xref: /linux/fs/timerfd.c (revision 7dda99952cede01e1225f8c4c856369a2cfda6ca)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *  fs/timerfd.c
4  *
5  *  Copyright (C) 2007  Davide Libenzi <davidel@xmailserver.org>
6  *
7  *
8  *  Thanks to Thomas Gleixner for code reviews and useful comments.
9  *
10  */
11 
12 #include <linux/alarmtimer.h>
13 #include <linux/file.h>
14 #include <linux/poll.h>
15 #include <linux/init.h>
16 #include <linux/fs.h>
17 #include <linux/sched.h>
18 #include <linux/kernel.h>
19 #include <linux/slab.h>
20 #include <linux/list.h>
21 #include <linux/spinlock.h>
22 #include <linux/time.h>
23 #include <linux/hrtimer.h>
24 #include <linux/anon_inodes.h>
25 #include <linux/timerfd.h>
26 #include <linux/syscalls.h>
27 #include <linux/compat.h>
28 #include <linux/rcupdate.h>
29 #include <linux/time_namespace.h>
30 
31 struct timerfd_ctx {
32 	union {
33 		struct hrtimer tmr;
34 		struct alarm alarm;
35 	} t;
36 	ktime_t tintv;
37 	ktime_t moffs;
38 	wait_queue_head_t wqh;
39 	u64 ticks;
40 	int clockid;
41 	short unsigned expired;
42 	short unsigned settime_flags;	/* to show in fdinfo */
43 	struct rcu_head rcu;
44 	struct list_head clist;
45 	spinlock_t cancel_lock;
46 	bool might_cancel;
47 };
48 
49 static LIST_HEAD(cancel_list);
50 static DEFINE_SPINLOCK(cancel_lock);
51 
52 static inline bool isalarm(struct timerfd_ctx *ctx)
53 {
54 	return ctx->clockid == CLOCK_REALTIME_ALARM ||
55 		ctx->clockid == CLOCK_BOOTTIME_ALARM;
56 }
57 
58 static void __timerfd_triggered(struct timerfd_ctx *ctx)
59 {
60 	lockdep_assert_held(&ctx->wqh.lock);
61 
62 	ctx->expired = 1;
63 	ctx->ticks++;
64 	wake_up_locked_poll(&ctx->wqh, EPOLLIN);
65 }
66 
67 /*
68  * This gets called when the timer event triggers. We set the "expired"
69  * flag, but we do not re-arm the timer (in case it's necessary,
70  * tintv != 0) until the timer is accessed.
71  */
72 static void timerfd_triggered(struct timerfd_ctx *ctx)
73 {
74 	guard(spinlock_irqsave)(&ctx->wqh.lock);
75 	__timerfd_triggered(ctx);
76 }
77 
78 static enum hrtimer_restart timerfd_tmrproc(struct hrtimer *htmr)
79 {
80 	struct timerfd_ctx *ctx = container_of(htmr, struct timerfd_ctx,
81 					       t.tmr);
82 	timerfd_triggered(ctx);
83 	return HRTIMER_NORESTART;
84 }
85 
86 static void timerfd_alarmproc(struct alarm *alarm, ktime_t now)
87 {
88 	struct timerfd_ctx *ctx = container_of(alarm, struct timerfd_ctx,
89 					       t.alarm);
90 	timerfd_triggered(ctx);
91 }
92 
93 /*
94  * Called when the clock was set to cancel the timers in the cancel
95  * list. This will wake up processes waiting on these timers. The
96  * wake-up requires ctx->ticks to be non zero, therefore we increment
97  * it before calling wake_up_locked().
