The new syscall set_robust_list2() needs to handle both 64-bit and 32-bit robust lists, but not every 64-bit platform have compat entry points. Make exit_robust_list32() unconditionally available for 64-bit kernels regardless of having a compat configuration.

Signed-off-by: André Almeida andrealmeid@igalia.com --- kernel/futex/core.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/kernel/futex/core.c b/kernel/futex/core.c index c99d7baab24e..136639897ff9 100644 --- a/kernel/futex/core.c +++ b/kernel/futex/core.c @@ -31,7 +31,6 @@ * "The futexes are also cursed." * "But they come in a choice of three flavours!" */ -#include <linux/compat.h> #include <linux/jhash.h> #include <linux/pagemap.h> #include <linux/debugfs.h> @@ -1213,12 +1212,12 @@ static void exit_robust_list(struct task_struct *curr) } }

-#ifdef CONFIG_COMPAT +#ifdef CONFIG_64BIT static void __user *futex_uaddr(struct robust_list __user *entry, compat_long_t futex_offset) { - compat_uptr_t base = ptr_to_compat(entry); - void __user *uaddr = compat_ptr(base + futex_offset); + u32 base = (u32)(unsigned long)(entry); + void __user *uaddr = (void __user *)(unsigned long)(base + futex_offset);

return uaddr; } @@ -1227,13 +1226,13 @@ static void __user *futex_uaddr(struct robust_list __user *entry, * Fetch a robust-list pointer. Bit 0 signals PI futexes: */ static inline int -fetch_robust_entry32(compat_uptr_t *uentry, struct robust_list __user **entry, - compat_uptr_t __user *head, unsigned int *pi) +fetch_robust_entry32(u32 *uentry, struct robust_list __user **entry, + u32 __user *head, unsigned int *pi) { if (get_user(*uentry, head)) return -EFAULT;

- *entry = compat_ptr((*uentry) & ~1); + *entry = (void __user *)(unsigned long)((*uentry) & ~1); *pi = (unsigned int)(*uentry) & 1;

return 0; @@ -1251,8 +1250,8 @@ static void exit_robust_list32(struct task_struct *curr) struct robust_list __user *entry, *next_entry, *pending; unsigned int limit = ROBUST_LIST_LIMIT, pi, pip; unsigned int next_pi; - compat_uptr_t uentry, next_uentry, upending; - compat_long_t futex_offset; + u32 uentry, next_uentry, upending; + s32 futex_offset; int rc;

/* @@ -1412,7 +1411,7 @@ static void futex_cleanup(struct task_struct *tsk) tsk->robust_list = NULL; }

-#ifdef CONFIG_COMPAT +#ifdef CONFIG_64BIT if (unlikely(tsk->robust_list32)) { exit_robust_list32(tsk); tsk->robust_list32 = NULL;

As in the original robust list interface, to pair with set_robust_list2(), create a get_robust_list2() syscall with the following signature:

get_robust_list2(int pid, void __user **head_ptr, unsigned int index, unsigned int flags)

- `pid` sets with task's list should be returned. If is 0, it gets the list of the calling task. - `index` is the index of the list to get - `flags` is unused but can be used for expanding the interface

Signed-off-by: André Almeida andrealmeid@igalia.com --- For some reason I wasn't able to use put_user() for 32-bit lists.. it kept corrupting the value due to wrong write size I believe. copy_to_user() worked fine nonetheless. --- kernel/futex/syscalls.c | 61 +++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 57 insertions(+), 4 deletions(-)

diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c index 0b7fa88aa34c..f730d16632fc 100644 --- a/kernel/futex/syscalls.c +++ b/kernel/futex/syscalls.c @@ -48,7 +48,7 @@ static inline void __user *futex_task_robust_list(struct task_struct *p, bool co return p->robust_list; }

-static void __user *futex_get_robust_list_common(int pid, bool compat) +static void __user *futex_get_robust_list_common(int pid, bool compat, int index) { struct task_struct *p = current; void __user *head; @@ -75,7 +75,15 @@ static void __user *futex_get_robust_list_common(int pid, bool compat) if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) goto err_unlock;

- head = futex_task_robust_list(p, compat); + if (index >= 0) { + scoped_guard(mutex, &p->futex_exit_mutex) { + uintptr_t *rl = p->futex_robust_lists; + + head = rl ? (void __user *) rl[index] : NULL; + } + } else { + head = futex_task_robust_list(p, compat); + }

up_read(&p->signal->exec_update_lock); put_task_struct(p); @@ -99,7 +107,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pid, struct robust_list_head __user * __user *, head_ptr, size_t __user *, len_ptr) { - struct robust_list_head __user *head = futex_get_robust_list_common(pid, false); + struct robust_list_head __user *head = futex_get_robust_list_common(pid, false, -1);

if (IS_ERR(head)) return PTR_ERR(head); @@ -150,6 +158,51 @@ SYSCALL_DEFINE4(set_robust_list2, struct robust_list_head *, head, unsigned int, return -EINVAL; }

