Branch data Line data Source code
1 : : // SPDX-License-Identifier: GPL-2.0-or-later
2 : : /*
3 : : * Fast Userspace Mutexes (which I call "Futexes!").
4 : : * (C) Rusty Russell, IBM 2002
5 : : *
6 : : * Generalized futexes, futex requeueing, misc fixes by Ingo Molnar
7 : : * (C) Copyright 2003 Red Hat Inc, All Rights Reserved
8 : : *
9 : : * Removed page pinning, fix privately mapped COW pages and other cleanups
10 : : * (C) Copyright 2003, 2004 Jamie Lokier
11 : : *
12 : : * Robust futex support started by Ingo Molnar
13 : : * (C) Copyright 2006 Red Hat Inc, All Rights Reserved
14 : : * Thanks to Thomas Gleixner for suggestions, analysis and fixes.
15 : : *
16 : : * PI-futex support started by Ingo Molnar and Thomas Gleixner
17 : : * Copyright (C) 2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
18 : : * Copyright (C) 2006 Timesys Corp., Thomas Gleixner <tglx@timesys.com>
19 : : *
20 : : * PRIVATE futexes by Eric Dumazet
21 : : * Copyright (C) 2007 Eric Dumazet <dada1@cosmosbay.com>
22 : : *
23 : : * Requeue-PI support by Darren Hart <dvhltc@us.ibm.com>
24 : : * Copyright (C) IBM Corporation, 2009
25 : : * Thanks to Thomas Gleixner for conceptual design and careful reviews.
26 : : *
27 : : * Thanks to Ben LaHaise for yelling "hashed waitqueues" loudly
28 : : * enough at me, Linus for the original (flawed) idea, Matthew
29 : : * Kirkwood for proof-of-concept implementation.
30 : : *
31 : : * "The futexes are also cursed."
32 : : * "But they come in a choice of three flavours!"
33 : : */
34 : : #include <linux/compat.h>
35 : : #include <linux/slab.h>
36 : : #include <linux/poll.h>
37 : : #include <linux/fs.h>
38 : : #include <linux/file.h>
39 : : #include <linux/jhash.h>
40 : : #include <linux/init.h>
41 : : #include <linux/futex.h>
42 : : #include <linux/mount.h>
43 : : #include <linux/pagemap.h>
44 : : #include <linux/syscalls.h>
45 : : #include <linux/signal.h>
46 : : #include <linux/export.h>
47 : : #include <linux/magic.h>
48 : : #include <linux/pid.h>
49 : : #include <linux/nsproxy.h>
50 : : #include <linux/ptrace.h>
51 : : #include <linux/sched/rt.h>
52 : : #include <linux/sched/wake_q.h>
53 : : #include <linux/sched/mm.h>
54 : : #include <linux/hugetlb.h>
55 : : #include <linux/freezer.h>
56 : : #include <linux/memblock.h>
57 : : #include <linux/fault-inject.h>
58 : : #include <linux/refcount.h>
59 : :
60 : : #include <asm/futex.h>
61 : :
62 : : #include "locking/rtmutex_common.h"
63 : :
64 : : /*
65 : : * READ this before attempting to hack on futexes!
66 : : *
67 : : * Basic futex operation and ordering guarantees
68 : : * =============================================
69 : : *
70 : : * The waiter reads the futex value in user space and calls
71 : : * futex_wait(). This function computes the hash bucket and acquires
72 : : * the hash bucket lock. After that it reads the futex user space value
73 : : * again and verifies that the data has not changed. If it has not changed
74 : : * it enqueues itself into the hash bucket, releases the hash bucket lock
75 : : * and schedules.
76 : : *
77 : : * The waker side modifies the user space value of the futex and calls
78 : : * futex_wake(). This function computes the hash bucket and acquires the
79 : : * hash bucket lock. Then it looks for waiters on that futex in the hash
80 : : * bucket and wakes them.
81 : : *
82 : : * In futex wake up scenarios where no tasks are blocked on a futex, taking
83 : : * the hb spinlock can be avoided and simply return. In order for this
84 : : * optimization to work, ordering guarantees must exist so that the waiter
85 : : * being added to the list is acknowledged when the list is concurrently being
86 : : * checked by the waker, avoiding scenarios like the following:
87 : : *
88 : : * CPU 0 CPU 1
89 : : * val = *futex;
90 : : * sys_futex(WAIT, futex, val);
91 : : * futex_wait(futex, val);
92 : : * uval = *futex;
93 : : * *futex = newval;
94 : : * sys_futex(WAKE, futex);
95 : : * futex_wake(futex);
96 : : * if (queue_empty())
97 : : * return;
98 : : * if (uval == val)
99 : : * lock(hash_bucket(futex));
100 : : * queue();
101 : : * unlock(hash_bucket(futex));
102 : : * schedule();
103 : : *
104 : : * This would cause the waiter on CPU 0 to wait forever because it
105 : : * missed the transition of the user space value from val to newval
106 : : * and the waker did not find the waiter in the hash bucket queue.
107 : : *
108 : : * The correct serialization ensures that a waiter either observes
109 : : * the changed user space value before blocking or is woken by a
110 : : * concurrent waker:
111 : : *
112 : : * CPU 0 CPU 1
113 : : * val = *futex;
114 : : * sys_futex(WAIT, futex, val);
115 : : * futex_wait(futex, val);
116 : : *
117 : : * waiters++; (a)
118 : : * smp_mb(); (A) <-- paired with -.
119 : : * |
120 : : * lock(hash_bucket(futex)); |
121 : : * |
122 : : * uval = *futex; |
123 : : * | *futex = newval;
124 : : * | sys_futex(WAKE, futex);
125 : : * | futex_wake(futex);
126 : : * |
127 : : * `--------> smp_mb(); (B)
128 : : * if (uval == val)
129 : : * queue();
130 : : * unlock(hash_bucket(futex));
131 : : * schedule(); if (waiters)
132 : : * lock(hash_bucket(futex));
133 : : * else wake_waiters(futex);
134 : : * waiters--; (b) unlock(hash_bucket(futex));
135 : : *
136 : : * Where (A) orders the waiters increment and the futex value read through
137 : : * atomic operations (see hb_waiters_inc) and where (B) orders the write
138 : : * to futex and the waiters read -- this is done by the barriers for both
139 : : * shared and private futexes in get_futex_key_refs().
140 : : *
141 : : * This yields the following case (where X:=waiters, Y:=futex):
142 : : *
143 : : * X = Y = 0
144 : : *
145 : : * w[X]=1 w[Y]=1
146 : : * MB MB
147 : : * r[Y]=y r[X]=x
148 : : *
149 : : * Which guarantees that x==0 && y==0 is impossible; which translates back into
150 : : * the guarantee that we cannot both miss the futex variable change and the
151 : : * enqueue.
152 : : *
153 : : * Note that a new waiter is accounted for in (a) even when it is possible that
154 : : * the wait call can return error, in which case we backtrack from it in (b).
155 : : * Refer to the comment in queue_lock().
156 : : *
157 : : * Similarly, in order to account for waiters being requeued on another
158 : : * address we always increment the waiters for the destination bucket before
159 : : * acquiring the lock. It then decrements them again after releasing it -
160 : : * the code that actually moves the futex(es) between hash buckets (requeue_futex)
161 : : * will do the additional required waiter count housekeeping. This is done for
162 : : * double_lock_hb() and double_unlock_hb(), respectively.
163 : : */
164 : :
165 : : #ifdef CONFIG_HAVE_FUTEX_CMPXCHG
166 : : #define futex_cmpxchg_enabled 1
167 : : #else
168 : : static int __read_mostly futex_cmpxchg_enabled;
169 : : #endif
170 : :
171 : : /*
172 : : * Futex flags used to encode options to functions and preserve them across
173 : : * restarts.
174 : : */
175 : : #ifdef CONFIG_MMU
176 : : # define FLAGS_SHARED 0x01
177 : : #else
178 : : /*
179 : : * NOMMU does not have per process address space. Let the compiler optimize
180 : : * code away.
181 : : */
182 : : # define FLAGS_SHARED 0x00
183 : : #endif
184 : : #define FLAGS_CLOCKRT 0x02
185 : : #define FLAGS_HAS_TIMEOUT 0x04
186 : :
187 : : /*
188 : : * Priority Inheritance state:
189 : : */
190 : : struct futex_pi_state {
191 : : /*
192 : : * list of 'owned' pi_state instances - these have to be
193 : : * cleaned up in do_exit() if the task exits prematurely:
194 : : */
195 : : struct list_head list;
196 : :
197 : : /*
198 : : * The PI object:
199 : : */
200 : : struct rt_mutex pi_mutex;
201 : :
202 : : struct task_struct *owner;
203 : : refcount_t refcount;
204 : :
205 : : union futex_key key;
206 : : } __randomize_layout;
207 : :
208 : : /**
209 : : * struct futex_q - The hashed futex queue entry, one per waiting task
210 : : * @list: priority-sorted list of tasks waiting on this futex
211 : : * @task: the task waiting on the futex
212 : : * @lock_ptr: the hash bucket lock
213 : : * @key: the key the futex is hashed on
214 : : * @pi_state: optional priority inheritance state
215 : : * @rt_waiter: rt_waiter storage for use with requeue_pi
216 : : * @requeue_pi_key: the requeue_pi target futex key
217 : : * @bitset: bitset for the optional bitmasked wakeup
218 : : *
219 : : * We use this hashed waitqueue, instead of a normal wait_queue_entry_t, so
220 : : * we can wake only the relevant ones (hashed queues may be shared).
221 : : *
222 : : * A futex_q has a woken state, just like tasks have TASK_RUNNING.
223 : : * It is considered woken when plist_node_empty(&q->list) || q->lock_ptr == 0.
224 : : * The order of wakeup is always to make the first condition true, then
225 : : * the second.
226 : : *
227 : : * PI futexes are typically woken before they are removed from the hash list via
228 : : * the rt_mutex code. See unqueue_me_pi().
229 : : */
230 : : struct futex_q {
231 : : struct plist_node list;
232 : :
233 : : struct task_struct *task;
234 : : spinlock_t *lock_ptr;
235 : : union futex_key key;
236 : : struct futex_pi_state *pi_state;
237 : : struct rt_mutex_waiter *rt_waiter;
238 : : union futex_key *requeue_pi_key;
239 : : u32 bitset;
240 : : } __randomize_layout;
241 : :
242 : : static const struct futex_q futex_q_init = {
243 : : /* list gets initialized in queue_me()*/
244 : : .key = FUTEX_KEY_INIT,
245 : : .bitset = FUTEX_BITSET_MATCH_ANY
246 : : };
247 : :
248 : : /*
249 : : * Hash buckets are shared by all the futex_keys that hash to the same
250 : : * location. Each key may have multiple futex_q structures, one for each task
251 : : * waiting on a futex.
252 : : */
253 : : struct futex_hash_bucket {
254 : : atomic_t waiters;
255 : : spinlock_t lock;
256 : : struct plist_head chain;
257 : : } ____cacheline_aligned_in_smp;
258 : :
259 : : /*
260 : : * The base of the bucket array and its size are always used together
261 : : * (after initialization only in hash_futex()), so ensure that they
262 : : * reside in the same cacheline.
263 : : */
264 : : static struct {
265 : : struct futex_hash_bucket *queues;
266 : : unsigned long hashsize;
267 : : } __futex_data __read_mostly __aligned(2*sizeof(long));
268 : : #define futex_queues (__futex_data.queues)
269 : : #define futex_hashsize (__futex_data.hashsize)
270 : :
271 : :
272 : : /*
273 : : * Fault injections for futexes.
274 : : */
275 : : #ifdef CONFIG_FAIL_FUTEX
276 : :
277 : : static struct {
278 : : struct fault_attr attr;
279 : :
280 : : bool ignore_private;
281 : : } fail_futex = {
282 : : .attr = FAULT_ATTR_INITIALIZER,
283 : : .ignore_private = false,
284 : : };
285 : :
286 : : static int __init setup_fail_futex(char *str)
287 : : {
288 : : return setup_fault_attr(&fail_futex.attr, str);
289 : : }
290 : : __setup("fail_futex=", setup_fail_futex);
291 : :
292 : : static bool should_fail_futex(bool fshared)
293 : : {
294 : : if (fail_futex.ignore_private && !fshared)
295 : : return false;
296 : :
297 : : return should_fail(&fail_futex.attr, 1);
298 : : }
299 : :
300 : : #ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
301 : :
302 : : static int __init fail_futex_debugfs(void)
303 : : {
304 : : umode_t mode = S_IFREG | S_IRUSR | S_IWUSR;
305 : : struct dentry *dir;
306 : :
307 : : dir = fault_create_debugfs_attr("fail_futex", NULL,
308 : : &fail_futex.attr);
309 : : if (IS_ERR(dir))
310 : : return PTR_ERR(dir);
311 : :
312 : : debugfs_create_bool("ignore-private", mode, dir,
313 : : &fail_futex.ignore_private);
314 : : return 0;
315 : : }
316 : :
317 : : late_initcall(fail_futex_debugfs);
318 : :
319 : : #endif /* CONFIG_FAULT_INJECTION_DEBUG_FS */
320 : :
321 : : #else
322 : 28512 : static inline bool should_fail_futex(bool fshared)
323 : : {
324 : 28512 : return false;
325 : : }
326 : : #endif /* CONFIG_FAIL_FUTEX */
327 : :
328 : : #ifdef CONFIG_COMPAT
329 : : static void compat_exit_robust_list(struct task_struct *curr);
330 : : #else
331 : : static inline void compat_exit_robust_list(struct task_struct *curr) { }
332 : : #endif
333 : :
334 : : static inline void futex_get_mm(union futex_key *key)
335 : : {
336 : : mmgrab(key->private.mm);
337 : : /*
338 : : * Ensure futex_get_mm() implies a full barrier such that
339 : : * get_futex_key() implies a full barrier. This is relied upon
340 : : * as smp_mb(); (B), see the ordering comment above.
341 : : */
342 : : smp_mb__after_atomic();
343 : : }
344 : :
345 : : /*
346 : : * Reflects a new waiter being added to the waitqueue.
347 : : */
348 : 1717 : static inline void hb_waiters_inc(struct futex_hash_bucket *hb)
349 : : {
350 : : #ifdef CONFIG_SMP
351 : 1717 : atomic_inc(&hb->waiters);
352 : : /*
353 : : * Full barrier (A), see the ordering comment above.
354 : : */
355 : 1717 : smp_mb__after_atomic();
356 : : #endif
357 : : }
358 : :
359 : : /*
360 : : * Reflects a waiter being removed from the waitqueue by wakeup
361 : : * paths.
362 : : */
363 : 1639 : static inline void hb_waiters_dec(struct futex_hash_bucket *hb)
364 : : {
365 : : #ifdef CONFIG_SMP
366 : 1639 : atomic_dec(&hb->waiters);
367 : : #endif
368 : 1639 : }
369 : :
370 : 26795 : static inline int hb_waiters_pending(struct futex_hash_bucket *hb)
371 : : {
372 : : #ifdef CONFIG_SMP
373 : 26795 : return atomic_read(&hb->waiters);
374 : : #else
375 : : return 1;
376 : : #endif
377 : : }
378 : :
379 : : /**
380 : : * hash_futex - Return the hash bucket in the global hash
381 : : * @key: Pointer to the futex key for which the hash is calculated
382 : : *
383 : : * We hash on the keys returned from get_futex_key (see below) and return the
384 : : * corresponding hash bucket in the global hash.
385 : : */
386 : 28512 : static struct futex_hash_bucket *hash_futex(union futex_key *key)
387 : : {
388 : 28512 : u32 hash = jhash2((u32 *)key, offsetof(typeof(*key), both.offset) / 4,
389 : : key->both.offset);
390 : :
391 : 28512 : return &futex_queues[hash & (futex_hashsize - 1)];
392 : : }
393 : :
394 : :
395 : : /**
396 : : * match_futex - Check whether two futex keys are equal
397 : : * @key1: Pointer to key1
398 : : * @key2: Pointer to key2
399 : : *
400 : : * Return 1 if two futex_keys are equal, 0 otherwise.
401 : : */
402 : 1726 : static inline int match_futex(union futex_key *key1, union futex_key *key2)
403 : : {
404 : 1726 : return (key1 && key2
405 [ - - - - : 1726 : && key1->both.word == key2->both.word
- - - - -
- - - - -
+ + - - ]
406 [ - - - - : 1639 : && key1->both.ptr == key2->both.ptr
- - - - -
- - - - -
- - + - -
- ]
407 [ - - - - : 1639 : && key1->both.offset == key2->both.offset);
- - - - -
- - - - -
- - + - -
- ]
408 : : }
409 : :
410 : : /*
411 : : * Take a reference to the resource addressed by a key.
412 : : * Can be called while holding spinlocks.
413 : : *
414 : : */
415 : : static void get_futex_key_refs(union futex_key *key)
416 : : {
417 : : if (!key->both.ptr)
418 : : return;
419 : :
420 : : /*
421 : : * On MMU less systems futexes are always "private" as there is no per
422 : : * process address space. We need the smp wmb nevertheless - yes,
423 : : * arch/blackfin has MMU less SMP ...
424 : : */
425 : : if (!IS_ENABLED(CONFIG_MMU)) {
426 : : smp_mb(); /* explicit smp_mb(); (B) */
427 : : return;
428 : : }
429 : :
430 : : switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
431 : : case FUT_OFF_INODE:
432 : : smp_mb(); /* explicit smp_mb(); (B) */
433 : : break;
434 : : case FUT_OFF_MMSHARED:
435 : : futex_get_mm(key); /* implies smp_mb(); (B) */
436 : : break;
437 : : default:
438 : : /*
439 : : * Private futexes do not hold reference on an inode or
440 : : * mm, therefore the only purpose of calling get_futex_key_refs
441 : : * is because we need the barrier for the lockless waiter check.
442 : : */
443 : : smp_mb(); /* explicit smp_mb(); (B) */
444 : : }
445 : : }
446 : :
447 : : /*
448 : : * Drop a reference to the resource addressed by a key.
449 : : * The hash bucket spinlock must not be held. This is
450 : : * a no-op for private futexes, see comment in the get
451 : : * counterpart.
452 : : */
453 : : static void drop_futex_key_refs(union futex_key *key)
454 : : {
455 : : if (!key->both.ptr) {
456 : : /* If we're here then we tried to put a key we failed to get */
457 : : WARN_ON_ONCE(1);
458 : : return;
459 : : }
460 : :
461 : : if (!IS_ENABLED(CONFIG_MMU))
462 : : return;
463 : :
464 : : switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
465 : : case FUT_OFF_INODE:
466 : : break;
467 : : case FUT_OFF_MMSHARED:
468 : : mmdrop(key->private.mm);
469 : : break;
470 : : }
471 : : }
472 : :
473 : : enum futex_access {
474 : : FUTEX_READ,
475 : : FUTEX_WRITE
476 : : };
477 : :
478 : : /**
479 : : * futex_setup_timer - set up the sleeping hrtimer.
480 : : * @time: ptr to the given timeout value
481 : : * @timeout: the hrtimer_sleeper structure to be set up
482 : : * @flags: futex flags
483 : : * @range_ns: optional range in ns
484 : : *
485 : : * Return: Initialized hrtimer_sleeper structure or NULL if no timeout
486 : : * value given
487 : : */
488 : : static inline struct hrtimer_sleeper *
489 : 1717 : futex_setup_timer(ktime_t *time, struct hrtimer_sleeper *timeout,
490 : : int flags, u64 range_ns)
491 : : {
492 [ - + ]: 1717 : if (!time)
493 : : return NULL;
494 : :
495 : 0 : hrtimer_init_sleeper_on_stack(timeout, (flags & FLAGS_CLOCKRT) ?
496 : : CLOCK_REALTIME : CLOCK_MONOTONIC,
497 : : HRTIMER_MODE_ABS);
498 : : /*
499 : : * If range_ns is 0, calling hrtimer_set_expires_range_ns() is
500 : : * effectively the same as calling hrtimer_set_expires().
501 : : */
502 : 0 : hrtimer_set_expires_range_ns(&timeout->timer, *time, range_ns);
503 : :
504 : 0 : return timeout;
505 : : }
506 : :
507 : : /*
508 : : * Generate a machine wide unique identifier for this inode.
509 : : *
510 : : * This relies on u64 not wrapping in the life-time of the machine; which with
511 : : * 1ns resolution means almost 585 years.
512 : : *
513 : : * This further relies on the fact that a well formed program will not unmap
514 : : * the file while it has a (shared) futex waiting on it. This mapping will have
515 : : * a file reference which pins the mount and inode.
516 : : *
517 : : * If for some reason an inode gets evicted and read back in again, it will get
518 : : * a new sequence number and will _NOT_ match, even though it is the exact same
519 : : * file.
520 : : *
521 : : * It is important that match_futex() will never have a false-positive, esp.
522 : : * for PI futexes that can mess up the state. The above argues that false-negatives
523 : : * are only possible for malformed programs.
524 : : */
525 : 0 : static u64 get_inode_sequence_number(struct inode *inode)
526 : : {
527 : 0 : static atomic64_t i_seq;
528 : 0 : u64 old;
529 : :
530 : : /* Does the inode already have a sequence number? */
531 : 0 : old = atomic64_read(&inode->i_sequence);
532 [ # # ]: 0 : if (likely(old))
533 : : return old;
534 : :
535 : 0 : for (;;) {
536 : 0 : u64 new = atomic64_add_return(1, &i_seq);
537 [ # # # # ]: 0 : if (WARN_ON_ONCE(!new))
538 : 0 : continue;
539 : :
540 : 0 : old = atomic64_cmpxchg_relaxed(&inode->i_sequence, 0, new);
541 [ # # ]: 0 : if (old)
542 : 0 : return old;
543 : : return new;
544 : : }
545 : : }
546 : :
547 : : /**
548 : : * get_futex_key() - Get parameters which are the keys for a futex
549 : : * @uaddr: virtual address of the futex
550 : : * @fshared: 0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
551 : : * @key: address where result is stored.
552 : : * @rw: mapping needs to be read/write (values: FUTEX_READ,
553 : : * FUTEX_WRITE)
554 : : *
555 : : * Return: a negative error code or 0
556 : : *
557 : : * The key words are stored in @key on success.
558 : : *
559 : : * For shared mappings (when @fshared), the key is:
560 : : * ( inode->i_sequence, page->index, offset_within_page )
561 : : * [ also see get_inode_sequence_number() ]
562 : : *
563 : : * For private mappings (or when !@fshared), the key is:
564 : : * ( current->mm, address, 0 )
565 : : *
566 : : * This allows (cross process, where applicable) identification of the futex
567 : : * without keeping the page pinned for the duration of the FUTEX_WAIT.
