This is part of a longer set of changes to clean up the last remaining
bits for the y2038 conversion. In XFS, three distinct problems need to
be addressed:
1. The use of time_t in kernel sources -- I'm in the process
of removing all of them so we can remove the definition itself,
making it harder to write new y2038-unsafe code. This part is
trivially done as a side-effect of the other two.
2. The use of time_t in a user API header for ioctls. When
building against a new 32-bit libc with 64-bit time_t, the structures
no longer match and we get incorrect data from ioctls. Unfortunately,
there is no good way to fix XFS_IOC_FSBULKSTAT, I considered different
approaches and in the end came up with three variants that are all
part of this series. The idea is to pick just one of course.
3. On-disk timestamps hitting the y2038 limit. This applies to both
inode timestamps and quota data. Both are extended to 40 bits,
with the minimum timestamp still being year 1902, and the maximum
getting extended from 2038 to 36744.
Please review and let me know which of ioctl API changes makes the
most sense. I have not done any actual runtime testing on the patches,
so this is clearly too late for the next merge window, but I hope to
get it all merged for v5.6.
Arnd
Arnd Bergmann (5):
xfs: [variant A] avoid time_t in user api
xfs: [variant B] add time64 version of xfs_bstat
xfs: [variant C] avoid i386-misaligned xfs_bstat
xfs: extend inode format for 40-bit timestamps
xfs: use 40-bit quota time limits
fs/xfs/libxfs/xfs_dquot_buf.c | 6 +-
fs/xfs/libxfs/xfs_format.h | 11 +-
fs/xfs/libxfs/xfs_fs.h | 37 +++++-
fs/xfs/libxfs/xfs_inode_buf.c | 28 +++--
fs/xfs/libxfs/xfs_inode_buf.h | 1 +
fs/xfs/libxfs/xfs_log_format.h | 6 +-
fs/xfs/libxfs/xfs_trans_inode.c | 3 +-
fs/xfs/xfs_dquot.c | 29 +++--
fs/xfs/xfs_inode.c | 3 +-
fs/xfs/xfs_inode_item.c | 10 +-
fs/xfs/xfs_ioctl.c | 195 +++++++++++++++++++++++++++++++-
fs/xfs/xfs_ioctl.h | 12 ++
fs/xfs/xfs_ioctl32.c | 160 +++++---------------------
fs/xfs/xfs_ioctl32.h | 26 ++---
fs/xfs/xfs_iops.c | 3 +-
fs/xfs/xfs_itable.c | 2 +-
fs/xfs/xfs_qm.c | 18 ++-
fs/xfs/xfs_qm.h | 6 +-
fs/xfs/xfs_qm_syscalls.c | 16 ++-
fs/xfs/xfs_quotaops.c | 6 +-
fs/xfs/xfs_super.c | 2 +-
fs/xfs/xfs_trans_dquot.c | 17 ++-
22 files changed, 387 insertions(+), 210 deletions(-)
--
2.20.0
Most kernel interfaces that take a timespec require normalized
representation with tv_nsec between 0 and NSEC_PER_SEC.
Passing values larger than 0x100000000ull further behaves differently
on 32-bit and 64-bit kernels, and can cause the latter to spend a long
time counting seconds in timespec64_sub()/set_normalized_timespec64().
Reject those large values at the user interface to enforce sane and
portable behavior.
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
drivers/gpu/drm/etnaviv/etnaviv_drv.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
index 1f9c01be40d7..95d72dc00280 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
@@ -297,6 +297,9 @@ static int etnaviv_ioctl_gem_cpu_prep(struct drm_device *dev, void *data,
if (args->op & ~(ETNA_PREP_READ | ETNA_PREP_WRITE | ETNA_PREP_NOSYNC))
return -EINVAL;
+ if (args->timeout.tv_nsec > NSEC_PER_SEC)
+ return -EINVAL;
+
obj = drm_gem_object_lookup(file, args->handle);
if (!obj)
return -ENOENT;
@@ -360,6 +363,9 @@ static int etnaviv_ioctl_wait_fence(struct drm_device *dev, void *data,
if (args->flags & ~(ETNA_WAIT_NONBLOCK))
return -EINVAL;
+ if (args->timeout.tv_nsec > NSEC_PER_SEC)
+ return -EINVAL;
+
if (args->pipe >= ETNA_MAX_PIPES)
return -EINVAL;
@@ -411,6 +417,9 @@ static int etnaviv_ioctl_gem_wait(struct drm_device *dev, void *data,
if (args->flags & ~(ETNA_WAIT_NONBLOCK))
return -EINVAL;
+ if (args->timeout.tv_nsec > NSEC_PER_SEC)
+ return -EINVAL;
+
if (args->pipe >= ETNA_MAX_PIPES)
return -EINVAL;
--
2.20.0
I'm in the process of finishing up the last bits on y2038-unsafe
code in the kernel, this series is for v4l2, which has no problem
with overflow, but has multiple ioctls that break with user space
built against a new 32-bit libc.
