1 // SPDX-License-Identifier: GPL-2.0-or-later
2
3 #include <linux/syscalls.h>
4 #include <linux/time_namespace.h>
5
6 #include "futex.h"
7
8 /*
9 * Support for robust futexes: the kernel cleans up held futexes at
10 * thread exit time.
11 *
12 * Implementation: user-space maintains a per-thread list of locks it
13 * is holding. Upon do_exit(), the kernel carefully walks this list,
14 * and marks all locks that are owned by this thread with the
15 * FUTEX_OWNER_DIED bit, and wakes up a waiter (if any). The list is
16 * always manipulated with the lock held, so the list is private and
17 * per-thread. Userspace also maintains a per-thread 'list_op_pending'
18 * field, to allow the kernel to clean up if the thread dies after
19 * acquiring the lock, but just before it could have added itself to
20 * the list. There can only be one such pending lock.
21 */
22
23 /**
24 * sys_set_robust_list() - Set the robust-futex list head of a task
25 * @head: pointer to the list-head
26 * @len: length of the list-head, as userspace expects
27 */
28 SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
29 size_t, len)
30 {
31 /*
32 * The kernel knows only one size for now:
33 */
34 if (unlikely(len != sizeof(*head)))
35 return -EINVAL;
36
37 current->robust_list = head;
38
39 return 0;
40 }
41
42 /**
43 * sys_get_robust_list() - Get the robust-futex list head of a task
44 * @pid: pid of the process [zero for current task]
45 * @head_ptr: pointer to a list-head pointer, the kernel fills it in
46 * @len_ptr: pointer to a length field, the kernel fills in the header size
47 */
48 SYSCALL_DEFINE3(get_robust_list, int, pid,
49 struct robust_list_head __user * __user *, head_ptr,
50 size_t __user *, len_ptr)
51 {
52 struct robust_list_head __user *head;
53 unsigned long ret;
54 struct task_struct *p;
55
56 rcu_read_lock();
57
58 ret = -ESRCH;
59 if (!pid)
60 p = current;
61 else {
62 p = find_task_by_vpid(pid);
63 if (!p)
64 goto err_unlock;
65 }
66
67 ret = -EPERM;
68 if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
69 goto err_unlock;
70
71 head = p->robust_list;
72 rcu_read_unlock();
73
74 if (put_user(sizeof(*head), len_ptr))
75 return -EFAULT;
76 return put_user(head, head_ptr);
77
78 err_unlock:
79 rcu_read_unlock();
80
81 return ret;
82 }
83
84 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
85 u32 __user *uaddr2, u32 val2, u32 val3)
86 {
87 unsigned int flags = futex_to_flags(op);
88 int cmd = op & FUTEX_CMD_MASK;
89
90 if (flags & FLAGS_CLOCKRT) {
91 if (cmd != FUTEX_WAIT_BITSET &&
92 cmd != FUTEX_WAIT_REQUEUE_PI &&
93 cmd != FUTEX_LOCK_PI2)
94 return -ENOSYS;
95 }
96
97 switch (cmd) {
98 case FUTEX_WAIT:
99 val3 = FUTEX_BITSET_MATCH_ANY;
100 fallthrough;
101 case FUTEX_WAIT_BITSET:
102 return futex_wait(uaddr, flags, val, timeout, val3);
103 case FUTEX_WAKE:
104 val3 = FUTEX_BITSET_MATCH_ANY;
105 fallthrough;
106 case FUTEX_WAKE_BITSET:
107 return futex_wake(uaddr, flags, val, val3);
108 case FUTEX_REQUEUE:
109 return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, NULL, 0);
110 case FUTEX_CMP_REQUEUE:
111 return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 0);
112 case FUTEX_WAKE_OP:
113 return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3);
114 case FUTEX_LOCK_PI:
115 flags |= FLAGS_CLOCKRT;
116 fallthrough;
117 case FUTEX_LOCK_PI2:
118 return futex_lock_pi(uaddr, flags, timeout, 0);
119 case FUTEX_UNLOCK_PI:
120 return futex_unlock_pi(uaddr, flags);
121 case FUTEX_TRYLOCK_PI:
122 return futex_lock_pi(uaddr, flags, NULL, 1);
123 case FUTEX_WAIT_REQUEUE_PI:
124 val3 = FUTEX_BITSET_MATCH_ANY;
125 return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3,
126 uaddr2);
127 case FUTEX_CMP_REQUEUE_PI:
128 return futex_requeue(uaddr, flags, uaddr2, flags, val, val2, &val3, 1);
129 }