568 : : *
569 : : * lock_page() might sleep, the caller should not hold a spinlock.
570 : : */
571 : : static int
572 : 28512 : get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, enum futex_access rw)
573 : : {
574 : 28512 : unsigned long address = (unsigned long)uaddr;
575 [ + - ]: 28512 : struct mm_struct *mm = current->mm;
576 : 28512 : struct page *page, *tail;
577 : 28512 : struct address_space *mapping;
578 : 28512 : int err, ro = 0;
579 : :
580 : : /*
581 : : * The futex address must be "naturally" aligned.
582 : : */
583 : 28512 : key->both.offset = address % PAGE_SIZE;
584 [ + - ]: 28512 : if (unlikely((address % sizeof(u32)) != 0))
585 : : return -EINVAL;
586 : 28512 : address -= key->both.offset;
587 : :
588 [ + - ]: 28512 : if (unlikely(!access_ok(uaddr, sizeof(u32))))
589 : : return -EFAULT;
590 : :
591 : 28512 : if (unlikely(should_fail_futex(fshared)))
592 : : return -EFAULT;
593 : :
594 : : /*
595 : : * PROCESS_PRIVATE futexes are fast.
596 : : * As the mm cannot disappear under us and the 'key' only needs
597 : : * virtual address, we dont even have to find the underlying vma.
598 : : * Note : We do have to check 'uaddr' is a valid user address,
599 : : * but access_ok() should be faster than find_vma()
600 : : */
601 [ - + ]: 28512 : if (!fshared) {
602 : 28512 : key->private.mm = mm;
603 : 28512 : key->private.address = address;
604 : 28512 : get_futex_key_refs(key); /* implies smp_mb(); (B) */
605 : 28512 : return 0;
606 : : }
607 : :
608 : 0 : again:
609 : : /* Ignore any VERIFY_READ mapping (futex common case) */
610 : 0 : if (unlikely(should_fail_futex(fshared)))
611 : : return -EFAULT;
612 : :
613 : 0 : err = get_user_pages_fast(address, 1, FOLL_WRITE, &page);
614 : : /*
615 : : * If write access is not required (eg. FUTEX_WAIT), try
616 : : * and get read-only access.
617 : : */
618 [ # # ]: 0 : if (err == -EFAULT && rw == FUTEX_READ) {
619 : 0 : err = get_user_pages_fast(address, 1, 0, &page);
620 : 0 : ro = 1;
621 : : }
622 [ # # ]: 0 : if (err < 0)
623 : 0 : return err;
624 : : else
625 : 0 : err = 0;
626 : :
627 : : /*
628 : : * The treatment of mapping from this point on is critical. The page
629 : : * lock protects many things but in this context the page lock
630 : : * stabilizes mapping, prevents inode freeing in the shared
631 : : * file-backed region case and guards against movement to swap cache.
632 : : *
633 : : * Strictly speaking the page lock is not needed in all cases being
634 : : * considered here and page lock forces unnecessarily serialization
635 : : * From this point on, mapping will be re-verified if necessary and
636 : : * page lock will be acquired only if it is unavoidable
637 : : *
638 : : * Mapping checks require the head page for any compound page so the
639 : : * head page and mapping is looked up now. For anonymous pages, it
640 : : * does not matter if the page splits in the future as the key is
641 : : * based on the address. For filesystem-backed pages, the tail is
642 : : * required as the index of the page determines the key. For
643 : : * base pages, there is no tail page and tail == page.
644 : : */
645 : 0 : tail = page;
646 [ # # ]: 0 : page = compound_head(page);
647 [ # # ]: 0 : mapping = READ_ONCE(page->mapping);
648 : :
649 : : /*
650 : : * If page->mapping is NULL, then it cannot be a PageAnon
651 : : * page; but it might be the ZERO_PAGE or in the gate area or
652 : : * in a special mapping (all cases which we are happy to fail);
653 : : * or it may have been a good file page when get_user_pages_fast
654 : : * found it, but truncated or holepunched or subjected to
655 : : * invalidate_complete_page2 before we got the page lock (also
656 : : * cases which we are happy to fail). And we hold a reference,
657 : : * so refcount care in invalidate_complete_page's remove_mapping
658 : : * prevents drop_caches from setting mapping to NULL beneath us.
659 : : *
660 : : * The case we do have to guard against is when memory pressure made
661 : : * shmem_writepage move it from filecache to swapcache beneath us:
662 : : * an unlikely race, but we do need to retry for page->mapping.
663 : : */
664 [ # # ]: 0 : if (unlikely(!mapping)) {
665 : 0 : int shmem_swizzled;
666 : :
667 : : /*
668 : : * Page lock is required to identify which special case above
669 : : * applies. If this is really a shmem page then the page lock
670 : : * will prevent unexpected transitions.
671 : : */
672 : 0 : lock_page(page);
673 [ # # # # ]: 0 : shmem_swizzled = PageSwapCache(page) || page->mapping;
674 : 0 : unlock_page(page);
675 : 0 : put_page(page);
676 : :
677 [ # # ]: 0 : if (shmem_swizzled)
678 : 0 : goto again;
679 : :
680 : : return -EFAULT;
681 : : }
682 : :
683 : : /*
684 : : * Private mappings are handled in a simple way.
685 : : *
686 : : * If the futex key is stored on an anonymous page, then the associated
687 : : * object is the mm which is implicitly pinned by the calling process.
688 : : *
689 : : * NOTE: When userspace waits on a MAP_SHARED mapping, even if
690 : : * it's a read-only handle, it's expected that futexes attach to
691 : : * the object not the particular process.
692 : : */
693 [ # # # # ]: 0 : if (PageAnon(page)) {
694 : : /*
695 : : * A RO anonymous page will never change and thus doesn't make
696 : : * sense for futex operations.
697 : : */
698 [ # # ]: 0 : if (unlikely(should_fail_futex(fshared)) || ro) {
699 : 0 : err = -EFAULT;
700 : 0 : goto out;
701 : : }
702 : :
703 : 0 : key->both.offset |= FUT_OFF_MMSHARED; /* ref taken on mm */
704 : 0 : key->private.mm = mm;
705 : 0 : key->private.address = address;
706 : :
707 : : } else {
708 : 0 : struct inode *inode;
709 : :
710 : : /*
711 : : * The associated futex object in this case is the inode and
712 : : * the page->mapping must be traversed. Ordinarily this should
713 : : * be stabilised under page lock but it's not strictly
714 : : * necessary in this case as we just want to pin the inode, not
715 : : * update the radix tree or anything like that.
716 : : *
717 : : * The RCU read lock is taken as the inode is finally freed
718 : : * under RCU. If the mapping still matches expectations then the
719 : : * mapping->host can be safely accessed as being a valid inode.
720 : : */
721 : 0 : rcu_read_lock();
722 : :
723 [ # # ]: 0 : if (READ_ONCE(page->mapping) != mapping) {
724 : 0 : rcu_read_unlock();
725 : 0 : put_page(page);
726 : :
727 : 0 : goto again;
728 : : }
729 : :
730 [ # # ]: 0 : inode = READ_ONCE(mapping->host);
731 [ # # ]: 0 : if (!inode) {
732 : 0 : rcu_read_unlock();
733 : 0 : put_page(page);
734 : :
735 : 0 : goto again;
736 : : }
737 : :
738 : 0 : key->both.offset |= FUT_OFF_INODE; /* inode-based key */
739 : 0 : key->shared.i_seq = get_inode_sequence_number(inode);
740 : 0 : key->shared.pgoff = basepage_index(tail);
741 : 0 : rcu_read_unlock();
742 : : }
743 : :
744 : 0 : get_futex_key_refs(key); /* implies smp_mb(); (B) */
745 : :
746 : 0 : out:
747 : 0 : put_page(page);
748 : 0 : return err;
749 : : }
750 : :
751 : 26795 : static inline void put_futex_key(union futex_key *key)
752 : : {
753 : 26795 : drop_futex_key_refs(key);
754 : 26795 : }
755 : :
756 : : /**
757 : : * fault_in_user_writeable() - Fault in user address and verify RW access
758 : : * @uaddr: pointer to faulting user space address
759 : : *
760 : : * Slow path to fixup the fault we just took in the atomic write
761 : : * access to @uaddr.
762 : : *
763 : : * We have no generic implementation of a non-destructive write to the
764 : : * user address. We know that we faulted in the atomic pagefault
765 : : * disabled section so we can as well avoid the #PF overhead by
766 : : * calling get_user_pages() right away.
767 : : */
768 : 0 : static int fault_in_user_writeable(u32 __user *uaddr)
769 : : {
770 : 0 : struct mm_struct *mm = current->mm;
771 : 0 : int ret;
772 : :
773 : 0 : down_read(&mm->mmap_sem);
774 : 0 : ret = fixup_user_fault(current, mm, (unsigned long)uaddr,
775 : : FAULT_FLAG_WRITE, NULL);
776 : 0 : up_read(&mm->mmap_sem);
777 : :
778 : 0 : return ret < 0 ? ret : 0;
779 : : }
780 : :
781 : : /**
782 : : * futex_top_waiter() - Return the highest priority waiter on a futex
783 : : * @hb: the hash bucket the futex_q's reside in
784 : : * @key: the futex key (to distinguish it from other futex futex_q's)
785 : : *
786 : : * Must be called with the hb lock held.
787 : : */
788 : 0 : static struct futex_q *futex_top_waiter(struct futex_hash_bucket *hb,
789 : : union futex_key *key)
790 : : {
791 : 0 : struct futex_q *this;
792 : :
793 [ # # ]: 0 : plist_for_each_entry(this, &hb->chain, list) {
794 [ # # ]: 0 : if (match_futex(&this->key, key))
795 : 0 : return this;
796 : : }
797 : : return NULL;
798 : : }
799 : :
800 : 78 : static int cmpxchg_futex_value_locked(u32 *curval, u32 __user *uaddr,
801 : : u32 uval, u32 newval)
802 : : {
803 : 78 : int ret;
804 : :
805 : 78 : pagefault_disable();
806 : 78 : ret = futex_atomic_cmpxchg_inatomic(curval, uaddr, uval, newval);
807 : 78 : pagefault_enable();
808 : :
809 : 78 : return ret;
810 : : }
811 : :
812 : 1717 : static int get_futex_value_locked(u32 *dest, u32 __user *from)
813 : : {
814 : 1717 : int ret;
815 : :
816 : 1717 : pagefault_disable();
817 : 1717 : ret = __get_user(*dest, from);
818 : 1717 : pagefault_enable();
819 : :
820 [ + - ]: 1717 : return ret ? -EFAULT : 0;
821 : : }
822 : :
823 : :
824 : : /*
825 : : * PI code:
826 : : */
827 : 0 : static int refill_pi_state_cache(void)
828 : : {
829 : 0 : struct futex_pi_state *pi_state;
830 : :
831 [ # # ]: 0 : if (likely(current->pi_state_cache))
832 : : return 0;
833 : :
834 : 0 : pi_state = kzalloc(sizeof(*pi_state), GFP_KERNEL);
835 : :
836 [ # # ]: 0 : if (!pi_state)
837 : : return -ENOMEM;
838 : :
839 : 0 : INIT_LIST_HEAD(&pi_state->list);
840 : : /* pi_mutex gets initialized later */
841 : 0 : pi_state->owner = NULL;
842 : 0 : refcount_set(&pi_state->refcount, 1);
843 : 0 : pi_state->key = FUTEX_KEY_INIT;
844 : :
845 : 0 : current->pi_state_cache = pi_state;
846 : :
847 : 0 : return 0;
848 : : }
849 : :
850 : 0 : static struct futex_pi_state *alloc_pi_state(void)
851 : : {
852 : 0 : struct futex_pi_state *pi_state = current->pi_state_cache;
853 : :
854 [ # # ]: 0 : WARN_ON(!pi_state);
855 : 0 : current->pi_state_cache = NULL;
856 : :
857 : 0 : return pi_state;
858 : : }
859 : :
860 : 0 : static void get_pi_state(struct futex_pi_state *pi_state)
861 : : {
862 [ # # ]: 0 : WARN_ON_ONCE(!refcount_inc_not_zero(&pi_state->refcount));
863 : 0 : }
864 : :
865 : : /*
866 : : * Drops a reference to the pi_state object and frees or caches it
867 : : * when the last reference is gone.
868 : : */
869 : 0 : static void put_pi_state(struct futex_pi_state *pi_state)
870 : : {
871 [ # # ]: 0 : if (!pi_state)
872 : : return;
873 : :
874 [ # # ]: 0 : if (!refcount_dec_and_test(&pi_state->refcount))
875 : : return;
876 : :
877 : : /*
878 : : * If pi_state->owner is NULL, the owner is most probably dying
879 : : * and has cleaned up the pi_state already
880 : : */
881 [ # # ]: 0 : if (pi_state->owner) {
882 : 0 : struct task_struct *owner;
883 : :
884 : 0 : raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
885 : 0 : owner = pi_state->owner;
886 [ # # ]: 0 : if (owner) {
887 : 0 : raw_spin_lock(&owner->pi_lock);
888 : 0 : list_del_init(&pi_state->list);
889 : 0 : raw_spin_unlock(&owner->pi_lock);
890 : : }
891 : 0 : rt_mutex_proxy_unlock(&pi_state->pi_mutex, owner);
892 : 0 : raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
893 : : }
894 : :
895 [ # # ]: 0 : if (current->pi_state_cache) {
896 : 0 : kfree(pi_state);
897 : : } else {
898 : : /*
899 : : * pi_state->list is already empty.
900 : : * clear pi_state->owner.
901 : : * refcount is at 0 - put it back to 1.
902 : : */
903 : 0 : pi_state->owner = NULL;
904 : 0 : refcount_set(&pi_state->refcount, 1);
905 : 0 : current->pi_state_cache = pi_state;
906 : : }
907 : : }
908 : :
909 : : #ifdef CONFIG_FUTEX_PI
910 : :
911 : : /*
912 : : * This task is holding PI mutexes at exit time => bad.
913 : : * Kernel cleans up PI-state, but userspace is likely hosed.
914 : : * (Robust-futex cleanup is separate and might save the day for userspace.)
915 : : */
916 : 0 : static void exit_pi_state_list(struct task_struct *curr)
917 : : {
918 : 0 : struct list_head *next, *head = &curr->pi_state_list;
919 : 0 : struct futex_pi_state *pi_state;
920 : 0 : struct futex_hash_bucket *hb;
921 : 0 : union futex_key key = FUTEX_KEY_INIT;
922 : :
923 [ # # ]: 0 : if (!futex_cmpxchg_enabled)
924 : 0 : return;
925 : : /*
926 : : * We are a ZOMBIE and nobody can enqueue itself on
927 : : * pi_state_list anymore, but we have to be careful
928 : : * versus waiters unqueueing themselves:
929 : : */
930 : 0 : raw_spin_lock_irq(&curr->pi_lock);
931 [ # # ]: 0 : while (!list_empty(head)) {
932 : 0 : next = head->next;
933 : 0 : pi_state = list_entry(next, struct futex_pi_state, list);
934 : 0 : key = pi_state->key;
935 : 0 : hb = hash_futex(&key);
936 : :
937 : : /*
938 : : * We can race against put_pi_state() removing itself from the
939 : : * list (a waiter going away). put_pi_state() will first
940 : : * decrement the reference count and then modify the list, so
941 : : * its possible to see the list entry but fail this reference
942 : : * acquire.
943 : : *
944 : : * In that case; drop the locks to let put_pi_state() make
945 : : * progress and retry the loop.
946 : : */
947 [ # # ]: 0 : if (!refcount_inc_not_zero(&pi_state->refcount)) {
948 : 0 : raw_spin_unlock_irq(&curr->pi_lock);
949 : 0 : cpu_relax();
950 : 0 : raw_spin_lock_irq(&curr->pi_lock);
951 : 0 : continue;
952 : : }
953 : 0 : raw_spin_unlock_irq(&curr->pi_lock);
954 : :
955 : 0 : spin_lock(&hb->lock);
956 : 0 : raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
957 : 0 : raw_spin_lock(&curr->pi_lock);
958 : : /*
959 : : * We dropped the pi-lock, so re-check whether this
960 : : * task still owns the PI-state:
961 : : */
962 [ # # ]: 0 : if (head->next != next) {
963 : : /* retain curr->pi_lock for the loop invariant */
964 : 0 : raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
965 : 0 : spin_unlock(&hb->lock);
966 : 0 : put_pi_state(pi_state);
967 : 0 : continue;
968 : : }
969 : :
970 [ # # ]: 0 : WARN_ON(pi_state->owner != curr);
971 [ # # ]: 0 : WARN_ON(list_empty(&pi_state->list));
972 : 0 : list_del_init(&pi_state->list);
973 : 0 : pi_state->owner = NULL;
974 : :
975 : 0 : raw_spin_unlock(&curr->pi_lock);
976 : 0 : raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
977 : 0 : spin_unlock(&hb->lock);
978 : :
979 : 0 : rt_mutex_futex_unlock(&pi_state->pi_mutex);
980 : 0 : put_pi_state(pi_state);
981 : :
982 : 0 : raw_spin_lock_irq(&curr->pi_lock);
983 : : }
984 : 0 : raw_spin_unlock_irq(&curr->pi_lock);
985 : : }
986 : : #else
987 : : static inline void exit_pi_state_list(struct task_struct *curr) { }
988 : : #endif
989 : :
990 : : /*
991 : : * We need to check the following states:
992 : : *
993 : : * Waiter | pi_state | pi->owner | uTID | uODIED | ?
994 : : *
995 : : * [1] NULL | --- | --- | 0 | 0/1 | Valid
996 : : * [2] NULL | --- | --- | >0 | 0/1 | Valid
997 : : *
998 : : * [3] Found | NULL | -- | Any | 0/1 | Invalid
999 : : *
1000 : : * [4] Found | Found | NULL | 0 | 1 | Valid
1001 : : * [5] Found | Found | NULL | >0 | 1 | Invalid
1002 : : *
1003 : : * [6] Found | Found | task | 0 | 1 | Valid
1004 : : *
1005 : : * [7] Found | Found | NULL | Any | 0 | Invalid
1006 : : *
1007 : : * [8] Found | Found | task | ==taskTID | 0/1 | Valid
1008 : : * [9] Found | Found | task | 0 | 0 | Invalid
1009 : : * [10] Found | Found | task | !=taskTID | 0/1 | Invalid
1010 : : *
1011 : : * [1] Indicates that the kernel can acquire the futex atomically. We
1012 : : * came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.
1013 : : *
1014 : : * [2] Valid, if TID does not belong to a kernel thread. If no matching
1015 : : * thread is found then it indicates that the owner TID has died.
1016 : : *
1017 : : * [3] Invalid. The waiter is queued on a non PI futex
1018 : : *
1019 : : * [4] Valid state after exit_robust_list(), which sets the user space
1020 : : * value to FUTEX_WAITERS | FUTEX_OWNER_DIED.
1021 : : *
1022 : : * [5] The user space value got manipulated between exit_robust_list()
1023 : : * and exit_pi_state_list()
1024 : : *
1025 : : * [6] Valid state after exit_pi_state_list() which sets the new owner in
1026 : : * the pi_state but cannot access the user space value.
1027 : : *
1028 : : * [7] pi_state->owner can only be NULL when the OWNER_DIED bit is set.
1029 : : *
1030 : : * [8] Owner and user space value match
1031 : : *
1032 : : * [9] There is no transient state which sets the user space TID to 0
1033 : : * except exit_robust_list(), but this is indicated by the
1034 : : * FUTEX_OWNER_DIED bit. See [4]
1035 : : *
1036 : : * [10] There is no transient state which leaves owner and user space
1037 : : * TID out of sync.
1038 : : *
1039 : : *
1040 : : * Serialization and lifetime rules:
1041 : : *
1042 : : * hb->lock:
1043 : : *
1044 : : * hb -> futex_q, relation
1045 : : * futex_q -> pi_state, relation
1046 : : *
1047 : : * (cannot be raw because hb can contain arbitrary amount
1048 : : * of futex_q's)
1049 : : *
1050 : : * pi_mutex->wait_lock:
1051 : : *
1052 : : * {uval, pi_state}
1053 : : *
1054 : : * (and pi_mutex 'obviously')
1055 : : *
1056 : : * p->pi_lock:
1057 : : *
1058 : : * p->pi_state_list -> pi_state->list, relation
1059 : : *
1060 : : * pi_state->refcount:
1061 : : *
1062 : : * pi_state lifetime
1063 : : *
1064 : : *
1065 : : * Lock order:
1066 : : *
1067 : : * hb->lock
1068 : : * pi_mutex->wait_lock
1069 : : * p->pi_lock
1070 : : *
1071 : : */
1072 : :
1073 : : /*
1074 : : * Validate that the existing waiter has a pi_state and sanity check
1075 : : * the pi_state against the user space value. If correct, attach to
1076 : : * it.
1077 : : */
1078 : 0 : static int attach_to_pi_state(u32 __user *uaddr, u32 uval,
1079 : : struct futex_pi_state *pi_state,
1080 : : struct futex_pi_state **ps)
1081 : : {
1082 : 0 : pid_t pid = uval & FUTEX_TID_MASK;
1083 : 0 : u32 uval2;
1084 : 0 : int ret;
1085 : :
1086 : : /*
1087 : : * Userspace might have messed up non-PI and PI futexes [3]
1088 : : */
1089 [ # # ]: 0 : if (unlikely(!pi_state))
1090 : : return -EINVAL;
1091 : :
1092 : : /*
1093 : : * We get here with hb->lock held, and having found a
1094 : : * futex_top_waiter(). This means that futex_lock_pi() of said futex_q
1095 : : * has dropped the hb->lock in between queue_me() and unqueue_me_pi(),
1096 : : * which in turn means that futex_lock_pi() still has a reference on
1097 : : * our pi_state.
1098 : : *
1099 : : * The waiter holding a reference on @pi_state also protects against
1100 : : * the unlocked put_pi_state() in futex_unlock_pi(), futex_lock_pi()
1101 : : * and futex_wait_requeue_pi() as it cannot go to 0 and consequently
1102 : : * free pi_state before we can take a reference ourselves.
1103 : : */
1104 [ # # ]: 0 : WARN_ON(!refcount_read(&pi_state->refcount));
1105 : :
1106 : : /*
1107 : : * Now that we have a pi_state, we can acquire wait_lock
1108 : : * and do the state validation.
1109 : : */
1110 : 0 : raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
1111 : :
1112 : : /*
1113 : : * Since {uval, pi_state} is serialized by wait_lock, and our current
1114 : : * uval was read without holding it, it can have changed. Verify it
1115 : : * still is what we expect it to be, otherwise retry the entire
1116 : : * operation.