I posted similar patches as part of a series back in 2015, the
new version was rewritten from scratch and I double-checked with
the old version to make sure I did not miss anything I had already
taken care of before.
Hans Verkuil worked on a different patch set in 2017, but this
also did not get to the point of being merged.
My new version contains compat-ioctl support, which the old one
did not and should be complete, but given its size likely contains
bugs. I did randconfig build tests, but no runtime test, so
careful review as well as testing would be much appreciated.
With this version, the newly added code takes care of the existing
ABI, while the existing code got moved to the 64-bit time_t
interface and is used internally. This means that testing with
existing binaries should exercise most of the modifications
and if that works and doesn't get shot down in review, we can
probably live without testing the new ABI explicitly.
I'm not entirely happy with the compat-ioctl implementation that
adds quite a bit of code duplication, but I hope this is
acceptable anyway, as a better implementation would likely
require a larger refactoring of the compat-ioctl file, while
my approach simply adds support for the additional data structure
variants.
The patches apply cleanly on either v5.4-rc4 or the media-tree
master branch. I uploaded a copy to [2] for easier testing.
Arnd
[1] https://lwn.net/Articles/657754/
[2] https://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground.git/log/?h=…
Arnd Bergmann (8):
media: documentation: fix video_event description
media: v4l2: abstract timeval handling in v4l2_buffer
media: v4l2-core: ignore native command codes
media: v4l2-core: split out data copy from video_usercopy
media: v4l2-core: fix VIDIOC_DQEVENT for time64 ABI
media: v4l2-core: fix v4l2_buffer handling for time64 ABI
media: v4l2-core: fix compat VIDIOC_DQEVENT for time64 ABI
media: v4l2-core: fix compat v4l2_buffer handling for time64 ABI
.../media/uapi/dvb/video-get-event.rst | 2 +-
Documentation/media/uapi/dvb/video_types.rst | 2 +-
.../media/common/videobuf2/videobuf2-v4l2.c | 4 +-
drivers/media/pci/meye/meye.c | 4 +-
drivers/media/usb/cpia2/cpia2_v4l.c | 4 +-
drivers/media/usb/stkwebcam/stk-webcam.c | 2 +-
drivers/media/usb/usbvision/usbvision-video.c | 4 +-
drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 464 +++++++++++++++---
drivers/media/v4l2-core/v4l2-event.c | 5 +-
drivers/media/v4l2-core/v4l2-ioctl.c | 186 +++++--
drivers/media/v4l2-core/v4l2-subdev.c | 20 +-
drivers/media/v4l2-core/videobuf-core.c | 4 +-
include/linux/videodev2.h | 17 +-
include/trace/events/v4l2.h | 2 +-
include/uapi/linux/videodev2.h | 72 +++
15 files changed, 660 insertions(+), 132 deletions(-)
--
2.20.0
Hi Vinvenzo,
I'm looking through some of the remaining y2038 work, and noticed
that arch/arm64 has the new generic vdso implementation, but arch/arm
does.
Do you patches for using the same code on arch/arm?
Arnd
All system calls use struct __kernel_timespec instead of the old struct
timespec, but this one was just added with the old-style ABI. Change it
now to enforce the use of __kernel_timespec, avoiding ABI confusion and
the need for compat handlers on 32-bit architectures.
Any user space caller will have to use __kernel_timespec now, but this
is unambiguous and works for any C library regardless of the time_t
definition. A nicer way to specify the timeout would have been a less
ambiguous 64-bit nanosecond value, but I suppose it's too late now to
change that as this would impact both 32-bit and 64-bit users.