+SYSCALL_DEFINE4(get_robust_list2, int, pid, + void __user * __user *, head_ptr, + unsigned int, index, unsigned int, flags) +{ + void __user *entry_ptr; + uintptr_t entry; + + if (index >= FUTEX_ROBUST_LISTS_PER_USER) + return -EINVAL; + + if (flags) + return -EINVAL; + + /* + * The first two indexes are reserved for the kernel to be used with the + * legacy syscall, so we hide them from userspace. + * + * We map [0, FUTEX_ROBUST_LISTS_PER_USER) to + * [FUTEX_ROBUST_LIST2_IDX, FUTEX_ROBUST_LIST2_MAX_IDX) + */ + index += FUTEX_ROBUST_LIST2_IDX; + + entry_ptr = futex_get_robust_list_common(pid, false, index); + if (IS_ERR(entry_ptr)) + return PTR_ERR(entry_ptr); + + entry = (uintptr_t) entry_ptr; + + if (entry & FUTEX_ROBUST_LIST_ENTRY_32BIT) { + entry &= FUTEX_ROBUST_LIST_ENTRY_MASK; + + if (copy_to_user(head_ptr, &entry, sizeof(u32))) + return -EFAULT; + + return 0; + } else { + struct robust_list_head *head; + + entry &= FUTEX_ROBUST_LIST_ENTRY_MASK; + head = (__force struct robust_list_head __user *)entry; + + return put_user(head, head_ptr); + } +} + long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, u32 __user *uaddr2, u32 val2, u32 val3) { @@ -524,7 +577,7 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, compat_uptr_t __user *, head_ptr, compat_size_t __user *, len_ptr) { - struct robust_list_head32 __user *head = futex_get_robust_list_common(pid, true); + struct robust_list_head32 __user *head = futex_get_robust_list_common(pid, true, -1);

if (IS_ERR(head)) return PTR_ERR(head);

Wire up the new get_robust_list2 syscall in all available architectures.

Signed-off-by: André Almeida andrealmeid@igalia.com --- arch/alpha/kernel/syscalls/syscall.tbl | 1 + arch/arm/tools/syscall.tbl | 1 + arch/m68k/kernel/syscalls/syscall.tbl | 1 + arch/microblaze/kernel/syscalls/syscall.tbl | 1 + arch/mips/kernel/syscalls/syscall_n32.tbl | 1 + arch/mips/kernel/syscalls/syscall_n64.tbl | 1 + arch/mips/kernel/syscalls/syscall_o32.tbl | 1 + arch/parisc/kernel/syscalls/syscall.tbl | 1 + arch/powerpc/kernel/syscalls/syscall.tbl | 1 + arch/s390/kernel/syscalls/syscall.tbl | 1 + arch/sh/kernel/syscalls/syscall.tbl | 1 + arch/sparc/kernel/syscalls/syscall.tbl | 1 + arch/x86/entry/syscalls/syscall_32.tbl | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 1 + arch/xtensa/kernel/syscalls/syscall.tbl | 1 + include/uapi/asm-generic/unistd.h | 4 +++- kernel/sys_ni.c | 1 + 17 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/arch/alpha/kernel/syscalls/syscall.tbl b/arch/alpha/kernel/syscalls/syscall.tbl index d0cb7b902cc6..b4a42beda6db 100644 --- a/arch/alpha/kernel/syscalls/syscall.tbl +++ b/arch/alpha/kernel/syscalls/syscall.tbl @@ -510,3 +510,4 @@ 578 common file_getattr sys_file_getattr 579 common file_setattr sys_file_setattr 580 common set_robust_list2 sys_set_robust_list2 +581 common get_robust_list2 sys_get_robust_list2 diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl index 910e6e14ccf0..d4a4d8446cb0 100644 --- a/arch/arm/tools/syscall.tbl +++ b/arch/arm/tools/syscall.tbl @@ -485,3 +485,4 @@ 468 common file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 +471 common get_robust_list2 sys_get_robust_list2 diff --git a/arch/m68k/kernel/syscalls/syscall.tbl b/arch/m68k/kernel/syscalls/syscall.tbl index eee3f320483d..c2f1c5a3313c 100644 --- a/arch/m68k/kernel/syscalls/syscall.tbl +++ b/arch/m68k/kernel/syscalls/syscall.tbl @@ -470,3 +470,4 @@ 468 common file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 +471 common get_robust_list2 sys_get_robust_list2 diff --git a/arch/microblaze/kernel/syscalls/syscall.tbl b/arch/microblaze/kernel/syscalls/syscall.tbl index 6c69d8ebbc38..1389dd194eec 100644 --- a/arch/microblaze/kernel/syscalls/syscall.tbl +++ b/arch/microblaze/kernel/syscalls/syscall.tbl @@ -476,3 +476,4 @@ 468 common file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 +471 common get_robust_list2 sys_get_robust_list2 diff --git a/arch/mips/kernel/syscalls/syscall_n32.tbl b/arch/mips/kernel/syscalls/syscall_n32.tbl index f70db3741b0e..e149d2ddbc2f 100644 --- a/arch/mips/kernel/syscalls/syscall_n32.tbl +++ b/arch/mips/kernel/syscalls/syscall_n32.tbl @@ -409,3 +409,4 @@ 468 n32 file_getattr sys_file_getattr 469 n32 file_setattr sys_file_setattr 470 n32 set_robust_list2 sys_set_robust_list2 +471 n32 get_robust_list2 sys_get_robust_list2 diff --git a/arch/mips/kernel/syscalls/syscall_n64.tbl b/arch/mips/kernel/syscalls/syscall_n64.tbl index 9480488f9495..7ddddc89a751 100644 --- a/arch/mips/kernel/syscalls/syscall_n64.tbl +++ b/arch/mips/kernel/syscalls/syscall_n64.tbl @@ -385,3 +385,4 @@ 468 n64 file_getattr sys_file_getattr 469 n64 file_setattr sys_file_setattr 470 n64 set_robust_list2 sys_set_robust_list2 +471 n64 get_robust_list2 sys_get_robust_list2 diff --git a/arch/mips/kernel/syscalls/syscall_o32.tbl b/arch/mips/kernel/syscalls/syscall_o32.tbl index 2761c9cd8946..c0a5ebafed1a 100644 --- a/arch/mips/kernel/syscalls/syscall_o32.tbl +++ b/arch/mips/kernel/syscalls/syscall_o32.tbl @@ -458,3 +458,4 @@ 468 o32 file_getattr sys_file_getattr 469 o32 file_setattr sys_file_setattr 470 o32 set_robust_list2 sys_set_robust_list2 +471 o32 get_robust_list2 sys_get_robust_list2 diff --git a/arch/parisc/kernel/syscalls/syscall.tbl b/arch/parisc/kernel/syscalls/syscall.tbl index eb37fda5c48f..4c6cb64ec113 100644 --- a/arch/parisc/kernel/syscalls/syscall.tbl +++ b/arch/parisc/kernel/syscalls/syscall.tbl @@ -469,3 +469,4 @@ 468 common file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 +471 common get_robust_list2 sys_get_robust_list2 diff --git a/arch/powerpc/kernel/syscalls/syscall.tbl b/arch/powerpc/kernel/syscalls/syscall.tbl index 472bebec449d..1475fa6b3ee3 100644 --- a/arch/powerpc/kernel/syscalls/syscall.tbl +++ b/arch/powerpc/kernel/syscalls/syscall.tbl @@ -561,3 +561,4 @@ 468 common file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 +470 common get_robust_list2 sys_get_robust_list2 diff --git a/arch/s390/kernel/syscalls/syscall.tbl b/arch/s390/kernel/syscalls/syscall.tbl index ba7fac304941..b8161ee922ef 100644 --- a/arch/s390/kernel/syscalls/syscall.tbl +++ b/arch/s390/kernel/syscalls/syscall.tbl @@ -473,3 +473,4 @@ 468 common file_getattr sys_file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 sys_set_robust_list2 +471 common get_robust_list2 sys_get_robust_list2 sys_get_robust_list2 diff --git a/arch/sh/kernel/syscalls/syscall.tbl b/arch/sh/kernel/syscalls/syscall.tbl index c05c94a742be..566baa152634 100644 --- a/arch/sh/kernel/syscalls/syscall.tbl +++ b/arch/sh/kernel/syscalls/syscall.tbl @@ -474,3 +474,4 @@ 468 common file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 +471 common get_robust_list2 sys_get_robust_list2 diff --git a/arch/sparc/kernel/syscalls/syscall.tbl b/arch/sparc/kernel/syscalls/syscall.tbl index 3a59f3008325..fb3844c17711 100644 --- a/arch/sparc/kernel/syscalls/syscall.tbl +++ b/arch/sparc/kernel/syscalls/syscall.tbl @@ -516,3 +516,4 @@ 468 common file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 +471 common get_robust_list2 sys_get_robust_list2 diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl index e9d6e1a1d777..0df93458ef37 100644 --- a/arch/x86/entry/syscalls/syscall_32.tbl +++ b/arch/x86/entry/syscalls/syscall_32.tbl @@ -476,3 +476,4 @@ 468 i386 file_getattr sys_file_getattr 469 i386 file_setattr sys_file_setattr 470 i386 set_robust_list2 sys_set_robust_list2 +471 i386 get_robust_list2 sys_get_robust_list2 diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl index 8fdcf090300d..e7fdcc3d6e52 100644 --- a/arch/x86/entry/syscalls/syscall_64.tbl +++ b/arch/x86/entry/syscalls/syscall_64.tbl @@ -395,6 +395,7 @@ 468 common file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 +471 common get_robust_list2 sys_get_robust_list2