1117 : : */
1118 [ # # ]: 0 : if (get_futex_value_locked(&uval2, uaddr))
1119 : 0 : goto out_efault;
1120 : :
1121 [ # # ]: 0 : if (uval != uval2)
1122 : 0 : goto out_eagain;
1123 : :
1124 : : /*
1125 : : * Handle the owner died case:
1126 : : */
1127 [ # # ]: 0 : if (uval & FUTEX_OWNER_DIED) {
1128 : : /*
1129 : : * exit_pi_state_list sets owner to NULL and wakes the
1130 : : * topmost waiter. The task which acquires the
1131 : : * pi_state->rt_mutex will fixup owner.
1132 : : */
1133 [ # # ]: 0 : if (!pi_state->owner) {
1134 : : /*
1135 : : * No pi state owner, but the user space TID
1136 : : * is not 0. Inconsistent state. [5]
1137 : : */
1138 [ # # ]: 0 : if (pid)
1139 : 0 : goto out_einval;
1140 : : /*
1141 : : * Take a ref on the state and return success. [4]
1142 : : */
1143 : 0 : goto out_attach;
1144 : : }
1145 : :
1146 : : /*
1147 : : * If TID is 0, then either the dying owner has not
1148 : : * yet executed exit_pi_state_list() or some waiter
1149 : : * acquired the rtmutex in the pi state, but did not
1150 : : * yet fixup the TID in user space.
1151 : : *
1152 : : * Take a ref on the state and return success. [6]
1153 : : */
1154 [ # # ]: 0 : if (!pid)
1155 : 0 : goto out_attach;
1156 : : } else {
1157 : : /*
1158 : : * If the owner died bit is not set, then the pi_state
1159 : : * must have an owner. [7]
1160 : : */
1161 [ # # ]: 0 : if (!pi_state->owner)
1162 : 0 : goto out_einval;
1163 : : }
1164 : :
1165 : : /*
1166 : : * Bail out if user space manipulated the futex value. If pi
1167 : : * state exists then the owner TID must be the same as the
1168 : : * user space TID. [9/10]
1169 : : */
1170 [ # # ]: 0 : if (pid != task_pid_vnr(pi_state->owner))
1171 : 0 : goto out_einval;
1172 : :
1173 : 0 : out_attach:
1174 : 0 : get_pi_state(pi_state);
1175 : 0 : raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
1176 : 0 : *ps = pi_state;
1177 : 0 : return 0;
1178 : :
1179 : 0 : out_einval:
1180 : 0 : ret = -EINVAL;
1181 : 0 : goto out_error;
1182 : :
1183 : : out_eagain:
1184 : 0 : ret = -EAGAIN;
1185 : 0 : goto out_error;
1186 : :
1187 : : out_efault:
1188 : 0 : ret = -EFAULT;
1189 : 0 : goto out_error;
1190 : :
1191 : 0 : out_error:
1192 : 0 : raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
1193 : 0 : return ret;
1194 : : }
1195 : :
1196 : : /**
1197 : : * wait_for_owner_exiting - Block until the owner has exited
1198 : : * @ret: owner's current futex lock status
1199 : : * @exiting: Pointer to the exiting task
1200 : : *
1201 : : * Caller must hold a refcount on @exiting.
1202 : : */
1203 : 0 : static void wait_for_owner_exiting(int ret, struct task_struct *exiting)
1204 : : {
1205 [ # # ]: 0 : if (ret != -EBUSY) {
1206 [ # # ]: 0 : WARN_ON_ONCE(exiting);
1207 : : return;
1208 : : }
1209 : :
1210 [ # # # # ]: 0 : if (WARN_ON_ONCE(ret == -EBUSY && !exiting))
1211 : : return;
1212 : :
1213 : 0 : mutex_lock(&exiting->futex_exit_mutex);
1214 : : /*
1215 : : * No point in doing state checking here. If the waiter got here
1216 : : * while the task was in exec()->exec_futex_release() then it can
1217 : : * have any FUTEX_STATE_* value when the waiter has acquired the
1218 : : * mutex. OK, if running, EXITING or DEAD if it reached exit()
1219 : : * already. Highly unlikely and not a problem. Just one more round
1220 : : * through the futex maze.
1221 : : */
1222 : 0 : mutex_unlock(&exiting->futex_exit_mutex);
1223 : :
1224 : 0 : put_task_struct(exiting);
1225 : : }
1226 : :
1227 : 0 : static int handle_exit_race(u32 __user *uaddr, u32 uval,
1228 : : struct task_struct *tsk)
1229 : : {
1230 : 0 : u32 uval2;
1231 : :
1232 : : /*
1233 : : * If the futex exit state is not yet FUTEX_STATE_DEAD, tell the
1234 : : * caller that the alleged owner is busy.
1235 : : */
1236 [ # # # # ]: 0 : if (tsk && tsk->futex_state != FUTEX_STATE_DEAD)
1237 : : return -EBUSY;
1238 : :
1239 : : /*
1240 : : * Reread the user space value to handle the following situation:
1241 : : *
1242 : : * CPU0 CPU1
1243 : : *
1244 : : * sys_exit() sys_futex()
1245 : : * do_exit() futex_lock_pi()
1246 : : * futex_lock_pi_atomic()
1247 : : * exit_signals(tsk) No waiters:
1248 : : * tsk->flags |= PF_EXITING; *uaddr == 0x00000PID
1249 : : * mm_release(tsk) Set waiter bit
1250 : : * exit_robust_list(tsk) { *uaddr = 0x80000PID;
1251 : : * Set owner died attach_to_pi_owner() {
1252 : : * *uaddr = 0xC0000000; tsk = get_task(PID);
1253 : : * } if (!tsk->flags & PF_EXITING) {
1254 : : * ... attach();
1255 : : * tsk->futex_state = } else {
1256 : : * FUTEX_STATE_DEAD; if (tsk->futex_state !=
1257 : : * FUTEX_STATE_DEAD)
1258 : : * return -EAGAIN;
1259 : : * return -ESRCH; <--- FAIL
1260 : : * }
1261 : : *
1262 : : * Returning ESRCH unconditionally is wrong here because the
1263 : : * user space value has been changed by the exiting task.
1264 : : *
1265 : : * The same logic applies to the case where the exiting task is
1266 : : * already gone.
1267 : : */
1268 [ # # # # ]: 0 : if (get_futex_value_locked(&uval2, uaddr))
1269 : : return -EFAULT;
1270 : :
1271 : : /* If the user space value has changed, try again. */
1272 [ # # # # ]: 0 : if (uval2 != uval)
1273 : 0 : return -EAGAIN;
1274 : :
1275 : : /*
1276 : : * The exiting task did not have a robust list, the robust list was
1277 : : * corrupted or the user space value in *uaddr is simply bogus.
1278 : : * Give up and tell user space.
1279 : : */
1280 : : return -ESRCH;
1281 : : }
1282 : :
1283 : : /*
1284 : : * Lookup the task for the TID provided from user space and attach to
1285 : : * it after doing proper sanity checks.
1286 : : */
1287 : 0 : static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key,
1288 : : struct futex_pi_state **ps,
1289 : : struct task_struct **exiting)
1290 : : {
1291 : 0 : pid_t pid = uval & FUTEX_TID_MASK;
1292 : 0 : struct futex_pi_state *pi_state;
1293 : 0 : struct task_struct *p;
1294 : :
1295 : : /*
1296 : : * We are the first waiter - try to look up the real owner and attach
1297 : : * the new pi_state to it, but bail out when TID = 0 [1]
1298 : : *
1299 : : * The !pid check is paranoid. None of the call sites should end up
1300 : : * with pid == 0, but better safe than sorry. Let the caller retry
1301 : : */
1302 [ # # ]: 0 : if (!pid)
1303 : : return -EAGAIN;
1304 : 0 : p = find_get_task_by_vpid(pid);
1305 [ # # ]: 0 : if (!p)
1306 : 0 : return handle_exit_race(uaddr, uval, NULL);
1307 : :
1308 [ # # ]: 0 : if (unlikely(p->flags & PF_KTHREAD)) {
1309 : 0 : put_task_struct(p);
1310 : 0 : return -EPERM;
1311 : : }
1312 : :
1313 : : /*
1314 : : * We need to look at the task state to figure out, whether the
1315 : : * task is exiting. To protect against the change of the task state
1316 : : * in futex_exit_release(), we do this protected by p->pi_lock:
1317 : : */
1318 : 0 : raw_spin_lock_irq(&p->pi_lock);
1319 [ # # ]: 0 : if (unlikely(p->futex_state != FUTEX_STATE_OK)) {
1320 : : /*
1321 : : * The task is on the way out. When the futex state is
1322 : : * FUTEX_STATE_DEAD, we know that the task has finished
1323 : : * the cleanup:
1324 : : */
1325 : 0 : int ret = handle_exit_race(uaddr, uval, p);
1326 : :
1327 : 0 : raw_spin_unlock_irq(&p->pi_lock);
1328 : : /*
1329 : : * If the owner task is between FUTEX_STATE_EXITING and
1330 : : * FUTEX_STATE_DEAD then store the task pointer and keep
1331 : : * the reference on the task struct. The calling code will
1332 : : * drop all locks, wait for the task to reach
1333 : : * FUTEX_STATE_DEAD and then drop the refcount. This is
1334 : : * required to prevent a live lock when the current task
1335 : : * preempted the exiting task between the two states.
1336 : : */
1337 [ # # ]: 0 : if (ret == -EBUSY)
1338 : 0 : *exiting = p;
1339 : : else
1340 : 0 : put_task_struct(p);
1341 : 0 : return ret;
1342 : : }
1343 : :
1344 : : /*
1345 : : * No existing pi state. First waiter. [2]
1346 : : *
1347 : : * This creates pi_state, we have hb->lock held, this means nothing can
1348 : : * observe this state, wait_lock is irrelevant.
1349 : : */
1350 [ # # ]: 0 : pi_state = alloc_pi_state();
1351 : :
1352 : : /*
1353 : : * Initialize the pi_mutex in locked state and make @p
1354 : : * the owner of it:
1355 : : */
1356 : 0 : rt_mutex_init_proxy_locked(&pi_state->pi_mutex, p);
1357 : :
1358 : : /* Store the key for possible exit cleanups: */
1359 : 0 : pi_state->key = *key;
1360 : :
1361 [ # # ]: 0 : WARN_ON(!list_empty(&pi_state->list));
1362 : 0 : list_add(&pi_state->list, &p->pi_state_list);
1363 : : /*
1364 : : * Assignment without holding pi_state->pi_mutex.wait_lock is safe
1365 : : * because there is no concurrency as the object is not published yet.
1366 : : */
1367 : 0 : pi_state->owner = p;
1368 : 0 : raw_spin_unlock_irq(&p->pi_lock);
1369 : :
1370 : 0 : put_task_struct(p);
1371 : :
1372 : 0 : *ps = pi_state;
1373 : :
1374 : 0 : return 0;
1375 : : }
1376 : :
1377 : 0 : static int lookup_pi_state(u32 __user *uaddr, u32 uval,
1378 : : struct futex_hash_bucket *hb,
1379 : : union futex_key *key, struct futex_pi_state **ps,
1380 : : struct task_struct **exiting)
1381 : : {
1382 : 0 : struct futex_q *top_waiter = futex_top_waiter(hb, key);
1383 : :
1384 : : /*
1385 : : * If there is a waiter on that futex, validate it and
1386 : : * attach to the pi_state when the validation succeeds.
1387 : : */
1388 [ # # ]: 0 : if (top_waiter)
1389 : 0 : return attach_to_pi_state(uaddr, uval, top_waiter->pi_state, ps);
1390 : :
1391 : : /*
1392 : : * We are the first waiter - try to look up the owner based on
1393 : : * @uval and attach to it.
1394 : : */
1395 : 0 : return attach_to_pi_owner(uaddr, uval, key, ps, exiting);
1396 : : }
1397 : :
1398 : 0 : static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
1399 : : {
1400 : 0 : int err;
1401 : 0 : u32 uninitialized_var(curval);
1402 : :
1403 : 0 : if (unlikely(should_fail_futex(true)))
1404 : : return -EFAULT;
1405 : :
1406 : 0 : err = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval);
1407 [ # # # # ]: 0 : if (unlikely(err))
1408 : : return err;
1409 : :
1410 : : /* If user space value changed, let the caller retry */
1411 [ # # # # ]: 0 : return curval != uval ? -EAGAIN : 0;
1412 : : }
1413 : :
1414 : : /**
1415 : : * futex_lock_pi_atomic() - Atomic work required to acquire a pi aware futex
1416 : : * @uaddr: the pi futex user address
1417 : : * @hb: the pi futex hash bucket
1418 : : * @key: the futex key associated with uaddr and hb
1419 : : * @ps: the pi_state pointer where we store the result of the
1420 : : * lookup
1421 : : * @task: the task to perform the atomic lock work for. This will
1422 : : * be "current" except in the case of requeue pi.
1423 : : * @exiting: Pointer to store the task pointer of the owner task
1424 : : * which is in the middle of exiting
1425 : : * @set_waiters: force setting the FUTEX_WAITERS bit (1) or not (0)
1426 : : *
1427 : : * Return:
1428 : : * - 0 - ready to wait;
1429 : : * - 1 - acquired the lock;
1430 : : * - <0 - error
1431 : : *
1432 : : * The hb->lock and futex_key refs shall be held by the caller.
1433 : : *
1434 : : * @exiting is only set when the return value is -EBUSY. If so, this holds
1435 : : * a refcount on the exiting task on return and the caller needs to drop it
1436 : : * after waiting for the exit to complete.
1437 : : */
1438 : 0 : static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
1439 : : union futex_key *key,
1440 : : struct futex_pi_state **ps,
1441 : : struct task_struct *task,
1442 : : struct task_struct **exiting,
1443 : : int set_waiters)
1444 : : {
1445 : 0 : u32 uval, newval, vpid = task_pid_vnr(task);
1446 : 0 : struct futex_q *top_waiter;
1447 : 0 : int ret;
1448 : :
1449 : : /*
1450 : : * Read the user space value first so we can validate a few
1451 : : * things before proceeding further.
1452 : : */
1453 [ # # ]: 0 : if (get_futex_value_locked(&uval, uaddr))
1454 : : return -EFAULT;
1455 : :
1456 : 0 : if (unlikely(should_fail_futex(true)))
1457 : : return -EFAULT;
1458 : :
1459 : : /*
1460 : : * Detect deadlocks.
1461 : : */
1462 [ # # ]: 0 : if ((unlikely((uval & FUTEX_TID_MASK) == vpid)))
1463 : : return -EDEADLK;
1464 : :
1465 : 0 : if ((unlikely(should_fail_futex(true))))
1466 : : return -EDEADLK;
1467 : :
1468 : : /*
1469 : : * Lookup existing state first. If it exists, try to attach to
1470 : : * its pi_state.
1471 : : */
1472 : 0 : top_waiter = futex_top_waiter(hb, key);
1473 [ # # ]: 0 : if (top_waiter)
1474 : 0 : return attach_to_pi_state(uaddr, uval, top_waiter->pi_state, ps);
1475 : :
1476 : : /*
1477 : : * No waiter and user TID is 0. We are here because the
1478 : : * waiters or the owner died bit is set or called from
1479 : : * requeue_cmp_pi or for whatever reason something took the
1480 : : * syscall.
1481 : : */
1482 [ # # ]: 0 : if (!(uval & FUTEX_TID_MASK)) {
1483 : : /*
1484 : : * We take over the futex. No other waiters and the user space
1485 : : * TID is 0. We preserve the owner died bit.
1486 : : */
1487 : 0 : newval = uval & FUTEX_OWNER_DIED;
1488 : 0 : newval |= vpid;
1489 : :
1490 : : /* The futex requeue_pi code can enforce the waiters bit */
1491 [ # # ]: 0 : if (set_waiters)
1492 : 0 : newval |= FUTEX_WAITERS;
1493 : :
1494 : 0 : ret = lock_pi_update_atomic(uaddr, uval, newval);
1495 : : /* If the take over worked, return 1 */
1496 [ # # ]: 0 : return ret < 0 ? ret : 1;
1497 : : }
1498 : :
1499 : : /*
1500 : : * First waiter. Set the waiters bit before attaching ourself to
1501 : : * the owner. If owner tries to unlock, it will be forced into
1502 : : * the kernel and blocked on hb->lock.
1503 : : */
1504 : 0 : newval = uval | FUTEX_WAITERS;
1505 : 0 : ret = lock_pi_update_atomic(uaddr, uval, newval);
1506 [ # # ]: 0 : if (ret)
1507 : 0 : return ret;
1508 : : /*
1509 : : * If the update of the user space value succeeded, we try to
1510 : : * attach to the owner. If that fails, no harm done, we only
1511 : : * set the FUTEX_WAITERS bit in the user space variable.
1512 : : */
1513 : 0 : return attach_to_pi_owner(uaddr, newval, key, ps, exiting);
1514 : : }
1515 : :
1516 : : /**
1517 : : * __unqueue_futex() - Remove the futex_q from its futex_hash_bucket
1518 : : * @q: The futex_q to unqueue
1519 : : *
1520 : : * The q->lock_ptr must not be NULL and must be held by the caller.
1521 : : */
1522 : 1639 : static void __unqueue_futex(struct futex_q *q)
1523 : : {
1524 : 1639 : struct futex_hash_bucket *hb;
1525 : :
1526 [ - + + - : 1639 : if (WARN_ON_SMP(!q->lock_ptr) || WARN_ON(plist_node_empty(&q->list)))
- + + - ]
1527 : : return;
1528 : 1639 : lockdep_assert_held(q->lock_ptr);
1529 : :
1530 : 1639 : hb = container_of(q->lock_ptr, struct futex_hash_bucket, lock);
1531 : 1639 : plist_del(&q->list, &hb->chain);
1532 : 1639 : hb_waiters_dec(hb);
1533 : : }
1534 : :
1535 : : /*
1536 : : * The hash bucket lock must be held when this is called.
1537 : : * Afterwards, the futex_q must not be accessed. Callers
1538 : : * must ensure to later call wake_up_q() for the actual
1539 : : * wakeups to occur.
1540 : : */
1541 : 1639 : static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
1542 : : {
1543 : 1639 : struct task_struct *p = q->task;
1544 : :
1545 [ + - + - : 3278 : if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
- + + - ]
1546 : : return;
1547 : :
1548 : 1639 : get_task_struct(p);
1549 : 1639 : __unqueue_futex(q);
1550 : : /*
1551 : : * The waiting task can free the futex_q as soon as q->lock_ptr = NULL
1552 : : * is written, without taking any locks. This is possible in the event
1553 : : * of a spurious wakeup, for example. A memory barrier is required here
1554 : : * to prevent the following store to lock_ptr from getting ahead of the
1555 : : * plist_del in __unqueue_futex().
1556 : : */
1557 : 1639 : smp_store_release(&q->lock_ptr, NULL);
1558 : :
1559 : : /*
1560 : : * Queue the task for later wakeup for after we've released
1561 : : * the hb->lock.
1562 : : */
1563 : 1639 : wake_q_add_safe(wake_q, p);
1564 : : }
1565 : :
1566 : : /*
1567 : : * Caller must hold a reference on @pi_state.
1568 : : */
1569 : 0 : static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_state)
1570 : : {
1571 : 0 : u32 uninitialized_var(curval), newval;
1572 : 0 : struct task_struct *new_owner;
1573 : 0 : bool postunlock = false;
1574 : 0 : DEFINE_WAKE_Q(wake_q);
1575 : 0 : int ret = 0;
1576 : :
1577 : 0 : new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
1578 [ # # # # ]: 0 : if (WARN_ON_ONCE(!new_owner)) {
1579 : : /*
1580 : : * As per the comment in futex_unlock_pi() this should not happen.
1581 : : *
1582 : : * When this happens, give up our locks and try again, giving
1583 : : * the futex_lock_pi() instance time to complete, either by
1584 : : * waiting on the rtmutex or removing itself from the futex
1585 : : * queue.
1586 : : */
1587 : 0 : ret = -EAGAIN;
1588 : 0 : goto out_unlock;
1589 : : }
1590 : :
1591 : : /*
1592 : : * We pass it to the next owner. The WAITERS bit is always kept
1593 : : * enabled while there is PI state around. We cleanup the owner
1594 : : * died bit, because we are the owner.
1595 : : */
1596 : 0 : newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
1597 : :
1598 : 0 : if (unlikely(should_fail_futex(true)))
1599 : : ret = -EFAULT;
1600 : :
1601 : 0 : ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval);
1602 [ # # # # ]: 0 : if (!ret && (curval != uval)) {
1603 : : /*
1604 : : * If a unconditional UNLOCK_PI operation (user space did not
1605 : : * try the TID->0 transition) raced with a waiter setting the
1606 : : * FUTEX_WAITERS flag between get_user() and locking the hash
1607 : : * bucket lock, retry the operation.
1608 : : */
1609 [ # # ]: 0 : if ((FUTEX_TID_MASK & curval) == uval)
1610 : : ret = -EAGAIN;
1611 : : else
1612 : 0 : ret = -EINVAL;
1613 : : }
1614 : :
1615 [ # # ]: 0 : if (ret)
1616 : 0 : goto out_unlock;
1617 : :
1618 : : /*
1619 : : * This is a point of no return; once we modify the uval there is no
1620 : : * going back and subsequent operations must not fail.
1621 : : */
1622 : :
1623 : 0 : raw_spin_lock(&pi_state->owner->pi_lock);
1624 [ # # ]: 0 : WARN_ON(list_empty(&pi_state->list));
1625 : 0 : list_del_init(&pi_state->list);
1626 : 0 : raw_spin_unlock(&pi_state->owner->pi_lock);
1627 : :
1628 : 0 : raw_spin_lock(&new_owner->pi_lock);
1629 [ # # ]: 0 : WARN_ON(!list_empty(&pi_state->list));
1630 : 0 : list_add(&pi_state->list, &new_owner->pi_state_list);
1631 : 0 : pi_state->owner = new_owner;
1632 : 0 : raw_spin_unlock(&new_owner->pi_lock);
1633 : :
1634 : 0 : postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
1635 : :
1636 : 0 : out_unlock:
1637 : 0 : raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
1638 : :
1639 [ # # ]: 0 : if (postunlock)
1640 : 0 : rt_mutex_postunlock(&wake_q);
1641 : :
1642 : 0 : return ret;
1643 : : }
1644 : :
1645 : : /*
1646 : : * Express the locking dependencies for lockdep:
1647 : : */
1648 : : static inline void
1649 : 0 : double_lock_hb(struct futex_hash_bucket *hb1, struct futex_hash_bucket *hb2)
1650 : : {
1651 [ # # ]: 0 : if (hb1 <= hb2) {
1652 : 0 : spin_lock(&hb1->lock);
1653 [ # # ]: 0 : if (hb1 < hb2)
1654 : 0 : spin_lock_nested(&hb2->lock, SINGLE_DEPTH_NESTING);
1655 : : } else { /* hb1 > hb2 */
1656 : 0 : spin_lock(&hb2->lock);
1657 : 0 : spin_lock_nested(&hb1->lock, SINGLE_DEPTH_NESTING);
1658 : : }
1659 : 0 : }
1660 : :
1661 : : static inline void
1662 : 0 : double_unlock_hb(struct futex_hash_bucket *hb1, struct futex_hash_bucket *hb2)
1663 : : {
1664 : 0 : spin_unlock(&hb1->lock);
1665 [ # # # # : 0 : if (hb1 != hb2)
# # # # #
# # # ]
1666 : 0 : spin_unlock(&hb2->lock);
1667 : : }
1668 : :
1669 : : /*
1670 : : * Wake up waiters matching bitset queued on this futex (uaddr).