130 return -ENOSYS;
131 }
132
133 static __always_inline bool futex_cmd_has_timeout(u32 cmd)
134 {
135 switch (cmd) {
136 case FUTEX_WAIT:
137 case FUTEX_LOCK_PI:
138 case FUTEX_LOCK_PI2:
139 case FUTEX_WAIT_BITSET:
140 case FUTEX_WAIT_REQUEUE_PI:
141 return true;
142 }
143 return false;
144 }
145
146 static __always_inline int
147 futex_init_timeout(u32 cmd, u32 op, struct timespec64 *ts, ktime_t *t)
148 {
149 if (!timespec64_valid(ts))
150 return -EINVAL;
151
152 *t = timespec64_to_ktime(*ts);
153 if (cmd == FUTEX_WAIT)
154 *t = ktime_add_safe(ktime_get(), *t);
155 else if (cmd != FUTEX_LOCK_PI && !(op & FUTEX_CLOCK_REALTIME))
156 *t = timens_ktime_to_host(CLOCK_MONOTONIC, *t);
157 return 0;
158 }
159
160 SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
161 const struct __kernel_timespec __user *, utime,
162 u32 __user *, uaddr2, u32, val3)
163 {
164 int ret, cmd = op & FUTEX_CMD_MASK;
165 ktime_t t, *tp = NULL;
166 struct timespec64 ts;
167
168 if (utime && futex_cmd_has_timeout(cmd)) {
169 if (unlikely(should_fail_futex(!(op & FUTEX_PRIVATE_FLAG))))
170 return -EFAULT;
171 if (get_timespec64(&ts, utime))
172 return -EFAULT;
173 ret = futex_init_timeout(cmd, op, &ts, &t);
174 if (ret)
175 return ret;
176 tp = &t;
177 }
178
179 return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
180 }
181
182 /**
183 * futex_parse_waitv - Parse a waitv array from userspace
184 * @futexv: Kernel side list of waiters to be filled
185 * @uwaitv: Userspace list to be parsed
186 * @nr_futexes: Length of futexv
187 * @wake: Wake to call when futex is woken
188 * @wake_data: Data for the wake handler
189 *
190 * Return: Error code on failure, 0 on success
191 */
192 int futex_parse_waitv(struct futex_vector *futexv,
193 struct futex_waitv __user *uwaitv,
194 unsigned int nr_futexes, futex_wake_fn *wake,
195 void *wake_data)
196 {
197 struct futex_waitv aux;
198 unsigned int i;
199
200 for (i = 0; i < nr_futexes; i++) {
201 unsigned int flags;
202
203 if (copy_from_user(&aux, &uwaitv[i], sizeof(aux)))
204 return -EFAULT;
205
206 if ((aux.flags & ~FUTEX2_VALID_MASK) || aux.__reserved)
207 return -EINVAL;
208
209 flags = futex2_to_flags(aux.flags);
210 if (!futex_flags_valid(flags))
211 return -EINVAL;
212
213 if (!futex_validate_input(flags, aux.val))
214 return -EINVAL;
215
216 futexv[i].w.flags = flags;
217 futexv[i].w.val = aux.val;
218 futexv[i].w.uaddr = aux.uaddr;
219 futexv[i].q = futex_q_init;
220 futexv[i].q.wake = wake;
221 futexv[i].q.wake_data = wake_data;
222 }
223
224 return 0;
225 }
226
227 static int futex2_setup_timeout(struct __kernel_timespec __user *timeout,
228 clockid_t clockid, struct hrtimer_sleeper *to)
229 {
230 int flag_clkid = 0, flag_init = 0;
231 struct timespec64 ts;
232 ktime_t time;
233 int ret;
234
235 if (!timeout)
236 return 0;
237
238 if (clockid == CLOCK_REALTIME) {
239 flag_clkid = FLAGS_CLOCKRT;
240 flag_init = FUTEX_CLOCK_REALTIME;
241 }
242
243 if (clockid != CLOCK_REALTIME && clockid != CLOCK_MONOTONIC)
244 return -EINVAL;
245
246 if (get_timespec64(&ts, timeout))
247 return -EFAULT;
248
249 /*
250 * Since there's no opcode for futex_waitv, use
251 * FUTEX_WAIT_BITSET that uses absolute timeout as well
252 */
253 ret = futex_init_timeout(FUTEX_WAIT_BITSET, flag_init, &ts, &time);
254 if (ret)
255 return ret;
256
257 futex_setup_timer(&time, to, flag_clkid, 0);
258 return 0;
259 }
260
261 static inline void futex2_destroy_timeout(struct hrtimer_sleeper *to)
262 {
263 hrtimer_cancel(&to->timer);
264 destroy_hrtimer_on_stack(&to->timer);
265 }
266
267 /**
268 * sys_futex_waitv - Wait on a list of futexes
269 * @waiters: List of futexes to wait on
270 * @nr_futexes: Length of futexv
271 * @flags: Flag for timeout (monotonic/realtime)
272 * @timeout: Optional absolute timeout.
