1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */
3 
4 #include <vmlinux.h>
5 #include <bpf/bpf_tracing.h>
6 #include <bpf/bpf_helpers.h>
7 
8 #include "bpf_misc.h"
9 #include "cgrp_kfunc_common.h"
10 
11 char _license[] SEC("license") = "GPL";
12 
13 /* Prototype for all of the program trace events below:
14  *
15  * TRACE_EVENT(cgroup_mkdir,
16  *         TP_PROTO(struct cgroup *cgrp, const char *path),
17  *         TP_ARGS(cgrp, path)
18  */
19 
20 static struct __cgrps_kfunc_map_value *insert_lookup_cgrp(struct cgroup *cgrp)
21 {
22 	int status;
23 
24 	status = cgrps_kfunc_map_insert(cgrp);
25 	if (status)
26 		return NULL;
27 
28 	return cgrps_kfunc_map_value_lookup(cgrp);
29 }
30 
31 SEC("tp_btf/cgroup_mkdir")
32 __failure __msg("Possibly NULL pointer passed to trusted arg0")
33 int BPF_PROG(cgrp_kfunc_acquire_untrusted, struct cgroup *cgrp, const char *path)
34 {
35 	struct cgroup *acquired;
36 	struct __cgrps_kfunc_map_value *v;
37 
38 	v = insert_lookup_cgrp(cgrp);
39 	if (!v)
40 		return 0;
41 
42 	/* Can't invoke bpf_cgroup_acquire() on an untrusted pointer. */
43 	acquired = bpf_cgroup_acquire(v->cgrp);
44 	if (acquired)
45 		bpf_cgroup_release(acquired);
46 
47 	return 0;
48 }
49 
50 SEC("tp_btf/cgroup_mkdir")
51 __failure __msg("Possibly NULL pointer passed to trusted arg0")
52 int BPF_PROG(cgrp_kfunc_acquire_no_null_check, struct cgroup *cgrp, const char *path)
53 {
54 	struct cgroup *acquired;
55 
56 	acquired = bpf_cgroup_acquire(cgrp);
57 	/*
58 	 * Can't invoke bpf_cgroup_release() without checking the return value
59 	 * of bpf_cgroup_acquire().
60 	 */
61 	bpf_cgroup_release(acquired);
62 
63 	return 0;
64 }
65 
66 SEC("tp_btf/cgroup_mkdir")
67 __failure __msg("arg#0 pointer type STRUCT cgroup must point")
68 int BPF_PROG(cgrp_kfunc_acquire_fp, struct cgroup *cgrp, const char *path)
69 {
70 	struct cgroup *acquired, *stack_cgrp = (struct cgroup *)&path;
71 
72 	/* Can't invoke bpf_cgroup_acquire() on a random frame pointer. */
73 	acquired = bpf_cgroup_acquire((struct cgroup *)&stack_cgrp);
74 	if (acquired)
75 		bpf_cgroup_release(acquired);
76 
77 	return 0;
78 }
79 
80 SEC("kretprobe/cgroup_destroy_locked")
81 __failure __msg("reg type unsupported for arg#0 function")
82 int BPF_PROG(cgrp_kfunc_acquire_unsafe_kretprobe, struct cgroup *cgrp)
83 {
84 	struct cgroup *acquired;
85 
86 	/* Can't acquire an untrusted struct cgroup * pointer. */
87 	acquired = bpf_cgroup_acquire(cgrp);
88 	if (acquired)
89 		bpf_cgroup_release(acquired);
90 
91 	return 0;
92 }
93 
94 SEC("tp_btf/cgroup_mkdir")
95 __failure __msg("cgrp_kfunc_acquire_trusted_walked")
96 int BPF_PROG(cgrp_kfunc_acquire_trusted_walked, struct cgroup *cgrp, const char *path)
97 {
98 	struct cgroup *acquired;
99 
100 	/* Can't invoke bpf_cgroup_acquire() on a pointer obtained from walking a trusted cgroup. */
101 	acquired = bpf_cgroup_acquire(cgrp->old_dom_cgrp);
102 	if (acquired)
103 		bpf_cgroup_release(acquired);
104 
105 	return 0;
106 }
107 
108 SEC("tp_btf/cgroup_mkdir")
109 __failure __msg("Possibly NULL pointer passed to trusted arg0")
110 int BPF_PROG(cgrp_kfunc_acquire_null, struct cgroup *cgrp, const char *path)
111 {
112 	struct cgroup *acquired;
113 
114 	/* Can't invoke bpf_cgroup_acquire() on a NULL pointer. */
115 	acquired = bpf_cgroup_acquire(NULL);
116 	if (acquired)
117 		bpf_cgroup_release(acquired);
118 
119 	return 0;
120 }
121 