1671 : : */
1672 : : static int
1673 : 26795 : futex_wake(u32 __user *uaddr, unsigned int flags, int nr_wake, u32 bitset)
1674 : : {
1675 : 26795 : struct futex_hash_bucket *hb;
1676 : 26795 : struct futex_q *this, *next;
1677 : 26795 : union futex_key key = FUTEX_KEY_INIT;
1678 : 26795 : int ret;
1679 : 26795 : DEFINE_WAKE_Q(wake_q);
1680 : :
1681 [ + - ]: 26795 : if (!bitset)
1682 : : return -EINVAL;
1683 : :
1684 : 26795 : ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &key, FUTEX_READ);
1685 [ - + ]: 26795 : if (unlikely(ret != 0))
1686 : 0 : goto out;
1687 : :
1688 : 26795 : hb = hash_futex(&key);
1689 : :
1690 : : /* Make sure we really have tasks to wakeup */
1691 [ + + ]: 26795 : if (!hb_waiters_pending(hb))
1692 : 25069 : goto out_put_key;
1693 : :
1694 : 1726 : spin_lock(&hb->lock);
1695 : :
1696 [ + + ]: 1891 : plist_for_each_entry_safe(this, next, &hb->chain, list) {
1697 [ + - ]: 1726 : if (match_futex (&this->key, &key)) {
1698 [ + - + - ]: 1639 : if (this->pi_state || this->rt_waiter) {
1699 : : ret = -EINVAL;
1700 : : break;
1701 : : }
1702 : :
1703 : : /* Check if one of the bits is set in both bitsets */
1704 [ - + ]: 1639 : if (!(this->bitset & bitset))
1705 : 0 : continue;
1706 : :
1707 : 1639 : mark_wake_futex(&wake_q, this);
1708 [ + + ]: 1639 : if (++ret >= nr_wake)
1709 : : break;
1710 : : }
1711 : : }
1712 : :
1713 : 1726 : spin_unlock(&hb->lock);
1714 : 1726 : wake_up_q(&wake_q);
1715 : 26795 : out_put_key:
1716 : 26795 : put_futex_key(&key);
1717 : : out:
1718 : : return ret;
1719 : : }
1720 : :
1721 : 0 : static int futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr)
1722 : : {
1723 : 0 : unsigned int op = (encoded_op & 0x70000000) >> 28;
1724 : 0 : unsigned int cmp = (encoded_op & 0x0f000000) >> 24;
1725 [ # # ]: 0 : int oparg = sign_extend32((encoded_op & 0x00fff000) >> 12, 11);
1726 : 0 : int cmparg = sign_extend32(encoded_op & 0x00000fff, 11);
1727 : 0 : int oldval, ret;
1728 : :
1729 [ # # ]: 0 : if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) {
1730 [ # # ]: 0 : if (oparg < 0 || oparg > 31) {
1731 : 0 : char comm[sizeof(current->comm)];
1732 : : /*
1733 : : * kill this print and return -EINVAL when userspace
1734 : : * is sane again
1735 : : */
1736 [ # # ]: 0 : pr_info_ratelimited("futex_wake_op: %s tries to shift op by %d; fix this program\n",
1737 : : get_task_comm(comm, current), oparg);
1738 : 0 : oparg &= 31;
1739 : : }
1740 : 0 : oparg = 1 << oparg;
1741 : : }
1742 : :
1743 [ # # ]: 0 : if (!access_ok(uaddr, sizeof(u32)))
1744 : : return -EFAULT;
1745 : :
1746 : 0 : ret = arch_futex_atomic_op_inuser(op, oparg, &oldval, uaddr);
1747 [ # # ]: 0 : if (ret)
1748 : : return ret;
1749 : :
1750 [ # # # # : 0 : switch (cmp) {
# # # ]
1751 : 0 : case FUTEX_OP_CMP_EQ:
1752 : 0 : return oldval == cmparg;
1753 : 0 : case FUTEX_OP_CMP_NE:
1754 : 0 : return oldval != cmparg;
1755 : 0 : case FUTEX_OP_CMP_LT:
1756 : 0 : return oldval < cmparg;
1757 : 0 : case FUTEX_OP_CMP_GE:
1758 : 0 : return oldval >= cmparg;
1759 : 0 : case FUTEX_OP_CMP_LE:
1760 : 0 : return oldval <= cmparg;
1761 : 0 : case FUTEX_OP_CMP_GT:
1762 : 0 : return oldval > cmparg;
1763 : : default:
1764 : : return -ENOSYS;
1765 : : }
1766 : : }
1767 : :
1768 : : /*
1769 : : * Wake up all waiters hashed on the physical page that is mapped
1770 : : * to this virtual address:
1771 : : */
1772 : : static int
1773 : 0 : futex_wake_op(u32 __user *uaddr1, unsigned int flags, u32 __user *uaddr2,
1774 : : int nr_wake, int nr_wake2, int op)
1775 : : {
1776 : 0 : union futex_key key1 = FUTEX_KEY_INIT, key2 = FUTEX_KEY_INIT;
1777 : 0 : struct futex_hash_bucket *hb1, *hb2;
1778 : 0 : struct futex_q *this, *next;
1779 : 0 : int ret, op_ret;
1780 : 0 : DEFINE_WAKE_Q(wake_q);
1781 : :
1782 : 0 : retry:
1783 : 0 : ret = get_futex_key(uaddr1, flags & FLAGS_SHARED, &key1, FUTEX_READ);
1784 [ # # ]: 0 : if (unlikely(ret != 0))
1785 : 0 : goto out;
1786 : 0 : ret = get_futex_key(uaddr2, flags & FLAGS_SHARED, &key2, FUTEX_WRITE);
1787 [ # # ]: 0 : if (unlikely(ret != 0))
1788 : 0 : goto out_put_key1;
1789 : :
1790 : 0 : hb1 = hash_futex(&key1);
1791 : 0 : hb2 = hash_futex(&key2);
1792 : :
1793 : 0 : retry_private:
1794 : 0 : double_lock_hb(hb1, hb2);
1795 : 0 : op_ret = futex_atomic_op_inuser(op, uaddr2);
1796 [ # # ]: 0 : if (unlikely(op_ret < 0)) {
1797 : 0 : double_unlock_hb(hb1, hb2);
1798 : :
1799 : 0 : if (!IS_ENABLED(CONFIG_MMU) ||
1800 [ # # ]: 0 : unlikely(op_ret != -EFAULT && op_ret != -EAGAIN)) {
1801 : : /*
1802 : : * we don't get EFAULT from MMU faults if we don't have
1803 : : * an MMU, but we might get them from range checking
1804 : : */
1805 : 0 : ret = op_ret;
1806 : 0 : goto out_put_keys;
1807 : : }
1808 : :
1809 [ # # ]: 0 : if (op_ret == -EFAULT) {
1810 : 0 : ret = fault_in_user_writeable(uaddr2);
1811 [ # # ]: 0 : if (ret)
1812 : 0 : goto out_put_keys;
1813 : : }
1814 : :
1815 [ # # ]: 0 : if (!(flags & FLAGS_SHARED)) {
1816 : 0 : cond_resched();
1817 : 0 : goto retry_private;
1818 : : }
1819 : :
1820 : 0 : put_futex_key(&key2);
1821 : 0 : put_futex_key(&key1);
1822 : 0 : cond_resched();
1823 : 0 : goto retry;
1824 : : }
1825 : :
1826 [ # # ]: 0 : plist_for_each_entry_safe(this, next, &hb1->chain, list) {
1827 [ # # ]: 0 : if (match_futex (&this->key, &key1)) {
1828 [ # # # # ]: 0 : if (this->pi_state || this->rt_waiter) {
1829 : 0 : ret = -EINVAL;
1830 : 0 : goto out_unlock;
1831 : : }
1832 : 0 : mark_wake_futex(&wake_q, this);
1833 [ # # ]: 0 : if (++ret >= nr_wake)
1834 : : break;
1835 : : }
1836 : : }
1837 : :
1838 [ # # ]: 0 : if (op_ret > 0) {
1839 : 0 : op_ret = 0;
1840 [ # # ]: 0 : plist_for_each_entry_safe(this, next, &hb2->chain, list) {
1841 [ # # ]: 0 : if (match_futex (&this->key, &key2)) {
1842 [ # # # # ]: 0 : if (this->pi_state || this->rt_waiter) {
1843 : 0 : ret = -EINVAL;
1844 : 0 : goto out_unlock;
1845 : : }
1846 : 0 : mark_wake_futex(&wake_q, this);
1847 [ # # ]: 0 : if (++op_ret >= nr_wake2)
1848 : : break;
1849 : : }
1850 : : }
1851 : 0 : ret += op_ret;
1852 : : }
1853 : :
1854 : 0 : out_unlock:
1855 : 0 : double_unlock_hb(hb1, hb2);
1856 : 0 : wake_up_q(&wake_q);
1857 : 0 : out_put_keys:
1858 : 0 : put_futex_key(&key2);
1859 : 0 : out_put_key1:
1860 : 0 : put_futex_key(&key1);
1861 : 0 : out:
1862 : 0 : return ret;
1863 : : }
1864 : :
1865 : : /**
1866 : : * requeue_futex() - Requeue a futex_q from one hb to another
1867 : : * @q: the futex_q to requeue
1868 : : * @hb1: the source hash_bucket
1869 : : * @hb2: the target hash_bucket
1870 : : * @key2: the new key for the requeued futex_q
1871 : : */
1872 : : static inline
1873 : 0 : void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
1874 : : struct futex_hash_bucket *hb2, union futex_key *key2)
1875 : : {
1876 : :
1877 : : /*
1878 : : * If key1 and key2 hash to the same bucket, no need to
1879 : : * requeue.
1880 : : */
1881 [ # # ]: 0 : if (likely(&hb1->chain != &hb2->chain)) {
1882 : 0 : plist_del(&q->list, &hb1->chain);
1883 : 0 : hb_waiters_dec(hb1);
1884 : 0 : hb_waiters_inc(hb2);
1885 : 0 : plist_add(&q->list, &hb2->chain);
1886 : 0 : q->lock_ptr = &hb2->lock;
1887 : : }
1888 : 0 : get_futex_key_refs(key2);
1889 : 0 : q->key = *key2;
1890 : 0 : }
1891 : :
1892 : : /**
1893 : : * requeue_pi_wake_futex() - Wake a task that acquired the lock during requeue
1894 : : * @q: the futex_q
1895 : : * @key: the key of the requeue target futex
1896 : : * @hb: the hash_bucket of the requeue target futex
1897 : : *
1898 : : * During futex_requeue, with requeue_pi=1, it is possible to acquire the
1899 : : * target futex if it is uncontended or via a lock steal. Set the futex_q key
1900 : : * to the requeue target futex so the waiter can detect the wakeup on the right
1901 : : * futex, but remove it from the hb and NULL the rt_waiter so it can detect
1902 : : * atomic lock acquisition. Set the q->lock_ptr to the requeue target hb->lock
1903 : : * to protect access to the pi_state to fixup the owner later. Must be called
1904 : : * with both q->lock_ptr and hb->lock held.
1905 : : */
1906 : : static inline
1907 : 0 : void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
1908 : : struct futex_hash_bucket *hb)
1909 : : {
1910 : 0 : get_futex_key_refs(key);
1911 : 0 : q->key = *key;
1912 : :
1913 : 0 : __unqueue_futex(q);
1914 : :
1915 [ # # ]: 0 : WARN_ON(!q->rt_waiter);
1916 : 0 : q->rt_waiter = NULL;
1917 : :
1918 : 0 : q->lock_ptr = &hb->lock;
1919 : :
1920 : 0 : wake_up_state(q->task, TASK_NORMAL);
1921 : 0 : }
1922 : :
1923 : : /**
1924 : : * futex_proxy_trylock_atomic() - Attempt an atomic lock for the top waiter
1925 : : * @pifutex: the user address of the to futex
1926 : : * @hb1: the from futex hash bucket, must be locked by the caller
1927 : : * @hb2: the to futex hash bucket, must be locked by the caller
1928 : : * @key1: the from futex key
1929 : : * @key2: the to futex key
1930 : : * @ps: address to store the pi_state pointer
1931 : : * @exiting: Pointer to store the task pointer of the owner task
1932 : : * which is in the middle of exiting
1933 : : * @set_waiters: force setting the FUTEX_WAITERS bit (1) or not (0)
1934 : : *
1935 : : * Try and get the lock on behalf of the top waiter if we can do it atomically.
1936 : : * Wake the top waiter if we succeed. If the caller specified set_waiters,
1937 : : * then direct futex_lock_pi_atomic() to force setting the FUTEX_WAITERS bit.
1938 : : * hb1 and hb2 must be held by the caller.
1939 : : *
1940 : : * @exiting is only set when the return value is -EBUSY. If so, this holds
1941 : : * a refcount on the exiting task on return and the caller needs to drop it
1942 : : * after waiting for the exit to complete.
1943 : : *
1944 : : * Return:
1945 : : * - 0 - failed to acquire the lock atomically;
1946 : : * - >0 - acquired the lock, return value is vpid of the top_waiter
1947 : : * - <0 - error
1948 : : */
1949 : : static int
1950 : 0 : futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1,
1951 : : struct futex_hash_bucket *hb2, union futex_key *key1,
1952 : : union futex_key *key2, struct futex_pi_state **ps,
1953 : : struct task_struct **exiting, int set_waiters)
1954 : : {
1955 : 0 : struct futex_q *top_waiter = NULL;
1956 : 0 : u32 curval;
1957 : 0 : int ret, vpid;
1958 : :
1959 [ # # ]: 0 : if (get_futex_value_locked(&curval, pifutex))
1960 : : return -EFAULT;
1961 : :
1962 : 0 : if (unlikely(should_fail_futex(true)))
1963 : : return -EFAULT;
1964 : :
1965 : : /*
1966 : : * Find the top_waiter and determine if there are additional waiters.
1967 : : * If the caller intends to requeue more than 1 waiter to pifutex,
1968 : : * force futex_lock_pi_atomic() to set the FUTEX_WAITERS bit now,
1969 : : * as we have means to handle the possible fault. If not, don't set
1970 : : * the bit unecessarily as it will force the subsequent unlock to enter
1971 : : * the kernel.
1972 : : */
1973 : 0 : top_waiter = futex_top_waiter(hb1, key1);
1974 : :
1975 : : /* There are no waiters, nothing for us to do. */
1976 [ # # ]: 0 : if (!top_waiter)
1977 : : return 0;
1978 : :
1979 : : /* Ensure we requeue to the expected futex. */
1980 [ # # ]: 0 : if (!match_futex(top_waiter->requeue_pi_key, key2))
1981 : : return -EINVAL;
1982 : :
1983 : : /*
1984 : : * Try to take the lock for top_waiter. Set the FUTEX_WAITERS bit in
1985 : : * the contended case or if set_waiters is 1. The pi_state is returned
1986 : : * in ps in contended cases.
1987 : : */
1988 : 0 : vpid = task_pid_vnr(top_waiter->task);
1989 : 0 : ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
1990 : : exiting, set_waiters);
1991 [ # # ]: 0 : if (ret == 1) {
1992 : 0 : requeue_pi_wake_futex(top_waiter, key2, hb2);
1993 : 0 : return vpid;
1994 : : }
1995 : : return ret;
1996 : : }
1997 : :
1998 : : /**
1999 : : * futex_requeue() - Requeue waiters from uaddr1 to uaddr2
2000 : : * @uaddr1: source futex user address
2001 : : * @flags: futex flags (FLAGS_SHARED, etc.)
2002 : : * @uaddr2: target futex user address
2003 : : * @nr_wake: number of waiters to wake (must be 1 for requeue_pi)
2004 : : * @nr_requeue: number of waiters to requeue (0-INT_MAX)
2005 : : * @cmpval: @uaddr1 expected value (or %NULL)
2006 : : * @requeue_pi: if we are attempting to requeue from a non-pi futex to a
2007 : : * pi futex (pi to pi requeue is not supported)
2008 : : *
2009 : : * Requeue waiters on uaddr1 to uaddr2. In the requeue_pi case, try to acquire
2010 : : * uaddr2 atomically on behalf of the top waiter.
2011 : : *
2012 : : * Return:
2013 : : * - >=0 - on success, the number of tasks requeued or woken;
2014 : : * - <0 - on error
2015 : : */
2016 : 0 : static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
2017 : : u32 __user *uaddr2, int nr_wake, int nr_requeue,
2018 : : u32 *cmpval, int requeue_pi)
2019 : : {
2020 : 0 : union futex_key key1 = FUTEX_KEY_INIT, key2 = FUTEX_KEY_INIT;
2021 : 0 : int drop_count = 0, task_count = 0, ret;
2022 : 0 : struct futex_pi_state *pi_state = NULL;
2023 : 0 : struct futex_hash_bucket *hb1, *hb2;
2024 : 0 : struct futex_q *this, *next;
2025 : 0 : DEFINE_WAKE_Q(wake_q);
2026 : :
2027 [ # # ]: 0 : if (nr_wake < 0 || nr_requeue < 0)
2028 : : return -EINVAL;
2029 : :
2030 : : /*
2031 : : * When PI not supported: return -ENOSYS if requeue_pi is true,
2032 : : * consequently the compiler knows requeue_pi is always false past
2033 : : * this point which will optimize away all the conditional code
2034 : : * further down.
2035 : : */
2036 : 0 : if (!IS_ENABLED(CONFIG_FUTEX_PI) && requeue_pi)
2037 : : return -ENOSYS;
2038 : :
2039 [ # # ]: 0 : if (requeue_pi) {
2040 : : /*
2041 : : * Requeue PI only works on two distinct uaddrs. This
2042 : : * check is only valid for private futexes. See below.
2043 : : */
2044 [ # # ]: 0 : if (uaddr1 == uaddr2)
2045 : : return -EINVAL;
2046 : :
2047 : : /*
2048 : : * requeue_pi requires a pi_state, try to allocate it now
2049 : : * without any locks in case it fails.
2050 : : */
2051 [ # # ]: 0 : if (refill_pi_state_cache())
2052 : : return -ENOMEM;
2053 : : /*
2054 : : * requeue_pi must wake as many tasks as it can, up to nr_wake
2055 : : * + nr_requeue, since it acquires the rt_mutex prior to
2056 : : * returning to userspace, so as to not leave the rt_mutex with
2057 : : * waiters and no owner. However, second and third wake-ups
2058 : : * cannot be predicted as they involve race conditions with the
2059 : : * first wake and a fault while looking up the pi_state. Both
2060 : : * pthread_cond_signal() and pthread_cond_broadcast() should
2061 : : * use nr_wake=1.
2062 : : */
2063 [ # # ]: 0 : if (nr_wake != 1)
2064 : : return -EINVAL;
2065 : : }
2066 : :
2067 : 0 : retry:
2068 : 0 : ret = get_futex_key(uaddr1, flags & FLAGS_SHARED, &key1, FUTEX_READ);
2069 [ # # ]: 0 : if (unlikely(ret != 0))
2070 : 0 : goto out;
2071 : 0 : ret = get_futex_key(uaddr2, flags & FLAGS_SHARED, &key2,
2072 : : requeue_pi ? FUTEX_WRITE : FUTEX_READ);
2073 [ # # ]: 0 : if (unlikely(ret != 0))
2074 : 0 : goto out_put_key1;
2075 : :
2076 : : /*
2077 : : * The check above which compares uaddrs is not sufficient for
2078 : : * shared futexes. We need to compare the keys:
2079 : : */
2080 [ # # ]: 0 : if (requeue_pi && match_futex(&key1, &key2)) {
2081 : 0 : ret = -EINVAL;
2082 : 0 : goto out_put_keys;
2083 : : }
2084 : :
2085 : 0 : hb1 = hash_futex(&key1);
2086 : 0 : hb2 = hash_futex(&key2);
2087 : :
2088 : 0 : retry_private:
2089 : 0 : hb_waiters_inc(hb2);
2090 : 0 : double_lock_hb(hb1, hb2);
2091 : :
2092 [ # # ]: 0 : if (likely(cmpval != NULL)) {
2093 : 0 : u32 curval;
2094 : :
2095 : 0 : ret = get_futex_value_locked(&curval, uaddr1);
2096 : :
2097 [ # # ]: 0 : if (unlikely(ret)) {
2098 : 0 : double_unlock_hb(hb1, hb2);
2099 : 0 : hb_waiters_dec(hb2);
2100 : :
2101 : 0 : ret = get_user(curval, uaddr1);
2102 [ # # ]: 0 : if (ret)
2103 : 0 : goto out_put_keys;
2104 : :
2105 [ # # ]: 0 : if (!(flags & FLAGS_SHARED))
2106 : 0 : goto retry_private;
2107 : :
2108 : 0 : put_futex_key(&key2);
2109 : 0 : put_futex_key(&key1);
2110 : 0 : goto retry;
2111 : : }
2112 [ # # ]: 0 : if (curval != *cmpval) {
2113 : 0 : ret = -EAGAIN;
2114 : 0 : goto out_unlock;
2115 : : }
2116 : : }
2117 : :
2118 [ # # # # ]: 0 : if (requeue_pi && (task_count - nr_wake < nr_requeue)) {
2119 : 0 : struct task_struct *exiting = NULL;
2120 : :
2121 : : /*
2122 : : * Attempt to acquire uaddr2 and wake the top waiter. If we
2123 : : * intend to requeue waiters, force setting the FUTEX_WAITERS
2124 : : * bit. We force this here where we are able to easily handle
2125 : : * faults rather in the requeue loop below.