273 * @clockid: Clock to be used for the timeout, realtime or monotonic.
274 *
275 * Given an array of `struct futex_waitv`, wait on each uaddr. The thread wakes
276 * if a futex_wake() is performed at any uaddr. The syscall returns immediately
277 * if any waiter has *uaddr != val. *timeout is an optional timeout value for
278 * the operation. Each waiter has individual flags. The `flags` argument for
279 * the syscall should be used solely for specifying the timeout as realtime, if
280 * needed. Flags for private futexes, sizes, etc. should be used on the
281 * individual flags of each waiter.
282 *
283 * Returns the array index of one of the woken futexes. No further information
284 * is provided: any number of other futexes may also have been woken by the
285 * same event, and if more than one futex was woken, the retrned index may
286 * refer to any one of them. (It is not necessaryily the futex with the
287 * smallest index, nor the one most recently woken, nor...)
288 */
289
290 SYSCALL_DEFINE5(futex_waitv, struct futex_waitv __user *, waiters,
291 unsigned int, nr_futexes, unsigned int, flags,
292 struct __kernel_timespec __user *, timeout, clockid_t, clockid)
293 {
294 struct hrtimer_sleeper to;
295 struct futex_vector *futexv;
296 int ret;
297
298 /* This syscall supports no flags for now */
299 if (flags)
300 return -EINVAL;
301
302 if (!nr_futexes || nr_futexes > FUTEX_WAITV_MAX || !waiters)
303 return -EINVAL;
304
305 if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to)))
306 return ret;
307
308 futexv = kcalloc(nr_futexes, sizeof(*futexv), GFP_KERNEL);
309 if (!futexv) {
310 ret = -ENOMEM;
311 goto destroy_timer;
312 }
313
314 ret = futex_parse_waitv(futexv, waiters, nr_futexes, futex_wake_mark,
315 NULL);
316 if (!ret)
317 ret = futex_wait_multiple(futexv, nr_futexes, timeout ? &to : NULL);
318
319 kfree(futexv);
320
321 destroy_timer:
322 if (timeout)
323 futex2_destroy_timeout(&to);
324 return ret;
325 }
326
327 /*
328 * sys_futex_wake - Wake a number of futexes
329 * @uaddr: Address of the futex(es) to wake
330 * @mask: bitmask
331 * @nr: Number of the futexes to wake
332 * @flags: FUTEX2 flags
333 *
334 * Identical to the traditional FUTEX_WAKE_BITSET op, except it is part of the
335 * futex2 family of calls.
336 */
337
338 SYSCALL_DEFINE4(futex_wake,
339 void __user *, uaddr,
340 unsigned long, mask,
341 int, nr,
342 unsigned int, flags)
343 {
344 if (flags & ~FUTEX2_VALID_MASK)
345 return -EINVAL;
346
347 flags = futex2_to_flags(flags);
348 if (!futex_flags_valid(flags))
349 return -EINVAL;
350
351 if (!futex_validate_input(flags, mask))
352 return -EINVAL;
353
354 return futex_wake(uaddr, FLAGS_STRICT | flags, nr, mask);
355 }
356
357 /*
358 * sys_futex_wait - Wait on a futex
359 * @uaddr: Address of the futex to wait on
360 * @val: Value of @uaddr
361 * @mask: bitmask
362 * @flags: FUTEX2 flags
363 * @timeout: Optional absolute timeout
364 * @clockid: Clock to be used for the timeout, realtime or monotonic
365 *
366 * Identical to the traditional FUTEX_WAIT_BITSET op, except it is part of the
367 * futex2 familiy of calls.