# # Due to a historical design error, certain syscalls are numbered differently diff --git a/arch/xtensa/kernel/syscalls/syscall.tbl b/arch/xtensa/kernel/syscalls/syscall.tbl index d7bb6b9104dd..bd63dbc78c0e 100644 --- a/arch/xtensa/kernel/syscalls/syscall.tbl +++ b/arch/xtensa/kernel/syscalls/syscall.tbl @@ -441,3 +441,4 @@ 468 common file_getattr sys_file_getattr 469 common file_setattr sys_file_setattr 470 common set_robust_list2 sys_set_robust_list2 +471 common get_robust_list2 sys_get_robust_list2 diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h index 44fc87287983..9539e893c9ac 100644 --- a/include/uapi/asm-generic/unistd.h +++ b/include/uapi/asm-generic/unistd.h @@ -860,9 +860,11 @@ __SYSCALL(__NR_file_setattr, sys_file_setattr)

#define __NR_set_robust_list2 470 __SYSCALL(__NR_set_robust_list2, sys_set_robust_list2) +#define __NR_get_robust_list2 471 +__SYSCALL(__NR_get_robust_list2, sys_get_robust_list2)

#undef __NR_syscalls -#define __NR_syscalls 471 +#define __NR_syscalls 472

/* * 32 bit systems traditionally used different diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c index 0ca2cfe69b11..0a7f7634446c 100644 --- a/kernel/sys_ni.c +++ b/kernel/sys_ni.c @@ -173,6 +173,7 @@ COND_SYSCALL(lsm_get_self_attr); COND_SYSCALL(lsm_set_self_attr); COND_SYSCALL(lsm_list_modules); COND_SYSCALL(set_robust_list2); +COND_SYSCALL(get_robust_list2);

/* CONFIG_MMU only */ COND_SYSCALL(swapon);

Reuse the same selftest for the original set_robust_list() syscall for the new set_robust_list2() syscall. Use kselftest variants feature to run the relevant tests for both interfaces. Create new test cases for checking invalid parameters, the ability to correctly set multiple lists for the same task, and to use 32-bit lists in a 64-bit task.

