timerfd.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 *  fs/timerfd.c
  4 *
  5 *  Copyright (C) 2007  Davide Libenzi <davidel@xmailserver.org>
  6 *
  7 *
  8 *  Thanks to Thomas Gleixner for code reviews and useful comments.
  9 *
 10 */
 11
 12#include <linux/alarmtimer.h>
 13#include <linux/file.h>
 14#include <linux/poll.h>
 15#include <linux/init.h>
 16#include <linux/fs.h>
 17#include <linux/sched.h>
 18#include <linux/kernel.h>
 19#include <linux/slab.h>
 20#include <linux/list.h>
 21#include <linux/spinlock.h>
 22#include <linux/time.h>
 23#include <linux/hrtimer.h>
 24#include <linux/anon_inodes.h>
 25#include <linux/timerfd.h>
 26#include <linux/syscalls.h>
 27#include <linux/compat.h>
 28#include <linux/rcupdate.h>
 29#include <linux/time_namespace.h>
 30
 31struct timerfd_ctx {
 32	union {
 33		struct hrtimer tmr;
 34		struct alarm alarm;
 35	} t;
 36	ktime_t tintv;
 37	ktime_t moffs;
 38	wait_queue_head_t wqh;
 39	u64 ticks;
 40	int clockid;
 41	short unsigned expired;
 42	short unsigned settime_flags;	/* to show in fdinfo */
 43	struct rcu_head rcu;
 44	struct list_head clist;
 45	spinlock_t cancel_lock;
 46	bool might_cancel;
 47};
 48
 49static LIST_HEAD(cancel_list);
 50static DEFINE_SPINLOCK(cancel_lock);
 51
 52static inline bool isalarm(struct timerfd_ctx *ctx)
 53{
 54	return ctx->clockid == CLOCK_REALTIME_ALARM ||
 55		ctx->clockid == CLOCK_BOOTTIME_ALARM;
 56}
 57
 58/*
 59 * This gets called when the timer event triggers. We set the "expired"
 60 * flag, but we do not re-arm the timer (in case it's necessary,
 61 * tintv != 0) until the timer is accessed.
 62 */
 63static void timerfd_triggered(struct timerfd_ctx *ctx)
 64{
 65	unsigned long flags;
 66
 67	spin_lock_irqsave(&ctx->wqh.lock, flags);
 68	ctx->expired = 1;
 69	ctx->ticks++;
 70	wake_up_locked_poll(&ctx->wqh, EPOLLIN);
 71	spin_unlock_irqrestore(&ctx->wqh.lock, flags);
 72}
 73
 74static enum hrtimer_restart timerfd_tmrproc(struct hrtimer *htmr)
 75{
 76	struct timerfd_ctx *ctx = container_of(htmr, struct timerfd_ctx,
 77					       t.tmr);
 78	timerfd_triggered(ctx);
 79	return HRTIMER_NORESTART;
 80}
 81
 82static void timerfd_alarmproc(struct alarm *alarm, ktime_t now)
 83{
 84	struct timerfd_ctx *ctx = container_of(alarm, struct timerfd_ctx,
 85					       t.alarm);
 86	timerfd_triggered(ctx);
 87}
 88
 89/*
 90 * Called when the clock was set to cancel the timers in the cancel
 91 * list. This will wake up processes waiting on these timers. The
 92 * wake-up requires ctx->ticks to be non zero, therefore we increment
 93 * it before calling wake_up_locked().
 94 */
 95void timerfd_clock_was_set(void)
 96{
 97	ktime_t moffs = ktime_mono_to_real(0);
 98	struct timerfd_ctx *ctx;
 99	unsigned long flags;
100
101	rcu_read_lock();
102	list_for_each_entry_rcu(ctx, &cancel_list, clist) {
103		if (!ctx->might_cancel)
104			continue;
105		spin_lock_irqsave(&ctx->wqh.lock, flags);
106		if (ctx->moffs != moffs) {
107			ctx->moffs = KTIME_MAX;
108			ctx->ticks++;
109			wake_up_locked_poll(&ctx->wqh, EPOLLIN);
110		}
111		spin_unlock_irqrestore(&ctx->wqh.lock, flags);
112	}
113	rcu_read_unlock();
114}
115
116static void timerfd_resume_work(struct work_struct *work)
117{
118	timerfd_clock_was_set();
119}
120
121static DECLARE_WORK(timerfd_work, timerfd_resume_work);
122
123/*
124 * Invoked from timekeeping_resume(). Defer the actual update to work so
125 * timerfd_clock_was_set() runs in task context.