Fixes: 5262f567987d ("io_uring: IORING_OP_TIMEOUT support")
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
fs/io_uring.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index aa8ac557493c..8a0381f1a43b 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1892,15 +1892,15 @@ static int io_timeout(struct io_kiocb *req, const struct io_uring_sqe *sqe)
unsigned count, req_dist, tail_index;
struct io_ring_ctx *ctx = req->ctx;
struct list_head *entry;
- struct timespec ts;
+ struct timespec64 ts;
if (unlikely(ctx->flags & IORING_SETUP_IOPOLL))
return -EINVAL;
if (sqe->flags || sqe->ioprio || sqe->buf_index || sqe->timeout_flags ||
sqe->len != 1)
return -EINVAL;
- if (copy_from_user(&ts, (void __user *) (unsigned long) sqe->addr,
- sizeof(ts)))
+
+ if (get_timespec64(&ts, u64_to_user_ptr(sqe->addr)))
return -EFAULT;
/*
@@ -1934,7 +1934,7 @@ static int io_timeout(struct io_kiocb *req, const struct io_uring_sqe *sqe)
hrtimer_init(&req->timeout.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
req->timeout.timer.function = io_timeout_fn;
- hrtimer_start(&req->timeout.timer, timespec_to_ktime(ts),
+ hrtimer_start(&req->timeout.timer, timespec64_to_ktime(ts),
HRTIMER_MODE_REL);
return 0;
}
--
2.20.0
The following changes since commit a55aa89aab90fae7c815b0551b07be37db359d76:
Linux 5.3-rc6 (2019-08-25 12:01:23 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground.git
tags/y2038-vfs
for you to fetch changes up to cba465b4f9820b0d929822a70341dde14909fc18:
ext4: Reduce ext4 timestamp warnings (2019-09-04 22:54:53 +0200)
----------------------------------------------------------------
y2038: add inode timestamp clamping
This series from Deepa Dinamani adds a per-superblock minimum/maximum
timestamp limit for a file system, and clamps timestamps as they are
written, to avoid random behavior from integer overflow as well as having
different time stamps on disk vs in memory.
At mount time, a warning is now printed for any file system that can
represent current timestamps but not future timestamps more than 30
years into the future, similar to the arbitrary 30 year limit that was
added to settimeofday().
This was picked as a compromise to warn users to migrate to other file
systems (e.g. ext4 instead of ext3) when they need the file system to
survive beyond 2038 (or similar limits in other file systems), but not
get in the way of normal usage.
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
----------------------------------------------------------------
Arnd Bergmann (1):
Merge branch 'limits' of https://github.com/deepa-hub/vfs into y2038
Deepa Dinamani (19):
vfs: Add file timestamp range support
vfs: Add timestamp_truncate() api
timestamp_truncate: Replace users of timespec64_trunc
mount: Add mount warning for impending timestamp expiry
utimes: Clamp the timestamps before update
fs: Fill in max and min timestamps in superblock
9p: Fill min and max timestamps in sb
ext4: Initialize timestamps limits
fs: nfs: Initialize filesystem timestamp ranges
fs: cifs: Initialize filesystem timestamp ranges
fs: fat: Initialize filesystem timestamp ranges
fs: affs: Initialize filesystem timestamp ranges
fs: sysv: Initialize filesystem timestamp ranges
fs: ceph: Initialize filesystem timestamp ranges
fs: hpfs: Initialize filesystem timestamp ranges
fs: omfs: Initialize filesystem timestamp ranges
pstore: fs superblock limits
isofs: Initialize filesystem timestamp ranges
ext4: Reduce ext4 timestamp warnings
fs/9p/vfs_super.c | 6 +++++-
fs/affs/amigaffs.c | 2 +-
fs/affs/amigaffs.h | 3 +++
fs/affs/inode.c | 4 ++--
fs/affs/super.c | 4 ++++
fs/attr.c | 21 ++++++++++++---------
fs/befs/linuxvfs.c | 2 ++
fs/bfs/inode.c | 2 ++
fs/ceph/super.c | 2 ++
fs/cifs/cifsfs.c | 22 ++++++++++++++++++++++
fs/cifs/netmisc.c | 14 +++++++-------
fs/coda/inode.c | 3 +++
fs/configfs/inode.c | 12 ++++++------
fs/cramfs/inode.c | 2 ++
fs/efs/super.c | 2 ++
fs/ext2/super.c | 2 ++
fs/ext4/ext4.h | 8 +++++++-
fs/ext4/super.c | 17 +++++++++++++++--
fs/f2fs/file.c | 21 ++++++++++++---------
fs/fat/inode.c | 12 ++++++++++++
fs/freevxfs/vxfs_super.c | 2 ++
