ntsync: absolute MONOTONIC timeout ignores time namespace offset

--0000000000006a3615065214ecb8
Content-Type: text/plain; charset="UTF-8"

Hi all,

While reading drivers/misc/ntsync.c I noticed something that
might be a time-namespace bug. I would appreciate it if you
could take a look and let me know whether this is a real bug,
and whether it is worth fixing.

ntsync_schedule() takes the user-supplied absolute timeout
and hands it to schedule_hrtimeout_range_clock() with
HRTIMER_MODE_ABS. For the default CLOCK_MONOTONIC path, it
does not call timens_ktime_to_host() first.

A process inside a CLOCK_MONOTONIC time namespace computes
the absolute timeout in its own clock view. The kernel reads
the same value against the host clock. The two differ by the
namespace offset.

The other absolute-timeout consumers (timerfd, posix-timers,
alarmtimer, posix-stubs, futex) all run user-supplied
absolute MONOTONIC ktime through timens_ktime_to_host()
before hrtimer. ntsync was added post-5.17 and seems to have
missed that step.

/dev/ntsync is mode 0666, so any user in a time namespace
that can open it is affected. The user-visible impact is
wrong timeout behaviour for Wine inside a container that
sets a CLOCK_MONOTONIC offset.

Attached PoC: baseline run elapsed ~100 ms; the --in-timens
run inside a -10s namespace elapsed ~0 ms.

A candidate fix would call timens_ktime_to_host(clock, timeout)
in the else branch (i.e., when NTSYNC_WAIT_REALTIME is not set)
before passing the value to schedule_hrtimeout_range_clock().

If this is intentional or already known, please disregard.
Otherwise, I am happy to send a [PATCH] or to leave the fix to you.
Thank you for your time, and sorry for the noise if this is not actually
a bug or has already been spotted.

Thanks,
Maoyi Xie
https://maoyixie.com/

--0000000000006a3615065214ecb8
Content-Type: application/octet-stream; name="poc_ntsync_timens.log"
Content-Disposition: attachment; filename="poc_ntsync_timens.log"
Content-Transfer-Encoding: base64
Content-ID: <f_mpb1w8nh0>
X-Attachment-Id: f_mpb1w8nh0

