1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */
3
4 #include <vmlinux.h>
5 #include <bpf/bpf_tracing.h>
6 #include <bpf/bpf_helpers.h>
7
8 #include "bpf_misc.h"
9 #include "task_kfunc_common.h"
10
11 char _license[] SEC("license") = "GPL";
12
13 /* Prototype for all of the program trace events below:
14 *
15 * TRACE_EVENT(task_newtask,
16 * TP_PROTO(struct task_struct *p, u64 clone_flags)
17 */
18
insert_lookup_task(struct task_struct * task)19 static struct __tasks_kfunc_map_value *insert_lookup_task(struct task_struct *task)
20 {
21 int status;
22
23 status = tasks_kfunc_map_insert(task);
24 if (status)
25 return NULL;
26
27 return tasks_kfunc_map_value_lookup(task);
28 }
29
30 SEC("tp_btf/task_newtask")
31 __failure __msg("Possibly NULL pointer passed to trusted arg0")
BPF_PROG(task_kfunc_acquire_untrusted,struct task_struct * task,u64 clone_flags)32 int BPF_PROG(task_kfunc_acquire_untrusted, struct task_struct *task, u64 clone_flags)
33 {
34 struct task_struct *acquired;
35 struct __tasks_kfunc_map_value *v;
36
37 v = insert_lookup_task(task);
38 if (!v)
39 return 0;
40
41 /* Can't invoke bpf_task_acquire() on an untrusted pointer. */
42 acquired = bpf_task_acquire(v->task);
43 if (!acquired)
44 return 0;
45
46 bpf_task_release(acquired);
47
48 return 0;
49 }
50
51 SEC("tp_btf/task_newtask")
52 __failure __msg("arg#0 pointer type STRUCT task_struct must point")
BPF_PROG(task_kfunc_acquire_fp,struct task_struct * task,u64 clone_flags)53 int BPF_PROG(task_kfunc_acquire_fp, struct task_struct *task, u64 clone_flags)
54 {
55 struct task_struct *acquired, *stack_task = (struct task_struct *)&clone_flags;
56
57 /* Can't invoke bpf_task_acquire() on a random frame pointer. */
58 acquired = bpf_task_acquire((struct task_struct *)&stack_task);
59 if (!acquired)
60 return 0;
61
62 bpf_task_release(acquired);
63
64 return 0;
65 }
66
67 SEC("kretprobe/free_task")
68 __failure __msg("calling kernel function bpf_task_acquire is not allowed")
BPF_PROG(task_kfunc_acquire_unsafe_kretprobe,struct task_struct * task,u64 clone_flags)69 int BPF_PROG(task_kfunc_acquire_unsafe_kretprobe, struct task_struct *task, u64 clone_flags)
70 {
71 struct task_struct *acquired;
72
73 /* Can't call bpf_task_acquire() or bpf_task_release() in an untrusted prog. */
74 acquired = bpf_task_acquire(task);
75 if (!acquired)
76 return 0;
77 bpf_task_release(acquired);
78
79 return 0;
80 }
81
82 SEC("kretprobe/free_task")
83 __failure __msg("calling kernel function bpf_task_acquire is not allowed")
BPF_PROG(task_kfunc_acquire_unsafe_kretprobe_rcu,struct task_struct * task,u64 clone_flags)84 int BPF_PROG(task_kfunc_acquire_unsafe_kretprobe_rcu, struct task_struct *task, u64 clone_flags)
85 {
86 struct task_struct *acquired;
87
88 bpf_rcu_read_lock();
89 if (!task) {
90 bpf_rcu_read_unlock();
91 return 0;
92 }
93 /* Can't call bpf_task_acquire() or bpf_task_release() in an untrusted prog. */
94 acquired = bpf_task_acquire(task);
95 if (acquired)
96 bpf_task_release(acquired);
97 bpf_rcu_read_unlock();
98
99 return 0;
100 }
101
102 SEC("tp_btf/task_newtask")
103 __failure __msg("Possibly NULL pointer passed to trusted arg0")
BPF_PROG(task_kfunc_acquire_null,struct task_struct * task,u64 clone_flags)104 int BPF_PROG(task_kfunc_acquire_null, struct task_struct *task, u64 clone_flags)
105 {
106 struct task_struct *acquired;
107
108 /* Can't invoke bpf_task_acquire() on a NULL pointer. */
109 acquired = bpf_task_acquire(NULL);
110 if (!acquired)
111 return 0;
