1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2022 Facebook */
3 
4 #include <errno.h>
5 #include <string.h>
6 #include <linux/bpf.h>
7 #include <bpf/bpf_helpers.h>
8 #include "bpf_misc.h"
9 
10 char _license[] SEC("license") = "GPL";
11 
12 #define ITER_HELPERS						\
13 	  __imm(bpf_iter_num_new),				\
14 	  __imm(bpf_iter_num_next),				\
15 	  __imm(bpf_iter_num_destroy)
16 
17 SEC("?raw_tp")
18 __success
19 int force_clang_to_emit_btf_for_externs(void *ctx)
20 {
21 	/* we need this as a workaround to enforce compiler emitting BTF
22 	 * information for bpf_iter_num_{new,next,destroy}() kfuncs,
23 	 * as, apparently, it doesn't emit it for symbols only referenced from
24 	 * assembly (or cleanup attribute, for that matter, as well)
25 	 */
26 	bpf_repeat(0);
27 
28 	return 0;
29 }
30 
31 SEC("?raw_tp")
32 __success __log_level(2)
33 __msg("fp-8_w=iter_num(ref_id=1,state=active,depth=0)")
34 int create_and_destroy(void *ctx)
35 {
36 	struct bpf_iter_num iter;
37 
38 	asm volatile (
39 		/* create iterator */
40 		"r1 = %[iter];"
41 		"r2 = 0;"
42 		"r3 = 1000;"
43 		"call %[bpf_iter_num_new];"
44 		/* destroy iterator */
45 		"r1 = %[iter];"
46 		"call %[bpf_iter_num_destroy];"
47 		:
48 		: __imm_ptr(iter), ITER_HELPERS
49 		: __clobber_common
50 	);
51 
52 	return 0;
53 }
54 
55 SEC("?raw_tp")
56 __failure __msg("Unreleased reference id=1")
57 int create_and_forget_to_destroy_fail(void *ctx)
58 {
59 	struct bpf_iter_num iter;
60 
61 	asm volatile (
62 		/* create iterator */
63 		"r1 = %[iter];"
64 		"r2 = 0;"
65 		"r3 = 1000;"
66 		"call %[bpf_iter_num_new];"
67 		:
68 		: __imm_ptr(iter), ITER_HELPERS
69 		: __clobber_common
70 	);
71 
72 	return 0;
73 }
74 
75 SEC("?raw_tp")
76 __failure __msg("expected an initialized iter_num as arg #1")
77 int destroy_without_creating_fail(void *ctx)
78 {
79 	/* init with zeros to stop verifier complaining about uninit stack */
80 	struct bpf_iter_num iter;
81 
82 	asm volatile (
83 		"r1 = %[iter];"
84 		"call %[bpf_iter_num_destroy];"
85 		:
86 		: __imm_ptr(iter), ITER_HELPERS
87 		: __clobber_common
88 	);
89 
90 	return 0;
91 }
92 
93 SEC("?raw_tp")
94 __failure __msg("expected an initialized iter_num as arg #1")
95 int compromise_iter_w_direct_write_fail(void *ctx)
96 {
97 	struct bpf_iter_num iter;
98 
99 	asm volatile (
100 		/* create iterator */
101 		"r1 = %[iter];"
102 		"r2 = 0;"
103 		"r3 = 1000;"
104 		"call %[bpf_iter_num_new];"
105 
106 		/* directly write over first half of iter state */
107 		"*(u64 *)(%[iter] + 0) = r0;"
108 
109 		/* (attempt to) destroy iterator */
110 		"r1 = %[iter];"
111 		"call %[bpf_iter_num_destroy];"
112 		:
113 		: __imm_ptr(iter), ITER_HELPERS
114 		: __clobber_common
115 	);
116 
117 	return 0;
118 }
119 
120 SEC("?raw_tp")
121 __failure __msg("Unreleased reference id=1")
122 int compromise_iter_w_direct_write_and_skip_destroy_fail(void *ctx)
123 {
124 	struct bpf_iter_num iter;
125 
126 	asm volatile (
127 		/* create iterator */
128 		"r1 = %[iter];"
129 		"r2 = 0;"
130 		"r3 = 1000;"
131 		"call %[bpf_iter_num_new];"
132 
133 		/* directly write over first half of iter state */
134 		"*(u64 *)(%[iter] + 0) = r0;"
135 
136 		/* don't destroy iter, leaking ref, which should fail */
137 		:
138 		: __imm_ptr(iter), ITER_HELPERS
139 		: __clobber_common
140 	);
141 
142 	return 0;
143 }
144 
145 SEC("?raw_tp")
146 __failure __msg("expected an initialized iter_num as arg #1")