2126 : : */
2127 : 0 : ret = futex_proxy_trylock_atomic(uaddr2, hb1, hb2, &key1,
2128 : : &key2, &pi_state,
2129 : : &exiting, nr_requeue);
2130 : :
2131 : : /*
2132 : : * At this point the top_waiter has either taken uaddr2 or is
2133 : : * waiting on it. If the former, then the pi_state will not
2134 : : * exist yet, look it up one more time to ensure we have a
2135 : : * reference to it. If the lock was taken, ret contains the
2136 : : * vpid of the top waiter task.
2137 : : * If the lock was not taken, we have pi_state and an initial
2138 : : * refcount on it. In case of an error we have nothing.
2139 : : */
2140 [ # # ]: 0 : if (ret > 0) {
2141 [ # # ]: 0 : WARN_ON(pi_state);
2142 : 0 : drop_count++;
2143 : 0 : task_count++;
2144 : : /*
2145 : : * If we acquired the lock, then the user space value
2146 : : * of uaddr2 should be vpid. It cannot be changed by
2147 : : * the top waiter as it is blocked on hb2 lock if it
2148 : : * tries to do so. If something fiddled with it behind
2149 : : * our back the pi state lookup might unearth it. So
2150 : : * we rather use the known value than rereading and
2151 : : * handing potential crap to lookup_pi_state.
2152 : : *
2153 : : * If that call succeeds then we have pi_state and an
2154 : : * initial refcount on it.
2155 : : */
2156 : 0 : ret = lookup_pi_state(uaddr2, ret, hb2, &key2,
2157 : : &pi_state, &exiting);
2158 : : }
2159 : :
2160 [ # # # # ]: 0 : switch (ret) {
2161 : : case 0:
2162 : : /* We hold a reference on the pi state. */
2163 : 0 : break;
2164 : :
2165 : : /* If the above failed, then pi_state is NULL */
2166 : : case -EFAULT:
2167 : 0 : double_unlock_hb(hb1, hb2);
2168 : 0 : hb_waiters_dec(hb2);
2169 : 0 : put_futex_key(&key2);
2170 : 0 : put_futex_key(&key1);
2171 : 0 : ret = fault_in_user_writeable(uaddr2);
2172 [ # # ]: 0 : if (!ret)
2173 : 0 : goto retry;
2174 : 0 : goto out;
2175 : : case -EBUSY:
2176 : : case -EAGAIN:
2177 : : /*
2178 : : * Two reasons for this:
2179 : : * - EBUSY: Owner is exiting and we just wait for the
2180 : : * exit to complete.
2181 : : * - EAGAIN: The user space value changed.
2182 : : */
2183 : 0 : double_unlock_hb(hb1, hb2);
2184 : 0 : hb_waiters_dec(hb2);
2185 : 0 : put_futex_key(&key2);
2186 : 0 : put_futex_key(&key1);
2187 : : /*
2188 : : * Handle the case where the owner is in the middle of
2189 : : * exiting. Wait for the exit to complete otherwise
2190 : : * this task might loop forever, aka. live lock.
2191 : : */
2192 : 0 : wait_for_owner_exiting(ret, exiting);
2193 : 0 : cond_resched();
2194 : 0 : goto retry;
2195 : 0 : default:
2196 : 0 : goto out_unlock;
2197 : : }
2198 : : }
2199 : :
2200 [ # # ]: 0 : plist_for_each_entry_safe(this, next, &hb1->chain, list) {
2201 [ # # ]: 0 : if (task_count - nr_wake >= nr_requeue)
2202 : : break;
2203 : :
2204 [ # # ]: 0 : if (!match_futex(&this->key, &key1))
2205 : 0 : continue;
2206 : :
2207 : : /*
2208 : : * FUTEX_WAIT_REQEUE_PI and FUTEX_CMP_REQUEUE_PI should always
2209 : : * be paired with each other and no other futex ops.
2210 : : *
2211 : : * We should never be requeueing a futex_q with a pi_state,
2212 : : * which is awaiting a futex_unlock_pi().
2213 : : */
2214 [ # # # # : 0 : if ((requeue_pi && !this->rt_waiter) ||
# # ]
2215 [ # # ]: 0 : (!requeue_pi && this->rt_waiter) ||
2216 [ # # ]: 0 : this->pi_state) {
2217 : : ret = -EINVAL;
2218 : : break;
2219 : : }
2220 : :
2221 : : /*
2222 : : * Wake nr_wake waiters. For requeue_pi, if we acquired the
2223 : : * lock, we already woke the top_waiter. If not, it will be
2224 : : * woken by futex_unlock_pi().
2225 : : */
2226 [ # # # # ]: 0 : if (++task_count <= nr_wake && !requeue_pi) {
2227 : 0 : mark_wake_futex(&wake_q, this);
2228 : 0 : continue;
2229 : : }
2230 : :
2231 : : /* Ensure we requeue to the expected futex for requeue_pi. */
2232 [ # # # # ]: 0 : if (requeue_pi && !match_futex(this->requeue_pi_key, &key2)) {
2233 : : ret = -EINVAL;
2234 : : break;
2235 : : }
2236 : :
2237 : : /*
2238 : : * Requeue nr_requeue waiters and possibly one more in the case
2239 : : * of requeue_pi if we couldn't acquire the lock atomically.
2240 : : */
2241 [ # # ]: 0 : if (requeue_pi) {
2242 : : /*
2243 : : * Prepare the waiter to take the rt_mutex. Take a
2244 : : * refcount on the pi_state and store the pointer in
2245 : : * the futex_q object of the waiter.
2246 : : */
2247 : 0 : get_pi_state(pi_state);
2248 : 0 : this->pi_state = pi_state;
2249 : 0 : ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
2250 : : this->rt_waiter,
2251 : : this->task);
2252 [ # # ]: 0 : if (ret == 1) {
2253 : : /*
2254 : : * We got the lock. We do neither drop the
2255 : : * refcount on pi_state nor clear
2256 : : * this->pi_state because the waiter needs the
2257 : : * pi_state for cleaning up the user space
2258 : : * value. It will drop the refcount after
2259 : : * doing so.
2260 : : */
2261 : 0 : requeue_pi_wake_futex(this, &key2, hb2);
2262 : 0 : drop_count++;
2263 : 0 : continue;
2264 [ # # ]: 0 : } else if (ret) {
2265 : : /*
2266 : : * rt_mutex_start_proxy_lock() detected a
2267 : : * potential deadlock when we tried to queue
2268 : : * that waiter. Drop the pi_state reference
2269 : : * which we took above and remove the pointer
2270 : : * to the state from the waiters futex_q
2271 : : * object.
2272 : : */
2273 : 0 : this->pi_state = NULL;
2274 : 0 : put_pi_state(pi_state);
2275 : : /*
2276 : : * We stop queueing more waiters and let user
2277 : : * space deal with the mess.
2278 : : */
2279 : 0 : break;
2280 : : }
2281 : : }
2282 : 0 : requeue_futex(this, hb1, hb2, &key2);
2283 : 0 : drop_count++;
2284 : : }
2285 : :
2286 : : /*
2287 : : * We took an extra initial reference to the pi_state either
2288 : : * in futex_proxy_trylock_atomic() or in lookup_pi_state(). We
2289 : : * need to drop it here again.
2290 : : */
2291 : 0 : put_pi_state(pi_state);
2292 : :
2293 : 0 : out_unlock:
2294 : 0 : double_unlock_hb(hb1, hb2);
2295 : 0 : wake_up_q(&wake_q);
2296 : 0 : hb_waiters_dec(hb2);
2297 : :
2298 : : /*
2299 : : * drop_futex_key_refs() must be called outside the spinlocks. During
2300 : : * the requeue we moved futex_q's from the hash bucket at key1 to the
2301 : : * one at key2 and updated their key pointer. We no longer need to
2302 : : * hold the references to key1.
2303 : : */
2304 [ # # ]: 0 : while (--drop_count >= 0)
2305 : 0 : drop_futex_key_refs(&key1);
2306 : :
2307 : 0 : out_put_keys:
2308 : 0 : put_futex_key(&key2);
2309 : 0 : out_put_key1:
2310 : 0 : put_futex_key(&key1);
2311 : 0 : out:
2312 [ # # ]: 0 : return ret ? ret : task_count;
2313 : : }
2314 : :
2315 : : /* The key must be already stored in q->key. */
2316 : 1717 : static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
2317 : : __acquires(&hb->lock)
2318 : : {
2319 : 1717 : struct futex_hash_bucket *hb;
2320 : :
2321 : 1717 : hb = hash_futex(&q->key);
2322 : :
2323 : : /*
2324 : : * Increment the counter before taking the lock so that
2325 : : * a potential waker won't miss a to-be-slept task that is
2326 : : * waiting for the spinlock. This is safe as all queue_lock()
2327 : : * users end up calling queue_me(). Similarly, for housekeeping,
2328 : : * decrement the counter at queue_unlock() when some error has
2329 : : * occurred and we don't end up adding the task to the list.
2330 : : */
2331 : 1717 : hb_waiters_inc(hb); /* implies smp_mb(); (A) */
2332 : :
2333 : 1717 : q->lock_ptr = &hb->lock;
2334 : :
2335 : 1717 : spin_lock(&hb->lock);
2336 : 1717 : return hb;
2337 : : }
2338 : :
2339 : : static inline void
2340 : 0 : queue_unlock(struct futex_hash_bucket *hb)
2341 : : __releases(&hb->lock)
2342 : : {
2343 : 0 : spin_unlock(&hb->lock);
2344 : 0 : hb_waiters_dec(hb);
2345 : 0 : }
2346 : :
2347 : 1717 : static inline void __queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
2348 : : {
2349 : 1717 : int prio;
2350 : :
2351 : : /*
2352 : : * The priority used to register this element is
2353 : : * - either the real thread-priority for the real-time threads
2354 : : * (i.e. threads with a priority lower than MAX_RT_PRIO)
2355 : : * - or MAX_RT_PRIO for non-RT threads.
2356 : : * Thus, all RT-threads are woken first in priority order, and
2357 : : * the others are woken last, in FIFO order.
2358 : : */
2359 : 1717 : prio = min(current->normal_prio, MAX_RT_PRIO);
2360 : :
2361 : 1717 : plist_node_init(&q->list, prio);
2362 : 1717 : plist_add(&q->list, &hb->chain);
2363 [ - - ]: 1717 : q->task = current;
2364 : : }
2365 : :
2366 : : /**
2367 : : * queue_me() - Enqueue the futex_q on the futex_hash_bucket
2368 : : * @q: The futex_q to enqueue
2369 : : * @hb: The destination hash bucket
2370 : : *
2371 : : * The hb->lock must be held by the caller, and is released here. A call to
2372 : : * queue_me() is typically paired with exactly one call to unqueue_me(). The
2373 : : * exceptions involve the PI related operations, which may use unqueue_me_pi()
2374 : : * or nothing if the unqueue is done as part of the wake process and the unqueue
2375 : : * state is implicit in the state of woken task (see futex_wait_requeue_pi() for
2376 : : * an example).
2377 : : */
2378 : 1717 : static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
2379 : : __releases(&hb->lock)
2380 : : {
2381 : 1717 : __queue_me(q, hb);
2382 : 1717 : spin_unlock(&hb->lock);
2383 : 1717 : }
2384 : :
2385 : : /**
2386 : : * unqueue_me() - Remove the futex_q from its futex_hash_bucket
2387 : : * @q: The futex_q to unqueue
2388 : : *
2389 : : * The q->lock_ptr must not be held by the caller. A call to unqueue_me() must
2390 : : * be paired with exactly one earlier call to queue_me().
2391 : : *
2392 : : * Return:
2393 : : * - 1 - if the futex_q was still queued (and we removed unqueued it);
2394 : : * - 0 - if the futex_q was already removed by the waking thread
2395 : : */
2396 : 1639 : static int unqueue_me(struct futex_q *q)
2397 : : {
2398 : 1639 : spinlock_t *lock_ptr;
2399 : 1639 : int ret = 0;
2400 : :
2401 : : /* In the common case we don't take the spinlock, which is nice. */
2402 : 1639 : retry:
2403 : : /*
2404 : : * q->lock_ptr can change between this read and the following spin_lock.
2405 : : * Use READ_ONCE to forbid the compiler from reloading q->lock_ptr and
2406 : : * optimizing lock_ptr out of the logic below.
2407 : : */
2408 [ - + ]: 1639 : lock_ptr = READ_ONCE(q->lock_ptr);
2409 [ - + ]: 1639 : if (lock_ptr != NULL) {
2410 : 0 : spin_lock(lock_ptr);
2411 : : /*
2412 : : * q->lock_ptr can change between reading it and
2413 : : * spin_lock(), causing us to take the wrong lock. This
2414 : : * corrects the race condition.
2415 : : *
2416 : : * Reasoning goes like this: if we have the wrong lock,
2417 : : * q->lock_ptr must have changed (maybe several times)
2418 : : * between reading it and the spin_lock(). It can
2419 : : * change again after the spin_lock() but only if it was
2420 : : * already changed before the spin_lock(). It cannot,
2421 : : * however, change back to the original value. Therefore
2422 : : * we can detect whether we acquired the correct lock.
2423 : : */
2424 [ # # ]: 0 : if (unlikely(lock_ptr != q->lock_ptr)) {
2425 : 0 : spin_unlock(lock_ptr);
2426 : 0 : goto retry;
2427 : : }
2428 : 0 : __unqueue_futex(q);
2429 : :
2430 [ # # ]: 0 : BUG_ON(q->pi_state);
2431 : :
2432 : 0 : spin_unlock(lock_ptr);
2433 : 0 : ret = 1;
2434 : : }
2435 : :
2436 : 1639 : drop_futex_key_refs(&q->key);
2437 : 1639 : return ret;
2438 : : }
2439 : :
2440 : : /*
2441 : : * PI futexes can not be requeued and must remove themself from the
2442 : : * hash bucket. The hash bucket lock (i.e. lock_ptr) is held on entry
2443 : : * and dropped here.
2444 : : */
2445 : 0 : static void unqueue_me_pi(struct futex_q *q)
2446 : : __releases(q->lock_ptr)
2447 : : {
2448 : 0 : __unqueue_futex(q);
2449 : :
2450 [ # # ]: 0 : BUG_ON(!q->pi_state);
2451 : 0 : put_pi_state(q->pi_state);
2452 : 0 : q->pi_state = NULL;
2453 : :
2454 : 0 : spin_unlock(q->lock_ptr);
2455 : 0 : }
2456 : :
2457 : : static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
2458 : : struct task_struct *argowner)
2459 : : {
2460 : : struct futex_pi_state *pi_state = q->pi_state;
2461 : : u32 uval, uninitialized_var(curval), newval;
2462 : : struct task_struct *oldowner, *newowner;
2463 : : u32 newtid;
2464 : : int ret, err = 0;
2465 : :
2466 : : lockdep_assert_held(q->lock_ptr);
2467 : :
2468 : : raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
2469 : :
2470 : : oldowner = pi_state->owner;
2471 : :
2472 : : /*
2473 : : * We are here because either:
2474 : : *
2475 : : * - we stole the lock and pi_state->owner needs updating to reflect
2476 : : * that (@argowner == current),
2477 : : *
2478 : : * or:
2479 : : *
2480 : : * - someone stole our lock and we need to fix things to point to the
2481 : : * new owner (@argowner == NULL).
2482 : : *
2483 : : * Either way, we have to replace the TID in the user space variable.
2484 : : * This must be atomic as we have to preserve the owner died bit here.
2485 : : *
2486 : : * Note: We write the user space value _before_ changing the pi_state
2487 : : * because we can fault here. Imagine swapped out pages or a fork
2488 : : * that marked all the anonymous memory readonly for cow.
2489 : : *
2490 : : * Modifying pi_state _before_ the user space value would leave the
2491 : : * pi_state in an inconsistent state when we fault here, because we
2492 : : * need to drop the locks to handle the fault. This might be observed
2493 : : * in the PID check in lookup_pi_state.
2494 : : */
2495 : : retry:
2496 : : if (!argowner) {
2497 : : if (oldowner != current) {
2498 : : /*
2499 : : * We raced against a concurrent self; things are
2500 : : * already fixed up. Nothing to do.
2501 : : */
2502 : : ret = 0;
2503 : : goto out_unlock;
2504 : : }
2505 : :
2506 : : if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
2507 : : /* We got the lock after all, nothing to fix. */
2508 : : ret = 0;
2509 : : goto out_unlock;
2510 : : }
2511 : :
2512 : : /*
2513 : : * Since we just failed the trylock; there must be an owner.
2514 : : */
2515 : : newowner = rt_mutex_owner(&pi_state->pi_mutex);
2516 : : BUG_ON(!newowner);
2517 : : } else {
2518 : : WARN_ON_ONCE(argowner != current);
2519 : : if (oldowner == current) {
2520 : : /*
2521 : : * We raced against a concurrent self; things are
2522 : : * already fixed up. Nothing to do.
2523 : : */
2524 : : ret = 0;
2525 : : goto out_unlock;
2526 : : }
2527 : : newowner = argowner;
2528 : : }
2529 : :
2530 : : newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
2531 : : /* Owner died? */
2532 : : if (!pi_state->owner)
2533 : : newtid |= FUTEX_OWNER_DIED;
2534 : :
2535 : : err = get_futex_value_locked(&uval, uaddr);
2536 : : if (err)
2537 : : goto handle_err;
2538 : :
2539 : : for (;;) {
2540 : : newval = (uval & FUTEX_OWNER_DIED) | newtid;
2541 : :
2542 : : err = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval);
2543 : : if (err)
2544 : : goto handle_err;
2545 : :
2546 : : if (curval == uval)
2547 : : break;
2548 : : uval = curval;
2549 : : }
2550 : :
2551 : : /*
2552 : : * We fixed up user space. Now we need to fix the pi_state
2553 : : * itself.
2554 : : */
2555 : : if (pi_state->owner != NULL) {
2556 : : raw_spin_lock(&pi_state->owner->pi_lock);
2557 : : WARN_ON(list_empty(&pi_state->list));
2558 : : list_del_init(&pi_state->list);
2559 : : raw_spin_unlock(&pi_state->owner->pi_lock);
2560 : : }
2561 : :
2562 : : pi_state->owner = newowner;
2563 : :
2564 : : raw_spin_lock(&newowner->pi_lock);
2565 : : WARN_ON(!list_empty(&pi_state->list));
2566 : : list_add(&pi_state->list, &newowner->pi_state_list);
2567 : : raw_spin_unlock(&newowner->pi_lock);
2568 : : raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
2569 : :
2570 : : return 0;
2571 : :
2572 : : /*
2573 : : * In order to reschedule or handle a page fault, we need to drop the
2574 : : * locks here. In the case of a fault, this gives the other task
2575 : : * (either the highest priority waiter itself or the task which stole
2576 : : * the rtmutex) the chance to try the fixup of the pi_state. So once we
2577 : : * are back from handling the fault we need to check the pi_state after
2578 : : * reacquiring the locks and before trying to do another fixup. When
2579 : : * the fixup has been done already we simply return.
2580 : : *
2581 : : * Note: we hold both hb->lock and pi_mutex->wait_lock. We can safely
2582 : : * drop hb->lock since the caller owns the hb -> futex_q relation.
2583 : : * Dropping the pi_mutex->wait_lock requires the state revalidate.
2584 : : */
2585 : : handle_err:
2586 : : raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
2587 : : spin_unlock(q->lock_ptr);
2588 : :
2589 : : switch (err) {
2590 : : case -EFAULT:
2591 : : ret = fault_in_user_writeable(uaddr);
2592 : : break;
2593 : :
2594 : : case -EAGAIN:
2595 : : cond_resched();
2596 : : ret = 0;
2597 : : break;
2598 : :
2599 : : default:
2600 : : WARN_ON_ONCE(1);
2601 : : ret = err;
2602 : : break;
2603 : : }
2604 : :
2605 : : spin_lock(q->lock_ptr);
2606 : : raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
2607 : :
2608 : : /*
2609 : : * Check if someone else fixed it for us:
2610 : : */
2611 : : if (pi_state->owner != oldowner) {
2612 : : ret = 0;
2613 : : goto out_unlock;
2614 : : }
2615 : :
2616 : : if (ret)
2617 : : goto out_unlock;
2618 : :
2619 : : goto retry;
2620 : :
2621 : : out_unlock:
2622 : : raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
2623 : : return ret;
2624 : : }
2625 : :
2626 : : static long futex_wait_restart(struct restart_block *restart);
2627 : :
2628 : : /**
2629 : : * fixup_owner() - Post lock pi_state and corner case management
2630 : : * @uaddr: user address of the futex
2631 : : * @q: futex_q (contains pi_state and access to the rt_mutex)
2632 : : * @locked: if the attempt to take the rt_mutex succeeded (1) or not (0)
2633 : : *
2634 : : * After attempting to lock an rt_mutex, this function is called to cleanup
2635 : : * the pi_state owner as well as handle race conditions that may allow us to
2636 : : * acquire the lock. Must be called with the hb lock held.
2637 : : *
2638 : : * Return:
2639 : : * - 1 - success, lock taken;
2640 : : * - 0 - success, lock not taken;
2641 : : * - <0 - on error (-EFAULT)
2642 : : */
2643 : 0 : static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
2644 : : {
2645 : 0 : int ret = 0;
2646 : :
2647 [ # # ]: 0 : if (locked) {
2648 : : /*
2649 : : * Got the lock. We might not be the anticipated owner if we
2650 : : * did a lock-steal - fix up the PI-state in that case:
2651 : : *
2652 : : * Speculative pi_state->owner read (we don't hold wait_lock);
2653 : : * since we own the lock pi_state->owner == current is the
2654 : : * stable state, anything else needs more attention.
2655 : : */
2656 [ # # ]: 0 : if (q->pi_state->owner != current)
2657 : 0 : ret = fixup_pi_state_owner(uaddr, q, current);
2658 : 0 : goto out;
2659 : : }
2660 : :
2661 : : /*
2662 : : * If we didn't get the lock; check if anybody stole it from us. In
2663 : : * that case, we need to fix up the uval to point to them instead of
2664 : : * us, otherwise bad things happen. [10]
2665 : : *
2666 : : * Another speculative read; pi_state->owner == current is unstable
2667 : : * but needs our attention.
2668 : : */
2669 [ # # ]: 0 : if (q->pi_state->owner == current) {
2670 : 0 : ret = fixup_pi_state_owner(uaddr, q, NULL);
2671 : 0 : goto out;
2672 : : }
2673 : :
2674 : : /*
2675 : : * Paranoia check. If we did not take the lock, then we should not be
2676 : : * the owner of the rt_mutex.
