1 // SPDX-License-Identifier: GPL-2.0 2 #include <unistd.h> 3 #include <pthread.h> 4 #include <sys/mman.h> 5 #include <stdatomic.h> 6 #include <test_progs.h> 7 #include <sys/syscall.h> 8 #include <linux/module.h> 9 #include <linux/userfaultfd.h> 10 11 #include "ksym_race.skel.h" 12 #include "bpf_mod_race.skel.h" 13 #include "kfunc_call_race.skel.h" 14 #include "testing_helpers.h" 15 16 /* This test crafts a race between btf_try_get_module and do_init_module, and 17 * checks whether btf_try_get_module handles the invocation for a well-formed 18 * but uninitialized module correctly. Unless the module has completed its 19 * initcalls, the verifier should fail the program load and return ENXIO. 20 * 21 * userfaultfd is used to trigger a fault in an fmod_ret program, and make it 22 * sleep, then the BPF program is loaded and the return value from verifier is 23 * inspected. After this, the userfaultfd is closed so that the module loading 24 * thread makes forward progress, and fmod_ret injects an error so that the 25 * module load fails and it is freed. 26 * 27 * If the verifier succeeded in loading the supplied program, it will end up 28 * taking reference to freed module, and trigger a crash when the program fd 29 * is closed later. This is true for both kfuncs and ksyms. In both cases, 30 * the crash is triggered inside bpf_prog_free_deferred, when module reference 31 * is finally released. 32 */ 33 34 struct test_config { 35 const char *str_open; 36 void *(*bpf_open_and_load)(); 37 void (*bpf_destroy)(void *); 38 }; 39 40 enum bpf_test_state { 41 _TS_INVALID, 42 TS_MODULE_LOAD, 43 TS_MODULE_LOAD_FAIL, 44 }; 45 46 static _Atomic enum bpf_test_state state = _TS_INVALID; 47 48 static void *load_module_thread(void *p) 49 { 50 51 if (!ASSERT_NEQ(load_bpf_testmod(false), 0, "load_module_thread must fail")) 52 atomic_store(&state, TS_MODULE_LOAD); 53 else 54 atomic_store(&state, TS_MODULE_LOAD_FAIL); 55 return p; 56 } 57 58 static int sys_userfaultfd(int flags) 59 { 60 return syscall(__NR_userfaultfd, flags); 61 } 62 63 static int test_setup_uffd(void *fault_addr) 64 { 65 struct uffdio_register uffd_register = {}; 66 struct uffdio_api uffd_api = {}; 67 int uffd; 68 69 uffd = sys_userfaultfd(O_CLOEXEC); 70 if (uffd < 0) 71 return -errno; 72 73 uffd_api.api = UFFD_API; 74 uffd_api.features = 0; 75 if (ioctl(uffd, UFFDIO_API, &uffd_api)) { 76 close(uffd); 77 return -1; 78 } 79 80 uffd_register.range.start = (unsigned long)fault_addr; 81 uffd_register.range.len = 4096; 82 uffd_register.mode = UFFDIO_REGISTER_MODE_MISSING; 83 if (ioctl(uffd, UFFDIO_REGISTER, &uffd_register)) { 84 close(uffd); 85 return -1; 86 } 87 return uffd; 88 } 89 90 static void test_bpf_mod_race_config(const struct test_config *config) 91 { 92 void *fault_addr, *skel_fail; 93 struct bpf_mod_race *skel; 94 struct uffd_msg uffd_msg; 95 pthread_t load_mod_thrd; 96 _Atomic int *blockingp; 97 int uffd, ret; 98 99 fault_addr = mmap(0, 4096, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 100 if (!ASSERT_NEQ(fault_addr, MAP_FAILED, "mmap for uffd registration")) 101 return; 102 103 if (!ASSERT_OK(unload_bpf_testmod(false), "unload bpf_testmod")) 104 goto end_mmap; 105 106 skel = bpf_mod_race__open(); 107 if (!ASSERT_OK_PTR(skel, "bpf_mod_kfunc_race__open")) 108 goto end_module; 109 110 skel->rodata->bpf_mod_race_config.tgid = getpid(); 111 