Signed-off-by: André Almeida andrealmeid@igalia.com --- .../selftests/futex/functional/robust_list.c | 409 +++++++++++++++++++-- 1 file changed, 387 insertions(+), 22 deletions(-)

diff --git a/tools/testing/selftests/futex/functional/robust_list.c b/tools/testing/selftests/futex/functional/robust_list.c index e7d1254e18ca..bf47e9ab2951 100644 --- a/tools/testing/selftests/futex/functional/robust_list.c +++ b/tools/testing/selftests/futex/functional/robust_list.c @@ -42,6 +42,27 @@

#define SLEEP_US 100

+#ifndef SYS_set_robust_list2 +# define SYS_set_robust_list2 470 + +enum robust_list_cmd { + FUTEX_ROBUST_LIST_CMD_SET_64, + FUTEX_ROBUST_LIST_CMD_SET_32, + FUTEX_ROBUST_LIST_CMD_LIST_LIMIT, + FUTEX_ROBUST_LIST_CMD_USER_MAX, +}; + +struct robust_list32 { + uint32_t next; +}; + +struct robust_list_head32 { + struct robust_list32 list; + int32_t futex_offset; + uint32_t list_op_pending; +}; +#endif + static pthread_barrier_t barrier, barrier2;

static int set_robust_list(struct robust_list_head *head, size_t len) @@ -54,6 +75,58 @@ static int get_robust_list(int pid, struct robust_list_head **head, size_t *len_ return syscall(SYS_get_robust_list, pid, head, len_ptr); }

+static int set_robust_list2(struct robust_list_head *head, int index, + enum robust_list_cmd cmd, unsigned int flags) +{ + return syscall(SYS_set_robust_list2, head, index, cmd, flags); +} + +static bool robust_list2_support(void) +{ + int ret = set_robust_list2(0, 0, FUTEX_ROBUST_LIST_CMD_LIST_LIMIT, 0); + + if (ret == -1 && errno == ENOSYS) + return false; + + return true; +} + +/* + * Return the set command according to the app bitness + */ +static int get_cmd_set(void) +{ + return sizeof(uintptr_t) == 8 ? FUTEX_ROBUST_LIST_CMD_SET_64 : + FUTEX_ROBUST_LIST_CMD_SET_32; +} + +FIXTURE(robust_api) {}; + +FIXTURE_VARIANT(robust_api) +{ + bool robust2; +}; + +FIXTURE_SETUP(robust_api) +{ + if (!variant->robust2) + return; + + ASSERT_NE(robust_list2_support(), false); +} + +FIXTURE_TEARDOWN(robust_api) {} + +FIXTURE_VARIANT_ADD(robust_api, robust1) +{ + .robust2 = false, +}; + +FIXTURE_VARIANT_ADD(robust_api, robust2) +{ + .robust2 = true, +}; + /* * Basic lock struct, contains just the futex word and the robust list element * Real implementations have also a *prev to easily walk in the list @@ -61,6 +134,12 @@ static int get_robust_list(int pid, struct robust_list_head **head, size_t *len_ struct lock_struct { _Atomic(unsigned int) futex; struct robust_list list; + bool robust2; +}; + +struct lock_struct32 { + _Atomic(uint32_t) futex; + struct robust_list32 list; };

/* @@ -89,20 +168,17 @@ static int create_child(int (*fn)(void *arg), void *arg) /* * Helper function to prepare and register a robust list */ -static int set_list(struct robust_list_head *head) +static int set_list(struct robust_list_head *head, bool robust2, int index) { - int ret; - - ret = set_robust_list(head, sizeof(*head)); - if (ret) - return ret; - head->futex_offset = (size_t) offsetof(struct lock_struct, futex) - (size_t) offsetof(struct lock_struct, list); head->list.next = &head->list; head->list_op_pending = NULL;

- return 0; + if (!robust2) + return set_robust_list(head, sizeof(*head)); + + return set_robust_list2(head, index, get_cmd_set(), 0); }

/* @@ -174,7 +250,7 @@ static int child_fn_lock(void *arg) struct robust_list_head head; int ret;

- ret = set_list(&head); + ret = set_list(&head, lock->robust2, 0); if (ret) { ksft_test_result_fail("set_robust_list error\n"); return ret; @@ -204,14 +280,16 @@ static int child_fn_lock(void *arg) * in the robust list and die. The parent thread will wait on this futex, and * should be waken up when the child exits. */ -TEST(test_robustness) +TEST_F(robust_api, test_robustness) { struct lock_struct lock = { .futex = 0 }; _Atomic(unsigned int) *futex = &lock.futex; - struct robust_list_head head; int ret, pid, wstatus; + struct robust_list_head head;

- ret = set_list(&head); + lock.robust2 = variant->robust2; + + ret = set_list(&head, lock.robust2, 0); ASSERT_EQ(ret, 0);

/* @@ -270,6 +348,46 @@ TEST(test_set_robust_list_invalid_size) ksft_test_result_pass("%s\n", __func__); }

