[PATCH 0/2] ntsync: honour time namespace offset in absolute MONOTONIC timeouts

[PATCH 0/2] ntsync: honour time namespace offset in absolute MONOTONIC timeouts

[Maoyi Xie]

ntsync_schedule() hands an absolute MONOTONIC timeout from userspace
to schedule_hrtimeout_range_clock() without applying the caller's
time namespace offset. Inside a CLOCK_MONOTONIC time namespace, the
timeout fires too early or too late by the offset. Elizabeth Figura
confirmed the bug on the inquiry thread [1] and said whoever gets to
it first can fix it.

The fix calls timens_ktime_to_host() before hrtimer. That helper is
an inline in <linux/time_namespace.h> and references init_time_ns
and do_timens_ktime_to_host. All current users are in the kernel
itself, so neither symbol is exported. ntsync is the first module
user, so 1/2 exports both with EXPORT_SYMBOL_GPL.

I considered two alternatives for the export. Flipping CONFIG_NTSYNC
to bool would break module users. A new exported out of line wrapper
that hides init_time_ns is a cleaner ABI but adds a helper for one
caller. If a different export shape is preferred, please let me know
and I will follow that.

Routing: 1/2 touches kernel/time/, 2/2 touches drivers/misc/. A
timens Ack on 1/2 would let the series go through char-misc, or
both can go via tip. Either works.

Reproducer: unshare --user --time, monotonic offset -10s,
NTSYNC_IOC_WAIT_ANY with a 100 ms absolute MONOTONIC timeout.
Before, the run inside the namespace elapses about 0 ms. After,
about 100 ms. Full PoC and logs available on request.

I raised the export plan on linux-kernel on 2026-05-21 [2] and got
no reply, so I am sending the series for concrete review.

[1] https://lore.kernel.org/lkml/53921477.W1JGFHXlht@camazotz/
[2] https://lore.kernel.org/lkml/20260521153928.3724328-1-maoyixie.tju@gmail.com/

Maoyi Xie (2):
  time/namespace: export init_time_ns and do_timens_ktime_to_host
  ntsync: honour caller's time namespace for absolute MONOTONIC timeouts

 drivers/misc/ntsync.c   | 3 +++
 kernel/time/namespace.c | 2 ++
 2 files changed, 5 insertions(+)

-- 
2.34.1

[PATCH 1/2] time/namespace: export init_time_ns and do_timens_ktime_to_host

[Maoyi Xie]

The inline timens_ktime_to_host() in <linux/time_namespace.h> compares
the current time namespace against init_time_ns for the fast path. It
calls do_timens_ktime_to_host() for the offset case. Both symbols are
needed at link time by any caller of the inline.

All current callers are in the kernel itself (timerfd, posix-timers,
alarmtimer, posix-stubs, futex, io_uring). The next caller is a module
(ntsync), which fails to load because neither symbol is exported.

Export both with EXPORT_SYMBOL_GPL. The header already declares
init_time_ns extern, so this only makes the symbols linkable from
modules.

Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
---
 kernel/time/namespace.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/time/namespace.c b/kernel/time/namespace.c
index 4bca3f78c8ea..5fa0af66cf3f 100644
--- a/kernel/time/namespace.c
+++ b/kernel/time/namespace.c
@@ -57,6 +57,7 @@ ktime_t do_timens_ktime_to_host(clockid_t clockid, ktime_t tim,
 
 	return tim;
 }
+EXPORT_SYMBOL_GPL(do_timens_ktime_to_host);
 
 static struct ucounts *inc_time_namespaces(struct user_namespace *ns)
 {
@@ -351,6 +352,7 @@ struct time_namespace init_time_ns = {
 	.user_ns	= &init_user_ns,
 	.frozen_offsets	= true,
 };
+EXPORT_SYMBOL_GPL(init_time_ns);
 
 void __init time_ns_init(void)
 {
-- 
2.34.1

[PATCH 2/2] ntsync: honour caller's time namespace for absolute MONOTONIC timeouts

[Maoyi Xie]

ntsync_schedule() takes the absolute timeout from userspace and hands
it to schedule_hrtimeout_range_clock() with HRTIMER_MODE_ABS. For the
default CLOCK_MONOTONIC path, it does not call timens_ktime_to_host()
first.

A process inside a CLOCK_MONOTONIC time namespace computes the
absolute timeout in its own clock view. The kernel reads the same
value against the host clock. The two differ by the namespace offset.
The timeout then fires too early or too late.

Other consumers of absolute timeouts run the ktime through
timens_ktime_to_host() before hrtimer. Examples are timerfd,
posix-timers, alarmtimer, posix-stubs and futex. ntsync was added
later and missed that step.

