For all commands except FUTEX_WAIT, timeout is interpreted as an absolute value. This absolute value is inside the task's time namespace and has to be converted to the host's time.
Cc: stable@vger.kernel.org Fixes: 5a590f35add9 ("posix-clocks: Wire up clock_gettime() with timens offsets") Reported-by: Hans van der Laan j.h.vanderlaan@student.utwente.nl Signed-off-by: Andrei Vagin avagin@gmail.com ---
v2: * check FUTEX_CLOCK_REALTIME properly * fix futex_time32 too
kernel/futex.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/kernel/futex.c b/kernel/futex.c index a5876694a60e..32056d2d4171 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -39,6 +39,7 @@ #include <linux/freezer.h> #include <linux/memblock.h> #include <linux/fault-inject.h> +#include <linux/time_namespace.h>
#include <asm/futex.h>
@@ -3797,6 +3798,8 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, t = timespec64_to_ktime(ts); if (cmd == FUTEX_WAIT) t = ktime_add_safe(ktime_get(), t); + else if (!(op & FUTEX_CLOCK_REALTIME)) + t = timens_ktime_to_host(CLOCK_MONOTONIC, t); tp = &t; } /* @@ -3989,6 +3992,8 @@ SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val, t = timespec64_to_ktime(ts); if (cmd == FUTEX_WAIT) t = ktime_add_safe(ktime_get(), t); + else if (!(op & FUTEX_CLOCK_REALTIME)) + t = timens_ktime_to_host(CLOCK_MONOTONIC, t); tp = &t; } if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||