linux-kernel - [RFC][PATCH 09/10] futex: Enable FUTEX2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230714141219.215288670@infradead.org>
Date:   Fri, 14 Jul 2023 15:39:08 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     tglx@...utronix.de, axboe@...nel.dk
Cc:     linux-kernel@...r.kernel.org, peterz@...radead.org,
        mingo@...hat.com, dvhart@...radead.org, dave@...olabs.net,
        andrealmeid@...lia.com, Andrew Morton <akpm@...ux-foundation.org>,
        urezki@...il.com, hch@...radead.org, lstoakes@...il.com,
        Arnd Bergmann <arnd@...db.de>, linux-api@...r.kernel.org,
        linux-mm@...ck.org, linux-arch@...r.kernel.org,
        malteskarupke@....de
Subject: [RFC][PATCH 09/10] futex: Enable FUTEX2_{8,16}

When futexes are no longer u32 aligned, the lower offset bits are no
longer available to put type info in. However, since offset is the
offset within a page, there are plenty bits available on the top end.

After that, pass flags into futex_get_value_locked() for WAIT and
disallow FUTEX2_64 instead of mandating FUTEX2_32.

Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
---
 include/linux/futex.h   |   11 ++++++-----
 kernel/futex/syscalls.c |    4 ++--
 kernel/futex/waitwake.c |    4 ++--
 3 files changed, 10 insertions(+), 9 deletions(-)

--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -16,18 +16,19 @@ struct task_struct;
  * The key type depends on whether it's a shared or private mapping.
  * Don't rearrange members without looking at hash_futex().
  *
- * offset is aligned to a multiple of sizeof(u32) (== 4) by definition.
- * We use the two low order bits of offset to tell what is the kind of key :
+ * offset is the position within a page and is in the range [0, PAGE_SIZE).
+ * The high bits of the offset indicate what kind of key this is:
  *  00 : Private process futex (PTHREAD_PROCESS_PRIVATE)
  *       (no reference on an inode or mm)
  *  01 : Shared futex (PTHREAD_PROCESS_SHARED)
  *	mapped on a file (reference on the underlying inode)
  *  10 : Shared futex (PTHREAD_PROCESS_SHARED)
  *       (but private mapping on an mm, and reference taken on it)
-*/
+ */
 
-#define FUT_OFF_INODE    1 /* We set bit 0 if key has a reference on inode */
-#define FUT_OFF_MMSHARED 2 /* We set bit 1 if key has a reference on mm */
+#define FUT_OFF_INODE    (PAGE_SIZE << 0)
+#define FUT_OFF_MMSHARED (PAGE_SIZE << 1)
+#define FUT_OFF_SIZE	 (PAGE_SIZE << 2)
 
 union futex_key {
 	struct {
--- a/kernel/futex/syscalls.c
+++ b/kernel/futex/syscalls.c
@@ -206,7 +206,7 @@ static int futex_parse_waitv(struct fute
 		if ((aux.flags & ~FUTEX2_MASK) || aux.__reserved)
 			return -EINVAL;
 
-		if ((aux.flags & FUTEX2_64) != FUTEX2_32)
+		if ((aux.flags & FUTEX2_64) == FUTEX2_64)
 			return -EINVAL;
 
 		flags = futex2_to_flags(aux.flags);
@@ -334,7 +334,7 @@ SYSCALL_DEFINE4(futex_wake,
 	if (flags & ~FUTEX2_MASK)
 		return -EINVAL;
 
-	if ((flags & FUTEX2_64) != FUTEX2_32)
+	if ((flags & FUTEX2_64) == FUTEX2_64)
 		return -EINVAL;
 
 	flags = futex2_to_flags(flags);
--- a/kernel/futex/waitwake.c
+++ b/kernel/futex/waitwake.c
@@ -439,7 +439,7 @@ static int futex_wait_multiple_setup(str
 		u32 val = vs[i].w.val;
 
 		hb = futex_q_lock(q);
-		ret = futex_get_value_locked(&uval, uaddr, FLAGS_SIZE_32);
+		ret = futex_get_value_locked(&uval, uaddr, flags);
 
 		if (!ret && uval == val) {
 			/*
@@ -607,7 +607,7 @@ int futex_wait_setup(u32 __user *uaddr,
 retry_private:
 	*hb = futex_q_lock(q);
 
-	ret = futex_get_value_locked(&uval, uaddr, FLAGS_SIZE_32);
+	ret = futex_get_value_locked(&uval, uaddr, flags);
 
 	if (ret) {
 		futex_q_unlock(*hb);