112 bpf_task_release(acquired);
113
114 return 0;
115 }
116
117 SEC("tp_btf/task_newtask")
118 __failure __msg("Unreleased reference")
BPF_PROG(task_kfunc_acquire_unreleased,struct task_struct * task,u64 clone_flags)119 int BPF_PROG(task_kfunc_acquire_unreleased, struct task_struct *task, u64 clone_flags)
120 {
121 struct task_struct *acquired;
122
123 acquired = bpf_task_acquire(task);
124
125 /* Acquired task is never released. */
126 __sink(acquired);
127
128 return 0;
129 }
130
131 SEC("tp_btf/task_newtask")
132 __failure __msg("Unreleased reference")
BPF_PROG(task_kfunc_xchg_unreleased,struct task_struct * task,u64 clone_flags)133 int BPF_PROG(task_kfunc_xchg_unreleased, struct task_struct *task, u64 clone_flags)
134 {
135 struct task_struct *kptr;
136 struct __tasks_kfunc_map_value *v;
137
138 v = insert_lookup_task(task);
139 if (!v)
140 return 0;
141
142 kptr = bpf_kptr_xchg(&v->task, NULL);
143 if (!kptr)
144 return 0;
145
146 /* Kptr retrieved from map is never released. */
147
148 return 0;
149 }
150
151 SEC("tp_btf/task_newtask")
152 __failure __msg("Possibly NULL pointer passed to trusted arg0")
BPF_PROG(task_kfunc_acquire_release_no_null_check,struct task_struct * task,u64 clone_flags)153 int BPF_PROG(task_kfunc_acquire_release_no_null_check, struct task_struct *task, u64 clone_flags)
154 {
155 struct task_struct *acquired;
156
157 acquired = bpf_task_acquire(task);
158 /* Can't invoke bpf_task_release() on an acquired task without a NULL check. */
159 bpf_task_release(acquired);
160
161 return 0;
162 }
163
164 SEC("tp_btf/task_newtask")
165 __failure __msg("Possibly NULL pointer passed to trusted arg0")
BPF_PROG(task_kfunc_release_untrusted,struct task_struct * task,u64 clone_flags)166 int BPF_PROG(task_kfunc_release_untrusted, struct task_struct *task, u64 clone_flags)
167 {
168 struct __tasks_kfunc_map_value *v;
169
170 v = insert_lookup_task(task);
171 if (!v)
172 return 0;
173
174 /* Can't invoke bpf_task_release() on an untrusted pointer. */
175 bpf_task_release(v->task);
176
177 return 0;
178 }
179
180 SEC("tp_btf/task_newtask")
181 __failure __msg("arg#0 pointer type STRUCT task_struct must point")
BPF_PROG(task_kfunc_release_fp,struct task_struct * task,u64 clone_flags)182 int BPF_PROG(task_kfunc_release_fp, struct task_struct *task, u64 clone_flags)
183 {
184 struct task_struct *acquired = (struct task_struct *)&clone_flags;
185
186 /* Cannot release random frame pointer. */
187 bpf_task_release(acquired);
188
189 return 0;
190 }
191
192 SEC("tp_btf/task_newtask")
193 __failure __msg("Possibly NULL pointer passed to trusted arg0")
BPF_PROG(task_kfunc_release_null,struct task_struct * task,u64 clone_flags)194 int BPF_PROG(task_kfunc_release_null, struct task_struct *task, u64 clone_flags)
195 {
196 struct __tasks_kfunc_map_value local, *v;
197 long status;
198 struct task_struct *acquired, *old;
199 s32 pid;
200
201 status = bpf_probe_read_kernel(&pid, sizeof(pid), &task->pid);
202 if (status)
203 return 0;
204
205 local.task = NULL;
206 status = bpf_map_update_elem(&__tasks_kfunc_map, &pid, &local, BPF_NOEXIST);
207 if (status)
208 return status;
209
210 v = bpf_map_lookup_elem(&__tasks_kfunc_map, &pid);
211 if (!v)
212 return -ENOENT;
213
214 acquired = bpf_task_acquire(task);
215 if (!acquired)
216 return -EEXIST;
217
218 old = bpf_kptr_xchg(&v->task, acquired);
219
220 /* old cannot be passed to bpf_task_release() without a NULL check. */
221 bpf_task_release(old);
222
223 return 0;
224 }
225
