1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ 3 4 #include <vmlinux.h> 5 #include <bpf/bpf_tracing.h> 6 #include <bpf/bpf_helpers.h> 7 8 #include "bpf_misc.h" 9 #include "cgrp_kfunc_common.h" 10 11 char _license[] SEC("license") = "GPL"; 12 13 /* Prototype for all of the program trace events below: 14 * 15 * TRACE_EVENT(cgroup_mkdir, 16 * TP_PROTO(struct cgroup *cgrp, const char *path), 17 * TP_ARGS(cgrp, path) 18 */ 19 20 static struct __cgrps_kfunc_map_value *insert_lookup_cgrp(struct cgroup *cgrp) 21 { 22 int status; 23 24 status = cgrps_kfunc_map_insert(cgrp); 25 if (status) 26 return NULL; 27 28 return cgrps_kfunc_map_value_lookup(cgrp); 29 } 30 31 SEC("tp_btf/cgroup_mkdir") 32 __failure __msg("Possibly NULL pointer passed to trusted arg0") 33 int BPF_PROG(cgrp_kfunc_acquire_untrusted, struct cgroup *cgrp, const char *path) 34 { 35 struct cgroup *acquired; 36 struct __cgrps_kfunc_map_value *v; 37 38 v = insert_lookup_cgrp(cgrp); 39 if (!v) 40 return 0; 41 42 /* Can't invoke bpf_cgroup_acquire() on an untrusted pointer. */ 43 acquired = bpf_cgroup_acquire(v->cgrp); 44 bpf_cgroup_release(acquired); 45 46 return 0; 47 } 48 49 SEC("tp_btf/cgroup_mkdir") 50 __failure __msg("arg#0 pointer type STRUCT cgroup must point") 51 int BPF_PROG(cgrp_kfunc_acquire_fp, struct cgroup *cgrp, const char *path) 52 { 53 struct cgroup *acquired, *stack_cgrp = (struct cgroup *)&path; 54 55 /* Can't invoke bpf_cgroup_acquire() on a random frame pointer. */ 56 acquired = bpf_cgroup_acquire((struct cgroup *)&stack_cgrp); 57 bpf_cgroup_release(acquired); 58 59 return 0; 60 } 61 62 SEC("kretprobe/cgroup_destroy_locked") 63 __failure __msg("reg type unsupported for arg#0 function") 64 int BPF_PROG(cgrp_kfunc_acquire_unsafe_kretprobe, struct cgroup *cgrp) 65 { 66 struct cgroup *acquired; 67 68 /* Can't acquire an untrusted struct cgroup * pointer. */ 69 acquired = bpf_cgroup_acquire(cgrp); 70 bpf_cgroup_release(acquired); 71 72 return 0; 73 } 74 75 SEC("tp_btf/cgroup_mkdir") 76 __failure __msg("cgrp_kfunc_acquire_trusted_walked") 77 int BPF_PROG(cgrp_kfunc_acquire_trusted_walked, struct cgroup *cgrp, const char *path) 78 { 79 struct cgroup *acquired; 80 81 /* Can't invoke bpf_cgroup_acquire() on a pointer obtained from walking a trusted cgroup. */ 82 acquired = bpf_cgroup_acquire(cgrp->old_dom_cgrp); 83 bpf_cgroup_release(acquired); 84 85 return 0; 86 } 87 88 SEC("tp_btf/cgroup_mkdir") 89 __failure __msg("Possibly NULL pointer passed to trusted arg0") 90 int BPF_PROG(cgrp_kfunc_acquire_null, struct cgroup *cgrp, const char *path) 91 { 92 struct cgroup *acquired; 93 94 /* Can't invoke bpf_cgroup_acquire() on a NULL pointer. */ 95 acquired = bpf_cgroup_acquire(NULL); 96 if (!acquired) 97 return 0; 98 bpf_cgroup_release(acquired); 99 100 return 0; 101 } 102 103 SEC("tp_btf/cgroup_mkdir") 104 __failure __msg("Unreleased reference") 105 int BPF_PROG(cgrp_kfunc_acquire_unreleased, struct cgroup *cgrp, const char *path) 106 { 107 struct cgroup *acquired; 108 109 acquired = bpf_cgroup_acquire(cgrp); 110 111 /* Acquired cgroup is never released. */ 112 113 return 0; 114 } 115 116 SEC("tp_btf/cgroup_mkdir") 117 __failure __msg("arg#0 expected pointer to map value") 118 int BPF_PROG(cgrp_kfunc_get_non_kptr_param, struct cgroup *cgrp, const char *path) 119 { 120 struct cgroup *kptr; 121 122 /* Cannot use bpf_cgroup_kptr_get() on a non-kptr, even on a valid cgroup. */ 123 kptr = bpf_cgroup_kptr_get(&cgrp); 124 if (!kptr) 125 return 0; 126 127 bpf_cgroup_release(kptr); 128 129 return 0; 130 } 131 132 SEC("tp_btf/cgroup_mkdir") 133 __failure __msg("arg#0 expected pointer to map value") 134 int BPF_PROG(cgrp_kfunc_get_non_kptr_acquired, struct cgroup *cgrp, const char *path) 135 { 136 struct cgroup *kptr, *acquired; 137 138 acquired = bpf_cgroup_acquire(cgrp); 139 140 /* Cannot use bpf_cgroup_kptr_get() on a non-map-value, even if the kptr was acquired. */ 141 kptr = bpf_cgroup_kptr_get(&acquired); 142 bpf_cgroup_release(acquired); 143 if (!kptr) 144 return 0; 145 146 bpf_cgroup_release(kptr); 147 148 return 0; 149 } 150 151 SEC("tp_btf/cgroup_mkdir") 152 __failure __msg("arg#0 expected pointer to map value") 153 int BPF_PROG(cgrp_kfunc_get_null, struct cgroup *cgrp, const char *path) 154 { 155 struct cgroup *kptr; 156 157 /* Cannot use bpf_cgroup_kptr_get() on a NULL pointer. */ 158 kptr = bpf_cgroup_kptr_get(NULL); 159 if (!kptr) 160 return 0; 161 162 bpf_cgroup_release(kptr); 163 164 return 0; 165 } 166 167 SEC("tp_btf/cgroup_mkdir") 168 __failure __msg("Unreleased reference") 169 int BPF_PROG(cgrp_kfunc_xchg_unreleased, struct cgroup *cgrp, const char *path) 170 { 171 struct cgroup *kptr; 172 struct __cgrps_kfunc_map_value *v; 173 174 v = insert_lookup_cgrp(cgrp); 175 if (!v) 176 return 0; 177 178 kptr = bpf_kptr_xchg(&v->cgrp, NULL); 179 if (!kptr) 180 return 0; 181 182 /* Kptr retrieved from map is never released. */ 183 184 return 0; 185 } 186 187 SEC("tp_btf/cgroup_mkdir") 188 __failure __msg("Unreleased reference") 189 int BPF_PROG(cgrp_kfunc_get_unreleased, struct cgroup *cgrp, const char *path) 190 { 191 struct cgroup *kptr; 192 struct __cgrps_kfunc_map_value *v; 193 194 v = insert_lookup_cgrp(cgrp); 195 if (!v) 196 return 0; 197 198 kptr = bpf_cgroup_kptr_get(&v->cgrp); 199 if (!kptr) 200 return 0; 201 202 /* Kptr acquired above is never released. */ 203 204 return 0; 205 } 206 207 SEC("tp_btf/cgroup_mkdir") 208 __failure __msg("arg#0 is untrusted_ptr_or_null_ expected ptr_ or socket") 209 int BPF_PROG(cgrp_kfunc_release_untrusted, struct cgroup *cgrp, const char *path) 210 { 211 struct __cgrps_kfunc_map_value *v; 212 213 v = insert_lookup_cgrp(cgrp); 214 if (!v) 215 return 0; 216 217 /* Can't invoke bpf_cgroup_release() on an untrusted pointer. */ 218 bpf_cgroup_release(v->cgrp); 219 220 return 0; 221 } 222 223 SEC("tp_btf/cgroup_mkdir") 224 __failure __msg("arg#0 pointer type STRUCT cgroup must point") 225 int BPF_PROG(cgrp_kfunc_release_fp, struct cgroup *cgrp, const char *path) 226 { 227 struct cgroup *acquired = (struct cgroup *)&path; 228 229 /* Cannot release random frame pointer. */ 230 bpf_cgroup_release(acquired); 231 232 return 0; 233 } 234 235 SEC("tp_btf/cgroup_mkdir") 236 __failure __msg("arg#0 is ptr_or_null_ expected ptr_ or socket") 237 int BPF_PROG(cgrp_kfunc_release_null, struct cgroup *cgrp, const char *path) 238 { 239 struct __cgrps_kfunc_map_value local, *v; 240 long status; 241 struct cgroup *acquired, *old; 242 s32 id; 243 244 status = bpf_probe_read_kernel(&id, sizeof(id), &cgrp->self.id); 245 if (status) 246 return 0; 247 248 local.cgrp = NULL; 249 status = bpf_map_update_elem(&__cgrps_kfunc_map, &id, &local, BPF_NOEXIST); 250 if (status) 251 return status; 252 253 v = bpf_map_lookup_elem(&__cgrps_kfunc_map, &id); 254 if (!v) 255 return -ENOENT; 256 257 acquired = bpf_cgroup_acquire(cgrp); 258 259 old = bpf_kptr_xchg(&v->cgrp, acquired); 260 261 /* old cannot be passed to bpf_cgroup_release() without a NULL check. */ 262 bpf_cgroup_release(old); 263 264 return 0; 265 } 266 267 SEC("tp_btf/cgroup_mkdir") 268 __failure __msg("release kernel function bpf_cgroup_release expects") 269 int BPF_PROG(cgrp_kfunc_release_unacquired, struct cgroup *cgrp, const char *path) 270 { 271 /* Cannot release trusted cgroup pointer which was not acquired. */ 272 bpf_cgroup_release(cgrp); 273 274 return 0; 275 } 276