98  */
99 void timerfd_clock_was_set(void)
100 {
101 	ktime_t moffs = ktime_mono_to_real(0);
102 	struct timerfd_ctx *ctx;
103 	unsigned long flags;
104 
105 	rcu_read_lock();
106 	list_for_each_entry_rcu(ctx, &cancel_list, clist) {
107 		if (!ctx->might_cancel)
108 			continue;
109 		spin_lock_irqsave(&ctx->wqh.lock, flags);
110 		if (ctx->moffs != moffs) {
111 			ctx->moffs = KTIME_MAX;
112 			ctx->ticks++;
113 			wake_up_locked_poll(&ctx->wqh, EPOLLIN);
114 		}
115 		spin_unlock_irqrestore(&ctx->wqh.lock, flags);
116 	}
117 	rcu_read_unlock();
118 }
119 
120 static void timerfd_resume_work(struct work_struct *work)
121 {
122 	timerfd_clock_was_set();
123 }
124 
125 static DECLARE_WORK(timerfd_work, timerfd_resume_work);
126 
127 /*
128  * Invoked from timekeeping_resume(). Defer the actual update to work so
129  * timerfd_clock_was_set() runs in task context.
130  */
131 void timerfd_resume(void)
132 {
133 	schedule_work(&timerfd_work);
134 }
135 
136 static void __timerfd_remove_cancel(struct timerfd_ctx *ctx)
137 {
138 	if (ctx->might_cancel) {
139 		ctx->might_cancel = false;
140 		spin_lock(&cancel_lock);
141 		list_del_rcu(&ctx->clist);
142 		spin_unlock(&cancel_lock);
143 	}
144 }
145 
146 static void timerfd_remove_cancel(struct timerfd_ctx *ctx)
147 {
148 	spin_lock(&ctx->cancel_lock);
149 	__timerfd_remove_cancel(ctx);
150 	spin_unlock(&ctx->cancel_lock);
151 }
152 
153 static bool timerfd_canceled(struct timerfd_ctx *ctx)
154 {
155 	if (!ctx->might_cancel || ctx->moffs != KTIME_MAX)
156 		return false;
157 	ctx->moffs = ktime_mono_to_real(0);
158 	return true;
159 }
160 
161 static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags)
162 {
163 	spin_lock(&ctx->cancel_lock);
164 	if ((ctx->clockid == CLOCK_REALTIME ||
165 	     ctx->clockid == CLOCK_REALTIME_ALARM) &&
166 	    (flags & TFD_TIMER_ABSTIME) && (flags & TFD_TIMER_CANCEL_ON_SET)) {
167 		if (!ctx->might_cancel) {
168 			ctx->might_cancel = true;
169 			spin_lock(&cancel_lock);
170 			list_add_rcu(&ctx->clist, &cancel_list);
171 			spin_unlock(&cancel_lock);
172 		}
173 	} else {
174 		__timerfd_remove_cancel(ctx);
175 	}
176 	spin_unlock(&ctx->cancel_lock);
177 }
178 
179 static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx)
180 {
181 	ktime_t remaining;
182 
183 	if (isalarm(ctx))
184 		remaining = alarm_expires_remaining(&ctx->t.alarm);
185 	else
186 		remaining = hrtimer_expires_remaining_adjusted(&ctx->t.tmr);
187 
188 	return remaining < 0 ? 0: remaining;
189 }
190 
191 static void timerfd_alarm_start(struct timerfd_ctx *ctx, ktime_t exp, bool relative)
192 {
193 	/* Start the timer. If it's expired already, handle the callback. */
194 	if (!alarm_start_timer(&ctx->t.alarm, exp, relative))
195 		__timerfd_triggered(ctx);
196 }
197 
198 static u64 timerfd_alarm_restart(struct timerfd_ctx *ctx)
199 {
200 	/* -1 to account for ctx->ticks++ in __timerfd_triggered() */
201 	u64 ticks = alarm_forward_now(&ctx->t.alarm, ctx->tintv) - 1;
202 
203 	timerfd_alarm_start(ctx, alarm_get_expires(&ctx->t.alarm), false);
204 	return ticks;
205 }
206 
207 static void timerfd_hrtimer_start(struct timerfd_ctx *ctx, ktime_t exp,
208 				  const enum hrtimer_mode mode)
209 {
