timerfd.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * fs/timerfd.c
  4. *
  5. * Copyright (C) 2007 Davide Libenzi <davidel@xmailserver.org>
  6. *
  7. *
  8. * Thanks to Thomas Gleixner for code reviews and useful comments.
  9. *
  10. */
  11. #include <linux/alarmtimer.h>
  12. #include <linux/file.h>
  13. #include <linux/poll.h>
  14. #include <linux/init.h>
  15. #include <linux/fs.h>
  16. #include <linux/sched.h>
  17. #include <linux/kernel.h>
  18. #include <linux/slab.h>
  19. #include <linux/list.h>
  20. #include <linux/spinlock.h>
  21. #include <linux/time.h>
  22. #include <linux/hrtimer.h>
  23. #include <linux/anon_inodes.h>
  24. #include <linux/timerfd.h>
  25. #include <linux/syscalls.h>
  26. #include <linux/compat.h>
  27. #include <linux/rcupdate.h>
  28. #include <linux/time_namespace.h>
  29. #include <trace/hooks/fs.h>
  30. struct timerfd_ctx {
  31. union {
  32. struct hrtimer tmr;
  33. struct alarm alarm;
  34. } t;
  35. ktime_t tintv;
  36. ktime_t moffs;
  37. wait_queue_head_t wqh;
  38. u64 ticks;
  39. int clockid;
  40. short unsigned expired;
  41. short unsigned settime_flags; /* to show in fdinfo */
  42. struct rcu_head rcu;
  43. struct list_head clist;
  44. spinlock_t cancel_lock;
  45. bool might_cancel;
  46. };
  47. static LIST_HEAD(cancel_list);
  48. static DEFINE_SPINLOCK(cancel_lock);
  49. static inline bool isalarm(struct timerfd_ctx *ctx)
  50. {
  51. return ctx->clockid == CLOCK_REALTIME_ALARM ||
  52. ctx->clockid == CLOCK_BOOTTIME_ALARM;
  53. }
  54. /*
  55. * This gets called when the timer event triggers. We set the "expired"
  56. * flag, but we do not re-arm the timer (in case it's necessary,
  57. * tintv != 0) until the timer is accessed.
  58. */
  59. static void timerfd_triggered(struct timerfd_ctx *ctx)
  60. {
  61. unsigned long flags;
  62. spin_lock_irqsave(&ctx->wqh.lock, flags);
  63. ctx->expired = 1;
  64. ctx->ticks++;
  65. wake_up_locked_poll(&ctx->wqh, EPOLLIN);
  66. spin_unlock_irqrestore(&ctx->wqh.lock, flags);
  67. }
  68. static enum hrtimer_restart timerfd_tmrproc(struct hrtimer *htmr)
  69. {
  70. struct timerfd_ctx *ctx = container_of(htmr, struct timerfd_ctx,
  71. t.tmr);
  72. timerfd_triggered(ctx);
  73. return HRTIMER_NORESTART;
  74. }
  75. static enum alarmtimer_restart timerfd_alarmproc(struct alarm *alarm,
  76. ktime_t now)
  77. {
  78. struct timerfd_ctx *ctx = container_of(alarm, struct timerfd_ctx,
  79. t.alarm);
  80. timerfd_triggered(ctx);
  81. return ALARMTIMER_NORESTART;
  82. }
  83. /*
  84. * Called when the clock was set to cancel the timers in the cancel
  85. * list. This will wake up processes waiting on these timers. The
  86. * wake-up requires ctx->ticks to be non zero, therefore we increment
  87. * it before calling wake_up_locked().