2677 : : */
2678 [ # # ]: 0 : if (rt_mutex_owner(&q->pi_state->pi_mutex) == current) {
2679 : 0 : printk(KERN_ERR "fixup_owner: ret = %d pi-mutex: %p "
2680 : : "pi-state %p\n", ret,
2681 : : q->pi_state->pi_mutex.owner,
2682 : : q->pi_state->owner);
2683 : : }
2684 : :
2685 : 0 : out:
2686 [ # # ]: 0 : return ret ? ret : locked;
2687 : : }
2688 : :
2689 : : /**
2690 : : * futex_wait_queue_me() - queue_me() and wait for wakeup, timeout, or signal
2691 : : * @hb: the futex hash bucket, must be locked by the caller
2692 : : * @q: the futex_q to queue up on
2693 : : * @timeout: the prepared hrtimer_sleeper, or null for no timeout
2694 : : */
2695 : 1717 : static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
2696 : : struct hrtimer_sleeper *timeout)
2697 : : {
2698 : : /*
2699 : : * The task state is guaranteed to be set before another task can
2700 : : * wake it. set_current_state() is implemented using smp_store_mb() and
2701 : : * queue_me() calls spin_unlock() upon completion, both serializing
2702 : : * access to the hash list and forcing another memory barrier.
2703 : : */
2704 : 1717 : set_current_state(TASK_INTERRUPTIBLE);
2705 : 1717 : queue_me(q, hb);
2706 : :
2707 : : /* Arm the timer */
2708 [ - + ]: 1717 : if (timeout)
2709 : 0 : hrtimer_sleeper_start_expires(timeout, HRTIMER_MODE_ABS);
2710 : :
2711 : : /*
2712 : : * If we have been removed from the hash list, then another task
2713 : : * has tried to wake us, and we can skip the call to schedule().
2714 : : */
2715 [ + - ]: 1717 : if (likely(!plist_node_empty(&q->list))) {
2716 : : /*
2717 : : * If the timer has already expired, current will already be
2718 : : * flagged for rescheduling. Only call schedule if there
2719 : : * is no timeout, or if it has yet to expire.
2720 : : */
2721 [ - + - - ]: 1717 : if (!timeout || timeout->task)
2722 : 1717 : freezable_schedule();
2723 : : }
2724 : 1639 : __set_current_state(TASK_RUNNING);
2725 : 1639 : }
2726 : :
2727 : : /**
2728 : : * futex_wait_setup() - Prepare to wait on a futex
2729 : : * @uaddr: the futex userspace address
2730 : : * @val: the expected value
2731 : : * @flags: futex flags (FLAGS_SHARED, etc.)
2732 : : * @q: the associated futex_q
2733 : : * @hb: storage for hash_bucket pointer to be returned to caller
2734 : : *
2735 : : * Setup the futex_q and locate the hash_bucket. Get the futex value and
2736 : : * compare it with the expected value. Handle atomic faults internally.
2737 : : * Return with the hb lock held and a q.key reference on success, and unlocked
2738 : : * with no q.key reference on failure.
2739 : : *
2740 : : * Return:
2741 : : * - 0 - uaddr contains val and hb has been locked;
2742 : : * - <1 - -EFAULT or -EWOULDBLOCK (uaddr does not contain val) and hb is unlocked
2743 : : */
2744 : 1717 : static int futex_wait_setup(u32 __user *uaddr, u32 val, unsigned int flags,
2745 : : struct futex_q *q, struct futex_hash_bucket **hb)
2746 : : {
2747 : 1717 : u32 uval;
2748 : 1717 : int ret;
2749 : :
2750 : : /*
2751 : : * Access the page AFTER the hash-bucket is locked.
2752 : : * Order is important:
2753 : : *
2754 : : * Userspace waiter: val = var; if (cond(val)) futex_wait(&var, val);
2755 : : * Userspace waker: if (cond(var)) { var = new; futex_wake(&var); }
2756 : : *
2757 : : * The basic logical guarantee of a futex is that it blocks ONLY
2758 : : * if cond(var) is known to be true at the time of blocking, for
2759 : : * any cond. If we locked the hash-bucket after testing *uaddr, that
2760 : : * would open a race condition where we could block indefinitely with
2761 : : * cond(var) false, which would violate the guarantee.
2762 : : *
2763 : : * On the other hand, we insert q and release the hash-bucket only
2764 : : * after testing *uaddr. This guarantees that futex_wait() will NOT
2765 : : * absorb a wakeup if *uaddr does not match the desired values
2766 : : * while the syscall executes.
2767 : : */
2768 : 1717 : retry:
2769 : 1717 : ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &q->key, FUTEX_READ);
2770 [ - + ]: 1717 : if (unlikely(ret != 0))
2771 : 0 : return ret;
2772 : :
2773 : 1717 : retry_private:
2774 : 1717 : *hb = queue_lock(q);
2775 : :
2776 : 1717 : ret = get_futex_value_locked(&uval, uaddr);
2777 : :
2778 [ - + ]: 1717 : if (ret) {
2779 : 0 : queue_unlock(*hb);
2780 : :
2781 : 0 : ret = get_user(uval, uaddr);
2782 [ # # ]: 0 : if (ret)
2783 : 0 : goto out;
2784 : :
2785 [ # # ]: 0 : if (!(flags & FLAGS_SHARED))
2786 : 0 : goto retry_private;
2787 : :
2788 : 0 : put_futex_key(&q->key);
2789 : 0 : goto retry;
2790 : : }
2791 : :
2792 [ - + ]: 1717 : if (uval != val) {
2793 : 0 : queue_unlock(*hb);
2794 : 0 : ret = -EWOULDBLOCK;
2795 : : }
2796 : :
2797 : 1717 : out:
2798 [ - + ]: 1717 : if (ret)
2799 : 0 : put_futex_key(&q->key);
2800 : : return ret;
2801 : : }
2802 : :
2803 : 1717 : static int futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
2804 : : ktime_t *abs_time, u32 bitset)
2805 : : {
2806 : 1717 : struct hrtimer_sleeper timeout, *to;
2807 : 1717 : struct restart_block *restart;
2808 : 1717 : struct futex_hash_bucket *hb;
2809 : 1717 : struct futex_q q = futex_q_init;
2810 : 1717 : int ret;
2811 : :
2812 [ + - ]: 1717 : if (!bitset)
2813 : : return -EINVAL;
2814 : 1717 : q.bitset = bitset;
2815 : :
2816 : 1717 : to = futex_setup_timer(abs_time, &timeout, flags,
2817 : : current->timer_slack_ns);
2818 : 1717 : retry:
2819 : : /*
2820 : : * Prepare to wait on uaddr. On success, holds hb lock and increments
2821 : : * q.key refs.
2822 : : */
2823 : 1717 : ret = futex_wait_setup(uaddr, val, flags, &q, &hb);
2824 [ - + ]: 1717 : if (ret)
2825 : 0 : goto out;
2826 : :
2827 : : /* queue_me and wait for wakeup, timeout, or a signal. */
2828 : 1717 : futex_wait_queue_me(hb, &q, to);
2829 : :
2830 : : /* If we were woken (and unqueued), we succeeded, whatever. */
2831 : 1639 : ret = 0;
2832 : : /* unqueue_me() drops q.key ref */
2833 [ + - ]: 1639 : if (!unqueue_me(&q))
2834 : 1639 : goto out;
2835 : 0 : ret = -ETIMEDOUT;
2836 [ # # # # ]: 0 : if (to && !to->task)
2837 : 0 : goto out;
2838 : :
2839 : : /*
2840 : : * We expect signal_pending(current), but we might be the
2841 : : * victim of a spurious wakeup as well.
2842 : : */
2843 [ # # ]: 0 : if (!signal_pending(current))
2844 : 0 : goto retry;
2845 : :
2846 : 0 : ret = -ERESTARTSYS;
2847 [ # # ]: 0 : if (!abs_time)
2848 : 0 : goto out;
2849 : :
2850 : 0 : restart = ¤t->restart_block;
2851 : 0 : restart->fn = futex_wait_restart;
2852 : 0 : restart->futex.uaddr = uaddr;
2853 : 0 : restart->futex.val = val;
2854 : 0 : restart->futex.time = *abs_time;
2855 : 0 : restart->futex.bitset = bitset;
2856 : 0 : restart->futex.flags = flags | FLAGS_HAS_TIMEOUT;
2857 : :
2858 : 0 : ret = -ERESTART_RESTARTBLOCK;
2859 : :
2860 : 1639 : out:
2861 [ - + ]: 1639 : if (to) {
2862 : 0 : hrtimer_cancel(&to->timer);
2863 : 0 : destroy_hrtimer_on_stack(&to->timer);
2864 : : }
2865 : : return ret;
2866 : : }
2867 : :
2868 : :
2869 : 0 : static long futex_wait_restart(struct restart_block *restart)
2870 : : {
2871 : 0 : u32 __user *uaddr = restart->futex.uaddr;
2872 : 0 : ktime_t t, *tp = NULL;
2873 : :
2874 [ # # ]: 0 : if (restart->futex.flags & FLAGS_HAS_TIMEOUT) {
2875 : 0 : t = restart->futex.time;
2876 : 0 : tp = &t;
2877 : : }
2878 : 0 : restart->fn = do_no_restart_syscall;
2879 : :
2880 : 0 : return (long)futex_wait(uaddr, restart->futex.flags,
2881 : : restart->futex.val, tp, restart->futex.bitset);
2882 : : }
2883 : :
2884 : :
2885 : : /*
2886 : : * Userspace tried a 0 -> TID atomic transition of the futex value
2887 : : * and failed. The kernel side here does the whole locking operation:
2888 : : * if there are waiters then it will block as a consequence of relying
2889 : : * on rt-mutexes, it does PI, etc. (Due to races the kernel might see
2890 : : * a 0 value of the futex too.).
2891 : : *
2892 : : * Also serves as futex trylock_pi()'ing, and due semantics.
2893 : : */
2894 : 0 : static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
2895 : : ktime_t *time, int trylock)
2896 : : {
2897 : 0 : struct hrtimer_sleeper timeout, *to;
2898 : 0 : struct futex_pi_state *pi_state = NULL;
2899 : 0 : struct task_struct *exiting = NULL;
2900 : 0 : struct rt_mutex_waiter rt_waiter;
2901 : 0 : struct futex_hash_bucket *hb;
2902 : 0 : struct futex_q q = futex_q_init;
2903 : 0 : int res, ret;
2904 : :
2905 : 0 : if (!IS_ENABLED(CONFIG_FUTEX_PI))
2906 : : return -ENOSYS;
2907 : :
2908 [ # # ]: 0 : if (refill_pi_state_cache())
2909 : : return -ENOMEM;
2910 : :
2911 : 0 : to = futex_setup_timer(time, &timeout, FLAGS_CLOCKRT, 0);
2912 : :
2913 : : retry:
2914 : 0 : ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &q.key, FUTEX_WRITE);
2915 [ # # ]: 0 : if (unlikely(ret != 0))
2916 : 0 : goto out;
2917 : :
2918 : 0 : retry_private:
2919 : 0 : hb = queue_lock(&q);
2920 : :
2921 : 0 : ret = futex_lock_pi_atomic(uaddr, hb, &q.key, &q.pi_state, current,
2922 : : &exiting, 0);
2923 [ # # ]: 0 : if (unlikely(ret)) {
2924 : : /*
2925 : : * Atomic work succeeded and we got the lock,
2926 : : * or failed. Either way, we do _not_ block.
2927 : : */
2928 [ # # # # ]: 0 : switch (ret) {
2929 : 0 : case 1:
2930 : : /* We got the lock. */
2931 : 0 : ret = 0;
2932 : 0 : goto out_unlock_put_key;
2933 : 0 : case -EFAULT:
2934 : 0 : goto uaddr_faulted;
2935 : : case -EBUSY:
2936 : : case -EAGAIN:
2937 : : /*
2938 : : * Two reasons for this:
2939 : : * - EBUSY: Task is exiting and we just wait for the
2940 : : * exit to complete.
2941 : : * - EAGAIN: The user space value changed.
2942 : : */
2943 : 0 : queue_unlock(hb);
2944 : 0 : put_futex_key(&q.key);
2945 : : /*
2946 : : * Handle the case where the owner is in the middle of
2947 : : * exiting. Wait for the exit to complete otherwise
2948 : : * this task might loop forever, aka. live lock.
2949 : : */
2950 : 0 : wait_for_owner_exiting(ret, exiting);
2951 : 0 : cond_resched();
2952 : 0 : goto retry;
2953 : 0 : default:
2954 : 0 : goto out_unlock_put_key;
2955 : : }
2956 : : }
2957 : :
2958 [ # # ]: 0 : WARN_ON(!q.pi_state);
2959 : :
2960 : : /*
2961 : : * Only actually queue now that the atomic ops are done:
2962 : : */
2963 : 0 : __queue_me(&q, hb);
2964 : :
2965 [ # # ]: 0 : if (trylock) {
2966 : 0 : ret = rt_mutex_futex_trylock(&q.pi_state->pi_mutex);
2967 : : /* Fixup the trylock return value: */
2968 [ # # ]: 0 : ret = ret ? 0 : -EWOULDBLOCK;
2969 : 0 : goto no_block;
2970 : : }
2971 : :
2972 : 0 : rt_mutex_init_waiter(&rt_waiter);
2973 : :
2974 : : /*
2975 : : * On PREEMPT_RT_FULL, when hb->lock becomes an rt_mutex, we must not
2976 : : * hold it while doing rt_mutex_start_proxy(), because then it will
2977 : : * include hb->lock in the blocking chain, even through we'll not in
2978 : : * fact hold it while blocking. This will lead it to report -EDEADLK
2979 : : * and BUG when futex_unlock_pi() interleaves with this.
2980 : : *
2981 : : * Therefore acquire wait_lock while holding hb->lock, but drop the
2982 : : * latter before calling __rt_mutex_start_proxy_lock(). This
2983 : : * interleaves with futex_unlock_pi() -- which does a similar lock
2984 : : * handoff -- such that the latter can observe the futex_q::pi_state
2985 : : * before __rt_mutex_start_proxy_lock() is done.
2986 : : */
2987 : 0 : raw_spin_lock_irq(&q.pi_state->pi_mutex.wait_lock);
2988 : 0 : spin_unlock(q.lock_ptr);
2989 : : /*
2990 : : * __rt_mutex_start_proxy_lock() unconditionally enqueues the @rt_waiter
2991 : : * such that futex_unlock_pi() is guaranteed to observe the waiter when
2992 : : * it sees the futex_q::pi_state.
2993 : : */
2994 : 0 : ret = __rt_mutex_start_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter, current);
2995 : 0 : raw_spin_unlock_irq(&q.pi_state->pi_mutex.wait_lock);
2996 : :
2997 [ # # ]: 0 : if (ret) {
2998 [ # # ]: 0 : if (ret == 1)
2999 : 0 : ret = 0;
3000 : 0 : goto cleanup;
3001 : : }
3002 : :
3003 [ # # ]: 0 : if (unlikely(to))
3004 : 0 : hrtimer_sleeper_start_expires(to, HRTIMER_MODE_ABS);
3005 : :
3006 : 0 : ret = rt_mutex_wait_proxy_lock(&q.pi_state->pi_mutex, to, &rt_waiter);
3007 : :
3008 : 0 : cleanup:
3009 : 0 : spin_lock(q.lock_ptr);
3010 : : /*
3011 : : * If we failed to acquire the lock (deadlock/signal/timeout), we must
3012 : : * first acquire the hb->lock before removing the lock from the
3013 : : * rt_mutex waitqueue, such that we can keep the hb and rt_mutex wait
3014 : : * lists consistent.
3015 : : *
3016 : : * In particular; it is important that futex_unlock_pi() can not
3017 : : * observe this inconsistency.
3018 : : */
3019 [ # # # # ]: 0 : if (ret && !rt_mutex_cleanup_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter))
3020 : 0 : ret = 0;
3021 : :
3022 : 0 : no_block:
3023 : : /*
3024 : : * Fixup the pi_state owner and possibly acquire the lock if we
3025 : : * haven't already.
3026 : : */
3027 : 0 : res = fixup_owner(uaddr, &q, !ret);
3028 : : /*
3029 : : * If fixup_owner() returned an error, proprogate that. If it acquired
3030 : : * the lock, clear our -ETIMEDOUT or -EINTR.
3031 : : */
3032 [ # # ]: 0 : if (res)
3033 : 0 : ret = (res < 0) ? res : 0;
3034 : :
3035 : : /*
3036 : : * If fixup_owner() faulted and was unable to handle the fault, unlock
3037 : : * it and return the fault to userspace.
3038 : : */
3039 [ # # # # ]: 0 : if (ret && (rt_mutex_owner(&q.pi_state->pi_mutex) == current)) {
3040 : 0 : pi_state = q.pi_state;
3041 : 0 : get_pi_state(pi_state);
3042 : : }
3043 : :
3044 : : /* Unqueue and drop the lock */
3045 : 0 : unqueue_me_pi(&q);
3046 : :
3047 [ # # ]: 0 : if (pi_state) {
3048 : 0 : rt_mutex_futex_unlock(&pi_state->pi_mutex);
3049 : 0 : put_pi_state(pi_state);
3050 : : }
3051 : :
3052 : 0 : goto out_put_key;
3053 : :
3054 : 0 : out_unlock_put_key:
3055 : 0 : queue_unlock(hb);
3056 : :
3057 : 0 : out_put_key:
3058 : 0 : put_futex_key(&q.key);
3059 : 0 : out:
3060 [ # # ]: 0 : if (to) {
3061 : 0 : hrtimer_cancel(&to->timer);
3062 : 0 : destroy_hrtimer_on_stack(&to->timer);
3063 : : }
3064 [ # # ]: 0 : return ret != -EINTR ? ret : -ERESTARTNOINTR;
3065 : :
3066 : : uaddr_faulted:
3067 : 0 : queue_unlock(hb);
3068 : :
3069 : 0 : ret = fault_in_user_writeable(uaddr);
3070 [ # # ]: 0 : if (ret)
3071 : 0 : goto out_put_key;
3072 : :
3073 [ # # ]: 0 : if (!(flags & FLAGS_SHARED))
3074 : 0 : goto retry_private;
3075 : :
3076 : 0 : put_futex_key(&q.key);
3077 : 0 : goto retry;
3078 : : }
3079 : :
3080 : : /*
3081 : : * Userspace attempted a TID -> 0 atomic transition, and failed.
3082 : : * This is the in-kernel slowpath: we look up the PI state (if any),
3083 : : * and do the rt-mutex unlock.
3084 : : */
3085 : 0 : static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
3086 : : {
3087 : 0 : u32 uninitialized_var(curval), uval, vpid = task_pid_vnr(current);
3088 : 0 : union futex_key key = FUTEX_KEY_INIT;
3089 : 0 : struct futex_hash_bucket *hb;
3090 : 0 : struct futex_q *top_waiter;
3091 : 0 : int ret;
3092 : :
3093 : 0 : if (!IS_ENABLED(CONFIG_FUTEX_PI))
3094 : : return -ENOSYS;
3095 : :
3096 : 0 : retry:
3097 [ # # ]: 0 : if (get_user(uval, uaddr))
3098 : : return -EFAULT;
3099 : : /*
3100 : : * We release only a lock we actually own:
3101 : : */
3102 [ # # ]: 0 : if ((uval & FUTEX_TID_MASK) != vpid)
3103 : : return -EPERM;
3104 : :
3105 : 0 : ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &key, FUTEX_WRITE);
3106 [ # # ]: 0 : if (ret)
3107 : 0 : return ret;
3108 : :
3109 : 0 : hb = hash_futex(&key);
3110 : 0 : spin_lock(&hb->lock);
3111 : :
3112 : : /*
3113 : : * Check waiters first. We do not trust user space values at
3114 : : * all and we at least want to know if user space fiddled
3115 : : * with the futex value instead of blindly unlocking.
3116 : : */
3117 : 0 : top_waiter = futex_top_waiter(hb, &key);
3118 [ # # ]: 0 : if (top_waiter) {
3119 : 0 : struct futex_pi_state *pi_state = top_waiter->pi_state;
3120 : :
3121 : 0 : ret = -EINVAL;
3122 [ # # ]: 0 : if (!pi_state)
3123 : 0 : goto out_unlock;
3124 : :
3125 : : /*
3126 : : * If current does not own the pi_state then the futex is
3127 : : * inconsistent and user space fiddled with the futex value.
3128 : : */
3129 [ # # ]: 0 : if (pi_state->owner != current)
3130 : 0 : goto out_unlock;
3131 : :
3132 : 0 : get_pi_state(pi_state);
3133 : : /*
3134 : : * By taking wait_lock while still holding hb->lock, we ensure
3135 : : * there is no point where we hold neither; and therefore
3136 : : * wake_futex_pi() must observe a state consistent with what we
3137 : : * observed.
3138 : : *
3139 : : * In particular; this forces __rt_mutex_start_proxy() to
3140 : : * complete such that we're guaranteed to observe the
3141 : : * rt_waiter. Also see the WARN in wake_futex_pi().
3142 : : */
3143 : 0 : raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
3144 : 0 : spin_unlock(&hb->lock);
3145 : :
3146 : : /* drops pi_state->pi_mutex.wait_lock */
3147 : 0 : ret = wake_futex_pi(uaddr, uval, pi_state);
3148 : :
3149 : 0 : put_pi_state(pi_state);
3150 : :
3151 : : /*
3152 : : * Success, we're done! No tricky corner cases.
3153 : : */
3154 [ # # ]: 0 : if (!ret)
3155 : 0 : goto out_putkey;
3156 : : /*
3157 : : * The atomic access to the futex value generated a
3158 : : * pagefault, so retry the user-access and the wakeup:
3159 : : */
3160 [ # # ]: 0 : if (ret == -EFAULT)
3161 : 0 : goto pi_faulted;
3162 : : /*
3163 : : * A unconditional UNLOCK_PI op raced against a waiter
3164 : : * setting the FUTEX_WAITERS bit. Try again.
3165 : : */
3166 [ # # ]: 0 : if (ret == -EAGAIN)
3167 : 0 : goto pi_retry;
3168 : : /*
3169 : : * wake_futex_pi has detected invalid state. Tell user
3170 : : * space.
3171 : : */
3172 : 0 : goto out_putkey;
3173 : : }
3174 : :
3175 : : /*
3176 : : * We have no kernel internal state, i.e. no waiters in the
3177 : : * kernel. Waiters which are about to queue themselves are stuck
3178 : : * on hb->lock. So we can safely ignore them. We do neither
3179 : : * preserve the WAITERS bit not the OWNER_DIED one. We are the
3180 : : * owner.