IyBidWcyNCBQb0MgdmVyaWZpY2F0aW9uIG9uIGxpbnV4LTcuMS1yYzEgKG1haW5saW5lIHZhbmls
bGEpCiMKIyBUZXN0IHBsYXRmb3JtOgojICAgcWVtdS1zeXN0ZW0teDg2XzY0IC1lbmFibGUta3Zt
IC1zbXAgNCAtbSA0RwojICAgYnpJbWFnZTogdm0vYnVpbGQtNy4xLXJjMS12YW5pbGxhL2FyY2gv
eDg2L2Jvb3QvYnpJbWFnZQojICAgcm9vdGZzOiAgdm0vYm9va3dvcm0ucWNvdzIgKGRlYmlhbiBi
b29rd29ybSkKIyAgIG50c3luYy5rbzogYnVpbHQgQ09ORklHX05UU1lOQz1tIGZyb20gdGhlIHNh
bWUgdHJlZQojCiMgL2Rldi9udHN5bmMgcmVnaXN0ZXJzIHdpdGggbW9kZSAwNjY2LCBzbyBhbnkg
dXNlciBpbnNpZGUgdGhlIFZNCiMgKGFuZCBhbnkgY29udGFpbmVyIGV4cG9zaW5nIC9kZXYvbnRz
eW5jKSBjYW4gb3BlbiBpdC4KCiMjIyBVbnBhdGNoZWQgKGxpbnV4LTcuMS1yYzEgdmFuaWxsYSkg
IyMjCgokIHVuYW1lIC1hCkxpbnV4IG5zcHJvYmUgNy4xLjAtcmMxLTAwMDAxLWcxOTZkOWE5YmZh
OWIgIzIgU01QIFBSRUVNUFRfRFlOQU1JQwoKJCBpbnNtb2QgL3Jvb3QvbnRzeW5jLmtvCiQgbHMg
LWxhIC9kZXYvbnRzeW5jCmNydy1ydy1ydy0gMSByb290IHJvb3QgMTAsIDI1OCBNYXkgMTcgMTY6
MTkgL2Rldi9udHN5bmMKCiQgLi9wb2NfbnRzeW5jX3RpbWVucyAgICAgICAgICAgICAgICAgICAg
ICAgICAgIyBiYXNlbGluZSAobm8gdGltZW5zKQpbcGFyZW50XSBiYXNlbGluZSAobm8gdGltZW5z
KQpbd2FpdF0gcmV0PS0xIGVycm5vPTExMCAoQ29ubmVjdGlvbiB0aW1lZCBvdXQpIGVsYXBzZWQ9
MTAwIG1zCgokIC4vcG9jX250c3luY190aW1lbnMgLS1pbi10aW1lbnMgICAgICAgICAgICAgICMg
aW5zaWRlIENMT0NLX01PTk9UT05JQyAtMTBzCltjaGlsZF0gaW4gQ0xPQ0tfTU9OT1RPTklDIC0x
MHMgdGltZSBuYW1lc3BhY2UKW3dhaXRdIHJldD0tMSBlcnJubz0xMTAgKENvbm5lY3Rpb24gdGlt
ZWQgb3V0KSBlbGFwc2VkPTAgbXMKCiMjIyBQYXRjaGVkIChsaW51eC03LjEtcmMxICsgMDAwMS1u
dHN5bmMtdGltZW5zLWZpeC5wYXRjaCkgIyMjCgokIHVuYW1lIC1hCkxpbnV4IG5zcHJvYmUgNy4x
LjAtcmMxLTAwMDAxLWcxOTZkOWE5YmZhOWItZGlydHkgIzMgU01QIFBSRUVNUFRfRFlOQU1JQwoK
JCBpbnNtb2QgL3Jvb3QvbnRzeW5jLmtvCiQgLi9wb2NfbnRzeW5jX3RpbWVucyAgICAgICAgICAg
ICAgICAgICAgICAgICAgIyBiYXNlbGluZSAobm8gdGltZW5zKQpbcGFyZW50XSBiYXNlbGluZSAo
bm8gdGltZW5zKQpbd2FpdF0gcmV0PS0xIGVycm5vPTExMCAoQ29ubmVjdGlvbiB0aW1lZCBvdXQp
IGVsYXBzZWQ9MTAwIG1zCgokIC4vcG9jX250c3luY190aW1lbnMgLS1pbi10aW1lbnMgICAgICAg
ICAgICAgICMgaW5zaWRlIENMT0NLX01PTk9UT05JQyAtMTBzCltjaGlsZF0gaW4gQ0xPQ0tfTU9O
T1RPTklDIC0xMHMgdGltZSBuYW1lc3BhY2UKW3dhaXRdIHJldD0tMSBlcnJubz0xMTAgKENvbm5l
Y3Rpb24gdGltZWQgb3V0KSBlbGFwc2VkPTEwMCBtcwo=
--0000000000006a3615065214ecb8
Content-Type: application/octet-stream; name="poc_ntsync_timens.c"
Content-Disposition: attachment; filename="poc_ntsync_timens.c"
Content-Transfer-Encoding: base64
Content-ID: <f_mpb1w8nq1>
X-Attachment-Id: f_mpb1w8nq1