/dev/ntsync is mode 0666. Any user inside a time namespace that can
open it is affected. The visible effect is wrong timeout behaviour
for Wine in a container that sets a CLOCK_MONOTONIC offset.

Reproducer: unshare --user --time, set the monotonic offset to -10s,
issue NTSYNC_IOC_WAIT_ANY with a 100 ms absolute MONOTONIC timeout.
The baseline run elapses about 100 ms. The run inside the namespace
elapses about 0 ms.

Apply timens_ktime_to_host() to the parsed timeout when the caller
did not set NTSYNC_WAIT_REALTIME. The helper does nothing in the
initial time namespace, so the fast path is unchanged.

Fixes: b4a7b5fe3f51 ("ntsync: Introduce NTSYNC_IOC_WAIT_ANY.")
Cc: stable@vger.kernel.org # v6.14+
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
---
 drivers/misc/ntsync.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/misc/ntsync.c b/drivers/misc/ntsync.c
index 30af282262ef..02c9d1192812 100644
--- a/drivers/misc/ntsync.c
+++ b/drivers/misc/ntsync.c
@@ -19,6 +19,7 @@
 #include <linux/sched/signal.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
+#include <linux/time_namespace.h>
 #include <uapi/linux/ntsync.h>
 
 #define NTSYNC_NAME	"ntsync"
@@ -836,6 +837,8 @@ static int ntsync_schedule(const struct ntsync_q *q, const struct ntsync_wait_ar
 
 	if (args->flags & NTSYNC_WAIT_REALTIME)
 		clock = CLOCK_REALTIME;
+	else
+		timeout = timens_ktime_to_host(clock, timeout);
 
 	do {
 		if (signal_pending(current)) {
-- 
2.34.1

Re: [PATCH 2/2] ntsync: honour caller's time namespace for absolute MONOTONIC timeouts

[Elizabeth Figura]

On Thursday, 28 May 2026 01:33:11 CDT Maoyi Xie wrote:
> ntsync_schedule() takes the absolute timeout from userspace and hands
> it to schedule_hrtimeout_range_clock() with HRTIMER_MODE_ABS. For the
> default CLOCK_MONOTONIC path, it does not call timens_ktime_to_host()
> first.
> 
> A process inside a CLOCK_MONOTONIC time namespace computes the
> absolute timeout in its own clock view. The kernel reads the same
> value against the host clock. The two differ by the namespace offset.
> The timeout then fires too early or too late.
> 
> Other consumers of absolute timeouts run the ktime through
> timens_ktime_to_host() before hrtimer. Examples are timerfd,
> posix-timers, alarmtimer, posix-stubs and futex. ntsync was added
> later and missed that step.
> 
> /dev/ntsync is mode 0666. Any user inside a time namespace that can
> open it is affected. The visible effect is wrong timeout behaviour
> for Wine in a container that sets a CLOCK_MONOTONIC offset.
> 
> Reproducer: unshare --user --time, set the monotonic offset to -10s,
> issue NTSYNC_IOC_WAIT_ANY with a 100 ms absolute MONOTONIC timeout.
> The baseline run elapses about 100 ms. The run inside the namespace
> elapses about 0 ms.
> 
> Apply timens_ktime_to_host() to the parsed timeout when the caller
> did not set NTSYNC_WAIT_REALTIME. The helper does nothing in the
> initial time namespace, so the fast path is unchanged.
> 
> Fixes: b4a7b5fe3f51 ("ntsync: Introduce NTSYNC_IOC_WAIT_ANY.")
> Cc: stable@vger.kernel.org # v6.14+
> Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
> ---
>  drivers/misc/ntsync.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/misc/ntsync.c b/drivers/misc/ntsync.c
> index 30af282262ef..02c9d1192812 100644
> --- a/drivers/misc/ntsync.c
> +++ b/drivers/misc/ntsync.c
> @@ -19,6 +19,7 @@
>  #include <linux/sched/signal.h>
>  #include <linux/slab.h>
>  #include <linux/spinlock.h>
> +#include <linux/time_namespace.h>
>  #include <uapi/linux/ntsync.h>
>  
>  #define NTSYNC_NAME	"ntsync"
> @@ -836,6 +837,8 @@ static int ntsync_schedule(const struct ntsync_q *q, const struct ntsync_wait_ar
>  
>  	if (args->flags & NTSYNC_WAIT_REALTIME)
>  		clock = CLOCK_REALTIME;
> +	else
> +		timeout = timens_ktime_to_host(clock, timeout);
>  
>  	do {
>  		if (signal_pending(current)) {
> 

Looks correct and passes tests here.

Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>

[tip: timers/core] ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts

[tip-bot2 for Maoyi Xie]

The following commit has been merged into the timers/core branch of tip:

Commit-ID:     180a232ea78003d1dc869b217b4e49106fd58e8f
Gitweb:        https://git.kernel.org/tip/180a232ea78003d1dc869b217b4e49106fd58e8f
Author:        Maoyi Xie <maoyixie.tju@gmail.com>
AuthorDate:    Thu, 28 May 2026 14:33:11 +08:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Tue, 02 Jun 2026 21:05:36 +02:00

ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts

ntsync_schedule() takes the absolute timeout from userspace and hands it to
schedule_hrtimeout_range_clock() with HRTIMER_MODE_ABS. For the default
CLOCK_MONOTONIC path, it does not call timens_ktime_to_host() first.

A process inside a CLOCK_MONOTONIC time namespace computes the absolute
timeout in its own clock view. The kernel reads the same value against the
host clock. The two differ by the namespace offset.  The timeout then fires
too early or too late.

Other users of absolute timeouts run the ktime through
timens_ktime_to_host() before starting the hrtimer. ntsync was added later
and missed that step.

/dev/ntsync is mode 0666. Any user inside a time namespace that can
open it is affected. The visible effect is wrong timeout behaviour
for Wine in a container that sets a CLOCK_MONOTONIC offset.

Reproducer: unshare --user --time, set the monotonic offset to -10s,
issue NTSYNC_IOC_WAIT_ANY with a 100 ms absolute MONOTONIC timeout.
The baseline run elapses about 100 ms. The run inside the namespace
elapses about 0 ms.

Apply timens_ktime_to_host() to the parsed timeout when the caller
did not set NTSYNC_WAIT_REALTIME. The helper does nothing in the
initial time namespace, so the fast path is unchanged.

Fixes: b4a7b5fe3f51 ("ntsync: Introduce NTSYNC_IOC_WAIT_ANY.")
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
Link: https://patch.msgid.link/20260528063311.3300393-3-maoyixie.tju@gmail.com
---
 drivers/misc/ntsync.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/misc/ntsync.c b/drivers/misc/ntsync.c
index 30af282..02c9d11 100644
--- a/drivers/misc/ntsync.c
+++ b/drivers/misc/ntsync.c
@@ -19,6 +19,7 @@
 #include <linux/sched/signal.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
+#include <linux/time_namespace.h>
 #include <uapi/linux/ntsync.h>
 
 #define NTSYNC_NAME	"ntsync"
@@ -836,6 +837,8 @@ static int ntsync_schedule(const struct ntsync_q *q, const struct ntsync_wait_ar
 
 	if (args->flags & NTSYNC_WAIT_REALTIME)
 		clock = CLOCK_REALTIME;
+	else
+		timeout = timens_ktime_to_host(clock, timeout);
 
 	do {
 		if (signal_pending(current)) {

[tip: timers/core] time/namespace: Export init_time_ns and do_timens_ktime_to_host()

[tip-bot2 for Maoyi Xie]

The following commit has been merged into the timers/core branch of tip:

Commit-ID:     766e828b011ca5f971554001611b4acab7c244c1
Gitweb:        https://git.kernel.org/tip/766e828b011ca5f971554001611b4acab7c244c1
Author:        Maoyi Xie <maoyixie.tju@gmail.com>
AuthorDate:    Thu, 28 May 2026 14:33:10 +08:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Tue, 02 Jun 2026 21:05:36 +02:00

time/namespace: Export init_time_ns and do_timens_ktime_to_host()

timens_ktime_to_host() in compares the current time namespace against
init_time_ns for the fast path. It calls do_timens_ktime_to_host() for the
offset case. Both symbols are needed at link time by any caller of the
inline.

All current callers are builtin, but ntsync can be built as module, which
prevents it from using it.

Export both with EXPORT_SYMBOL_GPL.

Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260528063311.3300393-2-maoyixie.tju@gmail.com
---
 kernel/time/namespace.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/time/namespace.c b/kernel/time/namespace.c
index 4bca3f7..5fa0af6 100644
--- a/kernel/time/namespace.c
+++ b/kernel/time/namespace.c
@@ -57,6 +57,7 @@ ktime_t do_timens_ktime_to_host(clockid_t clockid, ktime_t tim,
 
 	return tim;
 }
+EXPORT_SYMBOL_GPL(do_timens_ktime_to_host);
 
 static struct ucounts *inc_time_namespaces(struct user_namespace *ns)
 {
@@ -351,6 +352,7 @@ struct time_namespace init_time_ns = {
 	.user_ns	= &init_user_ns,
 	.frozen_offsets	= true,
 };
+EXPORT_SYMBOL_GPL(init_time_ns);
 
 void __init time_ns_init(void)
 {