210 	/* Start the timer. If it's expired already, handle the callback. */
211 	if (!hrtimer_start_range_ns_user(&ctx->t.tmr, exp, 0, mode))
212 		__timerfd_triggered(ctx);
213 }
214 
215 static u64 timerfd_hrtimer_restart(struct timerfd_ctx *ctx)
216 {
217 	/* -1 to account for ctx->ticks++ in __timerfd_triggered() */
218 	u64 ticks = hrtimer_forward_now(&ctx->t.tmr, ctx->tintv) - 1;
219 
220 	timerfd_hrtimer_start(ctx, hrtimer_get_expires(&ctx->t.tmr), HRTIMER_MODE_ABS);
221 	return ticks;
222 }
223 
224 static u64 timerfd_restart(struct timerfd_ctx *ctx)
225 {
226 	if (isalarm(ctx))
227 		return timerfd_alarm_restart(ctx);
228 	return timerfd_hrtimer_restart(ctx);
229 }
230 
231 static int timerfd_setup(struct timerfd_ctx *ctx, int flags,
232 			 const struct itimerspec64 *ktmr)
233 {
234 	int clockid = ctx->clockid;
235 	enum hrtimer_mode htmode;
236 	ktime_t texp;
237 
238 	htmode = (flags & TFD_TIMER_ABSTIME) ? HRTIMER_MODE_ABS: HRTIMER_MODE_REL;
239 
240 	texp = timespec64_to_ktime(ktmr->it_value);
241 	ctx->expired = 0;
242 	ctx->ticks = 0;
243 	ctx->tintv = timespec64_to_ktime(ktmr->it_interval);
244 
245 	if (isalarm(ctx)) {
246 		alarm_init(&ctx->t.alarm,
247 			   ctx->clockid == CLOCK_REALTIME_ALARM ?
248 			   ALARM_REALTIME : ALARM_BOOTTIME,
249 			   timerfd_alarmproc);
250 	} else {
251 		hrtimer_setup(&ctx->t.tmr, timerfd_tmrproc, clockid, htmode);
252 	}
253 
254 	if (texp != 0) {
255 		if (flags & TFD_TIMER_ABSTIME)
256 			texp = timens_ktime_to_host(clockid, texp);
257 		if (isalarm(ctx))
258 			timerfd_alarm_start(ctx, texp, !(flags & TFD_TIMER_ABSTIME));
259 		else
260 			timerfd_hrtimer_start(ctx, texp, htmode);
261 
262 		if (timerfd_canceled(ctx))
263 			return -ECANCELED;
264 	}
265 
266 	ctx->settime_flags = flags & TFD_SETTIME_FLAGS;
267 	return 0;
268 }
269 
270 static int timerfd_release(struct inode *inode, struct file *file)
271 {
272 	struct timerfd_ctx *ctx = file->private_data;
273 
274 	timerfd_remove_cancel(ctx);
275 
276 	if (isalarm(ctx))
277 		alarm_cancel(&ctx->t.alarm);
278 	else
279 		hrtimer_cancel(&ctx->t.tmr);
280 	kfree_rcu(ctx, rcu);
281 	return 0;
282 }
283 
284 static __poll_t timerfd_poll(struct file *file, poll_table *wait)
285 {
286 	struct timerfd_ctx *ctx = file->private_data;
287 	__poll_t events = 0;
288 	unsigned long flags;
289 
290 	poll_wait(file, &ctx->wqh, wait);
291 
292 	spin_lock_irqsave(&ctx->wqh.lock, flags);
293 	if (ctx->ticks)
294 		events |= EPOLLIN;
295 	spin_unlock_irqrestore(&ctx->wqh.lock, flags);
296 
297 	return events;
298 }
299 
300 static ssize_t timerfd_read_iter(struct kiocb *iocb, struct iov_iter *to)
301 {
302 	struct file *file = iocb->ki_filp;
303 	struct timerfd_ctx *ctx = file->private_data;
304 	ssize_t res;
305 	u64 ticks = 0;
306 
307 	if (iov_iter_count(to) < sizeof(ticks))
308 		return -EINVAL;
309 
310 	spin_lock_irq(&ctx->wqh.lock);
311 	if (file->f_flags & O_NONBLOCK || iocb->ki_flags & IOCB_NOWAIT)
312 		res = -EAGAIN;
313 	else
314 		res = wait_event_interruptible_locked_irq(ctx->wqh, ctx->ticks);
315 
316 	/*
317 	 * If clock has changed, we do not care about the
318 	 * ticks and we do not rearm the timer. Userspace must
319 	 * reevaluate anyway.
