[Deepin-Kernel-SIG] [linux 6.6.y] [Upstream] futex: More futex2 bits from mainline-v6.7#1812
[Deepin-Kernel-SIG] [linux 6.6.y] [Upstream] futex: More futex2 bits from mainline-v6.7#1812opsiff wants to merge 13 commits into
Conversation
mainline inclusion from mainline-v6.7-rc1 category: feature sys_futex_waitv() is part of the futex2 series (the first and only so far) of syscalls and has a flags field per futex (as opposed to flags being encoded in the futex op). This new flags field has a new namespace, which unfortunately isn't super explicit. Notably it currently takes FUTEX_32 and FUTEX_PRIVATE_FLAG. Introduce the FUTEX2 namespace to clarify this Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://lore.kernel.org/r/20230921105247.507327749@noisy.programming.kicks-ass.net (cherry picked from commit 4923954) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc1 category: feature Add the definition for the missing but always intended extra sizes, and add a NUMA flag for the planned numa extention. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://lore.kernel.org/r/20230921105247.617057368@noisy.programming.kicks-ass.net (cherry picked from commit d6d08d2) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc1 category: feature Futex has 3 sets of flags: - legacy futex op bits - futex2 flags - internal flags Add a few helpers to convert from the API flags into the internal flags. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://lore.kernel.org/r/20230921105247.722140574@noisy.programming.kicks-ass.net (cherry picked from commit 5694289) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc1 category: feature Ensure the futex value fits in the given futex size. Since this adds a constraint to an existing syscall, it might possibly change behaviour. Currently the value would be truncated to a u32 and any high bits would get silently lost. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/20230921105247.828934099@noisy.programming.kicks-ass.net (cherry picked from commit 698eb82) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc1 category: feature To complement sys_futex_waitv() add sys_futex_wake(). This syscall implements what was previously known as FUTEX_WAKE_BITSET except it uses 'unsigned long' for the bitmask and takes FUTEX2 flags. The 'unsigned long' allows FUTEX2_SIZE_U64 on 64bit platforms. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://lore.kernel.org/r/20230921105247.936205525@noisy.programming.kicks-ass.net (cherry picked from commit 9f6c532) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc1 category: feature The current semantics for futex_wake() are a bit loose, specifically asking for 0 futexes to be woken actually gets you 1. Adding a !nr check to sys_futex_wake() makes that it would return 0 for unaligned futex words, because that check comes in the shared futex_wake() function. Adding the !nr check there, would affect the legacy sys_futex() semantics. Hence frob a flag :-( Suggested-by: André Almeida <andrealmeid@igalia.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/20230921105248.048643656@noisy.programming.kicks-ass.net (cherry picked from commit 43adf84) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc1 category: feature To complement sys_futex_waitv()/wake(), add sys_futex_wait(). This syscall implements what was previously known as FUTEX_WAIT_BITSET except it uses 'unsigned long' for the value and bitmask arguments, takes timespec and clockid_t arguments for the absolute timeout and uses FUTEX2 flags. The 'unsigned long' allows FUTEX2_SIZE_U64 on 64bit platforms. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://lore.kernel.org/r/20230921105248.164324363@noisy.programming.kicks-ass.net (cherry picked from commit cb8c431) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc1 category: feature Instead of only passing FLAGS_SHARED as a boolean, pass down flags as a whole. No functional change intended. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/20230921105248.282857501@noisy.programming.kicks-ass.net Conflicts: kernel/futex/pi.c (cherry picked from commit 3b63a55) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc1 category: feature In order to support mixed size requeue, add a second flags argument to the internal futex_requeue() function. No functional change intended. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/20230921105248.396780136@noisy.programming.kicks-ass.net (cherry picked from commit 27b88f3) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion
from mainline-v6.7-rc1
category: feature
Finish off the 'simple' futex2 syscall group by adding
sys_futex_requeue(). Unlike sys_futex_{wait,wake}() its arguments are
too numerous to fit into a regular syscall. As such, use struct
futex_waitv to pass the 'source' and 'destination' futexes to the
syscall.
This syscall implements what was previously known as FUTEX_CMP_REQUEUE
and uses {val, uaddr, flags} for source and {uaddr, flags} for
destination.
