2005-04-17 05:20:36 +07:00
|
|
|
/* thread_info.h: common low-level thread information accessors
|
|
|
|
*
|
|
|
|
* Copyright (C) 2002 David Howells (dhowells@redhat.com)
|
|
|
|
* - Incorporating suggestions made by Linus Torvalds
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef _LINUX_THREAD_INFO_H
|
|
|
|
#define _LINUX_THREAD_INFO_H
|
|
|
|
|
futex: fix for futex_wait signal stack corruption
David Holmes found a bug in the -rt tree with respect to
pthread_cond_timedwait. After trying his test program on the latest git
from mainline, I found the bug was there too. The bug he was seeing
that his test program showed, was that if one were to do a "Ctrl-Z" on a
process that was in the pthread_cond_timedwait, and then did a "bg" on
that process, it would return with a "-ETIMEDOUT" but early. That is,
the timer would go off early.
Looking into this, I found the source of the problem. And it is a rather
nasty bug at that.
Here's the relevant code from kernel/futex.c: (not in order in the file)
[...]
smlinkage long sys_futex(u32 __user *uaddr, int op, u32 val,
struct timespec __user *utime, u32 __user *uaddr2,
u32 val3)
{
struct timespec ts;
ktime_t t, *tp = NULL;
u32 val2 = 0;
int cmd = op & FUTEX_CMD_MASK;
if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI)) {
if (copy_from_user(&ts, utime, sizeof(ts)) != 0)
return -EFAULT;
if (!timespec_valid(&ts))
return -EINVAL;
t = timespec_to_ktime(ts);
if (cmd == FUTEX_WAIT)
t = ktime_add(ktime_get(), t);
tp = &t;
}
[...]
return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
}
[...]
long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
u32 __user *uaddr2, u32 val2, u32 val3)
{
int ret;
int cmd = op & FUTEX_CMD_MASK;
struct rw_semaphore *fshared = NULL;
if (!(op & FUTEX_PRIVATE_FLAG))
fshared = ¤t->mm->mmap_sem;
switch (cmd) {
case FUTEX_WAIT:
ret = futex_wait(uaddr, fshared, val, timeout);
[...]
static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
u32 val, ktime_t *abs_time)
{
[...]
struct restart_block *restart;
restart = ¤t_thread_info()->restart_block;
restart->fn = futex_wait_restart;
restart->arg0 = (unsigned long)uaddr;
restart->arg1 = (unsigned long)val;
restart->arg2 = (unsigned long)abs_time;
restart->arg3 = 0;
if (fshared)
restart->arg3 |= ARG3_SHARED;
return -ERESTART_RESTARTBLOCK;
[...]
static long futex_wait_restart(struct restart_block *restart)
{
u32 __user *uaddr = (u32 __user *)restart->arg0;
u32 val = (u32)restart->arg1;
ktime_t *abs_time = (ktime_t *)restart->arg2;
struct rw_semaphore *fshared = NULL;
restart->fn = do_no_restart_syscall;
if (restart->arg3 & ARG3_SHARED)
fshared = ¤t->mm->mmap_sem;
return (long)futex_wait(uaddr, fshared, val, abs_time);
}
So when the futex_wait is interrupt by a signal we break out of the
hrtimer code and set up or return from signal. This code does not return
back to userspace, so we set up a RESTARTBLOCK. The bug here is that we
save the "abs_time" which is a pointer to the stack variable "ktime_t t"
from sys_futex.
This returns and unwinds the stack before we get to call our signal. On
return from the signal we go to futex_wait_restart, where we update all
the parameters for futex_wait and call it. But here we have a problem
where abs_time is no longer valid.
I verified this with print statements, and sure enough, what abs_time
was set to ends up being garbage when we get to futex_wait_restart.
The solution I did to solve this (with input from Linus Torvalds)
was to add unions to the restart_block to allow system calls to
use the restart with specific parameters. This way the futex code now
saves the time in a 64bit value in the restart block instead of storing
it on the stack.
Note: I'm a bit nervious to add "linux/types.h" and use u32 and u64
in thread_info.h, when there's a #ifdef __KERNEL__ just below that.
Not sure what that is there for. If this turns out to be a problem, I've
tested this with using "unsigned int" for u32 and "unsigned long long" for
u64 and it worked just the same. I'm using u32 and u64 just to be
consistent with what the futex code uses.
Signed-off-by: Steven Rostedt <srostedt@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-12-05 21:46:09 +07:00
|
|
|
#include <linux/types.h>
|
2012-04-28 00:42:45 +07:00
|
|
|
#include <linux/bug.h>
|
2016-10-20 01:28:12 +07:00
|
|
|
#include <linux/restart_block.h>
|
2008-02-10 15:04:12 +07:00
|
|
|
|
2016-09-14 04:29:24 +07:00
|
|
|
#ifdef CONFIG_THREAD_INFO_IN_TASK
|
2016-10-20 01:28:13 +07:00
|
|
|
/*
|
|
|
|
* For CONFIG_THREAD_INFO_IN_TASK kernels we need <asm/current.h> for the
|
|
|
|
* definition of current, but for !CONFIG_THREAD_INFO_IN_TASK kernels,
|
|
|
|
* including <asm/current.h> can cause a circular dependency on some platforms.
|
|
|
|
*/
|
|
|
|
#include <asm/current.h>
|
2016-09-14 04:29:24 +07:00
|
|
|
#define current_thread_info() ((struct thread_info *)current)
|
|
|
|
#endif
|
|
|
|
|
2005-04-17 05:20:36 +07:00
|
|
|
#include <linux/bitops.h>
|
2017-02-17 01:29:15 +07:00
|
|
|
|
|
|
|
/*
|
|
|
|
* For per-arch arch_within_stack_frames() implementations, defined in
|
|
|
|
* asm/thread_info.h.
|
|
|
|
*/
|
|
|
|
enum {
|
|
|
|
BAD_STACK = -1,
|
|
|
|
NOT_STACK = 0,
|
|
|
|
GOOD_FRAME,
|
|
|
|
GOOD_STACK,
|
|
|
|
};
|
|
|
|
|
2005-04-17 05:20:36 +07:00
|
|
|
#include <asm/thread_info.h>
|
|
|
|
|
|
|
|
#ifdef __KERNEL__
|
|
|
|
|
2017-07-14 18:23:09 +07:00
|
|
|
#ifndef THREAD_ALIGN
|
|
|
|
#define THREAD_ALIGN THREAD_SIZE
|
|
|
|
#endif
|
|
|
|
|
2017-10-14 05:58:22 +07:00
|
|
|
#if IS_ENABLED(CONFIG_DEBUG_STACK_USAGE) || IS_ENABLED(CONFIG_DEBUG_KMEMLEAK)
|
2016-01-15 06:18:21 +07:00
|
|
|
# define THREADINFO_GFP (GFP_KERNEL_ACCOUNT | __GFP_NOTRACK | \
|
|
|
|
__GFP_ZERO)
|
2012-05-05 22:05:41 +07:00
|
|
|
#else
|
2016-01-15 06:18:21 +07:00
|
|
|
# define THREADINFO_GFP (GFP_KERNEL_ACCOUNT | __GFP_NOTRACK)
|
2012-05-05 22:05:41 +07:00
|
|
|
#endif
|
|
|
|
|
2005-04-17 05:20:36 +07:00
|
|
|
/*
|
|
|
|
* flag set/clear/test wrappers
|
|
|
|
* - pass TIF_xxxx constants to these functions
|
|
|
|
*/
|
|
|
|
|
|
|
|
static inline void set_ti_thread_flag(struct thread_info *ti, int flag)
|
|
|
|
{
|
2008-01-30 19:30:55 +07:00
|
|
|
set_bit(flag, (unsigned long *)&ti->flags);
|
2005-04-17 05:20:36 +07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline void clear_ti_thread_flag(struct thread_info *ti, int flag)
|
|
|
|
{
|
2008-01-30 19:30:55 +07:00
|
|
|
clear_bit(flag, (unsigned long *)&ti->flags);
|
2005-04-17 05:20:36 +07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int test_and_set_ti_thread_flag(struct thread_info *ti, int flag)
|
|
|
|
{
|
2008-01-30 19:30:55 +07:00
|
|
|
return test_and_set_bit(flag, (unsigned long *)&ti->flags);
|
2005-04-17 05:20:36 +07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int test_and_clear_ti_thread_flag(struct thread_info *ti, int flag)
|
|
|
|
{
|
2008-01-30 19:30:55 +07:00
|
|
|
return test_and_clear_bit(flag, (unsigned long *)&ti->flags);
|
2005-04-17 05:20:36 +07:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline int test_ti_thread_flag(struct thread_info *ti, int flag)
