1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * fs/timerfd.c 4 * 5 * Copyright (C) 2007 Davide Libenzi <davidel@xmailserver.org> 6 * 7 * 8 * Thanks to Thomas Gleixner for code reviews and useful comments. 9 * 10 */ 11 12 #include <linux/alarmtimer.h> 13 #include <linux/file.h> 14 #include <linux/poll.h> 15 #include <linux/init.h> 16 #include <linux/fs.h> 17 #include <linux/sched.h> 18 #include <linux/kernel.h> 19 #include <linux/slab.h> 20 #include <linux/list.h> 21 #include <linux/spinlock.h> 22 #include <linux/time.h> 23 #include <linux/hrtimer.h> 24 #include <linux/anon_inodes.h> 25 #include <linux/timerfd.h> 26 #include <linux/syscalls.h> 27 #include <linux/compat.h> 28 #include <linux/rcupdate.h> 29 #include <linux/time_namespace.h> 30 31 struct timerfd_ctx { 32 union { 33 struct hrtimer tmr; 34 struct alarm alarm; 35 } t; 36 ktime_t tintv; 37 ktime_t moffs; 38 wait_queue_head_t wqh; 39 u64 ticks; 40 int clockid; 41 short unsigned expired; 42 short unsigned settime_flags; /* to show in fdinfo */ 43 struct rcu_head rcu; 44 struct list_head clist; 45 spinlock_t cancel_lock; 46 bool might_cancel; 47 }; 48 49 static LIST_HEAD(cancel_list); 50 static DEFINE_SPINLOCK(cancel_lock); 51 52 static inline bool isalarm(struct timerfd_ctx *ctx) 53 { 54 return ctx->clockid == CLOCK_REALTIME_ALARM || 55 ctx->clockid == CLOCK_BOOTTIME_ALARM; 56 } 57 58 static void __timerfd_triggered(struct timerfd_ctx *ctx) 59 { 60 lockdep_assert_held(&ctx->wqh.lock); 61 62 ctx->expired = 1; 63 ctx->ticks++; 64 wake_up_locked_poll(&ctx->wqh, EPOLLIN); 65 } 66 67 /* 68 * This gets called when the timer event triggers. We set the "expired" 69 * flag, but we do not re-arm the timer (in case it's necessary, 70 * tintv != 0) until the timer is accessed. 71 */ 72 static void timerfd_triggered(struct timerfd_ctx *ctx) 73 { 74 guard(spinlock_irqsave)(&ctx->wqh.lock); 75 __timerfd_triggered(ctx); 76 } 77 78 static enum hrtimer_restart timerfd_tmrproc(struct hrtimer *htmr) 79 { 80 struct timerfd_ctx *ctx = container_of(htmr, struct timerfd_ctx, 81 t.tmr); 82 timerfd_triggered(ctx); 83 return HRTIMER_NORESTART; 84 } 85 86 static void timerfd_alarmproc(struct alarm *alarm, ktime_t now) 87 { 88 struct timerfd_ctx *ctx = container_of(alarm, struct timerfd_ctx, 89 t.alarm); 90 timerfd_triggered(ctx); 91 } 92 93 /* 94 * Called when the clock was set to cancel the timers in the cancel 95 * list. This will wake up processes waiting on these timers. The 96 * wake-up requires ctx->ticks to be non zero, therefore we increment 97 * it before calling wake_up_locked(). 98 */ 99 void timerfd_clock_was_set(void) 100 { 101 ktime_t moffs = ktime_mono_to_real(0); 102 struct timerfd_ctx *ctx; 103 unsigned long flags; 104 105 rcu_read_lock(); 106 list_for_each_entry_rcu(ctx, &cancel_list, clist) { 107 if (!ctx->might_cancel) 108 continue; 109 spin_lock_irqsave(&ctx->wqh.lock, flags); 110 if (ctx->moffs != moffs) { 111 ctx->moffs = KTIME_MAX; 112 ctx->ticks++; 113 wake_up_locked_poll(&ctx->wqh, EPOLLIN); 114 } 115 spin_unlock_irqrestore(&ctx->wqh.lock, flags); 116 } 117 rcu_read_unlock(); 118 } 119 120 static void timerfd_resume_work(struct work_struct *work) 121 { 122 timerfd_clock_was_set(); 123 } 124 125 static DECLARE_WORK(timerfd_work, timerfd_resume_work); 126 127 /* 128 * Invoked from timekeeping_resume(). Defer the actual update to work so 129 * timerfd_clock_was_set() runs in task context. 