122 SEC("tp_btf/cgroup_mkdir")
123 __failure __msg("Unreleased reference")
124 int BPF_PROG(cgrp_kfunc_acquire_unreleased, struct cgroup *cgrp, const char *path)
125 {
126 	struct cgroup *acquired;
127 
128 	acquired = bpf_cgroup_acquire(cgrp);
129 
130 	/* Acquired cgroup is never released. */
131 	__sink(acquired);
132 
133 	return 0;
134 }
135 
136 SEC("tp_btf/cgroup_mkdir")
137 __failure __msg("Unreleased reference")
138 int BPF_PROG(cgrp_kfunc_xchg_unreleased, struct cgroup *cgrp, const char *path)
139 {
140 	struct cgroup *kptr;
141 	struct __cgrps_kfunc_map_value *v;
142 
143 	v = insert_lookup_cgrp(cgrp);
144 	if (!v)
145 		return 0;
146 
147 	kptr = bpf_kptr_xchg(&v->cgrp, NULL);
148 	if (!kptr)
149 		return 0;
150 
151 	/* Kptr retrieved from map is never released. */
152 
153 	return 0;
154 }
155 
156 SEC("tp_btf/cgroup_mkdir")
157 __failure __msg("must be referenced or trusted")
158 int BPF_PROG(cgrp_kfunc_rcu_get_release, struct cgroup *cgrp, const char *path)
159 {
160 	struct cgroup *kptr;
161 	struct __cgrps_kfunc_map_value *v;
162 
163 	v = insert_lookup_cgrp(cgrp);
164 	if (!v)
165 		return 0;
166 
167 	bpf_rcu_read_lock();
168 	kptr = v->cgrp;
169 	if (kptr)
170 		/* Can't release a cgroup kptr stored in a map. */
171 		bpf_cgroup_release(kptr);
172 	bpf_rcu_read_unlock();
173 
174 	return 0;
175 }
176 
177 SEC("tp_btf/cgroup_mkdir")
178 __failure __msg("Possibly NULL pointer passed to trusted arg0")
179 int BPF_PROG(cgrp_kfunc_release_untrusted, struct cgroup *cgrp, const char *path)
180 {
181 	struct __cgrps_kfunc_map_value *v;
182 
183 	v = insert_lookup_cgrp(cgrp);
184 	if (!v)
185 		return 0;
186 
187 	/* Can't invoke bpf_cgroup_release() on an untrusted pointer. */
188 	bpf_cgroup_release(v->cgrp);
189 
190 	return 0;
191 }
192 
193 SEC("tp_btf/cgroup_mkdir")
194 __failure __msg("arg#0 pointer type STRUCT cgroup must point")
195 int BPF_PROG(cgrp_kfunc_release_fp, struct cgroup *cgrp, const char *path)
196 {
197 	struct cgroup *acquired = (struct cgroup *)&path;
198 
199 	/* Cannot release random frame pointer. */
200 	bpf_cgroup_release(acquired);
201 
202 	return 0;
203 }
204 
205 SEC("tp_btf/cgroup_mkdir")
206 __failure __msg("Possibly NULL pointer passed to trusted arg0")
207 int BPF_PROG(cgrp_kfunc_release_null, struct cgroup *cgrp, const char *path)
208 {
209 	struct __cgrps_kfunc_map_value local, *v;
210 	long status;
211 	struct cgroup *acquired, *old;
212 	s32 id;
213 
214 	status = bpf_probe_read_kernel(&id, sizeof(id), &cgrp->self.id);
215 	if (status)
216 		return 0;
217 
218 	local.cgrp = NULL;
219 	status = bpf_map_update_elem(&__cgrps_kfunc_map, &id, &local, BPF_NOEXIST);
220 	if (status)
221 		return status;
222 
223 	v = bpf_map_lookup_elem(&__cgrps_kfunc_map, &id);
224 	if (!v)
225 		return -ENOENT;
226 
227 	acquired = bpf_cgroup_acquire(cgrp);
228 	if (!acquired)
229 		return -ENOENT;
230 
231 	old = bpf_kptr_xchg(&v->cgrp, acquired);
232 
233 	/* old cannot be passed to bpf_cgroup_release() without a NULL check. */
234 	bpf_cgroup_release(old);
235 
236 	return 0;
237 }
238 
239 SEC("tp_btf/cgroup_mkdir")
240 __failure __msg("release kernel function bpf_cgroup_release expects")
241 int BPF_PROG(cgrp_kfunc_release_unacquired, struct cgroup *cgrp, const char *path)
242 {
243 	/* Cannot release trusted cgroup pointer which was not acquired. */
244 	bpf_cgroup_release(cgrp);
245 
246 	return 0;
247 }
248