This design explicitly allows requeueing between different types of
futex by having a different flags word per uaddr.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20230921105248.511860556@noisy.programming.kicks-ass.net
(cherry picked from commit 0f4b5f9)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Reviewer's GuideBackports additional futex2 infrastructure from upstream: it introduces proper FUTEX2 flag and size handling, new futex2 syscalls (wait/wake/requeue), refactors timeout handling and core wait logic to be reusable, and threads the new internal flag representation through the futex core, wait/wake, requeue, PI, and syscall tables across architectures. Sequence diagram for futex2 futex_wait syscall pathsequenceDiagram
actor Userspace
participant sys_futex_wait as sys_futex_wait
participant futex2_to_flags as futex2_to_flags
participant futex2_setup_timeout as futex2_setup_timeout
participant __futex_wait as __futex_wait
participant futex_wait_setup as futex_wait_setup
participant futex_wait_queue as futex_wait_queue
participant futex_unqueue as futex_unqueue
Userspace->>sys_futex_wait: futex_wait(uaddr, val, mask, flags, timeout, clockid)
sys_futex_wait->>futex2_to_flags: futex2_to_flags(flags)
futex2_to_flags-->>sys_futex_wait: internal_flags
sys_futex_wait->>sys_futex_wait: futex_flags_valid(internal_flags)
sys_futex_wait->>sys_futex_wait: futex_validate_input(internal_flags, val)
sys_futex_wait->>sys_futex_wait: futex_validate_input(internal_flags, mask)
alt timeout provided
sys_futex_wait->>futex2_setup_timeout: futex2_setup_timeout(timeout, clockid, &to)
futex2_setup_timeout-->>sys_futex_wait: ret
end
sys_futex_wait->>__futex_wait: __futex_wait(uaddr, internal_flags, val, to, mask)
__futex_wait->>futex_wait_setup: futex_wait_setup(uaddr, val, internal_flags, &q, &hb)
futex_wait_setup-->>__futex_wait: ret
__futex_wait->>futex_wait_queue: futex_wait_queue(hb, &q, to)
futex_wait_queue-->>__futex_wait: wake/timeout/signal
__futex_wait->>futex_unqueue: futex_unqueue(&q)
futex_unqueue-->>__futex_wait: result
__futex_wait-->>sys_futex_wait: ret
alt timeout used
sys_futex_wait->>sys_futex_wait: futex2_destroy_timeout(&to)
end
sys_futex_wait-->>Userspace: result/errno
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
stable inclusion from stable-v6.18.21 category: bugfix [ Upstream commit 19f94b39058681dec64a10ebeb6f23fe7fc3f77a ] Nicholas reported that his LLM found it was possible to create a UaF when sys_futex_requeue() is used with different flags. The initial motivation for allowing different flags was the variable sized futex, but since that hasn't been merged (yet), simply mandate the flags are identical, as is the case for the old style sys_futex() requeue operations. Fixes: 0f4b5f9 ("futex: Add sys_futex_requeue()") Reported-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 18b7d09c2b794c71d4252f3ea2cf84ad12b73d6a) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc1 category: bugfix As per Arnd, Alpha syscalls since time64 are offset by 120, retain this offset. Fixes: 9f6c532 ("futex: Add sys_futex_wake()") Reported-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/cb4bb8e2-7dfe-4ca4-aa70-060f7b2f8f95@app.fastmail.com (cherry picked from commit dcc1345) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mainline inclusion from mainline-v6.7-rc2 category: bugfix Xi reported that commit 5694289 ("futex: Flag conversion") broke glibc's robust futex tests. This was narrowed down to the change of FLAGS_SHARED from 0x01 to 0x10, at which point Florian noted that handle_futex_death() has a hardcoded flags argument of 1. Change this to: FLAGS_SIZE_32 | FLAGS_SHARED, matching how futex_to_flags() unconditionally sets FLAGS_SIZE_32 for all legacy futex ops. Reported-by: Xi Ruoyao <xry111@xry111.site> Reported-by: Florian Weimer <fweimer@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://lkml.kernel.org/r/20231114201402.GA25315@noisy.programming.kicks-ass.net Fixes: 5694289 ("futex: Flag conversion") Cc: <stable@vger.kernel.org> (cherry picked from commit c9bd156) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
There was a problem hiding this comment.
Pull request overview
This pull request backports additional futex2 pieces by introducing futex2 wake/wait/requeue syscalls and refactoring the futex core to use a unified internal FLAGS_* encoding (size/shared/clock/strict/NUMA) across classic futex and futex2 paths.
Changes:
- Add futex2 syscalls:
futex_wake,futex_wait, andfutex_requeue, plus wire them into syscall tables andsys_nifallbacks. - Refactor futex internals to pass a per-futex
flagsword (instead of shared/private booleans) into keying, requeue, and wait paths; centralize futex2 timeout setup/teardown. - Extend/clarify futex2 uapi flag definitions (size bits, NUMA bit, private flag reuse) and add internal helpers for flag conversion and input validation.