226 SEC("tp_btf/task_newtask")
227 __failure __msg("release kernel function bpf_task_release expects")
BPF_PROG(task_kfunc_release_unacquired,struct task_struct * task,u64 clone_flags)228 int BPF_PROG(task_kfunc_release_unacquired, struct task_struct *task, u64 clone_flags)
229 {
230 /* Cannot release trusted task pointer which was not acquired. */
231 bpf_task_release(task);
232
233 return 0;
234 }
235
236 SEC("tp_btf/task_newtask")
237 __failure __msg("Possibly NULL pointer passed to trusted arg0")
BPF_PROG(task_kfunc_from_pid_no_null_check,struct task_struct * task,u64 clone_flags)238 int BPF_PROG(task_kfunc_from_pid_no_null_check, struct task_struct *task, u64 clone_flags)
239 {
240 struct task_struct *acquired;
241
242 acquired = bpf_task_from_pid(task->pid);
243
244 /* Releasing bpf_task_from_pid() lookup without a NULL check. */
245 bpf_task_release(acquired);
246
247 return 0;
248 }
249
250 SEC("lsm/task_free")
251 __failure __msg("reg type unsupported for arg#0 function")
BPF_PROG(task_kfunc_from_lsm_task_free,struct task_struct * task)252 int BPF_PROG(task_kfunc_from_lsm_task_free, struct task_struct *task)
253 {
254 struct task_struct *acquired;
255
256 /* the argument of lsm task_free hook is untrusted. */
257 acquired = bpf_task_acquire(task);
258 if (!acquired)
259 return 0;
260
261 bpf_task_release(acquired);
262 return 0;
263 }
264
265 SEC("tp_btf/task_newtask")
266 __failure __msg("access beyond the end of member comm")
BPF_PROG(task_access_comm1,struct task_struct * task,u64 clone_flags)267 int BPF_PROG(task_access_comm1, struct task_struct *task, u64 clone_flags)
268 {
269 bpf_strncmp(task->comm, 17, "foo");
270 return 0;
271 }
272
273 SEC("tp_btf/task_newtask")
274 __failure __msg("access beyond the end of member comm")
BPF_PROG(task_access_comm2,struct task_struct * task,u64 clone_flags)275 int BPF_PROG(task_access_comm2, struct task_struct *task, u64 clone_flags)
276 {
277 bpf_strncmp(task->comm + 1, 16, "foo");
278 return 0;
279 }
280
281 SEC("tp_btf/task_newtask")
282 __failure __msg("write into memory")
BPF_PROG(task_access_comm3,struct task_struct * task,u64 clone_flags)283 int BPF_PROG(task_access_comm3, struct task_struct *task, u64 clone_flags)
284 {
285 bpf_probe_read_kernel(task->comm, 16, task->comm);
286 return 0;
287 }
288
289 SEC("fentry/__set_task_comm")
290 __failure __msg("R1 type=ptr_ expected")
BPF_PROG(task_access_comm4,struct task_struct * task,const char * buf,bool exec)291 int BPF_PROG(task_access_comm4, struct task_struct *task, const char *buf, bool exec)
292 {
293 /*
294 * task->comm is a legacy ptr_to_btf_id. The verifier cannot guarantee
295 * its safety. Hence it cannot be accessed with normal load insns.
296 */
297 bpf_strncmp(task->comm, 16, "foo");
298 return 0;
299 }
300
301 SEC("tp_btf/task_newtask")
302 __failure __msg("R1 must be referenced or trusted")
BPF_PROG(task_kfunc_release_in_map,struct task_struct * task,u64 clone_flags)303 int BPF_PROG(task_kfunc_release_in_map, struct task_struct *task, u64 clone_flags)
304 {
305 struct task_struct *local;
306 struct __tasks_kfunc_map_value *v;
307
308 if (tasks_kfunc_map_insert(task))
309 return 0;
310
311 v = tasks_kfunc_map_value_lookup(task);
312 if (!v)
313 return 0;
314
315 bpf_rcu_read_lock();
316 local = v->task;
317 if (!local) {
318 bpf_rcu_read_unlock();
319 return 0;
320 }
321 /* Can't release a kptr that's still stored in a map. */
322 bpf_task_release(local);
323 bpf_rcu_read_unlock();
324
325 return 0;
326 }
327