+/* + * Test invalid parameters + */ +TEST(test_set_robust_list2_inval) +{ + struct robust_list_head head; + int ret, list_limit; + + if (!robust_list2_support()) { + ksft_test_result_skip("robust_list2 not supported\n"); + return; + } + + /* Bad flag */ + ret = set_robust_list2(&head, 0, get_cmd_set(), 999); + ASSERT_EQ(ret, -1); + ASSERT_EQ(errno, EINVAL); + + /* Bad index */ + list_limit = set_robust_list2(NULL, 0, FUTEX_ROBUST_LIST_CMD_LIST_LIMIT, 0); + ASSERT_GT(list_limit, 0); + + ret = set_robust_list2(&head, -1, get_cmd_set(), 0); + ASSERT_EQ(ret, -1); + ASSERT_EQ(errno, EINVAL); + + ret = set_robust_list2(&head, list_limit + 1, get_cmd_set(), 0); + ASSERT_EQ(ret, -1); + ASSERT_EQ(errno, EINVAL); + + /* Bad command */ + ret = set_robust_list2(&head, 0, FUTEX_ROBUST_LIST_CMD_USER_MAX, 0); + ASSERT_EQ(ret, -1); + ASSERT_EQ(errno, EINVAL); + + ret = set_robust_list2(&head, 0, -1, 0); + ASSERT_EQ(ret, -1); + ASSERT_EQ(errno, EINVAL); +} + /* * Test get_robust_list with pid = 0, getting the list of the running thread */ @@ -363,7 +481,7 @@ static int child_fn_lock_with_error(void *arg) struct robust_list_head head; int ret;

- ret = set_list(&head); + ret = set_list(&head, false, 0); if (ret) { ksft_test_result_fail("set_robust_list error\n"); return -1; @@ -388,14 +506,16 @@ static int child_fn_lock_with_error(void *arg) * earlier, just after setting list_op_pending and taking the lock, to test the * list_op_pending mechanism */ -TEST(test_set_list_op_pending) +TEST_F(robust_api, test_set_list_op_pending) { struct lock_struct lock = { .futex = 0 }; _Atomic(unsigned int) *futex = &lock.futex; - struct robust_list_head head; int ret, wstatus; + struct robust_list_head head; + + lock.robust2 = variant->robust2;

- ret = set_list(&head); + ret = set_list(&head, lock.robust2, 0); ASSERT_EQ(ret, 0);

ret = pthread_barrier_init(&barrier, NULL, 2); @@ -429,7 +549,7 @@ static int child_lock_holder(void *arg) struct robust_list_head head; int i;

- set_list(&head); + set_list(&head, locks[0].robust2, 0);

for (i = 0; i < CHILD_NR; i++) { locks[i].futex = 0; @@ -471,12 +591,19 @@ static int child_wait_lock(void *arg) * Test a robust list of more than one element. All the waiters should wake when * the holder dies */ -TEST(test_robust_list_multiple_elements) +TEST_F(robust_api, test_robust_list_multiple_elements) { struct lock_struct locks[CHILD_NR]; pid_t pids[CHILD_NR + 1]; int i, ret, wstatus;

+ if (!robust_list2_support()) { + ksft_test_result_skip("robust_list2 not supported\n"); + return; + } + + locks[0].robust2 = variant->robust2; + ret = pthread_barrier_init(&barrier, NULL, 2); ASSERT_EQ(ret, 0); ret = pthread_barrier_init(&barrier2, NULL, CHILD_NR + 1); @@ -507,13 +634,98 @@ TEST(test_robust_list_multiple_elements) ksft_test_result_pass("%s\n", __func__); }

+static int child_lock_holder_multiple_lists(void *arg) +{ + struct lock_struct *locks = arg; + struct robust_list_head *heads; + int i, list_limit; + + list_limit = set_robust_list2(NULL, 0, FUTEX_ROBUST_LIST_CMD_LIST_LIMIT, 0); + + heads = malloc(list_limit * sizeof(*heads)); + if (!heads) + return -1; + + for (i = 0; i < list_limit; i++) { + set_list(&heads[i], true, i); + locks[i].futex = 0; + mutex_lock(&locks[i], &heads[i], false); + } + + pthread_barrier_wait(&barrier); + pthread_barrier_wait(&barrier2); + + /* See comment at child_fn_lock() */ + usleep(SLEEP_US); + + return 0; +} + +/* + * Similar to test_robust_list_multiple_elements, but instead of one list with + * several elements, create several lists with one element. + */ +TEST(test_robust_list_multiple_lists) +{ + int i, ret, wstatus, list_limit; + struct lock_struct *locks; + pid_t *pids; + + if (!robust_list2_support()) { + ksft_test_result_skip("robust_list2 not supported\n"); + return; + } + + list_limit = set_robust_list2(NULL, 0, FUTEX_ROBUST_LIST_CMD_LIST_LIMIT, 0); + ASSERT_GT(list_limit, 1); + + locks = malloc(list_limit * sizeof(*locks)); + ASSERT_NE(locks, NULL); + + pids = malloc(list_limit * sizeof(*pids)); + ASSERT_NE(pids, NULL); + + ret = pthread_barrier_init(&barrier, NULL, 2); + ASSERT_EQ(ret, 0); + ret = pthread_barrier_init(&barrier2, NULL, list_limit + 1); + ASSERT_EQ(ret, 0); + + pids[0] = create_child(&child_lock_holder_multiple_lists, locks); + + /* Wait until the locker thread takes the look */ + pthread_barrier_wait(&barrier); + + for (i = 0; i < list_limit; i++) + pids[i+1] = create_child(&child_wait_lock, &locks[i]); + + /* Wait for all children to return */ + ret = 0; + + for (i = 0; i < list_limit; i++) { + waitpid(pids[i], &wstatus, 0); + if (WEXITSTATUS(wstatus)) + ret = -1; + } + + pthread_barrier_destroy(&barrier); + pthread_barrier_destroy(&barrier2); + + /* Pass only if the child hasn't return error */ + if (!ret) + ksft_test_result_pass("%s\n", __func__); + + free(locks); + free(pids); +} + static int child_circular_list(void *arg) { - static struct robust_list_head head; + struct robust_list_head head; struct lock_struct a, b, c; + bool robust2 = *(bool *) arg; int ret;