Reviewed changes
Copilot reviewed 28 out of 28 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| kernel/sys_ni.c | Add conditional syscall stubs for the new futex2 syscalls. |
| kernel/futex/waitwake.c | Switch keying to flags, add __futex_wait() helper, and adjust futex_waitv flag handling. |
| kernel/futex/syscalls.c | Add futex2 syscalls + futex2 timeout helper; convert classic futex op→flags handling. |
| kernel/futex/requeue.c | Update futex_requeue() API to accept per-futex flag sets; pass flags into keying. |
| kernel/futex/pi.c | Update PI paths to pass full flags into get_futex_key(). |
| kernel/futex/futex.h | Introduce unified FLAGS_* encoding and conversion/validation helpers; update prototypes. |
| kernel/futex/core.c | Change get_futex_key() signature to accept flags and derive fshared internally. |
| include/uapi/linux/futex.h | Define futex2 flag bit layout (size/NUMA/private) and keep historical FUTEX_32. |
| include/uapi/asm-generic/unistd.h | Allocate syscall numbers for futex2 wake/wait/requeue and bump __NR_syscalls. |
| include/linux/syscalls.h | Add prototypes for sys_futex_wake, sys_futex_wait, sys_futex_requeue. |
| arch/xtensa/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries. |
| arch/x86/entry/syscalls/syscall_64.tbl | Add futex2 syscall table entries. |
| arch/x86/entry/syscalls/syscall_32.tbl | Add futex2 syscall table entries. |
| arch/sparc/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries. |
| arch/sh/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries. |
| arch/s390/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries. |
| arch/powerpc/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries. |
| arch/parisc/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries. |
| arch/mips/kernel/syscalls/syscall_o32.tbl | Add futex2 syscall table entries. |
| arch/mips/kernel/syscalls/syscall_n64.tbl | Add futex2 syscall table entries. |
| arch/mips/kernel/syscalls/syscall_n32.tbl | Add futex2 syscall table entries. |
| arch/microblaze/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries. |
| arch/m68k/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries. |
| arch/ia64/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries. |
| arch/arm64/include/asm/unistd32.h | Add futex2 compat syscall numbers. |
| arch/arm64/include/asm/unistd.h | Bump compat syscall count. |
| arch/arm/tools/syscall.tbl | Add futex2 syscall table entries. |
| arch/alpha/kernel/syscalls/syscall.tbl | Add futex2 syscall table entries in alpha numbering space. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if ((flags & FLAGS_STRICT) && !nr_wake) | ||
| return 0; |
| u32 __user *uaddr = (u32 __user *)(unsigned long)vs[i].w.uaddr; | ||
| struct futex_q *q = &vs[i].q; | ||
| u32 val = (u32)vs[i].w.val; | ||
| u32 val = vs[i].w.val; | ||
|
|
||
| hb = futex_q_lock(q); |
| * get_futex_key() - Get parameters which are the keys for a futex | ||
| * @uaddr: virtual address of the futex | ||
| * @fshared: false for a PROCESS_PRIVATE futex, true for PROCESS_SHARED | ||
| * @flags: FLAGS_* | ||
| * @key: address where result is stored. | ||
| * @rw: mapping needs to be read/write (values: FUTEX_READ, |
| * Identical to the traditional FUTEX_WAIT_BITSET op, except it is part of the | ||
| * futex2 familiy of calls. | ||
| */ |

Link: https://lore.kernel.org/all/20230921104505.717750284@noisy.programming.kicks-ass.net/
Hi!
New version of the futex2 patches. Futex2 is a new interface to the same 'old'
futex core. An attempt to get away from the multiplex syscall and add a little
room for extentions.
Changes since v2:
My plan is to push the first 10 patches (all the syscalls) into
tip/locking/core this afternoon. All those patches have plenty review tags
including from Thomas who is the actual maintainer of this lot :-)
This should be plenty for Jens to get a move on with the io-uring stuff.
I'm holding off on the NUMA bits for now, because I want to write some
userspace for it since there is some confusion on that -- but I seem to keep
getting side-tracked :/
Patches also available at:
git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git locking/core
git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git locking/futex
Where the locking/core thing is the first 10 patches only, and barring Link
tags (which I'll harvest from this posting), will be what I'll push out to tip.
Summary by Sourcery
Introduce futex2 syscall support and shared futex core refactoring to enable new interfaces while preserving existing semantics.
New Features:
Enhancements: