@@ -16,18 +16,19 @@ struct task_struct;
* The key type depends on whether it's a shared or private mapping.
* Don't rearrange members without looking at hash_futex().
*
- * offset is aligned to a multiple of sizeof(u32) (== 4) by definition.
- * We use the two low order bits of offset to tell what is the kind of key :
+ * offset is the position within a page and is in the range [0, PAGE_SIZE).
+ * The high bits of the offset indicate what kind of key this is:
* 00 : Private process futex (PTHREAD_PROCESS_PRIVATE)
* (no reference on an inode or mm)
* 01 : Shared futex (PTHREAD_PROCESS_SHARED)
* mapped on a file (reference on the underlying inode)
* 10 : Shared futex (PTHREAD_PROCESS_SHARED)
* (but private mapping on an mm, and reference taken on it)
-*/
+ */
-#define FUT_OFF_INODE 1 /* We set bit 0 if key has a reference on inode */
-#define FUT_OFF_MMSHARED 2 /* We set bit 1 if key has a reference on mm */
+#define FUT_OFF_INODE (PAGE_SIZE << 0)
+#define FUT_OFF_MMSHARED (PAGE_SIZE << 1)
+#define FUT_OFF_SIZE (PAGE_SIZE << 2)
union futex_key {
struct {
@@ -206,7 +206,7 @@ static int futex_parse_waitv(struct fute
if ((aux.flags & ~FUTEX2_MASK) || aux.__reserved)
return -EINVAL;
- if ((aux.flags & FUTEX2_64) != FUTEX2_32)
+ if ((aux.flags & FUTEX2_64) == FUTEX2_64)
return -EINVAL;
flags = futex2_to_flags(aux.flags);
@@ -334,7 +334,7 @@ SYSCALL_DEFINE4(futex_wake,
if (flags & ~FUTEX2_MASK)
return -EINVAL;
- if ((flags & FUTEX2_64) != FUTEX2_32)
+ if ((flags & FUTEX2_64) == FUTEX2_64)
return -EINVAL;
flags = futex2_to_flags(flags);
@@ -439,7 +439,7 @@ static int futex_wait_multiple_setup(str
u32 val = vs[i].w.val;
hb = futex_q_lock(q);
- ret = futex_get_value_locked(&uval, uaddr, FLAGS_SIZE_32);
+ ret = futex_get_value_locked(&uval, uaddr, flags);
if (!ret && uval == val) {
/*
@@ -607,7 +607,7 @@ int futex_wait_setup(u32 __user *uaddr,
retry_private:
*hb = futex_q_lock(q);
- ret = futex_get_value_locked(&uval, uaddr, FLAGS_SIZE_32);
+ ret = futex_get_value_locked(&uval, uaddr, flags);
if (ret) {
futex_q_unlock(*hb);
When futexes are no longer u32 aligned, the lower offset bits are no longer available to put type info in. However, since offset is the offset within a page, there are plenty bits available on the top end. After that, pass flags into futex_get_value_locked() for WAIT and disallow FUTEX2_64 instead of mandating FUTEX2_32. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> --- include/linux/futex.h | 11 ++++++----- kernel/futex/syscalls.c | 4 ++-- kernel/futex/waitwake.c | 4 ++-- 3 files changed, 10 insertions(+), 9 deletions(-)