126 */
127void timerfd_resume(void)
128{
129	schedule_work(&timerfd_work);
130}
131
132static void __timerfd_remove_cancel(struct timerfd_ctx *ctx)
133{
134	if (ctx->might_cancel) {
135		ctx->might_cancel = false;
136		spin_lock(&cancel_lock);
137		list_del_rcu(&ctx->clist);
138		spin_unlock(&cancel_lock);
139	}
140}
141
142static void timerfd_remove_cancel(struct timerfd_ctx *ctx)
143{
144	spin_lock(&ctx->cancel_lock);
145	__timerfd_remove_cancel(ctx);
146	spin_unlock(&ctx->cancel_lock);
147}
148
149static bool timerfd_canceled(struct timerfd_ctx *ctx)
150{
151	if (!ctx->might_cancel || ctx->moffs != KTIME_MAX)
152		return false;
153	ctx->moffs = ktime_mono_to_real(0);
154	return true;
155}
156
157static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags)
158{
159	spin_lock(&ctx->cancel_lock);
160	if ((ctx->clockid == CLOCK_REALTIME ||
161	     ctx->clockid == CLOCK_REALTIME_ALARM) &&
162	    (flags & TFD_TIMER_ABSTIME) && (flags & TFD_TIMER_CANCEL_ON_SET)) {
163		if (!ctx->might_cancel) {
164			ctx->might_cancel = true;
165			spin_lock(&cancel_lock);
166			list_add_rcu(&ctx->clist, &cancel_list);
167			spin_unlock(&cancel_lock);
168		}
169	} else {
170		__timerfd_remove_cancel(ctx);
171	}
172	spin_unlock(&ctx->cancel_lock);
173}
174
175static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx)
176{
177	ktime_t remaining;
178
179	if (isalarm(ctx))
180		remaining = alarm_expires_remaining(&ctx->t.alarm);
181	else
182		remaining = hrtimer_expires_remaining_adjusted(&ctx->t.tmr);
183
184	return remaining < 0 ? 0: remaining;
185}
186
187static int timerfd_setup(struct timerfd_ctx *ctx, int flags,
188			 const struct itimerspec64 *ktmr)
189{
190	enum hrtimer_mode htmode;
191	ktime_t texp;
192	int clockid = ctx->clockid;
193
194	htmode = (flags & TFD_TIMER_ABSTIME) ?
195		HRTIMER_MODE_ABS: HRTIMER_MODE_REL;
196
197	texp = timespec64_to_ktime(ktmr->it_value);
198	ctx->expired = 0;
199	ctx->ticks = 0;
200	ctx->tintv = timespec64_to_ktime(ktmr->it_interval);
201
202	if (isalarm(ctx)) {
203		alarm_init(&ctx->t.alarm,
204			   ctx->clockid == CLOCK_REALTIME_ALARM ?