LyoKICogUG9DOiBudHN5bmMgTlRTWU5DX0lPQ19XQUlUX0FOWSBpZ25vcmVzIHRoZSBDTE9DS19N
T05PVE9OSUMKICogICAgICB0aW1lIG5hbWVzcGFjZSBvZmZzZXQuCiAqCiAqIG50c3luYyBwYXNz
ZXMgYSB1c2VyLXN1cHBsaWVkIGFic29sdXRlIHRpbWVvdXQgdG8gaHJ0aW1lcgogKiB3aXRoIEhS
VElNRVJfTU9ERV9BQlMuIEl0IGRvZXMgbm90IGNhbGwgdGltZW5zX2t0aW1lX3RvX2hvc3QoKQog
KiBmaXJzdC4gSW5zaWRlIGEgQ0xPQ0tfTU9OT1RPTklDIHRpbWUgbmFtZXNwYWNlLCB0aGUgdXNl
ciB2aWV3CiAqIGFuZCB0aGUgaG9zdCB2aWV3IG9mICJub3ciIGRpZmZlciBieSB0aGUgbmFtZXNw
YWNlIG9mZnNldC4KICoKICogQnVpbGQ6IGNjIC1PMCAtZyBwb2NfbnRzeW5jX3RpbWVucy5jIC1v
IHBvY19udHN5bmNfdGltZW5zCiAqIFJ1bjogICAuL3BvY19udHN5bmNfdGltZW5zICAgICAgICAg
ICAgICAgIyBiYXNlbGluZQogKiAgICAgICAgLi9wb2NfbnRzeW5jX3RpbWVucyAtLWluLXRpbWVu
cyAgICMgaW5zaWRlIC0xMHMgdGltZW5zCiAqCiAqIEJhc2VsaW5lOiAgZWxhcHNlZCB+IDEwMCBt
cwogKiBJbi10aW1lbnM6IGVsYXBzZWQgfiAwICAgbXMKICovCgojZGVmaW5lIF9HTlVfU09VUkNF
CiNpbmNsdWRlIDxlcnJuby5oPgojaW5jbHVkZSA8ZmNudGwuaD4KI2luY2x1ZGUgPHNjaGVkLmg+
CiNpbmNsdWRlIDxzdGRpbnQuaD4KI2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxzdGRsaWIu
aD4KI2luY2x1ZGUgPHN0cmluZy5oPgojaW5jbHVkZSA8c3lzL2lvY3RsLmg+CiNpbmNsdWRlIDxz
eXMvd2FpdC5oPgojaW5jbHVkZSA8dGltZS5oPgojaW5jbHVkZSA8dW5pc3RkLmg+CiNpbmNsdWRl
IDxsaW51eC90eXBlcy5oPgoKI2lmbmRlZiBDTE9ORV9ORVdUSU1FCiNkZWZpbmUgQ0xPTkVfTkVX
VElNRSAweDAwMDAwMDgwCiNlbmRpZgoKLyogTWlycm9yIG9mIGluY2x1ZGUvdWFwaS9saW51eC9u
dHN5bmMuaC4gKi8Kc3RydWN0IG50c3luY19zZW1fYXJncyB7IF9fdTMyIGNvdW50OyBfX3UzMiBt
YXg7IH07CnN0cnVjdCBudHN5bmNfd2FpdF9hcmdzIHsKCV9fdTY0IHRpbWVvdXQ7CglfX3U2NCBv
YmpzOwoJX191MzIgY291bnQ7CglfX3UzMiBpbmRleDsKCV9fdTMyIGZsYWdzOwoJX191MzIgb3du
ZXI7CglfX3UzMiBhbGVydDsKCV9fdTMyIHBhZDsKfTsKCiNkZWZpbmUgTlRTWU5DX0lPQ19DUkVB
VEVfU0VNICAgX0lPVyAoJ04nLCAweDgwLCBzdHJ1Y3QgbnRzeW5jX3NlbV9hcmdzKQojZGVmaW5l
IE5UU1lOQ19JT0NfV0FJVF9BTlkgICAgIF9JT1dSKCdOJywgMHg4Miwgc3RydWN0IG50c3luY193
YWl0X2FyZ3MpCgpzdGF0aWMgaW50IHJ1bl93YWl0KHZvaWQpCnsKCWludCBmZCA9IG9wZW4oIi9k