368 */
369
370 SYSCALL_DEFINE6(futex_wait,
371 void __user *, uaddr,
372 unsigned long, val,
373 unsigned long, mask,
374 unsigned int, flags,
375 struct __kernel_timespec __user *, timeout,
376 clockid_t, clockid)
377 {
378 struct hrtimer_sleeper to;
379 int ret;
380
381 if (flags & ~FUTEX2_VALID_MASK)
382 return -EINVAL;
383
384 flags = futex2_to_flags(flags);
385 if (!futex_flags_valid(flags))
386 return -EINVAL;
387
388 if (!futex_validate_input(flags, val) ||
389 !futex_validate_input(flags, mask))
390 return -EINVAL;
391
392 if (timeout && (ret = futex2_setup_timeout(timeout, clockid, &to)))
393 return ret;
394
395 ret = __futex_wait(uaddr, flags, val, timeout ? &to : NULL, mask);
396
397 if (timeout)
398 futex2_destroy_timeout(&to);
399
400 return ret;
401 }
402
403 /*
404 * sys_futex_requeue - Requeue a waiter from one futex to another
405 * @waiters: array describing the source and destination futex
406 * @flags: unused
407 * @nr_wake: number of futexes to wake
408 * @nr_requeue: number of futexes to requeue
409 *
410 * Identical to the traditional FUTEX_CMP_REQUEUE op, except it is part of the
411 * futex2 family of calls.
412 */
413
414 SYSCALL_DEFINE4(futex_requeue,
415 struct futex_waitv __user *, waiters,
416 unsigned int, flags,
417 int, nr_wake,
418 int, nr_requeue)
419 {
420 struct futex_vector futexes[2];
421 u32 cmpval;
422 int ret;
423
424 if (flags)
425 return -EINVAL;
426
427 if (!waiters)
428 return -EINVAL;
429
430 ret = futex_parse_waitv(futexes, waiters, 2, futex_wake_mark, NULL);
431 if (ret)
432 return ret;
433
434 cmpval = futexes[0].w.val;
435
436 return futex_requeue(u64_to_user_ptr(futexes[0].w.uaddr), futexes[0].w.flags,
437 u64_to_user_ptr(futexes[1].w.uaddr), futexes[1].w.flags,
438 nr_wake, nr_requeue, &cmpval, 0);
439 }
440
441 #ifdef CONFIG_COMPAT
442 COMPAT_SYSCALL_DEFINE2(set_robust_list,
443 struct compat_robust_list_head __user *, head,
444 compat_size_t, len)
445 {
446 if (unlikely(len != sizeof(*head)))
447 return -EINVAL;
448
449 current->compat_robust_list = head;
450
451 return 0;
452 }
453
454 COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
455 compat_uptr_t __user *, head_ptr,
456 compat_size_t __user *, len_ptr)
457 {
458 struct compat_robust_list_head __user *head;
459 unsigned long ret;
460 struct task_struct *p;
461
462 rcu_read_lock();
463
464 ret = -ESRCH;
465 if (!pid)
466 p = current;
467 else {
468 p = find_task_by_vpid(pid);
469 if (!p)
470 goto err_unlock;
471 }
472
473 ret = -EPERM;
474 if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
475 goto err_unlock;
476
477 head = p->compat_robust_list;
478 rcu_read_unlock();
479
480 if (put_user(sizeof(*head), len_ptr))
481 return -EFAULT;
482 return put_user(ptr_to_compat(head), head_ptr);
483
484 err_unlock:
485 rcu_read_unlock();
486
487 return ret;
488 }
489 #endif /* CONFIG_COMPAT */
490
491 #ifdef CONFIG_COMPAT_32BIT_TIME
492 SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val,
493 const struct old_timespec32 __user *, utime, u32 __user *, uaddr2,
494 u32, val3)
495 {
496 int ret, cmd = op & FUTEX_CMD_MASK;
497 ktime_t t, *tp = NULL;
498 struct timespec64 ts;
499
500 if (utime && futex_cmd_has_timeout(cmd)) {
501 if (get_old_timespec32(&ts, utime))
502 return -EFAULT;
503 ret = futex_init_timeout(cmd, op, &ts, &t);
504 if (ret)
505 return ret;
506 tp = &t;
507 }
508
509 return do_futex(uaddr, op, val, tp, uaddr2, (unsigned long)utime, val3);
510 }
511 #endif /* CONFIG_COMPAT_32BIT_TIME */
512
513
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.