130 */ 131 void timerfd_resume(void) 132 { 133 schedule_work(&timerfd_work); 134 } 135 136 static void __timerfd_remove_cancel(struct timerfd_ctx *ctx) 137 { 138 if (ctx->might_cancel) { 139 ctx->might_cancel = false; 140 spin_lock(&cancel_lock); 141 list_del_rcu(&ctx->clist); 142 spin_unlock(&cancel_lock); 143 } 144 } 145 146 static void timerfd_remove_cancel(struct timerfd_ctx *ctx) 147 { 148 spin_lock(&ctx->cancel_lock); 149 __timerfd_remove_cancel(ctx); 150 spin_unlock(&ctx->cancel_lock); 151 } 152 153 static bool timerfd_canceled(struct timerfd_ctx *ctx) 154 { 155 if (!ctx->might_cancel || ctx->moffs != KTIME_MAX) 156 return false; 157 ctx->moffs = ktime_mono_to_real(0); 158 return true; 159 } 160 161 static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags) 162 { 163 spin_lock(&ctx->cancel_lock); 164 if ((ctx->clockid == CLOCK_REALTIME || 165 ctx->clockid == CLOCK_REALTIME_ALARM) && 166 (flags & TFD_TIMER_ABSTIME) && (flags & TFD_TIMER_CANCEL_ON_SET)) { 167 if (!ctx->might_cancel) { 168 ctx->might_cancel = true; 169 spin_lock(&cancel_lock); 170 list_add_rcu(&ctx->clist, &cancel_list); 171 spin_unlock(&cancel_lock); 172 } 173 } else { 174 __timerfd_remove_cancel(ctx); 175 } 176 spin_unlock(&ctx->cancel_lock); 177 } 178 179 static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx) 180 { 181 ktime_t remaining; 182 183 if (isalarm(ctx)) 184 remaining = alarm_expires_remaining(&ctx->t.alarm); 185 else 186 remaining = hrtimer_expires_remaining_adjusted(&ctx->t.tmr); 187 188 return remaining < 0 ? 0: remaining; 189 } 190 191 static void timerfd_alarm_start(struct timerfd_ctx *ctx, ktime_t exp, bool relative) 192 { 193 /* Start the timer. If it's expired already, handle the callback. */ 194 if (!alarm_start_timer(&ctx->t.alarm, exp, relative)) 195 __timerfd_triggered(ctx); 196 } 197 198 static u64 timerfd_alarm_restart(struct timerfd_ctx *ctx) 199 { 200 /* -1 to account for ctx->ticks++ in __timerfd_triggered() */ 201 u64 ticks = alarm_forward_now(&ctx->t.alarm, ctx->tintv) - 1; 202 203 timerfd_alarm_start(ctx, alarm_get_expires(&ctx->t.alarm), false); 204 return ticks; 205 } 206 207 static void timerfd_hrtimer_start(struct timerfd_ctx *ctx, ktime_t exp, 208 const enum hrtimer_mode mode) 209 { 210 /* Start the timer. If it's expired already, handle the callback. */ 211 if (!hrtimer_start_range_ns_user(&ctx->t.tmr, exp, 0, mode)) 212 __timerfd_triggered(ctx); 213 } 214 215 static u64 timerfd_hrtimer_restart(struct timerfd_ctx *ctx) 216 { 217 /* -1 to account for ctx->ticks++ in __timerfd_triggered() */ 218 u64 ticks = hrtimer_forward_now(&ctx->t.tmr, ctx->tintv) - 1; 219 220 timerfd_hrtimer_start(ctx, hrtimer_get_expires(&ctx->t.tmr), HRTIMER_MODE_ABS); 221 return ticks; 222 } 223 224 static u64 timerfd_restart(struct timerfd_ctx *ctx) 225 { 226 if (isalarm(ctx)) 227 return timerfd_alarm_restart(ctx); 228 return timerfd_hrtimer_restart(ctx); 229 } 230 231 static int timerfd_setup(struct timerfd_ctx *ctx, int flags, 232 const struct itimerspec64 *ktmr) 233 { 234 int clockid = ctx->clockid; 235 enum hrtimer_mode htmode; 236 ktime_t texp; 237 238 htmode = (flags & TFD_TIMER_ABSTIME) ? HRTIMER_MODE_ABS: HRTIMER_MODE_REL; 239 240 texp = timespec64_to_ktime(ktmr->it_value); 241 ctx->expired = 0; 242 ctx->ticks = 0; 243 ctx->tintv = timespec64_to_ktime(ktmr->it_interval); 244 245 if (isalarm(ctx)) { 246 alarm_init(&ctx->t.alarm, 247 ctx->clockid == CLOCK_REALTIME_ALARM ? 