ZXYvbnRzeW5jIiwgT19SRFdSIHwgT19DTE9FWEVDKTsKCWlmIChmZCA8IDApIHsKCQlmcHJpbnRm
KHN0ZGVyciwgIm9wZW4gL2Rldi9udHN5bmM6ICVzXG4iLCBzdHJlcnJvcihlcnJubykpOwoJCXJl
dHVybiAxOwoJfQoKCXN0cnVjdCBudHN5bmNfc2VtX2FyZ3Mgc2EgPSB7IC5jb3VudCA9IDAsIC5t
YXggPSAxIH07CglpbnQgc2VtX2ZkID0gaW9jdGwoZmQsIE5UU1lOQ19JT0NfQ1JFQVRFX1NFTSwg
JnNhKTsKCWlmIChzZW1fZmQgPCAwKSB7CgkJZnByaW50ZihzdGRlcnIsICJpb2N0bCBDUkVBVEVf
U0VNOiAlc1xuIiwgc3RyZXJyb3IoZXJybm8pKTsKCQlyZXR1cm4gMTsKCX0KCglzdHJ1Y3QgdGlt
ZXNwZWMgdHM7CgljbG9ja19nZXR0aW1lKENMT0NLX01PTk9UT05JQywgJnRzKTsKCV9fdTY0IG5v
d19ucyA9IChfX3U2NCl0cy50dl9zZWMgKiAxMDAwMDAwMDAwVUxMICsgdHMudHZfbnNlYzsKCV9f
dTY0IHRpbWVvdXRfbnMgPSBub3dfbnMgKyAxMDBVTEwgKiAxMDAwMDAwVUxMOyAvKiArMTAwbXMg
Ki8KCglzdHJ1Y3QgbnRzeW5jX3dhaXRfYXJncyB3YSA9IHsKCQkudGltZW91dCA9IHRpbWVvdXRf
bnMsCgkJLm9ianMgICAgPSAoX191NjQpKHVpbnRwdHJfdCkmc2VtX2ZkLAoJCS5jb3VudCAgID0g
MSwKCQkuaW5kZXggICA9IDAsCgkJLmZsYWdzICAgPSAwLCAgICAgLyogQ0xPQ0tfTU9OT1RPTklD
ICovCgkJLm93bmVyICAgPSAwLAoJCS5hbGVydCAgID0gMCwKCX07CgoJc3RydWN0IHRpbWVzcGVj
IHQwLCB0MTsKCWNsb2NrX2dldHRpbWUoQ0xPQ0tfTU9OT1RPTklDLCAmdDApOwoJaW50IHJldCA9
IGlvY3RsKGZkLCBOVFNZTkNfSU9DX1dBSVRfQU5ZLCAmd2EpOwoJaW50IGVyciA9IGVycm5vOwoJ
Y2xvY2tfZ2V0dGltZShDTE9DS19NT05PVE9OSUMsICZ0MSk7CgoJbG9uZyBtcyA9ICh0MS50dl9z
ZWMgLSB0MC50dl9zZWMpICogMTAwMCArCgkJICAodDEudHZfbnNlYyAtIHQwLnR2X25zZWMpIC8g
MTAwMDAwMDsKCXByaW50ZigiW3dhaXRdIHJldD0lZCBlcnJubz0lZCAoJXMpIGVsYXBzZWQ9JWxk
IG1zXG4iLAoJICAgICAgIHJldCwgZXJyLCBzdHJlcnJvcihlcnIpLCBtcyk7CgoJY2xvc2Uoc2Vt
X2ZkKTsKCWNsb3NlKGZkKTsKCXJldHVybiAwOwp9CgpzdGF0aWMgaW50IHNldF90aW1lbnMobG9u
ZyBtb25vdG9uaWNfb2Zmc2V0X3NlYykKewoJaWYgKHVuc2hhcmUoQ0xPTkVfTkVXVVNFUikgPCAw
KSB7CgkJZnByaW50ZihzdGRlcnIsICJ1bnNoYXJlKENMT05FX05FV1VTRVIpOiAlc1xuIiwgc3Ry
ZXJyb3IoZXJybm8pKTsKCQlyZXR1cm4gMTsKCX0KCWludCBmZDsKCWlmICgoZmQgPSBvcGVuKCIv
cHJvYy9zZWxmL3NldGdyb3VwcyIsIE9fV1JPTkxZKSkgPj0gMCkgewoJCXdyaXRlKGZkLCAiZGVu
