeout as well
280 */
281 ret = futex_init_timeout(FUTEX_WAIT_BITSET, flag_init, &ts, &time);
282 if (ret)
283 return ret;
284
285 futex_setup_timer(&time, &to, flag_clkid, 0);
286 }
287
288 futexv = kcalloc(nr_futexes, sizeof(*futexv), GFP_KERNEL);
289 if (!futexv)
290 return -ENOMEM;
291
292 ret = futex_parse_waitv(futexv, waiters, nr_futexes);
293 if (!ret)
294 ret = futex_wait_multiple(futexv, nr_futexes, timeout ? &to : NULL);
295
296 if (timeout) {
297 hrtimer_cancel(&to.timer);
298 destroy_hrtimer_on_stack(&to.timer);
299 }
300
301 kfree(futexv);
302 return ret;
303 }
304
305 #ifdef CONFIG_COMPAT
COMPAT_SYSCALL_DEFINE2(set_robust_list,struct compat_robust_list_head __user *,head,compat_size_t,len)306 COMPAT_SYSCALL_DEFINE2(set_robust_list,
307 struct compat_robust_list_head __user *, head,
308 compat_size_t, len)
309 {
310 if (unlikely(len != sizeof(*head)))
311 return -EINVAL;
312
313 current->compat_robust_list = head;
314
315 return 0;
316 }
317
COMPAT_SYSCALL_DEFINE3(get_robust_list,int,pid,compat_uptr_t __user *,head_ptr,compat_size_t __user *,len_ptr)318 COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
319 compat_uptr_t __user *, head_ptr,
320 compat_size_t __user *, len_ptr)
321 {
322 struct compat_robust_list_head __user *head;
323 unsigned long ret;
324 struct task_struct *p;
325
326 rcu_read_lock();
327
328 ret = -ESRCH;
329 if (!pid)
330 p = current;
331 else {
332 p = find_task_by_vpid(pid);
333 if (!p)
334 goto err_unlock;
335 }
336
337 ret = -EPERM;
338 if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
339 goto err_unlock;
340
341 head = p->compat_robust_list;
342 rcu_read_unlock();
343
344 if (put_user(sizeof(*head), len_ptr))
345 return -EFAULT;
346 return put_user(ptr_to_compat(head), head_ptr);
347
348 err_unlock:
349 rcu_read_unlock();
350
351 return ret;
352 }
353 #endif /* CONFIG_COMPAT */
354
355 #ifdef CONFIG_COMPAT_32BIT_TIME
SYSCALL_DEFINE6(futex_time32,u32 __user *,uaddr,int,op,u32,val,const struct old_timespec32 __user *,utime,u32 __user *,uaddr2,u32,val3)356 SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val,
357 const struct old_timespec32 __user *, utime, u32 __user *, uaddr2,
358 u32, val3)
359 {
360 int ret, cmd = op & FUTEX_CMD_MASK;
361 ktime_t t, *tp = NULL;
362 struct timespec64 ts;
363
364 if (utime && futex_cmd_has_timeout(cmd)) {
365 if (get_old_timespec32(&ts, utime))
366 return -EFAULT;
367 ret = futex_init_timeout(cmd, op, &ts, &t);
368 if (ret)
369 return ret;
370 tp = &t;
371 }
372
373 return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
374 }
375 #endif /* CONFIG_COMPAT_32BIT_TIME */
376
377