320 	 */
321 	if (timerfd_canceled(ctx)) {
322 		ctx->ticks = 0;
323 		ctx->expired = 0;
324 		res = -ECANCELED;
325 	}
326 
327 	if (ctx->ticks) {
328 		unsigned int expired = ctx->expired;
329 
330 		ticks = ctx->ticks;
331 		ctx->expired = 0;
332 		ctx->ticks = 0;
333 
334 		/*
335 		 * If tintv != 0, this is a periodic timer that needs to be
336 		 * re-armed. We avoid doing it in the timer callback to avoid
337 		 * DoS attacks specifying a very short timer period.
338 		 */
339 		if (expired && ctx->tintv)
340 			ticks += timerfd_restart(ctx);
341 	}
342 	spin_unlock_irq(&ctx->wqh.lock);
343 	if (ticks) {
344 		res = copy_to_iter(&ticks, sizeof(ticks), to);
345 		if (!res)
346 			res = -EFAULT;
347 	}
348 	return res;
349 }
350 
351 #ifdef CONFIG_PROC_FS
352 static void timerfd_show(struct seq_file *m, struct file *file)
353 {
354 	struct timerfd_ctx *ctx = file->private_data;
355 	struct timespec64 value, interval;
356 
357 	spin_lock_irq(&ctx->wqh.lock);
358 	value = ktime_to_timespec64(timerfd_get_remaining(ctx));
359 	interval = ktime_to_timespec64(ctx->tintv);
360 	spin_unlock_irq(&ctx->wqh.lock);
361 
362 	seq_printf(m,
363 		   "clockid: %d\n"
364 		   "ticks: %llu\n"
365 		   "settime flags: 0%o\n"
366 		   "it_value: (%llu, %llu)\n"
367 		   "it_interval: (%llu, %llu)\n",
368 		   ctx->clockid,
369 		   (unsigned long long)ctx->ticks,
370 		   ctx->settime_flags,
371 		   (unsigned long long)value.tv_sec,
372 		   (unsigned long long)value.tv_nsec,
373 		   (unsigned long long)interval.tv_sec,
374 		   (unsigned long long)interval.tv_nsec);
375 }
376 #else
377 #define timerfd_show NULL
378 #endif
379 
380 #ifdef CONFIG_CHECKPOINT_RESTORE
381 static long timerfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
382 {
383 	struct timerfd_ctx *ctx = file->private_data;
384 	int ret = 0;
385 
386 	switch (cmd) {
387 	case TFD_IOC_SET_TICKS: {
388 		u64 ticks;
389 
390 		if (copy_from_user(&ticks, (u64 __user *)arg, sizeof(ticks)))
391 			return -EFAULT;
392 		if (!ticks)
393 			return -EINVAL;
394 
395 		spin_lock_irq(&ctx->wqh.lock);
396 		if (!timerfd_canceled(ctx)) {
397 			ctx->ticks = ticks;
398 			wake_up_locked_poll(&ctx->wqh, EPOLLIN);
399 		} else
400 			ret = -ECANCELED;
401 		spin_unlock_irq(&ctx->wqh.lock);
402 		break;
403 	}
404 	default:
405 		ret = -ENOTTY;
406 		break;
407 	}
408 
409 	return ret;
410 }
411 #else
412 #define timerfd_ioctl NULL
413 #endif
414 
415 static const struct file_operations timerfd_fops = {
416 	.release	= timerfd_release,
417 	.poll		= timerfd_poll,
418 	.read_iter	= timerfd_read_iter,
419 	.llseek		= noop_llseek,
420 	.show_fdinfo	= timerfd_show,
421 	.unlocked_ioctl	= timerfd_ioctl,
422 };
423 
424 SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