248 ALARM_REALTIME : ALARM_BOOTTIME, 249 timerfd_alarmproc); 250 } else { 251 hrtimer_setup(&ctx->t.tmr, timerfd_tmrproc, clockid, htmode); 252 } 253 254 if (texp != 0) { 255 if (flags & TFD_TIMER_ABSTIME) 256 texp = timens_ktime_to_host(clockid, texp); 257 if (isalarm(ctx)) 258 timerfd_alarm_start(ctx, texp, !(flags & TFD_TIMER_ABSTIME)); 259 else 260 timerfd_hrtimer_start(ctx, texp, htmode); 261 262 if (timerfd_canceled(ctx)) 263 return -ECANCELED; 264 } 265 266 ctx->settime_flags = flags & TFD_SETTIME_FLAGS; 267 return 0; 268 } 269 270 static int timerfd_release(struct inode *inode, struct file *file) 271 { 272 struct timerfd_ctx *ctx = file->private_data; 273 274 timerfd_remove_cancel(ctx); 275 276 if (isalarm(ctx)) 277 alarm_cancel(&ctx->t.alarm); 278 else 279 hrtimer_cancel(&ctx->t.tmr); 280 kfree_rcu(ctx, rcu); 281 return 0; 282 } 283 284 static __poll_t timerfd_poll(struct file *file, poll_table *wait) 285 { 286 struct timerfd_ctx *ctx = file->private_data; 287 __poll_t events = 0; 288 unsigned long flags; 289 290 poll_wait(file, &ctx->wqh, wait); 291 292 spin_lock_irqsave(&ctx->wqh.lock, flags); 293 if (ctx->ticks) 294 events |= EPOLLIN; 295 spin_unlock_irqrestore(&ctx->wqh.lock, flags); 296 297 return events; 298 } 299 300 static ssize_t timerfd_read_iter(struct kiocb *iocb, struct iov_iter *to) 301 { 302 struct file *file = iocb->ki_filp; 303 struct timerfd_ctx *ctx = file->private_data; 304 ssize_t res; 305 u64 ticks = 0; 306 307 if (iov_iter_count(to) < sizeof(ticks)) 308 return -EINVAL; 309 310 spin_lock_irq(&ctx->wqh.lock); 311 if (file->f_flags & O_NONBLOCK || iocb->ki_flags & IOCB_NOWAIT) 312 res = -EAGAIN; 313 else 314 res = wait_event_interruptible_locked_irq(ctx->wqh, ctx->ticks); 315 316 /* 317 * If clock has changed, we do not care about the 318 * ticks and we do not rearm the timer. Userspace must 319 * reevaluate anyway. 320 */ 321 if (timerfd_canceled(ctx)) { 322 ctx->ticks = 0; 323 ctx->expired = 0; 324 res = -ECANCELED; 325 } 326 327 if (ctx->ticks) { 328 unsigned int expired = ctx->expired; 329 330 ticks = ctx->ticks; 331 ctx->expired = 0; 332 ctx->ticks = 0; 333 334 /* 335 * If tintv != 0, this is a periodic timer that needs to be 336 * re-armed. We avoid doing it in the timer callback to avoid 337 * DoS attacks specifying a very short timer period. 338 */ 339 if (expired && ctx->tintv) 340 ticks += timerfd_restart(ctx); 341 } 342 spin_unlock_irq(&ctx->wqh.lock); 343 if (ticks) { 344 res = copy_to_iter(&ticks, sizeof(ticks), to); 345 if (!res) 346 res = -EFAULT; 347 } 348 return res; 349 } 350 351 #ifdef CONFIG_PROC_FS 352 static void timerfd_show(struct seq_file *m, struct file *file) 353 { 354 struct timerfd_ctx *ctx = file->private_data; 355 struct timespec64 value, interval; 356 357 spin_lock_irq(&ctx->wqh.lock); 358 value = ktime_to_timespec64(timerfd_get_remaining(ctx)); 359 interval = ktime_to_timespec64(ctx->tintv); 360 spin_unlock_irq(&ctx->wqh.lock); 361 362 seq_printf(m, 363 "clockid: %d\n" 364 "ticks: %llu\n" 365 "settime flags: 0%o\n" 366 "it_value: (%llu, %llu)\n" 367 "it_interval: (%llu, %llu)\n", 368 