skel->rodata->bpf_mod_race_config.inject_error = -4242; 112 skel->rodata->bpf_mod_race_config.fault_addr = fault_addr; 113 if (!ASSERT_OK(bpf_mod_race__load(skel), "bpf_mod___load")) 114 goto end_destroy; 115 blockingp = (_Atomic int *)&skel->bss->bpf_blocking; 116 117 if (!ASSERT_OK(bpf_mod_race__attach(skel), "bpf_mod_kfunc_race__attach")) 118 goto end_destroy; 119 120 uffd = test_setup_uffd(fault_addr); 121 if (!ASSERT_GE(uffd, 0, "userfaultfd open + register address")) 122 goto end_destroy; 123 124 if (!ASSERT_OK(pthread_create(&load_mod_thrd, NULL, load_module_thread, NULL), 125 "load module thread")) 126 goto end_uffd; 127 128 /* Now, we either fail loading module, or block in bpf prog, spin to find out */ 129 while (!atomic_load(&state) && !atomic_load(blockingp)) 130 ; 131 if (!ASSERT_EQ(state, _TS_INVALID, "module load should block")) 132 goto end_join; 133 if (!ASSERT_EQ(*blockingp, 1, "module load blocked")) { 134 pthread_kill(load_mod_thrd, SIGKILL); 135 goto end_uffd; 136 } 137 138 /* We might have set bpf_blocking to 1, but may have not blocked in 139 * bpf_copy_from_user. Read userfaultfd descriptor to verify that. 140 */ 141 if (!ASSERT_EQ(read(uffd, &uffd_msg, sizeof(uffd_msg)), sizeof(uffd_msg), 142 "read uffd block event")) 143 goto end_join; 144 if (!ASSERT_EQ(uffd_msg.event, UFFD_EVENT_PAGEFAULT, "read uffd event is pagefault")) 145 goto end_join; 146 147 /* We know that load_mod_thrd is blocked in the fmod_ret program, the 148 * module state is still MODULE_STATE_COMING because mod->init hasn't 149 * returned. This is the time we try to load a program calling kfunc and 150 * check if we get ENXIO from verifier. 151 */ 152 skel_fail = config->bpf_open_and_load(); 153 ret = errno; 154 if (!ASSERT_EQ(skel_fail, NULL, config->str_open)) { 155 /* Close uffd to unblock load_mod_thrd */ 156 close(uffd); 157 uffd = -1; 158 while (atomic_load(blockingp) != 2) 159 ; 160 ASSERT_OK(kern_sync_rcu(), "kern_sync_rcu"); 161 config->bpf_destroy(skel_fail); 162 goto end_join; 163 164 } 165 ASSERT_EQ(ret, ENXIO, "verifier returns ENXIO"); 166 ASSERT_EQ(skel->data->res_try_get_module, false, "btf_try_get_module == false"); 167 168 close(uffd); 169 uffd = -1; 170 end_join: 171 pthread_join(load_mod_thrd, NULL); 172 if (uffd < 0) 173 ASSERT_EQ(atomic_load(&state), TS_MODULE_LOAD_FAIL, "load_mod_thrd success"); 174 end_uffd: 175 if (uffd >= 0) 176 close(uffd); 177 end_destroy: 178 bpf_mod_race__destroy(skel); 179 ASSERT_OK(kern_sync_rcu(), "kern_sync_rcu"); 180 end_module: 181 unload_bpf_testmod(false); 182 ASSERT_OK(load_bpf_testmod(false), "restore bpf_testmod"); 183 end_mmap: 184 munmap(fault_addr, 4096); 185 atomic_store(&state, _TS_INVALID); 186 } 187 188 static const struct test_config ksym_config = { 189 .str_open = "ksym_race__open_and_load", 190 .bpf_open_and_load = (void *)ksym_race__open_and_load, 191 .bpf_destroy = (void *)ksym_race__destroy, 192 }; 193 194 static const struct test_config kfunc_config = { 195 .str_open = "kfunc_call_race__open_and_load", 196 .bpf_open_and_load = (void *)kfunc_call_race__open_and_load, 197 .bpf_destroy = (void *)kfunc_call_race__destroy, 198 }; 199 200 void serial_test_bpf_mod_race(void) 201 { 202 if (test__start_subtest("ksym (used_btfs UAF)")) 203 test_bpf_mod_race_config(&ksym_config); 204 if (test__start_subtest("kfunc (kfunc_btf_tab UAF)")) 205 test_bpf_mod_race_config(&kfunc_config); 206 } 207