  88. */
  89. void timerfd_clock_was_set(void)
  90. {
  91. ktime_t moffs = ktime_mono_to_real(0);
  92. struct timerfd_ctx *ctx;
  93. unsigned long flags;
  94. rcu_read_lock();
  95. list_for_each_entry_rcu(ctx, &cancel_list, clist) {
  96. if (!ctx->might_cancel)
  97. continue;
  98. spin_lock_irqsave(&ctx->wqh.lock, flags);
  99. if (ctx->moffs != moffs) {
  100. ctx->moffs = KTIME_MAX;
  101. ctx->ticks++;
  102. wake_up_locked_poll(&ctx->wqh, EPOLLIN);
  103. }
  104. spin_unlock_irqrestore(&ctx->wqh.lock, flags);
  105. }
  106. rcu_read_unlock();
  107. }
  108. static void __timerfd_remove_cancel(struct timerfd_ctx *ctx)
  109. {
  110. if (ctx->might_cancel) {
  111. ctx->might_cancel = false;
  112. spin_lock(&cancel_lock);
  113. list_del_rcu(&ctx->clist);
  114. spin_unlock(&cancel_lock);
  115. }
  116. }
  117. static void timerfd_remove_cancel(struct timerfd_ctx *ctx)
  118. {
  119. spin_lock(&ctx->cancel_lock);
  120. __timerfd_remove_cancel(ctx);
  121. spin_unlock(&ctx->cancel_lock);
  122. }
  123. static bool timerfd_canceled(struct timerfd_ctx *ctx)
  124. {
  125. if (!ctx->might_cancel || ctx->moffs != KTIME_MAX)
  126. return false;
  127. ctx->moffs = ktime_mono_to_real(0);
  128. return true;
  129. }
  130. static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags)
  131. {
  132. spin_lock(&ctx->cancel_lock);
  133. if ((ctx->clockid == CLOCK_REALTIME ||
  134. ctx->clockid == CLOCK_REALTIME_ALARM) &&
  135. (flags & TFD_TIMER_ABSTIME) && (flags & TFD_TIMER_CANCEL_ON_SET)) {
  136. if (!ctx->might_cancel) {
  137. ctx->might_cancel = true;
  138. spin_lock(&cancel_lock);
  139. list_add_rcu(&ctx->clist, &cancel_list);
  140. spin_unlock(&cancel_lock);
  141. }
  142. } else {
  143. __timerfd_remove_cancel(ctx);
  144. }
  145. spin_unlock(&ctx->cancel_lock);
  146. }
  147. static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx)
  148. {
  149. ktime_t remaining;
  150. if (isalarm(ctx))
  151. remaining = alarm_expires_remaining(&ctx->t.alarm);
  152. else
  153. remaining = hrtimer_expires_remaining_adjusted(&ctx->t.tmr);
  154. return remaining < 0 ? 0: remaining;
  155. }
  156. static int timerfd_setup(struct timerfd_ctx *ctx, int flags,
  157. const struct itimerspec64 *ktmr)
  158. {
  159. enum hrtimer_mode htmode;
  160. ktime_t texp;
  161. int clockid = ctx->clockid;
  162. htmode = (flags & TFD_TIMER_ABSTIME) ?
  163. HRTIMER_MODE_ABS: HRTIMER_MODE_REL;
  164. texp = timespec64_to_ktime(ktmr->it_value);
  165. ctx->expired = 0;
  166. ctx->ticks = 0;
  167. ctx->tintv = timespec64_to_ktime(ktmr->it_interval);
  168. if (isalarm(ctx)) {
  169. alarm_init(&ctx->t.alarm,
  170. ctx->clockid == CLOCK_REALTIME_ALARM ?
  171. ALARM_REALTIME : ALARM_BOOTTIME,
  172. timerfd_alarmproc);
  173. } else {
  174. hrtimer_init(&ctx->t.tmr, clockid, htmode);
  175. hrtimer_set_expires(&ctx->t.tmr, texp);
  176. ctx->t.tmr.function = timerfd_tmrproc;
  177. }
  178. if (texp != 0) {
  179. if (flags & TFD_TIMER_ABSTIME)
  180. texp = timens_ktime_to_host(clockid, texp);
  181. if (isalarm(ctx)) {
  182. if (flags & TFD_TIMER_ABSTIME)
  183. alarm_start(&ctx->t.alarm, texp);
  184. else
  185. alarm_start_relative(&ctx->t.alarm, texp);
  186. } else {
  187. hrtimer_start(&ctx->t.tmr, texp, htmode);
  188. }
  189. if (timerfd_canceled(ctx))
  190. return -ECANCELED;
  191. }
  192. ctx->settime_flags = flags & TFD_SETTIME_FLAGS;
  193. return 0;
  194. }
  195. static int timerfd_release(struct inode *inode, struct file *file)
  196. {
  197. struct timerfd_ctx *ctx = file->private_data;
  198. timerfd_remove_cancel(ctx);
  199. if (isalarm(ctx))
  200. alarm_cancel(&ctx->t.alarm);
  201. else
  202. hrtimer_cancel(&ctx->t.tmr);
  203. kfree_rcu(ctx, rcu);
  204. return 0;
  205. }
  206. static __poll_t timerfd_poll(struct file *file, poll_table *wait)
  207. {
  208. struct timerfd_ctx *ctx = file->private_data;
  209. __poll_t events = 0;
  210. unsigned long flags;
  211. poll_wait(file, &ctx->wqh, wait);
  212. spin_lock_irqsave(&ctx->wqh.lock, flags);
  213. if (ctx->ticks)
  214. events |= EPOLLIN;
  215. spin_unlock_irqrestore(&ctx->wqh.lock, flags);
  216. return events;
  217. }
  218. static ssize_t timerfd_read(struct file *file, char __user *buf, size_t count,
  219. loff_t *ppos)
  220. {
  221. struct timerfd_ctx *ctx = file->private_data;
  222. ssize_t res;
  223. u64 ticks = 0;
  224. if (count < sizeof(ticks))
  225. return -EINVAL;
  226. spin_lock_irq(&ctx->wqh.lock);
  227. if (file->f_flags & O_NONBLOCK)
  228. res = -EAGAIN;
  229. else
  230. res = wait_event_interruptible_locked_irq(ctx->wqh, ctx->ticks);
  231. /*
  232. * If clock has changed, we do not care about the
  233. * ticks and we do not rearm the timer. Userspace must
  234. * reevaluate anyway.