205			   ALARM_REALTIME : ALARM_BOOTTIME,
206			   timerfd_alarmproc);
207	} else {
208		hrtimer_setup(&ctx->t.tmr, timerfd_tmrproc, clockid, htmode);
209		hrtimer_set_expires(&ctx->t.tmr, texp);
210	}
211
212	if (texp != 0) {
213		if (flags & TFD_TIMER_ABSTIME)
214			texp = timens_ktime_to_host(clockid, texp);
215		if (isalarm(ctx)) {
216			if (flags & TFD_TIMER_ABSTIME)
217				alarm_start(&ctx->t.alarm, texp);
218			else
219				alarm_start_relative(&ctx->t.alarm, texp);
220		} else {
221			hrtimer_start(&ctx->t.tmr, texp, htmode);
222		}
223
224		if (timerfd_canceled(ctx))
225			return -ECANCELED;
226	}
227
228	ctx->settime_flags = flags & TFD_SETTIME_FLAGS;
229	return 0;
230}
231
232static int timerfd_release(struct inode *inode, struct file *file)
233{
234	struct timerfd_ctx *ctx = file->private_data;
235
236	timerfd_remove_cancel(ctx);
237
238	if (isalarm(ctx))
239		alarm_cancel(&ctx->t.alarm);
240	else
241		hrtimer_cancel(&ctx->t.tmr);
242	kfree_rcu(ctx, rcu);
243	return 0;
244}
245
246static __poll_t timerfd_poll(struct file *file, poll_table *wait)
247{
248	struct timerfd_ctx *ctx = file->private_data;
249	__poll_t events = 0;
250	unsigned long flags;
251
252	poll_wait(file, &ctx->wqh, wait);
253
254	spin_lock_irqsave(&ctx->wqh.lock, flags);
255	if (ctx->ticks)
256		events |= EPOLLIN;
257	spin_unlock_irqrestore(&ctx->wqh.lock, flags);
258
259	return events;
260}
261
262static ssize_t timerfd_read_iter(struct kiocb *iocb, struct iov_iter *to)
263{
264	struct file *file = iocb->ki_filp;
265	struct timerfd_ctx *ctx = file->private_data;
266	ssize_t res;
267	u64 ticks = 0;
268
269	if (iov_iter_count(to) < sizeof(ticks))
270		return -EINVAL;
271
272	spin_lock_irq(&ctx->wqh.lock);
273	if (file->f_flags & O_NONBLOCK || iocb->ki_flags & IOCB_NOWAIT)
274		res = -EAGAIN;
275	else
276		res = wait_event_interruptible_locked_irq(ctx->wqh, ctx->ticks);
277
278	/*
279	 * If clock has changed, we do not care about the
280	 * ticks and we do not rearm the timer. Userspace must
281	 * reevaluate anyway.
282	 */
283	if (timerfd_canceled(ctx)) {
284		ctx->ticks = 0;
285		ctx->expired = 0;
286		res = -ECANCELED;
287	}
288
289	if (ctx->ticks) {
290		ticks = ctx->ticks;
291
292		if (ctx->expired && ctx->tintv) {
293			/*
294			 * If tintv != 0, this is a periodic timer that
295			 * needs to be re-armed. We avoid doing it in the timer
296			 * callback to avoid DoS attacks specifying a very
297			 * short timer period.
298			 */
299			if (isalarm(ctx)) {
300				ticks += alarm_forward_now(
301					&ctx->t.alarm, ctx->tintv) - 1;
302				alarm_restart(&ctx->t.alarm);
303			} else {
304				ticks += hrtimer_forward_now(&ctx->t.tmr,
305							     ctx->tintv) - 1;
306				hrtimer_restart(&ctx->t.tmr);
307			}
308		}
309		ctx->expired = 0;
310		ctx->ticks = 0;
311	}
312	spin_unlock_irq(&ctx->wqh.lock);
313	if (ticks) {
314		res = copy_to_iter(&ticks, sizeof(ticks), to);
315		if (!res)
316			res = -EFAULT;
317	}
318	return res;
319}
320
321#ifdef CONFIG_PROC_FS
322static void timerfd_show(struct seq_file *m, struct file *file)
323{
324	struct timerfd_ctx *ctx = file->private_data;
325	struct timespec64 value, interval;
326
327	spin_lock_irq(&ctx->wqh.lock);
328	value = ktime_to_timespec64(timerfd_get_remaining(ctx));
329	interval = ktime_to_timespec64(ctx->tintv);
330	spin_unlock_irq(&ctx->wqh.lock);
331
332	seq_printf(m,
333		   "clockid: %d\n"
334		   "ticks: %llu\n"
335		   "settime flags: 0%o\n"
336		   "it_value: (%llu, %llu)\n"
337		   "it_interval: (%llu, %llu)\n",
338		   ctx->clockid,
339		   (unsigned long long)ctx->ticks,
340		   ctx->settime_flags,
341		   (unsigned long long)value.tv_sec,
342		   (unsigned long long)value.tv_nsec,
343		   (unsigned long long)interval.tv_sec,
344		   (unsigned long long)interval.tv_nsec);
345}
346#else