3181 : : */
3182 [ # # ]: 0 : if ((ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, 0))) {
3183 : 0 : spin_unlock(&hb->lock);
3184 [ # # # ]: 0 : switch (ret) {
3185 : 0 : case -EFAULT:
3186 : 0 : goto pi_faulted;
3187 : :
3188 : 0 : case -EAGAIN:
3189 : 0 : goto pi_retry;
3190 : :
3191 : : default:
3192 : 0 : WARN_ON_ONCE(1);
3193 : 0 : goto out_putkey;
3194 : : }
3195 : : }
3196 : :
3197 : : /*
3198 : : * If uval has changed, let user space handle it.
3199 : : */
3200 [ # # ]: 0 : ret = (curval == uval) ? 0 : -EAGAIN;
3201 : :
3202 : 0 : out_unlock:
3203 : 0 : spin_unlock(&hb->lock);
3204 : 0 : out_putkey:
3205 : 0 : put_futex_key(&key);
3206 : 0 : return ret;
3207 : :
3208 : 0 : pi_retry:
3209 : 0 : put_futex_key(&key);
3210 : 0 : cond_resched();
3211 : 0 : goto retry;
3212 : :
3213 : 0 : pi_faulted:
3214 : 0 : put_futex_key(&key);
3215 : :
3216 : 0 : ret = fault_in_user_writeable(uaddr);
3217 [ # # ]: 0 : if (!ret)
3218 : 0 : goto retry;
3219 : :
3220 : : return ret;
3221 : : }
3222 : :
3223 : : /**
3224 : : * handle_early_requeue_pi_wakeup() - Detect early wakeup on the initial futex
3225 : : * @hb: the hash_bucket futex_q was original enqueued on
3226 : : * @q: the futex_q woken while waiting to be requeued
3227 : : * @key2: the futex_key of the requeue target futex
3228 : : * @timeout: the timeout associated with the wait (NULL if none)
3229 : : *
3230 : : * Detect if the task was woken on the initial futex as opposed to the requeue
3231 : : * target futex. If so, determine if it was a timeout or a signal that caused
3232 : : * the wakeup and return the appropriate error code to the caller. Must be
3233 : : * called with the hb lock held.
3234 : : *
3235 : : * Return:
3236 : : * - 0 = no early wakeup detected;
3237 : : * - <0 = -ETIMEDOUT or -ERESTARTNOINTR
3238 : : */
3239 : : static inline
3240 : 0 : int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
3241 : : struct futex_q *q, union futex_key *key2,
3242 : : struct hrtimer_sleeper *timeout)
3243 : : {
3244 : 0 : int ret = 0;
3245 : :
3246 : : /*
3247 : : * With the hb lock held, we avoid races while we process the wakeup.
3248 : : * We only need to hold hb (and not hb2) to ensure atomicity as the
3249 : : * wakeup code can't change q.key from uaddr to uaddr2 if we hold hb.
3250 : : * It can't be requeued from uaddr2 to something else since we don't
3251 : : * support a PI aware source futex for requeue.
3252 : : */
3253 [ # # ]: 0 : if (!match_futex(&q->key, key2)) {
3254 [ # # # # : 0 : WARN_ON(q->lock_ptr && (&hb->lock != q->lock_ptr));
# # ]
3255 : : /*
3256 : : * We were woken prior to requeue by a timeout or a signal.
3257 : : * Unqueue the futex_q and determine which it was.
3258 : : */
3259 : 0 : plist_del(&q->list, &hb->chain);
3260 : 0 : hb_waiters_dec(hb);
3261 : :
3262 : : /* Handle spurious wakeups gracefully */
3263 : 0 : ret = -EWOULDBLOCK;
3264 [ # # # # ]: 0 : if (timeout && !timeout->task)
3265 : : ret = -ETIMEDOUT;
3266 [ # # ]: 0 : else if (signal_pending(current))
3267 : 0 : ret = -ERESTARTNOINTR;
3268 : : }
3269 : 0 : return ret;
3270 : : }
3271 : :
3272 : : /**
3273 : : * futex_wait_requeue_pi() - Wait on uaddr and take uaddr2
3274 : : * @uaddr: the futex we initially wait on (non-pi)
3275 : : * @flags: futex flags (FLAGS_SHARED, FLAGS_CLOCKRT, etc.), they must be
3276 : : * the same type, no requeueing from private to shared, etc.
3277 : : * @val: the expected value of uaddr
3278 : : * @abs_time: absolute timeout
3279 : : * @bitset: 32 bit wakeup bitset set by userspace, defaults to all
3280 : : * @uaddr2: the pi futex we will take prior to returning to user-space
3281 : : *
3282 : : * The caller will wait on uaddr and will be requeued by futex_requeue() to
3283 : : * uaddr2 which must be PI aware and unique from uaddr. Normal wakeup will wake
3284 : : * on uaddr2 and complete the acquisition of the rt_mutex prior to returning to
3285 : : * userspace. This ensures the rt_mutex maintains an owner when it has waiters;
3286 : : * without one, the pi logic would not know which task to boost/deboost, if
3287 : : * there was a need to.
3288 : : *
3289 : : * We call schedule in futex_wait_queue_me() when we enqueue and return there
3290 : : * via the following--
3291 : : * 1) wakeup on uaddr2 after an atomic lock acquisition by futex_requeue()
3292 : : * 2) wakeup on uaddr2 after a requeue
3293 : : * 3) signal
3294 : : * 4) timeout
3295 : : *
3296 : : * If 3, cleanup and return -ERESTARTNOINTR.
3297 : : *
3298 : : * If 2, we may then block on trying to take the rt_mutex and return via:
3299 : : * 5) successful lock
3300 : : * 6) signal
3301 : : * 7) timeout
3302 : : * 8) other lock acquisition failure
3303 : : *
3304 : : * If 6, return -EWOULDBLOCK (restarting the syscall would do the same).
3305 : : *
3306 : : * If 4 or 7, we cleanup and return with -ETIMEDOUT.
3307 : : *
3308 : : * Return:
3309 : : * - 0 - On success;
3310 : : * - <0 - On error
3311 : : */
3312 : 0 : static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
3313 : : u32 val, ktime_t *abs_time, u32 bitset,
3314 : : u32 __user *uaddr2)
3315 : : {
3316 : 0 : struct hrtimer_sleeper timeout, *to;
3317 : 0 : struct futex_pi_state *pi_state = NULL;
3318 : 0 : struct rt_mutex_waiter rt_waiter;
3319 : 0 : struct futex_hash_bucket *hb;
3320 : 0 : union futex_key key2 = FUTEX_KEY_INIT;
3321 : 0 : struct futex_q q = futex_q_init;
3322 : 0 : int res, ret;
3323 : :
3324 : 0 : if (!IS_ENABLED(CONFIG_FUTEX_PI))
3325 : : return -ENOSYS;
3326 : :
3327 [ # # ]: 0 : if (uaddr == uaddr2)
3328 : : return -EINVAL;
3329 : :
3330 [ # # ]: 0 : if (!bitset)
3331 : : return -EINVAL;
3332 : :
3333 : 0 : to = futex_setup_timer(abs_time, &timeout, flags,
3334 : : current->timer_slack_ns);
3335 : :
3336 : : /*
3337 : : * The waiter is allocated on our stack, manipulated by the requeue
3338 : : * code while we sleep on uaddr.
3339 : : */
3340 : 0 : rt_mutex_init_waiter(&rt_waiter);
3341 : :
3342 : 0 : ret = get_futex_key(uaddr2, flags & FLAGS_SHARED, &key2, FUTEX_WRITE);
3343 [ # # ]: 0 : if (unlikely(ret != 0))
3344 : 0 : goto out;
3345 : :
3346 : 0 : q.bitset = bitset;
3347 : 0 : q.rt_waiter = &rt_waiter;
3348 : 0 : q.requeue_pi_key = &key2;
3349 : :
3350 : : /*
3351 : : * Prepare to wait on uaddr. On success, increments q.key (key1) ref
3352 : : * count.
3353 : : */
3354 : 0 : ret = futex_wait_setup(uaddr, val, flags, &q, &hb);
3355 [ # # ]: 0 : if (ret)
3356 : 0 : goto out_key2;
3357 : :
3358 : : /*
3359 : : * The check above which compares uaddrs is not sufficient for
3360 : : * shared futexes. We need to compare the keys:
3361 : : */
3362 [ # # ]: 0 : if (match_futex(&q.key, &key2)) {
3363 : 0 : queue_unlock(hb);
3364 : 0 : ret = -EINVAL;
3365 : 0 : goto out_put_keys;
3366 : : }
3367 : :
3368 : : /* Queue the futex_q, drop the hb lock, wait for wakeup. */
3369 : 0 : futex_wait_queue_me(hb, &q, to);
3370 : :
3371 : 0 : spin_lock(&hb->lock);
3372 : 0 : ret = handle_early_requeue_pi_wakeup(hb, &q, &key2, to);
3373 : 0 : spin_unlock(&hb->lock);
3374 [ # # ]: 0 : if (ret)
3375 : 0 : goto out_put_keys;
3376 : :
3377 : : /*
3378 : : * In order for us to be here, we know our q.key == key2, and since
3379 : : * we took the hb->lock above, we also know that futex_requeue() has
3380 : : * completed and we no longer have to concern ourselves with a wakeup
3381 : : * race with the atomic proxy lock acquisition by the requeue code. The
3382 : : * futex_requeue dropped our key1 reference and incremented our key2
3383 : : * reference count.
3384 : : */
3385 : :
3386 : : /* Check if the requeue code acquired the second futex for us. */
3387 [ # # ]: 0 : if (!q.rt_waiter) {
3388 : : /*
3389 : : * Got the lock. We might not be the anticipated owner if we
3390 : : * did a lock-steal - fix up the PI-state in that case.
3391 : : */
3392 [ # # # # ]: 0 : if (q.pi_state && (q.pi_state->owner != current)) {
3393 : 0 : spin_lock(q.lock_ptr);
3394 : 0 : ret = fixup_pi_state_owner(uaddr2, &q, current);
3395 [ # # # # ]: 0 : if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
3396 : 0 : pi_state = q.pi_state;
3397 : 0 : get_pi_state(pi_state);
3398 : : }
3399 : : /*
3400 : : * Drop the reference to the pi state which
3401 : : * the requeue_pi() code acquired for us.
3402 : : */
3403 : 0 : put_pi_state(q.pi_state);
3404 : 0 : spin_unlock(q.lock_ptr);
3405 : : }
3406 : : } else {
3407 : 0 : struct rt_mutex *pi_mutex;
3408 : :
3409 : : /*
3410 : : * We have been woken up by futex_unlock_pi(), a timeout, or a
3411 : : * signal. futex_unlock_pi() will not destroy the lock_ptr nor
3412 : : * the pi_state.
3413 : : */
3414 [ # # ]: 0 : WARN_ON(!q.pi_state);
3415 : 0 : pi_mutex = &q.pi_state->pi_mutex;
3416 : 0 : ret = rt_mutex_wait_proxy_lock(pi_mutex, to, &rt_waiter);
3417 : :
3418 : 0 : spin_lock(q.lock_ptr);
3419 [ # # # # ]: 0 : if (ret && !rt_mutex_cleanup_proxy_lock(pi_mutex, &rt_waiter))
3420 : 0 : ret = 0;
3421 : :
3422 : 0 : debug_rt_mutex_free_waiter(&rt_waiter);
3423 : : /*
3424 : : * Fixup the pi_state owner and possibly acquire the lock if we
3425 : : * haven't already.
3426 : : */
3427 : 0 : res = fixup_owner(uaddr2, &q, !ret);
3428 : : /*
3429 : : * If fixup_owner() returned an error, proprogate that. If it
3430 : : * acquired the lock, clear -ETIMEDOUT or -EINTR.
3431 : : */
3432 [ # # ]: 0 : if (res)
3433 : 0 : ret = (res < 0) ? res : 0;
3434 : :
3435 : : /*
3436 : : * If fixup_pi_state_owner() faulted and was unable to handle
3437 : : * the fault, unlock the rt_mutex and return the fault to
3438 : : * userspace.
3439 : : */
3440 [ # # # # ]: 0 : if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
3441 : 0 : pi_state = q.pi_state;
3442 : 0 : get_pi_state(pi_state);
3443 : : }
3444 : :
3445 : : /* Unqueue and drop the lock. */
3446 : 0 : unqueue_me_pi(&q);
3447 : : }
3448 : :
3449 [ # # ]: 0 : if (pi_state) {
3450 : 0 : rt_mutex_futex_unlock(&pi_state->pi_mutex);
3451 : 0 : put_pi_state(pi_state);
3452 : : }
3453 : :
3454 [ # # ]: 0 : if (ret == -EINTR) {
3455 : : /*
3456 : : * We've already been requeued, but cannot restart by calling
3457 : : * futex_lock_pi() directly. We could restart this syscall, but
3458 : : * it would detect that the user space "val" changed and return
3459 : : * -EWOULDBLOCK. Save the overhead of the restart and return
3460 : : * -EWOULDBLOCK directly.
3461 : : */
3462 : 0 : ret = -EWOULDBLOCK;
3463 : : }
3464 : :
3465 : 0 : out_put_keys:
3466 : 0 : put_futex_key(&q.key);
3467 : 0 : out_key2:
3468 : 0 : put_futex_key(&key2);
3469 : :
3470 : 0 : out:
3471 [ # # ]: 0 : if (to) {
3472 : 0 : hrtimer_cancel(&to->timer);
3473 : 0 : destroy_hrtimer_on_stack(&to->timer);
3474 : : }
3475 : : return ret;
3476 : : }
3477 : :
3478 : : /*
3479 : : * Support for robust futexes: the kernel cleans up held futexes at
3480 : : * thread exit time.
3481 : : *
3482 : : * Implementation: user-space maintains a per-thread list of locks it
3483 : : * is holding. Upon do_exit(), the kernel carefully walks this list,
3484 : : * and marks all locks that are owned by this thread with the
3485 : : * FUTEX_OWNER_DIED bit, and wakes up a waiter (if any). The list is
3486 : : * always manipulated with the lock held, so the list is private and
3487 : : * per-thread. Userspace also maintains a per-thread 'list_op_pending'
3488 : : * field, to allow the kernel to clean up if the thread dies after
3489 : : * acquiring the lock, but just before it could have added itself to
3490 : : * the list. There can only be one such pending lock.
3491 : : */
3492 : :
3493 : : /**
3494 : : * sys_set_robust_list() - Set the robust-futex list head of a task
3495 : : * @head: pointer to the list-head
3496 : : * @len: length of the list-head, as userspace expects
3497 : : */
3498 : 115818 : SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
3499 : : size_t, len)
3500 : : {
3501 [ - - + - ]: 57909 : if (!futex_cmpxchg_enabled)
3502 : : return -ENOSYS;
3503 : : /*
3504 : : * The kernel knows only one size for now:
3505 : : */
3506 [ - - + - ]: 57909 : if (unlikely(len != sizeof(*head)))
3507 : : return -EINVAL;
3508 : :
3509 : 57909 : current->robust_list = head;
3510 : :
3511 : 57909 : return 0;
3512 : : }
3513 : :
3514 : : /**
3515 : : * sys_get_robust_list() - Get the robust-futex list head of a task
3516 : : * @pid: pid of the process [zero for current task]
3517 : : * @head_ptr: pointer to a list-head pointer, the kernel fills it in
3518 : : * @len_ptr: pointer to a length field, the kernel fills in the header size
3519 : : */
3520 : 0 : SYSCALL_DEFINE3(get_robust_list, int, pid,
3521 : : struct robust_list_head __user * __user *, head_ptr,
3522 : : size_t __user *, len_ptr)
3523 : : {
3524 : 0 : struct robust_list_head __user *head;
3525 : 0 : unsigned long ret;
3526 : 0 : struct task_struct *p;
3527 : :
3528 [ # # ]: 0 : if (!futex_cmpxchg_enabled)
3529 : : return -ENOSYS;
3530 : :
3531 : 0 : rcu_read_lock();
3532 : :
3533 : 0 : ret = -ESRCH;
3534 [ # # ]: 0 : if (!pid)
3535 : 0 : p = current;
3536 : : else {
3537 : 0 : p = find_task_by_vpid(pid);
3538 [ # # ]: 0 : if (!p)
3539 : 0 : goto err_unlock;
3540 : : }
3541 : :
3542 : 0 : ret = -EPERM;
3543 [ # # ]: 0 : if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
3544 : 0 : goto err_unlock;
3545 : :
3546 : 0 : head = p->robust_list;
3547 : 0 : rcu_read_unlock();
3548 : :
3549 [ # # ]: 0 : if (put_user(sizeof(*head), len_ptr))
3550 : : return -EFAULT;
3551 : 0 : return put_user(head, head_ptr);
3552 : :
3553 : 0 : err_unlock:
3554 : 0 : rcu_read_unlock();
3555 : :
3556 : 0 : return ret;
3557 : : }
3558 : :
3559 : : /* Constants for the pending_op argument of handle_futex_death */
3560 : : #define HANDLE_DEATH_PENDING true
3561 : : #define HANDLE_DEATH_LIST false
3562 : :
3563 : : /*
3564 : : * Process a futex-list entry, check whether it's owned by the
3565 : : * dying task, and do notification if so:
3566 : : */
3567 : 0 : static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr,
3568 : : bool pi, bool pending_op)
3569 : : {
3570 : 0 : u32 uval, uninitialized_var(nval), mval;
3571 : 0 : int err;
3572 : :
3573 : : /* Futex address must be 32bit aligned */
3574 [ # # ]: 0 : if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0)
3575 : : return -1;
3576 : :
3577 : 0 : retry:
3578 [ # # ]: 0 : if (get_user(uval, uaddr))
3579 : : return -1;
3580 : :
3581 : : /*
3582 : : * Special case for regular (non PI) futexes. The unlock path in
3583 : : * user space has two race scenarios:
3584 : : *
3585 : : * 1. The unlock path releases the user space futex value and
3586 : : * before it can execute the futex() syscall to wake up
3587 : : * waiters it is killed.
3588 : : *
3589 : : * 2. A woken up waiter is killed before it can acquire the
3590 : : * futex in user space.
3591 : : *
3592 : : * In both cases the TID validation below prevents a wakeup of
3593 : : * potential waiters which can cause these waiters to block
3594 : : * forever.
3595 : : *
3596 : : * In both cases the following conditions are met:
3597 : : *
3598 : : * 1) task->robust_list->list_op_pending != NULL
3599 : : * @pending_op == true
3600 : : * 2) User space futex value == 0
3601 : : * 3) Regular futex: @pi == false
3602 : : *
3603 : : * If these conditions are met, it is safe to attempt waking up a
3604 : : * potential waiter without touching the user space futex value and
3605 : : * trying to set the OWNER_DIED bit. The user space futex value is
3606 : : * uncontended and the rest of the user space mutex state is
3607 : : * consistent, so a woken waiter will just take over the
3608 : : * uncontended futex. Setting the OWNER_DIED bit would create
3609 : : * inconsistent state and malfunction of the user space owner died
3610 : : * handling.
3611 : : */
3612 [ # # # # ]: 0 : if (pending_op && !pi && !uval) {
3613 : 0 : futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY);
3614 : 0 : return 0;
3615 : : }
3616 : :
3617 [ # # ]: 0 : if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr))
3618 : : return 0;
3619 : :
3620 : : /*
3621 : : * Ok, this dying thread is truly holding a futex
3622 : : * of interest. Set the OWNER_DIED bit atomically
3623 : : * via cmpxchg, and if the value had FUTEX_WAITERS
3624 : : * set, wake up a waiter (if any). (We have to do a
3625 : : * futex_wake() even if OWNER_DIED is already set -
3626 : : * to handle the rare but possible case of recursive
3627 : : * thread-death.) The rest of the cleanup is done in
3628 : : * userspace.
3629 : : */
3630 : 0 : mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED;
3631 : :
3632 : : /*
3633 : : * We are not holding a lock here, but we want to have
3634 : : * the pagefault_disable/enable() protection because
3635 : : * we want to handle the fault gracefully. If the
3636 : : * access fails we try to fault in the futex with R/W
3637 : : * verification via get_user_pages. get_user() above
3638 : : * does not guarantee R/W access. If that fails we
3639 : : * give up and leave the futex locked.
3640 : : */
3641 [ # # ]: 0 : if ((err = cmpxchg_futex_value_locked(&nval, uaddr, uval, mval))) {
3642 [ # # # ]: 0 : switch (err) {
3643 : 0 : case -EFAULT:
3644 [ # # ]: 0 : if (fault_in_user_writeable(uaddr))
3645 : : return -1;
3646 : 0 : goto retry;
3647 : :
3648 : : case -EAGAIN:
3649 : 0 : cond_resched();
3650 : 0 : goto retry;
3651 : :
3652 : : default:
3653 : 0 : WARN_ON_ONCE(1);
3654 : 0 : return err;
3655 : : }
3656 : : }
3657 : :
3658 [ # # ]: 0 : if (nval != uval)
3659 : 0 : goto retry;
3660 : :
3661 : : /*
3662 : : * Wake robust non-PI futexes here. The wakeup of
3663 : : * PI futexes happens in exit_pi_state():
3664 : : */
3665 [ # # ]: 0 : if (!pi && (uval & FUTEX_WAITERS))
3666 : 0 : futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY);
3667 : :
3668 : : return 0;
3669 : : }
3670 : :
3671 : : /*
3672 : : * Fetch a robust-list pointer. Bit 0 signals PI futexes:
3673 : : */
3674 : 112396 : static inline int fetch_robust_entry(struct robust_list __user **entry,
3675 : : struct robust_list __user * __user *head,
3676 : : unsigned int *pi)
3677 : : {
3678 : 112396 : unsigned long uentry;
3679 : :
3680 [ + - + - : 112396 : if (get_user(uentry, (unsigned long __user *)head))
- - ]
3681 : : return -EFAULT;
3682 : :
3683 : 112396 : *entry = (void __user *)(uentry & ~1UL);
3684 : 112396 : *pi = uentry & 1;
3685 : :
3686 : 112396 : return 0;
3687 : : }
3688 : :
3689 : : /*
3690 : : * Walk curr->robust_list (very carefully, it's a userspace list!)
3691 : : * and mark any locks found there dead, and notify any waiters.
3692 : : *
3693 : : * We silently return on any sign of list-walking problem.