  235. */
  236. if (timerfd_canceled(ctx)) {
  237. ctx->ticks = 0;
  238. ctx->expired = 0;
  239. res = -ECANCELED;
  240. }
  241. if (ctx->ticks) {
  242. ticks = ctx->ticks;
  243. if (ctx->expired && ctx->tintv) {
  244. /*
  245. * If tintv != 0, this is a periodic timer that
  246. * needs to be re-armed. We avoid doing it in the timer
  247. * callback to avoid DoS attacks specifying a very
  248. * short timer period.
  249. */
  250. if (isalarm(ctx)) {
  251. ticks += alarm_forward_now(
  252. &ctx->t.alarm, ctx->tintv) - 1;
  253. alarm_restart(&ctx->t.alarm);
  254. } else {
  255. ticks += hrtimer_forward_now(&ctx->t.tmr,
  256. ctx->tintv) - 1;
  257. hrtimer_restart(&ctx->t.tmr);
  258. }
  259. }
  260. ctx->expired = 0;
  261. ctx->ticks = 0;
  262. }
  263. spin_unlock_irq(&ctx->wqh.lock);
  264. if (ticks)
  265. res = put_user(ticks, (u64 __user *) buf) ? -EFAULT: sizeof(ticks);
  266. return res;
  267. }
  268. #ifdef CONFIG_PROC_FS
  269. static void timerfd_show(struct seq_file *m, struct file *file)
  270. {
  271. struct timerfd_ctx *ctx = file->private_data;
  272. struct timespec64 value, interval;
  273. spin_lock_irq(&ctx->wqh.lock);
  274. value = ktime_to_timespec64(timerfd_get_remaining(ctx));
  275. interval = ktime_to_timespec64(ctx->tintv);
  276. spin_unlock_irq(&ctx->wqh.lock);
  277. seq_printf(m,
  278. "clockid: %d\n"
  279. "ticks: %llu\n"
  280. "settime flags: 0%o\n"
  281. "it_value: (%llu, %llu)\n"
  282. "it_interval: (%llu, %llu)\n",
  283. ctx->clockid,
  284. (unsigned long long)ctx->ticks,
  285. ctx->settime_flags,
  286. (unsigned long long)value.tv_sec,
  287. (unsigned long long)value.tv_nsec,
  288. (unsigned long long)interval.tv_sec,
  289. (unsigned long long)interval.tv_nsec);
  290. }
  291. #else
  292. #define timerfd_show NULL
  293. #endif
  294. #ifdef CONFIG_CHECKPOINT_RESTORE
  295. static long timerfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
  296. {
  297. struct timerfd_ctx *ctx = file->private_data;
  298. int ret = 0;
  299. switch (cmd) {
  300. case TFD_IOC_SET_TICKS: {
  301. u64 ticks;
  302. if (copy_from_user(&ticks, (u64 __user *)arg, sizeof(ticks)))
  303. return -EFAULT;
  304. if (!ticks)
  305. return -EINVAL;
  306. spin_lock_irq(&ctx->wqh.lock);
  307. if (!timerfd_canceled(ctx)) {
  308. ctx->ticks = ticks;
  309. wake_up_locked_poll(&ctx->wqh, EPOLLIN);
  310. } else
  311. ret = -ECANCELED;
  312. spin_unlock_irq(&ctx->wqh.lock);
  313. break;
  314. }
  315. default:
  316. ret = -ENOTTY;
  317. break;
  318. }
  319. return ret;
  320. }
  321. #else
  322. #define timerfd_ioctl NULL
  323. #endif
  324. static const struct file_operations timerfd_fops = {
  325. .release = timerfd_release,
  326. .poll = timerfd_poll,
  327. .read = timerfd_read,
  328. .llseek = noop_llseek,
  329. .show_fdinfo = timerfd_show,
  330. .unlocked_ioctl = timerfd_ioctl,
  331. };
  332. static int timerfd_fget(int fd, struct fd *p)
  333. {
  334. struct fd f = fdget(fd);