- ret = set_list(&head); + ret = set_list(&head, robust2, 0); if (ret) { ksft_test_result_fail("set_list error\n"); return -1; @@ -536,11 +748,12 @@ static int child_circular_list(void *arg) * while processing it so it won't be trapped in an infinite loop while handling * a process exit */ -TEST(test_circular_list) +TEST_F(robust_api, test_circular_list) { int wstatus; + bool robust2 = variant->robust2;

- create_child(child_circular_list, NULL); + create_child(child_circular_list, &robust2);

wait(&wstatus);

@@ -549,4 +762,156 @@ TEST(test_circular_list) ksft_test_result_pass("%s\n", __func__); }

+/* + * 32-bit version of child_lock_holder. + */ +static int child_lock_holder32(void *arg) +{ + struct lock_struct32 *locks = arg; + struct robust_list_head32 *head; + pid_t tid = gettid(); + int i, ret; + + head = mmap((void *)0x10000, sizeof(*head), PROT_READ | PROT_WRITE, + MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + + if (!head || ((uint32_t)(uintptr_t) head) > 0x7FFFFFFF) { + ksft_test_result_fail("child_lock_holder32 error\n"); + return -1; + } + + head->futex_offset = (uint32_t) ((size_t) offsetof(struct lock_struct32, futex) - + (size_t) offsetof(struct lock_struct32, list)); + head->list.next = (uint32_t)(uintptr_t) &head->list; + head->list_op_pending = (uint32_t)(uintptr_t) NULL; + + ret = set_robust_list2((struct robust_list_head *) head, 0, + FUTEX_ROBUST_LIST_CMD_SET_32, 0); + if (ret) { + ksft_test_result_fail("set_robust_list2 error\n"); + return -1; + } + + /* + * Take all the locks and insert them in the list + */ + for (i = 0; i < CHILD_NR; i++) { + struct robust_list32 *list = &head->list; + + locks[i].futex = tid; + + while (list->next != (uint32_t)(uintptr_t) &head->list) + list = (struct robust_list32 *)(uintptr_t) list->next; + + list->next = (uint32_t)(uintptr_t) &locks[i].list; + locks[i].list.next = (uint32_t)(uintptr_t) &head->list; + } + + pthread_barrier_wait(&barrier); + pthread_barrier_wait(&barrier2); + + /* See comment at child_fn_lock() */ + usleep(SLEEP_US); + + /* Exit holding all the locks */ + return 0; +} + +static int child_wait_lock32(void *arg) +{ + struct lock_struct32 *lock = arg; + _Atomic(unsigned int) *futex; + struct timespec to; + pid_t tid; + int ret; + + futex = &lock->futex; + + pthread_barrier_wait(&barrier2); + + to.tv_sec = FUTEX_TIMEOUT; + to.tv_nsec = 0; + + tid = atomic_load(futex); + + /* Kernel ignores futexes without the waiters flag */ + tid |= FUTEX_WAITERS; + atomic_store(futex, tid); + + ret = futex_wait((futex_t *) futex, tid, &to, 0); + + if (ret) { + ksft_test_result_fail("futex_wait error\n"); + return -1; + } + + if (!(lock->futex & FUTEX_OWNER_DIED)) { + ksft_test_result_fail("futex not marked with FUTEX_OWNER_DIED\n"); + return -1; + } + + return 0; +} + +/* + * Test to create a 32-bit robust list in a 64-bit kernel. Replicate + * test_robust_list_multiple_elements, but it's simplified: don't do all the + * mutex lock dance, just insert futexes in the list and check if the kernel + * correctly walks the list and wake the threads + */ +TEST(test_32bit_lists) +{ + struct lock_struct32 *locks; + pid_t pids[CHILD_NR + 1]; + int i, ret, wstatus; + + if (sizeof(uintptr_t) != 8) { + ksft_test_result_skip("Test only for 64-bit\n"); + return; + } + + if (!robust_list2_support()) { + ksft_test_result_skip("robust_list2 not supported\n"); + return; + } + + locks = mmap((void *)0x20000, sizeof(*locks) * CHILD_NR, + PROT_READ | PROT_WRITE, MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_ANONYMOUS, + -1, 0); + + ASSERT_NE(locks, NULL); + ASSERT_LT((uintptr_t) locks, 0x7FFFFFFF); + + ret = pthread_barrier_init(&barrier, NULL, 2); + ASSERT_EQ(ret, 0); + ret = pthread_barrier_init(&barrier2, NULL, CHILD_NR + 1); + ASSERT_EQ(ret, 0); + + pids[0] = create_child(&child_lock_holder32, locks); + + /* Wait until the locker thread takes the look */ + pthread_barrier_wait(&barrier); + + for (i = 0; i < CHILD_NR; i++) + pids[i+1] = create_child(&child_wait_lock32, &locks[i]); + + /* Wait for all children to return */ + ret = 0; + + for (i = 0; i < CHILD_NR; i++) { + waitpid(pids[i], &wstatus, 0); + if (WEXITSTATUS(wstatus)) + ret = -1; + } + + pthread_barrier_destroy(&barrier); + pthread_barrier_destroy(&barrier2); + + /* Pass only if the child hasn't return error */ + if (!ret) + ksft_test_result_pass("%s\n", __func__); + + munmap(locks, sizeof(*locks) * CHILD_NR); +} + TEST_HARNESS_MAIN