425 {
426 	struct timerfd_ctx *ctx __free(kfree) = NULL;
427 	int ret;
428 
429 	/* Check the TFD_* constants for consistency.  */
430 	BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
431 	BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
432 
433 	if ((flags & ~TFD_CREATE_FLAGS) ||
434 	    (clockid != CLOCK_MONOTONIC &&
435 	     clockid != CLOCK_REALTIME &&
436 	     clockid != CLOCK_REALTIME_ALARM &&
437 	     clockid != CLOCK_BOOTTIME &&
438 	     clockid != CLOCK_BOOTTIME_ALARM))
439 		return -EINVAL;
440 
441 	if ((clockid == CLOCK_REALTIME_ALARM ||
442 	     clockid == CLOCK_BOOTTIME_ALARM) &&
443 	    !capable(CAP_WAKE_ALARM))
444 		return -EPERM;
445 
446 	ctx = kzalloc_obj(*ctx);
447 	if (!ctx)
448 		return -ENOMEM;
449 
450 	init_waitqueue_head(&ctx->wqh);
451 	spin_lock_init(&ctx->cancel_lock);
452 	ctx->clockid = clockid;
453 
454 	if (isalarm(ctx))
455 		alarm_init(&ctx->t.alarm,
456 			   ctx->clockid == CLOCK_REALTIME_ALARM ?
457 			   ALARM_REALTIME : ALARM_BOOTTIME,
458 			   timerfd_alarmproc);
459 	else
460 		hrtimer_setup(&ctx->t.tmr, timerfd_tmrproc, clockid, HRTIMER_MODE_ABS);
461 
462 	ctx->moffs = ktime_mono_to_real(0);
463 
464 	ret = FD_ADD(flags & TFD_SHARED_FCNTL_FLAGS,
465 		     anon_inode_getfile_fmode("[timerfd]", &timerfd_fops, ctx,
466 					      O_RDWR | (flags & TFD_SHARED_FCNTL_FLAGS),
467 					      FMODE_NOWAIT));
468 	if (ret >= 0)
469 		retain_and_null_ptr(ctx);
470 	return ret;
471 }
472 
473 static int do_timerfd_settime(int ufd, int flags,
474 		const struct itimerspec64 *new,
475 		struct itimerspec64 *old)
476 {
477 	struct timerfd_ctx *ctx;
478 	int ret;
479 
480 	if ((flags & ~TFD_SETTIME_FLAGS) ||
481 		 !itimerspec64_valid(new))
482 		return -EINVAL;
483 
484 	CLASS(fd, f)(ufd);
485 	if (fd_empty(f))
486 		return -EBADF;
487 
488 	if (fd_file(f)->f_op != &timerfd_fops)
489 		return -EINVAL;
490 
491 	ctx = fd_file(f)->private_data;
492 
493 	if (isalarm(ctx) && !capable(CAP_WAKE_ALARM))
494 		return -EPERM;
495 
496 	timerfd_setup_cancel(ctx, flags);
497 
498 	/*
499 	 * We need to stop the existing timer before reprogramming
500 	 * it to the new values.
501 	 */
502 	for (;;) {
503 		spin_lock_irq(&ctx->wqh.lock);
504 
505 		if (isalarm(ctx)) {
506 			if (alarm_try_to_cancel(&ctx->t.alarm) >= 0)
507 				break;
508 		} else {
509 			if (hrtimer_try_to_cancel(&ctx->t.tmr) >= 0)
510 				break;
511 		}
512 		spin_unlock_irq(&ctx->wqh.lock);
513 
514 		if (isalarm(ctx))
515 			hrtimer_cancel_wait_running(&ctx->t.alarm.timer);
516 		else
517 			hrtimer_cancel_wait_running(&ctx->t.tmr);
518 	}
519 
520 	/*
521 	 * If the timer is expired and it's periodic, we need to advance it
522 	 * because the caller may want to know the previous expiration time.