  335. if (!f.file)
  336. return -EBADF;
  337. if (f.file->f_op != &timerfd_fops) {
  338. fdput(f);
  339. return -EINVAL;
  340. }
  341. *p = f;
  342. return 0;
  343. }
  344. SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
  345. {
  346. int ufd;
  347. struct timerfd_ctx *ctx;
  348. char file_name_buf[32];
  349. /* Check the TFD_* constants for consistency. */
  350. BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
  351. BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
  352. if ((flags & ~TFD_CREATE_FLAGS) ||
  353. (clockid != CLOCK_MONOTONIC &&
  354. clockid != CLOCK_REALTIME &&
  355. clockid != CLOCK_REALTIME_ALARM &&
  356. clockid != CLOCK_BOOTTIME &&
  357. clockid != CLOCK_BOOTTIME_ALARM))
  358. return -EINVAL;
  359. if ((clockid == CLOCK_REALTIME_ALARM ||
  360. clockid == CLOCK_BOOTTIME_ALARM) &&
  361. !capable(CAP_WAKE_ALARM))
  362. return -EPERM;
  363. ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
  364. if (!ctx)
  365. return -ENOMEM;
  366. init_waitqueue_head(&ctx->wqh);
  367. spin_lock_init(&ctx->cancel_lock);
  368. ctx->clockid = clockid;
  369. if (isalarm(ctx))
  370. alarm_init(&ctx->t.alarm,
  371. ctx->clockid == CLOCK_REALTIME_ALARM ?
  372. ALARM_REALTIME : ALARM_BOOTTIME,
  373. timerfd_alarmproc);
  374. else
  375. hrtimer_init(&ctx->t.tmr, clockid, HRTIMER_MODE_ABS);
  376. ctx->moffs = ktime_mono_to_real(0);
  377. strlcpy(file_name_buf, "[timerfd]", sizeof(file_name_buf));
  378. trace_android_vh_timerfd_create(file_name_buf, sizeof(file_name_buf));
  379. ufd = anon_inode_getfd(file_name_buf, &timerfd_fops, ctx,
  380. O_RDWR | (flags & TFD_SHARED_FCNTL_FLAGS));
  381. if (ufd < 0)
  382. kfree(ctx);
  383. return ufd;
  384. }
  385. static int do_timerfd_settime(int ufd, int flags,
  386. const struct itimerspec64 *new,
  387. struct itimerspec64 *old)
  388. {
  389. struct fd f;
  390. struct timerfd_ctx *ctx;
  391. int ret;
  392. if ((flags & ~TFD_SETTIME_FLAGS) ||
  393. !itimerspec64_valid(new))
  394. return -EINVAL;
  395. ret = timerfd_fget(ufd, &f);
  396. if (ret)
  397. return ret;
  398. ctx = f.file->private_data;
  399. if (isalarm(ctx) && !capable(CAP_WAKE_ALARM)) {
  400. fdput(f);
  401. return -EPERM;
  402. }
  403. timerfd_setup_cancel(ctx, flags);
  404. /*
  405. * We need to stop the existing timer before reprogramming
  406. * it to the new values.
  407. */
  408. for (;;) {
  409. spin_lock_irq(&ctx->wqh.lock);
  410. if (isalarm(ctx)) {
  411. if (alarm_try_to_cancel(&ctx->t.alarm) >= 0)
  412. break;
  413. } else {
  414. if (hrtimer_try_to_cancel(&ctx->t.tmr) >= 0)
  415. break;
  416. }
  417. spin_unlock_irq(&ctx->wqh.lock);
  418. if (isalarm(ctx))
  419. hrtimer_cancel_wait_running(&ctx->t.alarm.timer);
  420. else
  421. hrtimer_cancel_wait_running(&ctx->t.tmr);
  422. }
  423. /*
  424. * If the timer is expired and it's periodic, we need to advance it
  425. * because the caller may want to know the previous expiration time.
  426. * We do not update "ticks" and "expired" since the timer will be
  427. * re-programmed again in the following timerfd_setup() call.
  428. */
  429. if (ctx->expired && ctx->tintv) {
  430. if (isalarm(ctx))
  431. alarm_forward_now(&ctx->t.alarm, ctx->tintv);
  432. else
  433. hrtimer_forward_now(&ctx->t.tmr, ctx->tintv);
  434. }
  435. old->it_value = ktime_to_timespec64(timerfd_get_remaining(ctx));
  436. old->it_interval = ktime_to_timespec64(ctx->tintv);
  437. /*
  438. * Re-program the timer to the new value ...
  439. */
  440. ret = timerfd_setup(ctx, flags, new);
  441. spin_unlock_irq(&ctx->wqh.lock);
  442. fdput(f);
  443. return ret;
  444. }
  445. static int do_timerfd_gettime(int ufd, struct itimerspec64 *t)
  446. {
  447. struct fd f;
  448. struct timerfd_ctx *ctx;
  449. int ret = timerfd_fget(ufd, &f);
  450. if (ret)
  451. return ret;
  452. ctx = f.file->private_data;
  453. spin_lock_irq(&ctx->wqh.lock);
  454. if (ctx->expired && ctx->tintv) {
  455. ctx->expired = 0;
  456. if (isalarm(ctx)) {
  457. ctx->ticks +=
  458. alarm_forward_now(
  459. &ctx->t.alarm, ctx->tintv) - 1;
  460. alarm_restart(&ctx->t.alarm);
  461. } else {
  462. ctx->ticks +=
  463. hrtimer_forward_now(&ctx->t.tmr, ctx->tintv)
  464. - 1;
  465. hrtimer_restart(&ctx->t.tmr);
  466. }
  467. }
  468. t->it_value = ktime_to_timespec64(timerfd_get_remaining(ctx));
  469. t->it_interval = ktime_to_timespec64(ctx->tintv);
  470. spin_unlock_irq(&ctx->wqh.lock);
  471. fdput(f);
  472. return 0;
  473. }
  474. SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
  475. const struct __kernel_itimerspec __user *, utmr,
  476. struct __kernel_itimerspec __user *, otmr)
  477. {
  478. struct itimerspec64 new, old;
  479. int ret;
  480. if (get_itimerspec64(&new, utmr))
  481. return -EFAULT;
  482. ret = do_timerfd_settime(ufd, flags, &new, &old);
  483. if (ret)
  484. return ret;
  485. if (otmr && put_itimerspec64(&old, otmr))
  486. return -EFAULT;
  487. return ret;
  488. }
  489. SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct __kernel_itimerspec __user *, otmr)
  490. {
  491. struct itimerspec64 kotmr;
  492. int ret = do_timerfd_gettime(ufd, &kotmr);
  493. if (ret)
  494. return ret;
  495. return put_itimerspec64(&kotmr, otmr) ? -EFAULT : 0;
  496. }
  497. #ifdef CONFIG_COMPAT_32BIT_TIME
  498. SYSCALL_DEFINE4(timerfd_settime32, int, ufd, int, flags,
  499. const struct old_itimerspec32 __user *, utmr,
  500. struct old_itimerspec32 __user *, otmr)
  501. {
  502. struct itimerspec64 new, old;
  503. int ret;
  504. if (get_old_itimerspec32(&new, utmr))
  505. return -EFAULT;
  506. ret = do_timerfd_settime(ufd, flags, &new, &old);
  507. if (ret)
  508. return ret;
  509. if (otmr && put_old_itimerspec32(&old, otmr))
  510. return -EFAULT;
  511. return ret;
  512. }
  513. SYSCALL_DEFINE2(timerfd_gettime32, int, ufd,
  514. struct old_itimerspec32 __user *, otmr)
  515. {
  516. struct itimerspec64 kotmr;
  517. int ret = do_timerfd_gettime(ufd, &kotmr);
  518. if (ret)
  519. return ret;
  520. return put_old_itimerspec32(&kotmr, otmr) ? -EFAULT : 0;
  521. }
  522. #endif