ctx->clockid, 369 (unsigned long long)ctx->ticks, 370 ctx->settime_flags, 371 (unsigned long long)value.tv_sec, 372 (unsigned long long)value.tv_nsec, 373 (unsigned long long)interval.tv_sec, 374 (unsigned long long)interval.tv_nsec); 375 } 376 #else 377 #define timerfd_show NULL 378 #endif 379 380 #ifdef CONFIG_CHECKPOINT_RESTORE 381 static long timerfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 382 { 383 struct timerfd_ctx *ctx = file->private_data; 384 int ret = 0; 385 386 switch (cmd) { 387 case TFD_IOC_SET_TICKS: { 388 u64 ticks; 389 390 if (copy_from_user(&ticks, (u64 __user *)arg, sizeof(ticks))) 391 return -EFAULT; 392 if (!ticks) 393 return -EINVAL; 394 395 spin_lock_irq(&ctx->wqh.lock); 396 if (!timerfd_canceled(ctx)) { 397 ctx->ticks = ticks; 398 wake_up_locked_poll(&ctx->wqh, EPOLLIN); 399 } else 400 ret = -ECANCELED; 401 spin_unlock_irq(&ctx->wqh.lock); 402 break; 403 } 404 default: 405 ret = -ENOTTY; 406 break; 407 } 408 409 return ret; 410 } 411 #else 412 #define timerfd_ioctl NULL 413 #endif 414 415 static const struct file_operations timerfd_fops = { 416 .release = timerfd_release, 417 .poll = timerfd_poll, 418 .read_iter = timerfd_read_iter, 419 .llseek = noop_llseek, 420 .show_fdinfo = timerfd_show, 421 .unlocked_ioctl = timerfd_ioctl, 422 }; 423 424 SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags) 425 { 426 struct timerfd_ctx *ctx __free(kfree) = NULL; 427 int ret; 428 429 /* Check the TFD_* constants for consistency. */ 430 BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC); 431 BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK); 432 433 if ((flags & ~TFD_CREATE_FLAGS) || 434 (clockid != CLOCK_MONOTONIC && 435 clockid != CLOCK_REALTIME && 436 clockid != CLOCK_REALTIME_ALARM && 437 clockid != CLOCK_BOOTTIME && 438 clockid != CLOCK_BOOTTIME_ALARM)) 439 return -EINVAL; 440 441 if ((clockid == CLOCK_REALTIME_ALARM || 442 clockid == CLOCK_BOOTTIME_ALARM) && 443 !capable(CAP_WAKE_ALARM)) 444 return -EPERM; 445 446 ctx = kzalloc_obj(*ctx); 447 if (!ctx) 448 return -ENOMEM; 449 450 init_waitqueue_head(&ctx->wqh); 451 spin_lock_init(&ctx->cancel_lock); 452 ctx->clockid = clockid; 453 454 if (isalarm(ctx)) 455 alarm_init(&ctx->t.alarm, 456 ctx->clockid == CLOCK_REALTIME_ALARM ? 457 ALARM_REALTIME : ALARM_BOOTTIME, 458 timerfd_alarmproc); 459 else 460 hrtimer_setup(&ctx->t.tmr, timerfd_tmrproc, clockid, HRTIMER_MODE_ABS); 461 462 ctx->moffs = ktime_mono_to_real(0); 463 464 ret = FD_ADD(flags & TFD_SHARED_FCNTL_FLAGS, 465 anon_inode_getfile_fmode("[timerfd]", &timerfd_fops, ctx, 466 O_RDWR | (flags & TFD_SHARED_FCNTL_FLAGS), 467 FMODE_NOWAIT)); 468 if (ret >= 0) 469 retain_and_null_ptr(ctx); 470 return ret; 471 } 472 473 static int do_timerfd_settime(int ufd, int flags, 474 const struct itimerspec64 *new, 475 struct itimerspec64 *old) 476 { 477 struct timerfd_ctx *ctx; 478 int ret; 479 480 if ((flags & ~TFD_SETTIME_FLAGS) || 481 !itimerspec64_valid(new)) 482 return -EINVAL; 483 484 CLASS(fd, f)(ufd); 485 if (fd_empty(f)) 486 return -EBADF; 487 488 if (fd_file(f)->f_op != &timerfd_fops) 489 return -EINVAL; 490 491 ctx = fd_file(f)->private_data; 492 493 if (isalarm(ctx) && !capable(CAP_WAKE_ALARM)) 494 return -EPERM; 495 496 timerfd_setup_cancel(ctx, flags); 497 498 /* 499 * We need to stop the existing timer before reprogramming 500 * it to the new values. 501 */ 502 for (;;) { 503 spin_lock_irq(&ctx->wqh.lock); 504 505 if (isalarm(ctx)) { 506 if (alarm_try_to_cancel(&ctx->t.alarm) >= 0) 507 break; 508 } else { 509 if (hrtimer_try_to_cancel(&ctx->t.tmr) >= 0) 510 break; 511 } 512 spin_unlock_irq(&ctx->wqh.lock); 513 514 if (isalarm(ctx)) 515 hrtimer_cancel_wait_running(&ctx->t.alarm.timer); 516 else 517 hrtimer_cancel_wait_running(&ctx->t.tmr); 518 } 519 520 /* 521 * If the timer is expired and it's periodic, we need to advance it 522 * because the caller may want to know the previous expiration time. 523 * We do not update "ticks" and "expired" since the timer will be 524 * re-programmed again in the following timerfd_setup() call. 525 */ 526 if (ctx->expired && ctx->tintv) { 527 if (isalarm(ctx)) 528 alarm_forward_now(&ctx->t.alarm, ctx->tintv); 529 else 530 hrtimer_forward_now(&ctx->t.tmr, ctx->tintv); 531 } 532 533 old->it_value = ktime_to_timespec64(timerfd_get_remaining(ctx)); 534 old->it_interval = ktime_to_timespec64(ctx->tintv); 535 536 /* 537 * Re-program the timer to the new value ... 538 */ 539 ret = timerfd_setup(ctx, flags, new); 540 541 spin_unlock_irq(&ctx->wqh.lock); 542 return ret; 543 } 544 545 static int do_timerfd_gettime(int ufd, struct itimerspec64 *t) 546 { 547 struct timerfd_ctx *ctx; 548 CLASS(fd, f)(ufd); 549 550 if (fd_empty(f)) 551 return -EBADF; 552 if (fd_file(f)->f_op != &timerfd_fops) 553 return -EINVAL; 554 ctx = fd_file(f)->private_data; 555 556 spin_lock_irq(&ctx->wqh.lock); 557 if (ctx->expired && ctx->tintv) { 558 ctx->expired = 0; 559 ctx->ticks += timerfd_restart(ctx); 560 } 561 t->it_value = ktime_to_timespec64(timerfd_get_remaining(ctx)); 562 t->it_interval = ktime_to_timespec64(ctx->tintv); 563 spin_unlock_irq(&ctx->wqh.lock); 564 return 0; 565 } 566 567 SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags, 568 const struct __kernel_itimerspec __user *, utmr, 569 struct __kernel_itimerspec __user *, otmr) 570 { 571 struct itimerspec64 new, old; 572 int ret; 573 574 if (get_itimerspec64(&new, utmr)) 575 return -EFAULT; 576 ret = do_timerfd_settime(ufd, flags, &new, &old); 577 if (ret) 578 return ret; 579 if (otmr && put_itimerspec64(&old, otmr)) 580 return -EFAULT; 581 582 return ret; 583 } 584 585 SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct __kernel_itimerspec __user *, otmr) 586 { 587 struct itimerspec64 kotmr; 588 int ret = do_timerfd_gettime(ufd, &kotmr); 589 if (ret) 590 return ret; 591 return put_itimerspec64(&kotmr, otmr) ? -EFAULT : 0; 592 } 593 594 #ifdef CONFIG_COMPAT_32BIT_TIME 595 SYSCALL_DEFINE4(timerfd_settime32, int, ufd, int, flags, 596 const struct old_itimerspec32 __user *, utmr, 597 struct old_itimerspec32 __user *, otmr) 598 { 599 struct itimerspec64 new, old; 600 int ret; 601 602 if (get_old_itimerspec32(&new, utmr)) 603 return -EFAULT; 604 ret = do_timerfd_settime(ufd, flags, &new, &old); 605 if (ret) 606 return ret; 607 if (otmr && put_old_itimerspec32(&old, otmr)) 608 return -EFAULT; 609 return ret; 610 } 611 612 SYSCALL_DEFINE2(timerfd_gettime32, int, ufd, 613 struct old_itimerspec32 __user *, otmr) 614 { 615 struct itimerspec64 kotmr; 616 int ret = do_timerfd_gettime(ufd, &kotmr); 617 if (ret) 618 return ret; 619 return put_old_itimerspec32(&kotmr, otmr) ? -EFAULT : 0; 620 } 621 #endif 622