The new robust list API internals can handle any kind of robust list, so to simplify the code, reuse the same mechanisms for the original API and when calling the original set syscall, set the head in the array of lists. The first two indexes of the array of robust lists are reserved for the original API lists, the native robust list and the compat robust list.

Signed-off-by: André Almeida andrealmeid@igalia.com --- include/linux/futex.h | 4 ---- include/linux/sched.h | 5 ----- kernel/futex/core.c | 12 ------------ kernel/futex/syscalls.c | 52 ++++++++++++++++++++++++------------------------- 4 files changed, 25 insertions(+), 48 deletions(-)

diff --git a/include/linux/futex.h b/include/linux/futex.h index 3dba249bcd32..ce27f6307c60 100644 --- a/include/linux/futex.h +++ b/include/linux/futex.h @@ -87,10 +87,6 @@ static inline bool futex_in_32bit_syscall(void)

static inline void futex_init_task(struct task_struct *tsk) { - tsk->robust_list = NULL; -#ifdef CONFIG_COMPAT - tsk->robust_list32 = NULL; -#endif tsk->futex_robust_lists = NULL; INIT_LIST_HEAD(&tsk->pi_state_list); tsk->pi_state_cache = NULL; diff --git a/include/linux/sched.h b/include/linux/sched.h index de2f3cbe4953..e0f28e7f0a2d 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -75,7 +75,6 @@ struct pid_namespace; struct pipe_inode_info; struct rcu_node; struct reclaim_state; -struct robust_list_head; struct root_domain; struct rq; struct sched_attr; @@ -1330,11 +1329,7 @@ struct task_struct { u32 rmid; #endif #ifdef CONFIG_FUTEX - struct robust_list_head __user *robust_list; uintptr_t *futex_robust_lists; -#ifdef CONFIG_COMPAT - struct robust_list_head32 __user *robust_list32; -#endif struct list_head pi_state_list; struct futex_pi_state *pi_state_cache; struct mutex futex_exit_mutex; diff --git a/kernel/futex/core.c b/kernel/futex/core.c index 14d8a7176367..f91df175033d 100644 --- a/kernel/futex/core.c +++ b/kernel/futex/core.c @@ -1500,18 +1500,6 @@ static void exit_robust_lists(struct task_struct *tsk)

static void futex_cleanup(struct task_struct *tsk) { - if (unlikely(tsk->robust_list)) { - exit_robust_list(tsk, tsk->robust_list); - tsk->robust_list = NULL; - } - -#ifdef CONFIG_64BIT - if (unlikely(tsk->robust_list32)) { - exit_robust_list32(tsk, tsk->robust_list32); - tsk->robust_list32 = NULL; - } -#endif - if (unlikely(tsk->futex_robust_lists)) exit_robust_lists(tsk);

diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c index f730d16632fc..2a44791db37a 100644 --- a/kernel/futex/syscalls.c +++ b/kernel/futex/syscalls.c @@ -28,32 +28,29 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head, size_t, len) { + enum robust_list2_cmd cmd; /* * The kernel knows only one size for now: */ if (unlikely(len != sizeof(*head))) return -EINVAL;

- current->robust_list = head; + cmd = IS_ENABLED(CONFIG_64BIT) ? FUTEX_ROBUST_LIST_CMD_SET_64 : + FUTEX_ROBUST_LIST_CMD_SET_32;

- return 0; + return futex_robust_list_set((uintptr_t) head, cmd, + FUTEX_ROBUST_LIST_NATIVE_IDX); }

-static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat) -{ -#ifdef CONFIG_COMPAT - if (compat) - return p->robust_list32; -#endif - return p->robust_list; -} - -static void __user *futex_get_robust_list_common(int pid, bool compat, int index) +static void __user *futex_get_robust_list_common(int pid, unsigned int index) { struct task_struct *p = current; void __user *head; int ret;

+ if (index >= FUTEX_ROBUST_LIST2_MAX_IDX) + return (void __user *)ERR_PTR(-EINVAL); + scoped_guard(rcu) { if (pid) { p = find_task_by_vpid(pid); @@ -75,14 +72,10 @@ static void __user *futex_get_robust_list_common(int pid, bool compat, int index if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) goto err_unlock;

- if (index >= 0) { - scoped_guard(mutex, &p->futex_exit_mutex) { - uintptr_t *rl = p->futex_robust_lists; + scoped_guard(mutex, &p->futex_exit_mutex) { + uintptr_t *rl = p->futex_robust_lists;