|
|
|
|
{
|
2008-01-30 19:30:55 +07:00
|
|
|
return test_bit(flag, (unsigned long *)&ti->flags);
|
2005-04-17 05:20:36 +07:00
|
|
|
}
|
|
|
|
|
2005-11-14 07:06:59 +07:00
|
|
|
#define set_thread_flag(flag) \
|
|
|
|
set_ti_thread_flag(current_thread_info(), flag)
|
|
|
|
#define clear_thread_flag(flag) \
|
|
|
|
clear_ti_thread_flag(current_thread_info(), flag)
|
|
|
|
#define test_and_set_thread_flag(flag) \
|
|
|
|
test_and_set_ti_thread_flag(current_thread_info(), flag)
|
|
|
|
#define test_and_clear_thread_flag(flag) \
|
|
|
|
test_and_clear_ti_thread_flag(current_thread_info(), flag)
|
|
|
|
#define test_thread_flag(flag) \
|
|
|
|
test_ti_thread_flag(current_thread_info(), flag)
|
|
|
|
|
2013-09-11 17:43:13 +07:00
|
|
|
#define tif_need_resched() test_thread_flag(TIF_NEED_RESCHED)
|
|
|
|
|
2016-07-13 06:19:48 +07:00
|
|
|
#ifndef CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES
|
|
|
|
static inline int arch_within_stack_frames(const void * const stack,
|
|
|
|
const void * const stackend,
|
|
|
|
const void *obj, unsigned long len)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2016-06-08 01:05:33 +07:00
|
|
|
#ifdef CONFIG_HARDENED_USERCOPY
|
|
|
|
extern void __check_object_size(const void *ptr, unsigned long n,
|
|
|
|
bool to_user);
|
|
|
|
|
2016-09-07 23:39:32 +07:00
|
|
|
static __always_inline void check_object_size(const void *ptr, unsigned long n,
|
|
|
|
bool to_user)
|
2016-06-08 01:05:33 +07:00
|
|
|
{
|
2016-09-01 06:04:21 +07:00
|
|
|
if (!__builtin_constant_p(n))
|
|
|
|
__check_object_size(ptr, n, to_user);
|
2016-06-08 01:05:33 +07:00
|
|
|
}
|
|
|
|
#else
|
|
|
|
static inline void check_object_size(const void *ptr, unsigned long n,
|
|
|
|
bool to_user)
|
|
|
|
{ }
|
|
|
|
#endif /* CONFIG_HARDENED_USERCOPY */
|
|
|
|
|
2017-06-30 08:42:43 +07:00
|
|
|
extern void __compiletime_error("copy source size is too small")
|
|
|
|
__bad_copy_from(void);
|
|
|
|
extern void __compiletime_error("copy destination size is too small")
|
|
|
|
__bad_copy_to(void);
|
|
|
|
|
|
|
|
static inline void copy_overflow(int size, unsigned long count)
|
|
|
|
{
|
|
|
|
WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
|
|
|
|
}
|
|
|
|
|
|
|
|
static __always_inline bool
|
|
|
|
check_copy_size(const void *addr, size_t bytes, bool is_source)
|
|
|
|
{
|
|
|
|
int sz = __compiletime_object_size(addr);
|
|
|
|
if (unlikely(sz >= 0 && sz < bytes)) {
|
|
|
|
if (!__builtin_constant_p(bytes))
|
|
|
|
copy_overflow(sz, bytes);
|
|
|
|
else if (is_source)
|
|
|
|
__bad_copy_from();
|
|
|
|
else
|
|
|
|
__bad_copy_to();
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
check_object_size(addr, bytes, is_source);
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2017-03-20 15:16:26 +07:00
|
|
|
#ifndef arch_setup_new_exec
|
|
|
|
static inline void arch_setup_new_exec(void) { }
|
|
|
|
#endif
|
|
|
|
|
2008-04-30 14:53:06 +07:00
|
|
|
#endif /* __KERNEL__ */
|
2005-04-17 05:20:36 +07:00
|
|
|
|
|
|
|
#endif /* _LINUX_THREAD_INFO_H */
|