523 	 * We do not update "ticks" and "expired" since the timer will be
524 	 * re-programmed again in the following timerfd_setup() call.
525 	 */
526 	if (ctx->expired && ctx->tintv) {
527 		if (isalarm(ctx))
528 			alarm_forward_now(&ctx->t.alarm, ctx->tintv);
529 		else
530 			hrtimer_forward_now(&ctx->t.tmr, ctx->tintv);
531 	}
532 
533 	old->it_value = ktime_to_timespec64(timerfd_get_remaining(ctx));
534 	old->it_interval = ktime_to_timespec64(ctx->tintv);
535 
536 	/*
537 	 * Re-program the timer to the new value ...
538 	 */
539 	ret = timerfd_setup(ctx, flags, new);
540 
541 	spin_unlock_irq(&ctx->wqh.lock);
542 	return ret;
543 }
544 
545 static int do_timerfd_gettime(int ufd, struct itimerspec64 *t)
546 {
547 	struct timerfd_ctx *ctx;
548 	CLASS(fd, f)(ufd);
549 
550 	if (fd_empty(f))
551 		return -EBADF;
552 	if (fd_file(f)->f_op != &timerfd_fops)
553 		return -EINVAL;
554 	ctx = fd_file(f)->private_data;
555 
556 	spin_lock_irq(&ctx->wqh.lock);
557 	if (ctx->expired && ctx->tintv) {
558 		ctx->expired = 0;
559 		ctx->ticks += timerfd_restart(ctx);
560 	}
561 	t->it_value = ktime_to_timespec64(timerfd_get_remaining(ctx));
562 	t->it_interval = ktime_to_timespec64(ctx->tintv);
563 	spin_unlock_irq(&ctx->wqh.lock);
564 	return 0;
565 }
566 
567 SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
568 		const struct __kernel_itimerspec __user *, utmr,
569 		struct __kernel_itimerspec __user *, otmr)
570 {
571 	struct itimerspec64 new, old;
572 	int ret;
573 
574 	if (get_itimerspec64(&new, utmr))
575 		return -EFAULT;
576 	ret = do_timerfd_settime(ufd, flags, &new, &old);
577 	if (ret)
578 		return ret;
579 	if (otmr && put_itimerspec64(&old, otmr))
580 		return -EFAULT;
581 
582 	return ret;
583 }
584 
585 SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct __kernel_itimerspec __user *, otmr)
586 {
587 	struct itimerspec64 kotmr;
588 	int ret = do_timerfd_gettime(ufd, &kotmr);
589 	if (ret)
590 		return ret;
591 	return put_itimerspec64(&kotmr, otmr) ? -EFAULT : 0;
592 }
593 
594 #ifdef CONFIG_COMPAT_32BIT_TIME
595 SYSCALL_DEFINE4(timerfd_settime32, int, ufd, int, flags,
596 		const struct old_itimerspec32 __user *, utmr,
597 		struct old_itimerspec32 __user *, otmr)
598 {
599 	struct itimerspec64 new, old;
600 	int ret;
601 
602 	if (get_old_itimerspec32(&new, utmr))
603 		return -EFAULT;
604 	ret = do_timerfd_settime(ufd, flags, &new, &old);
605 	if (ret)
606 		return ret;
607 	if (otmr && put_old_itimerspec32(&old, otmr))
608 		return -EFAULT;
609 	return ret;
610 }
611 
612 SYSCALL_DEFINE2(timerfd_gettime32, int, ufd,
613 		struct old_itimerspec32 __user *, otmr)
614 {
615 	struct itimerspec64 kotmr;
616 	int ret = do_timerfd_gettime(ufd, &kotmr);
617 	if (ret)
618 		return ret;
619 	return put_old_itimerspec32(&kotmr, otmr) ? -EFAULT : 0;
620 }
621 #endif
622