- head = rl ? (void __user *) rl[index] : NULL; - } - } else { - head = futex_task_robust_list(p, compat); + head = rl ? (void __user *) rl[index] : NULL; }

up_read(&p->signal->exec_update_lock); @@ -107,7 +100,11 @@ SYSCALL_DEFINE3(get_robust_list, int, pid, struct robust_list_head __user * __user *, head_ptr, size_t __user *, len_ptr) { - struct robust_list_head __user *head = futex_get_robust_list_common(pid, false, -1); + struct robust_list_head __user *head = + futex_get_robust_list_common(pid, FUTEX_ROBUST_LIST_NATIVE_IDX); + + head = (struct robust_list_head __user *) + ((uintptr_t) head & FUTEX_ROBUST_LIST_ENTRY_MASK);

if (IS_ERR(head)) return PTR_ERR(head); @@ -180,7 +177,7 @@ SYSCALL_DEFINE4(get_robust_list2, int, pid, */ index += FUTEX_ROBUST_LIST2_IDX;

- entry_ptr = futex_get_robust_list_common(pid, false, index); + entry_ptr = futex_get_robust_list_common(pid, index); if (IS_ERR(entry_ptr)) return PTR_ERR(entry_ptr);

@@ -568,22 +565,23 @@ COMPAT_SYSCALL_DEFINE2(set_robust_list, if (unlikely(len != sizeof(*head))) return -EINVAL;

- current->robust_list32 = head; - - return 0; + return futex_robust_list_set((uintptr_t) head, FUTEX_ROBUST_LIST_CMD_SET_32, + FUTEX_ROBUST_LIST_COMPAT_IDX); }

COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, compat_uptr_t __user *, head_ptr, compat_size_t __user *, len_ptr) { - struct robust_list_head32 __user *head = futex_get_robust_list_common(pid, true, -1); + struct robust_list_head32 __user *head = + futex_get_robust_list_common(pid, FUTEX_ROBUST_LIST_COMPAT_IDX);

- if (IS_ERR(head)) - return PTR_ERR(head); + head = (struct robust_list_head32 __user *) + ((uintptr_t) head & FUTEX_ROBUST_LIST_ENTRY_MASK);

if (put_user(sizeof(*head), len_ptr)) return -EFAULT; + return put_user(ptr_to_compat(head), head_ptr); } #endif /* CONFIG_COMPAT */

Hi André,

kernel test robot noticed the following build warnings:

[auto build test WARNING on c42ba5a87bdccbca11403b7ca8bad1a57b833732]

url: https://github.com/intel-lab-lkp/linux/commits/Andr-Almeida/futex-Use-explic... base: c42ba5a87bdccbca11403b7ca8bad1a57b833732 patch link: https://lore.kernel.org/r/20251122-tonyk-robust_futex-v6-4-05fea005a0fd%40ig... patch subject: [PATCH v6 4/9] futex: Create get_robust_list2() syscall config: i386-randconfig-063-20251123 (https://download.01.org/0day-ci/archive/20251123/202511231423.O6KdcL8r-lkp@i...) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251123/202511231423.O6KdcL8r-lkp@i...)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot lkp@intel.com | Closes: https://lore.kernel.org/oe-kbuild-all/202511231423.O6KdcL8r-lkp@intel.com/

sparse warnings: (new ones prefixed by >>)

...

kernel/futex/syscalls.c:200:22: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct robust_list_head *head @@ got struct robust_list_head [noderef] __user * @@

kernel/futex/syscalls.c:200:22: sparse: expected struct robust_list_head *head kernel/futex/syscalls.c:200:22: sparse: got struct robust_list_head [noderef] __user *

...

kernel/futex/syscalls.c:202:24: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __user *__x @@ got struct robust_list_head *head @@

kernel/futex/syscalls.c:202:24: sparse: expected void [noderef] __user *__x kernel/futex/syscalls.c:202:24: sparse: got struct robust_list_head *head

vim +200 kernel/futex/syscalls.c

160 161 SYSCALL_DEFINE4(get_robust_list2, int, pid, 162 void __user * __user *, head_ptr, 163 unsigned int, index, unsigned int, flags) 164 { 165 void __user *entry_ptr; 166 uintptr_t entry; 167 168 if (index >= FUTEX_ROBUST_LISTS_PER_USER) 169 return -EINVAL; 170 171 if (flags) 172 return -EINVAL; 173 174 /* 175 * The first two indexes are reserved for the kernel to be used with the 176 * legacy syscall, so we hide them from userspace. 177 * 178 * We map [0, FUTEX_ROBUST_LISTS_PER_USER) to 179 * [FUTEX_ROBUST_LIST2_IDX, FUTEX_ROBUST_LIST2_MAX_IDX) 180 */ 181 index += FUTEX_ROBUST_LIST2_IDX; 182 183 entry_ptr = futex_get_robust_list_common(pid, false, index); 184 if (IS_ERR(entry_ptr)) 185 return PTR_ERR(entry_ptr); 186 187 entry = (uintptr_t) entry_ptr; 188 189 if (entry & FUTEX_ROBUST_LIST_ENTRY_32BIT) { 190 entry &= FUTEX_ROBUST_LIST_ENTRY_MASK; 191 192 if (copy_to_user(head_ptr, &entry, sizeof(u32))) 193 return -EFAULT; 194 195 return 0; 196 } else { 197 struct robust_list_head *head; 198 199 entry &= FUTEX_ROBUST_LIST_ENTRY_MASK;

200 head = (__force struct robust_list_head __user *)entry;

201

202 return put_user(head, head_ptr);

203 } 204 } 205