eSIsIDQpOwoJCWNsb3NlKGZkKTsKCX0KCWlmICgoZmQgPSBvcGVuKCIvcHJvYy9zZWxmL3VpZF9t
YXAiLCBPX1dST05MWSkpID49IDApIHsKCQlkcHJpbnRmKGZkLCAiMCAlZCAxIiwgZ2V0dWlkKCkp
OwoJCWNsb3NlKGZkKTsKCX0KCWlmICgoZmQgPSBvcGVuKCIvcHJvYy9zZWxmL2dpZF9tYXAiLCBP
X1dST05MWSkpID49IDApIHsKCQlkcHJpbnRmKGZkLCAiMCAlZCAxIiwgZ2V0Z2lkKCkpOwoJCWNs
b3NlKGZkKTsKCX0KCglpZiAodW5zaGFyZShDTE9ORV9ORVdUSU1FKSA8IDApIHsKCQlmcHJpbnRm
KHN0ZGVyciwgInVuc2hhcmUoQ0xPTkVfTkVXVElNRSk6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp
OwoJCXJldHVybiAxOwoJfQoKCWZkID0gb3BlbigiL3Byb2Mvc2VsZi90aW1lbnNfb2Zmc2V0cyIs
IE9fV1JPTkxZKTsKCWlmIChmZCA8IDApIHsKCQlmcHJpbnRmKHN0ZGVyciwgIm9wZW4gdGltZW5z
X29mZnNldHM6ICVzXG4iLCBzdHJlcnJvcihlcnJubykpOwoJCXJldHVybiAxOwoJfQoJY2hhciBi
dWZbNjRdOwoJaW50IG4gPSBzbnByaW50ZihidWYsIHNpemVvZihidWYpLCAibW9ub3RvbmljICVs
ZCAwXG4iLAoJCQkgbW9ub3RvbmljX29mZnNldF9zZWMpOwoJaWYgKHdyaXRlKGZkLCBidWYsIG4p
IDwgMCkgewoJCWZwcmludGYoc3RkZXJyLCAid3JpdGUgdGltZW5zX29mZnNldHM6ICVzXG4iLCBz
dHJlcnJvcihlcnJubykpOwoJCWNsb3NlKGZkKTsKCQlyZXR1cm4gMTsKCX0KCWNsb3NlKGZkKTsK
CXJldHVybiAwOwp9CgppbnQgbWFpbihpbnQgYXJnYywgY2hhciAqKmFyZ3YpCnsKCWludCBpbl90
aW1lbnMgPSAwOwoJZm9yIChpbnQgaSA9IDE7IGkgPCBhcmdjOyBpKyspIHsKCQlpZiAoIXN0cmNt
cChhcmd2W2ldLCAiLS1pbi10aW1lbnMiKSkKCQkJaW5fdGltZW5zID0gMTsKCX0KCglpZiAoaW5f
dGltZW5zKSB7CgkJaWYgKHNldF90aW1lbnMoLTEwKSAhPSAwKQoJCQlyZXR1cm4gMTsKCQkvKiBm
b3JrIHNvIGNoaWxkIHJlLWV4ZWNzIGludG8gdGhlIG5ldyB0aW1lIG5hbWVzcGFjZSAqLwoJCXBp
ZF90IHBpZCA9IGZvcmsoKTsKCQlpZiAocGlkIDwgMCkgeyBwZXJyb3IoImZvcmsiKTsgcmV0dXJu
IDE7IH0KCQlpZiAocGlkID09IDApIHsKCQkJcHJpbnRmKCJbY2hpbGRdIGluIENMT0NLX01PTk9U
T05JQyAtMTBzIHRpbWUgbmFtZXNwYWNlXG4iKTsKCQkJcmV0dXJuIHJ1bl93YWl0KCk7CgkJfQoJ
CWludCBzdGF0dXM7CgkJd2FpdHBpZChwaWQsICZzdGF0dXMsIDApOwoJCXJldHVybiBXRVhJVFNU
QVRVUyhzdGF0dXMpOwoJfQoKCXByaW50ZigiW3BhcmVudF0gYmFzZWxpbmUgKG5vIHRpbWVucylc
biIpOwoJcmV0dXJuIHJ1bl93YWl0KCk7Cn0K
--0000000000006a3615065214ecb8--