fs/hpfs/hpfs_fn.h | 6 ++----
fs/hpfs/super.c | 2 ++
fs/inode.c | 33 ++++++++++++++++++++++++++++++++-
fs/isofs/inode.c | 7 +++++++
fs/jffs2/fs.c | 3 +++
fs/jfs/super.c | 2 ++
fs/kernfs/inode.c | 7 +++----
fs/minix/inode.c | 2 ++
fs/namespace.c | 33 ++++++++++++++++++++++++++++++++-
fs/nfs/super.c | 20 +++++++++++++++++++-
fs/ntfs/inode.c | 21 ++++++++++++---------
fs/omfs/inode.c | 4 ++++
fs/pstore/ram.c | 2 ++
fs/qnx4/inode.c | 2 ++
fs/qnx6/inode.c | 2 ++
fs/reiserfs/super.c | 3 +++
fs/romfs/super.c | 2 ++
fs/squashfs/super.c | 2 ++
fs/super.c | 2 ++
fs/sysv/super.c | 5 ++++-
fs/ubifs/file.c | 21 ++++++++++++---------
fs/ufs/super.c | 7 +++++++
fs/utimes.c | 6 ++----
fs/xfs/xfs_super.c | 2 ++
include/linux/fs.h | 5 +++++
include/linux/time64.h | 2 ++
47 files changed, 294 insertions(+), 72 deletions(-)
The following changes since commit 089cf7f6ecb266b6a4164919a2e69bd2f938374a:
Linux 5.3-rc7 (2019-09-02 09:57:40 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic.git
tags/ipc-fixes
for you to fetch changes up to fb377eb80c80339b580831a3c0fcce34a4c9d1ad:
ipc: fix sparc64 ipc() wrapper (2019-09-07 21:42:25 +0200)
----------------------------------------------------------------
ipc: fix regressions from y2038 patches
These are two regression fixes for bugs that got introduced
during the system call rework that went into linux-5.1
but only bisected and fixed now:
- One patch affects semtimedop() on many of the less
common 32-bit architectures, this just needs a single-line
bugfix.
- The other affects only sparc64 and has a slightly more
invasive workaround to apply the same change to sparc64
that was done to the generic code used everywhere else.
----------------------------------------------------------------
Arnd Bergmann (2):
ipc: fix semtimedop for generic 32-bit architectures
ipc: fix sparc64 ipc() wrapper
arch/sparc/kernel/sys_sparc_64.c | 33 ++++++++++++++++++---------------
include/linux/syscalls.h | 19 +++++++++++++++++++
include/uapi/asm-generic/unistd.h | 2 +-
ipc/util.h | 25 ++-----------------------
4 files changed, 40 insertions(+), 39 deletions(-)
As Vincent noticed, the y2038 conversion of semtimedop in linux-5.1
broke when commit 00bf25d693e7 ("y2038: use time32 syscall names on
32-bit") changed all system calls on all architectures that take
a 32-bit time_t to point to the _time32 implementation, but left out
semtimedop in the asm-generic header.
This affects all 32-bit architectures using asm-generic/unistd.h:
h8300, unicore32, openrisc, nios2, hexagon, c6x, arc, nds32 and csky.
The notable exception is riscv32, which has dropped support for the
time32 system calls entirely.
Reported-by: Vincent Chen <deanbo422(a)gmail.com>
Cc: stable(a)vger.kernel.org
Cc: Vincent Chen <deanbo422(a)gmail.com>
Cc: Greentime Hu <green.hu(a)gmail.com>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Guan Xuetao <gxt(a)pku.edu.cn>
Cc: Stafford Horne <shorne(a)gmail.com>
Cc: Jonas Bonn <jonas(a)southpole.se>
Cc: Stefan Kristiansson <stefan.kristiansson(a)saunalahti.fi>
Cc: Ley Foon Tan <lftan(a)altera.com>
Cc: Richard Kuo <rkuo(a)codeaurora.org>
Cc: Mark Salter <msalter(a)redhat.com>
Cc: Aurelien Jacquiot <jacquiot.aurelien(a)gmail.com>
Cc: Guo Ren <guoren(a)kernel.org>
Fixes: 00bf25d693e7 ("y2038: use time32 syscall names on 32-bit")
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
Hi Vincent,
Sorry for the delay since your report. Does this address your
problem?
Anyone else, please note that this patch is required since
5.1 to make sysvipc work on the listed architectures.
---
include/uapi/asm-generic/unistd.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index 1be0e798e362..1fc8faa6e973 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -569,7 +569,7 @@ __SYSCALL(__NR_semget, sys_semget)
__SC_COMP(__NR_semctl, sys_semctl, compat_sys_semctl)
#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
#define __NR_semtimedop 192
-__SC_COMP(__NR_semtimedop, sys_semtimedop, sys_semtimedop_time32)
+__SC_3264(__NR_semtimedop, sys_semtimedop_time32, sys_semtimedop)
#endif
#define __NR_semop 193
__SYSCALL(__NR_semop, sys_semop)
--
2.20.0