347#define timerfd_show NULL
348#endif
349
350#ifdef CONFIG_CHECKPOINT_RESTORE
351static long timerfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
352{
353	struct timerfd_ctx *ctx = file->private_data;
354	int ret = 0;
355
356	switch (cmd) {
357	case TFD_IOC_SET_TICKS: {
358		u64 ticks;
359
360		if (copy_from_user(&ticks, (u64 __user *)arg, sizeof(ticks)))
361			return -EFAULT;
362		if (!ticks)
363			return -EINVAL;
364
365		spin_lock_irq(&ctx->wqh.lock);
366		if (!timerfd_canceled(ctx)) {
367			ctx->ticks = ticks;
368			wake_up_locked_poll(&ctx->wqh, EPOLLIN);
369		} else
370			ret = -ECANCELED;
371		spin_unlock_irq(&ctx->wqh.lock);
372		break;
373	}
374	default:
375		ret = -ENOTTY;
376		break;
377	}
378
379	return ret;
380}
381#else
382#define timerfd_ioctl NULL
383#endif
384
385static const struct file_operations timerfd_fops = {
386	.release	= timerfd_release,
387	.poll		= timerfd_poll,
388	.read_iter	= timerfd_read_iter,
389	.llseek		= noop_llseek,
390	.show_fdinfo	= timerfd_show,
391	.unlocked_ioctl	= timerfd_ioctl,
392};
393
394SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
395{
396	struct timerfd_ctx *ctx __free(kfree) = NULL;
397	int ret;
398
399	/* Check the TFD_* constants for consistency.  */
400	BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
401	BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
402
403	if ((flags & ~TFD_CREATE_FLAGS) ||
404	    (clockid != CLOCK_MONOTONIC &&
405	     clockid != CLOCK_REALTIME &&
406	     clockid != CLOCK_REALTIME_ALARM &&
407	     clockid != CLOCK_BOOTTIME &&
408	     clockid != CLOCK_BOOTTIME_ALARM))
409		return -EINVAL;
410
411	if ((clockid == CLOCK_REALTIME_ALARM ||
412	     clockid == CLOCK_BOOTTIME_ALARM) &&
413	    !capable(CAP_WAKE_ALARM))
414		return -EPERM;
415
416	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
417	if (!ctx)
418		return -ENOMEM;
419
420	init_waitqueue_head(&ctx->wqh);
421	spin_lock_init(&ctx->cancel_lock);
422	ctx->clockid = clockid;
423
424	if (isalarm(ctx))
425		alarm_init(&ctx->t.alarm,
426			   ctx->clockid == CLOCK_REALTIME_ALARM ?
427			   ALARM_REALTIME : ALARM_BOOTTIME,
428			   timerfd_alarmproc);
429	else
430		hrtimer_setup(&ctx->t.tmr, timerfd_tmrproc, clockid, HRTIMER_MODE_ABS);
431
432	ctx->moffs = ktime_mono_to_real(0);
433
434	ret = FD_ADD(flags & TFD_SHARED_FCNTL_FLAGS,
435		     anon_inode_getfile_fmode("[timerfd]", &timerfd_fops, ctx,
436					      O_RDWR | (flags & TFD_SHARED_FCNTL_FLAGS),
437					      FMODE_NOWAIT));
438	if (ret >= 0)
439		retain_and_null_ptr(ctx);
440	return ret;
441}
442
443static int do_timerfd_settime(int ufd, int flags, 
444		const struct itimerspec64 *new,
445		struct itimerspec64 *old)
446{
447	struct timerfd_ctx *ctx;
448	int ret;
449
450	if ((flags & ~TFD_SETTIME_FLAGS) ||
451		 !itimerspec64_valid(new))
452		return -EINVAL;
453
454	CLASS(fd, f)(ufd);
455	if (fd_empty(f))
456		return -EBADF;
457
458	if (fd_file(f)->f_op != &timerfd_fops)
459		return -EINVAL;
460
461	ctx = fd_file(f)->private_data;
462
463	if (isalarm(ctx) && !capable(CAP_WAKE_ALARM))
464		return -EPERM;
465
466	timerfd_setup_cancel(ctx, flags);
467
468	/*
469	 * We need to stop the existing timer before reprogramming
470	 * it to the new values.
471	 */
472	for (;;) {
473		spin_lock_irq(&ctx->wqh.lock);
474
475		if (isalarm(ctx)) {
476			if (alarm_try_to_cancel(&ctx->t.alarm) >= 0)
477				break;
478		} else {
479			if (hrtimer_try_to_cancel(&ctx->t.tmr) >= 0)
480				break;
481		}
482		spin_unlock_irq(&ctx->wqh.lock);
483
484		if (isalarm(ctx))
485			hrtimer_cancel_wait_running(&ctx->t.alarm.timer);
486		else
487			hrtimer_cancel_wait_running(&ctx->t.tmr);
488	}
489
490	/*
491	 * If the timer is expired and it's periodic, we need to advance it
492	 * because the caller may want to know the previous expiration time.
493	 * We do not update "ticks" and "expired" since the timer will be
494	 * re-programmed again in the following timerfd_setup() call.
495	 */
496	if (ctx->expired && ctx->tintv) {
497		if (isalarm(ctx))
498			alarm_forward_now(&ctx->t.alarm, ctx->tintv);
499		else
500			hrtimer_forward_now(&ctx->t.tmr, ctx->tintv);
501	}
502
503	old->it_value = ktime_to_timespec64(timerfd_get_remaining(ctx));
504	old->it_interval = ktime_to_timespec64(ctx->tintv);
505
506	/*
507	 * Re-program the timer to the new value ...
508	 */
509	ret = timerfd_setup(ctx, flags, new);
510
511	spin_unlock_irq(&ctx->wqh.lock);
512	return ret;
513}
514
515static int do_timerfd_gettime(int ufd, struct itimerspec64 *t)
516{
517	struct timerfd_ctx *ctx;
518	CLASS(fd, f)(ufd);
519
520	if (fd_empty(f))
521		return -EBADF;
522	if (fd_file(f)->f_op != &timerfd_fops)
523		return -EINVAL;
524	ctx = fd_file(f)->private_data;
525
526	spin_lock_irq(&ctx->wqh.lock);
527	if (ctx->expired && ctx->tintv) {
528		ctx->expired = 0;
529
530		if (isalarm(ctx)) {
531			ctx->ticks +=
532				alarm_forward_now(
533					&ctx->t.alarm, ctx->tintv) - 1;
534			alarm_restart(&ctx->t.alarm);
535		} else {
536			ctx->ticks +=
537				hrtimer_forward_now(&ctx->t.tmr, ctx->tintv)
538				- 1;
539			hrtimer_restart(&ctx->t.tmr);
540		}
541	}
542	t->it_value = ktime_to_timespec64(timerfd_get_remaining(ctx));
543	t->it_interval = ktime_to_timespec64(ctx->tintv);
544	spin_unlock_irq(&ctx->wqh.lock);
545	return 0;
546}
547
548SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
549		const struct __kernel_itimerspec __user *, utmr,
550		struct __kernel_itimerspec __user *, otmr)
551{
552	struct itimerspec64 new, old;
553	int ret;
554
555	if (get_itimerspec64(&new, utmr))
556		return -EFAULT;
557	ret = do_timerfd_settime(ufd, flags, &new, &old);
558	if (ret)
559		return ret;
560	if (otmr && put_itimerspec64(&old, otmr))
561		return -EFAULT;
562
563	return ret;
564}
565
566SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct __kernel_itimerspec __user *, otmr)
567{
568	struct itimerspec64 kotmr;
569	int ret = do_timerfd_gettime(ufd, &kotmr);
570	if (ret)
571		return ret;
572	return put_itimerspec64(&kotmr, otmr) ? -EFAULT : 0;
573}
574
575#ifdef CONFIG_COMPAT_32BIT_TIME
576SYSCALL_DEFINE4(timerfd_settime32, int, ufd, int, flags,
577		const struct old_itimerspec32 __user *, utmr,
578		struct old_itimerspec32 __user *, otmr)
579{
580	struct itimerspec64 new, old;
581	int ret;
582
583	if (get_old_itimerspec32(&new, utmr))
584		return -EFAULT;
585	ret = do_timerfd_settime(ufd, flags, &new, &old);
586	if (ret)
587		return ret;
588	if (otmr && put_old_itimerspec32(&old, otmr))
589		return -EFAULT;
590	return ret;
591}
592
593SYSCALL_DEFINE2(timerfd_gettime32, int, ufd,
594		struct old_itimerspec32 __user *, otmr)
595{
596	struct itimerspec64 kotmr;
597	int ret = do_timerfd_gettime(ufd, &kotmr);
598	if (ret)
599		return ret;
600	return put_old_itimerspec32(&kotmr, otmr) ? -EFAULT : 0;
601}
602#endif