147 int compromise_iter_w_helper_write_fail(void *ctx)
148 {
149 	struct bpf_iter_num iter;
150 
151 	asm volatile (
152 		/* create iterator */
153 		"r1 = %[iter];"
154 		"r2 = 0;"
155 		"r3 = 1000;"
156 		"call %[bpf_iter_num_new];"
157 
158 		/* overwrite 8th byte with bpf_probe_read_kernel() */
159 		"r1 = %[iter];"
160 		"r1 += 7;"
161 		"r2 = 1;"
162 		"r3 = 0;" /* NULL */
163 		"call %[bpf_probe_read_kernel];"
164 
165 		/* (attempt to) destroy iterator */
166 		"r1 = %[iter];"
167 		"call %[bpf_iter_num_destroy];"
168 		:
169 		: __imm_ptr(iter), ITER_HELPERS, __imm(bpf_probe_read_kernel)
170 		: __clobber_common
171 	);
172 
173 	return 0;
174 }
175 
176 static __noinline void subprog_with_iter(void)
177 {
178 	struct bpf_iter_num iter;
179 
180 	bpf_iter_num_new(&iter, 0, 1);
181 
182 	return;
183 }
184 
185 SEC("?raw_tp")
186 __failure
187 /* ensure there was a call to subprog, which might happen without __noinline */
188 __msg("returning from callee:")
189 __msg("Unreleased reference id=1")
190 int leak_iter_from_subprog_fail(void *ctx)
191 {
192 	subprog_with_iter();
193 
194 	return 0;
195 }
196 
197 SEC("?raw_tp")
198 __success __log_level(2)
199 __msg("fp-8_w=iter_num(ref_id=1,state=active,depth=0)")
200 int valid_stack_reuse(void *ctx)
201 {
202 	struct bpf_iter_num iter;
203 
204 	asm volatile (
205 		/* create iterator */
206 		"r1 = %[iter];"
207 		"r2 = 0;"
208 		"r3 = 1000;"
209 		"call %[bpf_iter_num_new];"
210 		/* destroy iterator */
211 		"r1 = %[iter];"
212 		"call %[bpf_iter_num_destroy];"
213 
214 		/* now reuse same stack slots */
215 
216 		/* create iterator */
217 		"r1 = %[iter];"
218 		"r2 = 0;"
219 		"r3 = 1000;"
220 		"call %[bpf_iter_num_new];"
221 		/* destroy iterator */
222 		"r1 = %[iter];"
223 		"call %[bpf_iter_num_destroy];"
224 		:
225 		: __imm_ptr(iter), ITER_HELPERS
226 		: __clobber_common
227 	);
228 
229 	return 0;
230 }
231 
232 SEC("?raw_tp")
233 __failure __msg("expected uninitialized iter_num as arg #1")
234 int double_create_fail(void *ctx)
235 {
236 	struct bpf_iter_num iter;
237 
238 	asm volatile (
239 		/* create iterator */
240 		"r1 = %[iter];"
241 		"r2 = 0;"
242 		"r3 = 1000;"
243 		"call %[bpf_iter_num_new];"
244 		/* (attempt to) create iterator again */
245 		"r1 = %[iter];"
246 		"r2 = 0;"
247 		"r3 = 1000;"
248 		"call %[bpf_iter_num_new];"
249 		/* destroy iterator */
250 		"r1 = %[iter];"
251 		"call %[bpf_iter_num_destroy];"
252 		:
253 		: __imm_ptr(iter), ITER_HELPERS
254 		: __clobber_common
255 	);
256 
257 	return 0;
258 }
259 
260 SEC("?raw_tp")
261 __failure __msg("expected an initialized iter_num as arg #1")
262 int double_destroy_fail(void *ctx)
263 {
264 	struct bpf_iter_num iter;
265 
266 	asm volatile (
267 		/* create iterator */
268 		"r1 = %[iter];"
269 		"r2 = 0;"
270 		"r3 = 1000;"
271 		"call %[bpf_iter_num_new];"
272 		/* destroy iterator */
273 		"r1 = %[iter];"
274 		"call %[bpf_iter_num_destroy];"
275 		/* (attempt to) destroy iterator again */
276 		"r1 = %[iter];"
277 		"call %[bpf_iter_num_destroy];"
278 		:
279 		: __imm_ptr(iter), ITER_HELPERS
280 		: __clobber_common
281 	);
282 
283 	return 0;
284 }
285 
286 SEC("?raw_tp")
287 __failure __msg("expected an initialized iter_num as arg #1")
288 int next_without_new_fail(void *ctx)
289 {
290 	struct bpf_iter_num iter;
291 
292 	asm volatile (
293 		/* don't create iterator and try to iterate*/
294 		"r1 = %[iter];"
295 		"call %[bpf_iter_num_next];"
296 		/* destroy iterator */
297 		"r1 = %[iter];"
298 		"call %[bpf_iter_num_destroy];"
299 		:
300 		: __imm_ptr(iter), ITER_HELPERS
301 		: __clobber_common
302 	);
303 
304 	return 0;
305 }
306 
307 SEC("?raw_tp")
308 __failure __msg("expected an initialized iter_num as arg #1")
309 int next_after_destroy_fail(void *ctx)
310 {
311 	struct bpf_iter_num iter;
312 
313 	asm volatile (
314 		/* create iterator */
315 		"r1 = %[iter];"
316 		"r2 = 0;"
317 		"r3 = 1000;"
318 		"call %[bpf_iter_num_new];"
319 		/* destroy iterator */
320 		"r1 = %[iter];"
321 		"call %[bpf_iter_num_destroy];"
322 		/* don't create iterator and try to iterate*/
323 		"r1 = %[iter];"
324 		"call %[bpf_iter_num_next];"
325 		:
326 		: __imm_ptr(iter), ITER_HELPERS
327 		: __clobber_common
328 	);
329 
330 	return 0;
331 }
332 
333 SEC("?raw_tp")
334 __failure __msg("invalid read from stack")
335 int __naked read_from_iter_slot_fail(void)
336 {
337 	asm volatile (
338 		/* r6 points to struct bpf_iter_num on the stack */
339 		"r6 = r10;"
340 		"r6 += -24;"
341 
342 		/* create iterator */
343 		"r1 = r6;"
344 		"r2 = 0;"
345 		"r3 = 1000;"
346 		"call %[bpf_iter_num_new];"
347 
348 		/* attemp to leak bpf_iter_num state */
349 		"r7 = *(u64 *)(r6 + 0);"
350 		"r8 = *(u64 *)(r6 + 8);"
351 
352 		/* destroy iterator */
353 		"r1 = r6;"
354 		"call %[bpf_iter_num_destroy];"
355 
356 		/* leak bpf_iter_num state */
357 		"r0 = r7;"
358 		"if r7 > r8 goto +1;"
359 		"r0 = r8;"
360 		"exit;"
361 		:
362 		: ITER_HELPERS
363 		: __clobber_common, "r6", "r7", "r8"
364 	);
365 }
366 
367 int zero;
368 
369 SEC("?raw_tp")
370 __failure
371 __flag(BPF_F_TEST_STATE_FREQ)
372 __msg("Unreleased reference")
373 int stacksafe_should_not_conflate_stack_spill_and_iter(void *ctx)
374 {
375 	struct bpf_iter_num iter;
376 
377 	asm volatile (
378 		/* Create a fork in logic, with general setup as follows:
379 		 *   - fallthrough (first) path is valid;
380 		 *   - branch (second) path is invalid.
381 		 * Then depending on what we do in fallthrough vs branch path,
382 		 * we try to detect bugs in func_states_equal(), regsafe(),
383 		 * refsafe(), stack_safe(), and similar by tricking verifier
384 		 * into believing that branch state is a valid subset of
385 		 * a fallthrough state. Verifier should reject overall
386 		 * validation, unless there is a bug somewhere in verifier
387 		 * logic.
388 		 */
389 		"call %[bpf_get_prandom_u32];"
390 		"r6 = r0;"
391 		"call %[bpf_get_prandom_u32];"
392 		"r7 = r0;"
393 
394 		"if r6 > r7 goto bad;" /* fork */
395 
396 		/* spill r6 into stack slot of bpf_iter_num var */
397 		"*(u64 *)(%[iter] + 0) = r6;"
398 
399 		"goto skip_bad;"
400 
401 	"bad:"
402 		/* create iterator in the same stack slot */
403 		"r1 = %[iter];"
404 		"r2 = 0;"
405 		"r3 = 1000;"
406 		"call %[bpf_iter_num_new];"
407 
408 		/* but then forget about it and overwrite it back to r6 spill */
409 		"*(u64 *)(%[iter] + 0) = r6;"
410 
411 	"skip_bad:"
412 		"goto +0;" /* force checkpoint */
413 
414 		/* corrupt stack slots, if they are really dynptr */
415 		"*(u64 *)(%[iter] + 0) = r6;"
416 		:
417 		: __imm_ptr(iter),
418 		  __imm_addr(zero),
419 		  __imm(bpf_get_prandom_u32),
420 		  __imm(bpf_dynptr_from_mem),
421 		  ITER_HELPERS
422 		: __clobber_common, "r6", "r7"
423 	);
424 
425 	return 0;
426 }
427