3694 : : */
3695 : 56198 : static void exit_robust_list(struct task_struct *curr)
3696 : : {
3697 : 56198 : struct robust_list_head __user *head = curr->robust_list;
3698 : 56198 : struct robust_list __user *entry, *next_entry, *pending;
3699 : 56198 : unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
3700 : 56198 : unsigned int uninitialized_var(next_pi);
3701 : 56198 : unsigned long futex_offset;
3702 : 56198 : int rc;
3703 : :
3704 [ + - ]: 56198 : if (!futex_cmpxchg_enabled)
3705 : : return;
3706 : :
3707 : : /*
3708 : : * Fetch the list head (which was registered earlier, via
3709 : : * sys_set_robust_list()):
3710 : : */
3711 [ + - ]: 112396 : if (fetch_robust_entry(&entry, &head->list.next, &pi))
3712 : : return;
3713 : : /*
3714 : : * Fetch the relative futex offset:
3715 : : */
3716 [ + - ]: 56198 : if (get_user(futex_offset, &head->futex_offset))
3717 : : return;
3718 : : /*
3719 : : * Fetch any possibly pending lock-add first, and handle it
3720 : : * if it exists:
3721 : : */
3722 [ + - ]: 112396 : if (fetch_robust_entry(&pending, &head->list_op_pending, &pip))
3723 : : return;
3724 : :
3725 : : next_entry = NULL; /* avoid warning with gcc */
3726 [ - + ]: 56198 : while (entry != &head->list) {
3727 : : /*
3728 : : * Fetch the next entry in the list before calling
3729 : : * handle_futex_death:
3730 : : */
3731 : 0 : rc = fetch_robust_entry(&next_entry, &entry->next, &next_pi);
3732 : : /*
3733 : : * A pending lock might already be on the list, so
3734 : : * don't process it twice:
3735 : : */
3736 [ # # ]: 0 : if (entry != pending) {
3737 [ # # ]: 0 : if (handle_futex_death((void __user *)entry + futex_offset,
3738 : : curr, pi, HANDLE_DEATH_LIST))
3739 : : return;
3740 : : }
3741 [ # # ]: 0 : if (rc)
3742 : : return;
3743 : 0 : entry = next_entry;
3744 : 0 : pi = next_pi;
3745 : : /*
3746 : : * Avoid excessively long or circular lists:
3747 : : */
3748 [ # # ]: 0 : if (!--limit)
3749 : : break;
3750 : :
3751 : 0 : cond_resched();
3752 : : }
3753 : :
3754 [ - + ]: 56198 : if (pending) {
3755 : 0 : handle_futex_death((void __user *)pending + futex_offset,
3756 : : curr, pip, HANDLE_DEATH_PENDING);
3757 : : }
3758 : : }
3759 : :
3760 : 99431 : static void futex_cleanup(struct task_struct *tsk)
3761 : : {
3762 [ + + ]: 99431 : if (unlikely(tsk->robust_list)) {
3763 : 56198 : exit_robust_list(tsk);
3764 : 56198 : tsk->robust_list = NULL;
3765 : : }
3766 : :
3767 : : #ifdef CONFIG_COMPAT
3768 [ - + ]: 99431 : if (unlikely(tsk->compat_robust_list)) {
3769 : 0 : compat_exit_robust_list(tsk);
3770 : 0 : tsk->compat_robust_list = NULL;
3771 : : }
3772 : : #endif
3773 : :
3774 [ - + ]: 99431 : if (unlikely(!list_empty(&tsk->pi_state_list)))
3775 : 0 : exit_pi_state_list(tsk);
3776 : 99431 : }
3777 : :
3778 : : /**
3779 : : * futex_exit_recursive - Set the tasks futex state to FUTEX_STATE_DEAD
3780 : : * @tsk: task to set the state on
3781 : : *
3782 : : * Set the futex exit state of the task lockless. The futex waiter code
3783 : : * observes that state when a task is exiting and loops until the task has
3784 : : * actually finished the futex cleanup. The worst case for this is that the
3785 : : * waiter runs through the wait loop until the state becomes visible.
3786 : : *
3787 : : * This is called from the recursive fault handling path in do_exit().
3788 : : *
3789 : : * This is best effort. Either the futex exit code has run already or
3790 : : * not. If the OWNER_DIED bit has been set on the futex then the waiter can
3791 : : * take it over. If not, the problem is pushed back to user space. If the
3792 : : * futex exit code did not run yet, then an already queued waiter might
3793 : : * block forever, but there is nothing which can be done about that.
3794 : : */
3795 : 0 : void futex_exit_recursive(struct task_struct *tsk)
3796 : : {
3797 : : /* If the state is FUTEX_STATE_EXITING then futex_exit_mutex is held */
3798 [ # # ]: 0 : if (tsk->futex_state == FUTEX_STATE_EXITING)
3799 : 0 : mutex_unlock(&tsk->futex_exit_mutex);
3800 : 0 : tsk->futex_state = FUTEX_STATE_DEAD;
3801 : 0 : }
3802 : :
3803 : 99431 : static void futex_cleanup_begin(struct task_struct *tsk)
3804 : : {
3805 : : /*
3806 : : * Prevent various race issues against a concurrent incoming waiter
3807 : : * including live locks by forcing the waiter to block on
3808 : : * tsk->futex_exit_mutex when it observes FUTEX_STATE_EXITING in
3809 : : * attach_to_pi_owner().
3810 : : */
3811 : 99431 : mutex_lock(&tsk->futex_exit_mutex);
3812 : :
3813 : : /*
3814 : : * Switch the state to FUTEX_STATE_EXITING under tsk->pi_lock.
3815 : : *
3816 : : * This ensures that all subsequent checks of tsk->futex_state in
3817 : : * attach_to_pi_owner() must observe FUTEX_STATE_EXITING with
3818 : : * tsk->pi_lock held.
3819 : : *
3820 : : * It guarantees also that a pi_state which was queued right before
3821 : : * the state change under tsk->pi_lock by a concurrent waiter must
3822 : : * be observed in exit_pi_state_list().
3823 : : */
3824 : 99431 : raw_spin_lock_irq(&tsk->pi_lock);
3825 : 99431 : tsk->futex_state = FUTEX_STATE_EXITING;
3826 : 99431 : raw_spin_unlock_irq(&tsk->pi_lock);
3827 : 99431 : }
3828 : :
3829 : 99431 : static void futex_cleanup_end(struct task_struct *tsk, int state)
3830 : : {
3831 : : /*
3832 : : * Lockless store. The only side effect is that an observer might
3833 : : * take another loop until it becomes visible.
3834 : : */
3835 : 99431 : tsk->futex_state = state;
3836 : : /*
3837 : : * Drop the exit protection. This unblocks waiters which observed
3838 : : * FUTEX_STATE_EXITING to reevaluate the state.
3839 : : */
3840 : 99431 : mutex_unlock(&tsk->futex_exit_mutex);
3841 : : }
3842 : :
3843 : 48114 : void futex_exec_release(struct task_struct *tsk)
3844 : : {
3845 : : /*
3846 : : * The state handling is done for consistency, but in the case of
3847 : : * exec() there is no way to prevent futher damage as the PID stays
3848 : : * the same. But for the unlikely and arguably buggy case that a
3849 : : * futex is held on exec(), this provides at least as much state
3850 : : * consistency protection which is possible.
3851 : : */
3852 : 48114 : futex_cleanup_begin(tsk);
3853 : 48114 : futex_cleanup(tsk);
3854 : : /*
3855 : : * Reset the state to FUTEX_STATE_OK. The task is alive and about
3856 : : * exec a new binary.
3857 : : */
3858 : 48114 : futex_cleanup_end(tsk, FUTEX_STATE_OK);
3859 : 48114 : }
3860 : :
3861 : 51317 : void futex_exit_release(struct task_struct *tsk)
3862 : : {
3863 : 51317 : futex_cleanup_begin(tsk);
3864 : 51317 : futex_cleanup(tsk);
3865 : 51317 : futex_cleanup_end(tsk, FUTEX_STATE_DEAD);
3866 : 51317 : }
3867 : :
3868 : 28512 : long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
3869 : : u32 __user *uaddr2, u32 val2, u32 val3)
3870 : : {
3871 : 28512 : int cmd = op & FUTEX_CMD_MASK;
3872 : 28512 : unsigned int flags = 0;
3873 : :
3874 [ - + ]: 28512 : if (!(op & FUTEX_PRIVATE_FLAG))
3875 : 0 : flags |= FLAGS_SHARED;
3876 : :
3877 [ - + ]: 28512 : if (op & FUTEX_CLOCK_REALTIME) {
3878 : 0 : flags |= FLAGS_CLOCKRT;
3879 [ # # # # ]: 0 : if (cmd != FUTEX_WAIT && cmd != FUTEX_WAIT_BITSET && \
3880 : : cmd != FUTEX_WAIT_REQUEUE_PI)
3881 : : return -ENOSYS;
3882 : : }
3883 : :
3884 [ - + ]: 28512 : switch (cmd) {
3885 : 0 : case FUTEX_LOCK_PI:
3886 : : case FUTEX_UNLOCK_PI:
3887 : : case FUTEX_TRYLOCK_PI:
3888 : : case FUTEX_WAIT_REQUEUE_PI:
3889 : : case FUTEX_CMP_REQUEUE_PI:
3890 [ # # ]: 0 : if (!futex_cmpxchg_enabled)
3891 : : return -ENOSYS;
3892 : : }
3893 : :
3894 [ + - + - : 28512 : switch (cmd) {
- - - - -
- - - - ]
3895 : 1717 : case FUTEX_WAIT:
3896 : 1717 : val3 = FUTEX_BITSET_MATCH_ANY;
3897 : : /* fall through */
3898 : 1717 : case FUTEX_WAIT_BITSET:
3899 : 1717 : return futex_wait(uaddr, flags, val, timeout, val3);
3900 : 26795 : case FUTEX_WAKE:
3901 : 26795 : val3 = FUTEX_BITSET_MATCH_ANY;
3902 : : /* fall through */
3903 : 26795 : case FUTEX_WAKE_BITSET:
3904 : 26795 : return futex_wake(uaddr, flags, val, val3);
3905 : 0 : case FUTEX_REQUEUE:
3906 : 0 : return futex_requeue(uaddr, flags, uaddr2, val, val2, NULL, 0);
3907 : 0 : case FUTEX_CMP_REQUEUE:
3908 : 0 : return futex_requeue(uaddr, flags, uaddr2, val, val2, &val3, 0);
3909 : 0 : case FUTEX_WAKE_OP:
3910 : 0 : return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3);
3911 : 0 : case FUTEX_LOCK_PI:
3912 : 0 : return futex_lock_pi(uaddr, flags, timeout, 0);
3913 : 0 : case FUTEX_UNLOCK_PI:
3914 : 0 : return futex_unlock_pi(uaddr, flags);
3915 : 0 : case FUTEX_TRYLOCK_PI:
3916 : 0 : return futex_lock_pi(uaddr, flags, NULL, 1);
3917 : 0 : case FUTEX_WAIT_REQUEUE_PI:
3918 : 0 : val3 = FUTEX_BITSET_MATCH_ANY;
3919 : 0 : return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3,
3920 : : uaddr2);
3921 : 0 : case FUTEX_CMP_REQUEUE_PI:
3922 : 0 : return futex_requeue(uaddr, flags, uaddr2, val, val2, &val3, 1);
3923 : : }
3924 : : return -ENOSYS;
3925 : : }
3926 : :
3927 : :
3928 : 57024 : SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
3929 : : struct __kernel_timespec __user *, utime, u32 __user *, uaddr2,
3930 : : u32, val3)
3931 : : {
3932 : 28512 : struct timespec64 ts;
3933 : 28512 : ktime_t t, *tp = NULL;
3934 : 28512 : u32 val2 = 0;
3935 : 28512 : int cmd = op & FUTEX_CMD_MASK;
3936 : :
3937 [ + + + - ]: 28512 : if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI ||
3938 : 237 : cmd == FUTEX_WAIT_BITSET ||
3939 [ - + ]: 237 : cmd == FUTEX_WAIT_REQUEUE_PI)) {
3940 : 0 : if (unlikely(should_fail_futex(!(op & FUTEX_PRIVATE_FLAG))))
3941 : : return -EFAULT;
3942 [ # # ]: 0 : if (get_timespec64(&ts, utime))
3943 : : return -EFAULT;
3944 [ # # ]: 0 : if (!timespec64_valid(&ts))
3945 : : return -EINVAL;
3946 : :
3947 [ # # ]: 0 : t = timespec64_to_ktime(ts);
3948 [ # # ]: 0 : if (cmd == FUTEX_WAIT)
3949 : 0 : t = ktime_add_safe(ktime_get(), t);
3950 : : tp = &t;
3951 : : }
3952 : : /*
3953 : : * requeue parameter in 'utime' if cmd == FUTEX_*_REQUEUE_*.
3954 : : * number of waiters to wake in 'utime' if cmd == FUTEX_WAKE_OP.
3955 : : */
3956 : 28512 : if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||
3957 [ + - - + ]: 28512 : cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP)
3958 : 0 : val2 = (u32) (unsigned long) utime;
3959 : :
3960 : 28512 : return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
3961 : : }
3962 : :
3963 : : #ifdef CONFIG_COMPAT
3964 : : /*
3965 : : * Fetch a robust-list pointer. Bit 0 signals PI futexes:
3966 : : */
3967 : : static inline int
3968 : 0 : compat_fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
3969 : : compat_uptr_t __user *head, unsigned int *pi)
3970 : : {
3971 [ # # # # : 0 : if (get_user(*uentry, head))
# # ]
3972 : : return -EFAULT;
3973 : :
3974 : 0 : *entry = compat_ptr((*uentry) & ~1);
3975 : 0 : *pi = (unsigned int)(*uentry) & 1;
3976 : :
3977 : 0 : return 0;
3978 : : }
3979 : :
3980 : 0 : static void __user *futex_uaddr(struct robust_list __user *entry,
3981 : : compat_long_t futex_offset)
3982 : : {
3983 : 0 : compat_uptr_t base = ptr_to_compat(entry);
3984 : 0 : void __user *uaddr = compat_ptr(base + futex_offset);
3985 : :
3986 : 0 : return uaddr;
3987 : : }
3988 : :
3989 : : /*
3990 : : * Walk curr->robust_list (very carefully, it's a userspace list!)
3991 : : * and mark any locks found there dead, and notify any waiters.
3992 : : *
3993 : : * We silently return on any sign of list-walking problem.
3994 : : */
3995 : 0 : static void compat_exit_robust_list(struct task_struct *curr)
3996 : : {
3997 : 0 : struct compat_robust_list_head __user *head = curr->compat_robust_list;
3998 : 0 : struct robust_list __user *entry, *next_entry, *pending;
3999 : 0 : unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
4000 : 0 : unsigned int uninitialized_var(next_pi);
4001 : 0 : compat_uptr_t uentry, next_uentry, upending;
4002 : 0 : compat_long_t futex_offset;
4003 : 0 : int rc;
4004 : :
4005 [ # # ]: 0 : if (!futex_cmpxchg_enabled)
4006 : : return;
4007 : :
4008 : : /*
4009 : : * Fetch the list head (which was registered earlier, via
4010 : : * sys_set_robust_list()):
4011 : : */
4012 [ # # ]: 0 : if (compat_fetch_robust_entry(&uentry, &entry, &head->list.next, &pi))
4013 : : return;
4014 : : /*
4015 : : * Fetch the relative futex offset:
4016 : : */
4017 [ # # ]: 0 : if (get_user(futex_offset, &head->futex_offset))
4018 : : return;
4019 : : /*
4020 : : * Fetch any possibly pending lock-add first, and handle it
4021 : : * if it exists:
4022 : : */
4023 [ # # ]: 0 : if (compat_fetch_robust_entry(&upending, &pending,
4024 : : &head->list_op_pending, &pip))
4025 : : return;
4026 : :
4027 : : next_entry = NULL; /* avoid warning with gcc */
4028 [ # # ]: 0 : while (entry != (struct robust_list __user *) &head->list) {
4029 : : /*
4030 : : * Fetch the next entry in the list before calling
4031 : : * handle_futex_death:
4032 : : */
4033 : 0 : rc = compat_fetch_robust_entry(&next_uentry, &next_entry,
4034 : 0 : (compat_uptr_t __user *)&entry->next, &next_pi);
4035 : : /*
4036 : : * A pending lock might already be on the list, so
4037 : : * dont process it twice:
4038 : : */
4039 [ # # ]: 0 : if (entry != pending) {
4040 : 0 : void __user *uaddr = futex_uaddr(entry, futex_offset);
4041 : :
4042 [ # # ]: 0 : if (handle_futex_death(uaddr, curr, pi,
4043 : : HANDLE_DEATH_LIST))
4044 : : return;
4045 : : }
4046 [ # # ]: 0 : if (rc)
4047 : : return;
4048 : 0 : uentry = next_uentry;
4049 : 0 : entry = next_entry;
4050 : 0 : pi = next_pi;
4051 : : /*
4052 : : * Avoid excessively long or circular lists:
4053 : : */
4054 [ # # ]: 0 : if (!--limit)
4055 : : break;
4056 : :
4057 : 0 : cond_resched();
4058 : : }
4059 [ # # ]: 0 : if (pending) {
4060 : 0 : void __user *uaddr = futex_uaddr(pending, futex_offset);
4061 : :
4062 : 0 : handle_futex_death(uaddr, curr, pip, HANDLE_DEATH_PENDING);
4063 : : }
4064 : : }
4065 : :
4066 : 0 : COMPAT_SYSCALL_DEFINE2(set_robust_list,
4067 : : struct compat_robust_list_head __user *, head,
4068 : : compat_size_t, len)
4069 : : {
4070 [ # # ]: 0 : if (!futex_cmpxchg_enabled)
4071 : : return -ENOSYS;
4072 : :
4073 [ # # ]: 0 : if (unlikely(len != sizeof(*head)))
4074 : : return -EINVAL;
4075 : :
4076 : 0 : current->compat_robust_list = head;
4077 : :
4078 : 0 : return 0;
4079 : : }
4080 : :
4081 : 0 : COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
4082 : : compat_uptr_t __user *, head_ptr,
4083 : : compat_size_t __user *, len_ptr)
4084 : : {
4085 : 0 : struct compat_robust_list_head __user *head;
4086 : 0 : unsigned long ret;
4087 : 0 : struct task_struct *p;
4088 : :
4089 [ # # ]: 0 : if (!futex_cmpxchg_enabled)
4090 : : return -ENOSYS;
4091 : :
4092 : 0 : rcu_read_lock();
4093 : :
4094 : 0 : ret = -ESRCH;
4095 [ # # ]: 0 : if (!pid)
4096 : 0 : p = current;
4097 : : else {
4098 : 0 : p = find_task_by_vpid(pid);
4099 [ # # ]: 0 : if (!p)
4100 : 0 : goto err_unlock;
4101 : : }
4102 : :
4103 : 0 : ret = -EPERM;
4104 [ # # ]: 0 : if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
4105 : 0 : goto err_unlock;
4106 : :
4107 : 0 : head = p->compat_robust_list;
4108 : 0 : rcu_read_unlock();
4109 : :
4110 [ # # ]: 0 : if (put_user(sizeof(*head), len_ptr))
4111 : : return -EFAULT;
4112 : 0 : return put_user(ptr_to_compat(head), head_ptr);
4113 : :
4114 : 0 : err_unlock:
4115 : 0 : rcu_read_unlock();
4116 : :
4117 : 0 : return ret;
4118 : : }
4119 : : #endif /* CONFIG_COMPAT */
4120 : :
4121 : : #ifdef CONFIG_COMPAT_32BIT_TIME
4122 : 0 : SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val,
4123 : : struct old_timespec32 __user *, utime, u32 __user *, uaddr2,
4124 : : u32, val3)
4125 : : {
4126 : 0 : struct timespec64 ts;
4127 : 0 : ktime_t t, *tp = NULL;
4128 : 0 : int val2 = 0;
4129 : 0 : int cmd = op & FUTEX_CMD_MASK;
4130 : :
4131 [ # # # # ]: 0 : if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI ||
4132 : 0 : cmd == FUTEX_WAIT_BITSET ||
4133 [ # # ]: 0 : cmd == FUTEX_WAIT_REQUEUE_PI)) {
4134 [ # # ]: 0 : if (get_old_timespec32(&ts, utime))
4135 : : return -EFAULT;
4136 [ # # ]: 0 : if (!timespec64_valid(&ts))
4137 : : return -EINVAL;
4138 : :
4139 [ # # ]: 0 : t = timespec64_to_ktime(ts);
4140 [ # # ]: 0 : if (cmd == FUTEX_WAIT)
4141 : 0 : t = ktime_add_safe(ktime_get(), t);
4142 : : tp = &t;
4143 : : }
4144 : 0 : if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||
4145 [ # # # # ]: 0 : cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP)
4146 : 0 : val2 = (int) (unsigned long) utime;
4147 : :
4148 : 0 : return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
4149 : : }
4150 : : #endif /* CONFIG_COMPAT_32BIT_TIME */
4151 : :
4152 : 78 : static void __init futex_detect_cmpxchg(void)
4153 : : {
4154 : : #ifndef CONFIG_HAVE_FUTEX_CMPXCHG
4155 : 78 : u32 curval;
4156 : :
4157 : : /*
4158 : : * This will fail and we want it. Some arch implementations do
4159 : : * runtime detection of the futex_atomic_cmpxchg_inatomic()
4160 : : * functionality. We want to know that before we call in any
4161 : : * of the complex code paths. Also we want to prevent
4162 : : * registration of robust lists in that case. NULL is
4163 : : * guaranteed to fault and we get -EFAULT on functional
4164 : : * implementation, the non-functional ones will return
4165 : : * -ENOSYS.
4166 : : */
4167 [ + - ]: 78 : if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
4168 : 78 : futex_cmpxchg_enabled = 1;
4169 : : #endif
4170 : 78 : }
4171 : :
4172 : 78 : static int __init futex_init(void)
4173 : : {
4174 : 78 : unsigned int futex_shift;
4175 : 78 : unsigned long i;
4176 : :
4177 : : #if CONFIG_BASE_SMALL
4178 : : futex_hashsize = 16;
4179 : : #else
4180 [ + - ]: 78 : futex_hashsize = roundup_pow_of_two(256 * num_possible_cpus());
4181 : : #endif
4182 : :
4183 [ + - ]: 156 : futex_queues = alloc_large_system_hash("futex", sizeof(*futex_queues),
4184 : : futex_hashsize, 0,
4185 : : futex_hashsize < 256 ? HASH_SMALL : 0,
4186 : : &futex_shift, NULL,
4187 : : futex_hashsize, futex_hashsize);
4188 : 78 : futex_hashsize = 1UL << futex_shift;
4189 : :
4190 : 78 : futex_detect_cmpxchg();
4191 : :
4192 [ + + ]: 20124 : for (i = 0; i < futex_hashsize; i++) {
4193 : 19968 : atomic_set(&futex_queues[i].waiters, 0);
4194 : 19968 : plist_head_init(&futex_queues[i].chain);
4195 : 19968 : spin_lock_init(&futex_queues[i].lock);
4196 : : }
4197 : :
4198 : 78 : return 0;
4199 : : }
4200 : : core_initcall(futex_init);
|
