1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */
3
4 #include <vmlinux.h>
5 #include <bpf/bpf_tracing.h>
6 #include <bpf/bpf_helpers.h>
7
8 #include "bpf_misc.h"
9 #include "cgrp_kfunc_common.h"
10
11 char _license[] SEC("license") = "GPL";
12
13 /* Prototype for all of the program trace events below:
14 *
15 * TRACE_EVENT(cgroup_mkdir,
16 * TP_PROTO(struct cgroup *cgrp, const char *path),
17 * TP_ARGS(cgrp, path)
18 */
19
insert_lookup_cgrp(struct cgroup * cgrp)20 static struct __cgrps_kfunc_map_value *insert_lookup_cgrp(struct cgroup *cgrp)
21 {
22 int status;
23
24 status = cgrps_kfunc_map_insert(cgrp);
25 if (status)
26 return NULL;
27
28 return cgrps_kfunc_map_value_lookup(cgrp);
29 }
30
31 SEC("tp_btf/cgroup_mkdir")
32 __failure __msg("Possibly NULL pointer passed to trusted arg0")
BPF_PROG(cgrp_kfunc_acquire_untrusted,struct cgroup * cgrp,const char * path)33 int BPF_PROG(cgrp_kfunc_acquire_untrusted, struct cgroup *cgrp, const char *path)
34 {
35 struct cgroup *acquired;
36 struct __cgrps_kfunc_map_value *v;
37
38 v = insert_lookup_cgrp(cgrp);
39 if (!v)
40 return 0;
41
42 /* Can't invoke bpf_cgroup_acquire() on an untrusted pointer. */
43 acquired = bpf_cgroup_acquire(v->cgrp);
44 bpf_cgroup_release(acquired);
45
46 return 0;
47 }
48
49 SEC("tp_btf/cgroup_mkdir")
50 __failure __msg("arg#0 pointer type STRUCT cgroup must point")
BPF_PROG(cgrp_kfunc_acquire_fp,struct cgroup * cgrp,const char * path)51 int BPF_PROG(cgrp_kfunc_acquire_fp, struct cgroup *cgrp, const char *path)
52 {
53 struct cgroup *acquired, *stack_cgrp = (struct cgroup *)&path;
54
55 /* Can't invoke bpf_cgroup_acquire() on a random frame pointer. */
56 acquired = bpf_cgroup_acquire((struct cgroup *)&stack_cgrp);
57 bpf_cgroup_release(acquired);
58
59 return 0;
60 }
61
62 SEC("kretprobe/cgroup_destroy_locked")
63 __failure __msg("reg type unsupported for arg#0 function")
BPF_PROG(cgrp_kfunc_acquire_unsafe_kretprobe,struct cgroup * cgrp)64 int BPF_PROG(cgrp_kfunc_acquire_unsafe_kretprobe, struct cgroup *cgrp)
65 {
66 struct cgroup *acquired;
67
68 /* Can't acquire an untrusted struct cgroup * pointer. */
69 acquired = bpf_cgroup_acquire(cgrp);
70 bpf_cgroup_release(acquired);
71
72 return 0;
73 }
74
75 SEC("tp_btf/cgroup_mkdir")
76 __failure __msg("cgrp_kfunc_acquire_trusted_walked")
BPF_PROG(cgrp_kfunc_acquire_trusted_walked,struct cgroup * cgrp,const char * path)77 int BPF_PROG(cgrp_kfunc_acquire_trusted_walked, struct cgroup *cgrp, const char *path)
78 {
79 struct cgroup *acquired;
80
81 /* Can't invoke bpf_cgroup_acquire() on a pointer obtained from walking a trusted cgroup. */
82 acquired = bpf_cgroup_acquire(cgrp->old_dom_cgrp);
83 bpf_cgroup_release(acquired);
84
85 return 0;
86 }
87
88 SEC("tp_btf/cgroup_mkdir")
89 __failure __msg("Possibly NULL pointer passed to trusted arg0")
BPF_PROG(cgrp_kfunc_acquire_null,struct cgroup * cgrp,const char * path)90 int BPF_PROG(cgrp_kfunc_acquire_null, struct cgroup *cgrp, const char *path)
91 {
92 struct cgroup *acquired;
93
94 /* Can't invoke bpf_cgroup_acquire() on a NULL pointer. */
95 acquired = bpf_cgroup_acquire(NULL);
96 if (!acquired)
97 return 0;
98 bpf_cgroup_release(acquired);
99
100 return 0;
101 }
102
103 SEC("tp_btf/cgroup_mkdir")
104 __failure __msg("Unreleased reference")
BPF_PROG(cgrp_kfunc_acquire_unreleased,struct cgroup * cgrp,const char * path)105 int BPF_PROG(cgrp_kfunc_acquire_unreleased, struct cgroup *cgrp, const char *path)
106 {
107 struct cgroup *acquired;
108
109 acquired = bpf_cgroup_acquire(cgrp);
110
111 /* Acquired cgroup is never released. */
112
113 return 0;
114 }
115
116 SEC("tp_btf/cgroup_mkdir")
117 __failure __msg("arg#0 expected pointer to map value")
BPF_PROG(cgrp_kfunc_get_non_kptr_param,struct cgroup * cgrp,const char * path)118 int BPF_PROG(cgrp_kfunc_get_non_kptr_param, struct cgroup *cgrp, const char *path)
119 {
120 struct cgroup *kptr;
121
122 /* Cannot use bpf_cgroup_kptr_get() on a non-kptr, even on a valid cgroup. */
123 kptr = bpf_cgroup_kptr_get(&cgrp);
124 if (!kptr)
125 return 0;
126
127 bpf_cgroup_release(kptr);
128
129 return 0;
130 }
131
132 SEC("tp_btf/cgroup_mkdir")
133 __failure __msg("arg#0 expected pointer to map value")
BPF_PROG(cgrp_kfunc_get_non_kptr_acquired,struct cgroup * cgrp,const char * path)134 int BPF_PROG(cgrp_kfunc_get_non_kptr_acquired, struct cgroup *cgrp, const char *path)
135 {
136 struct cgroup *kptr, *acquired;
137
138 acquired = bpf_cgroup_acquire(cgrp);
139
140 /* Cannot use bpf_cgroup_kptr_get() on a non-map-value, even if the kptr was acquired. */
141 kptr = bpf_cgroup_kptr_get(&acquired);
142 bpf_cgroup_release(acquired);
143 if (!kptr)
144 return 0;
145
146 bpf_cgroup_release(kptr);
147
148 return 0;
149 }
150
151 SEC("tp_btf/cgroup_mkdir")
152 __failure __msg("arg#0 expected pointer to map value")
BPF_PROG(cgrp_kfunc_get_null,struct cgroup * cgrp,const char * path)153 int BPF_PROG(cgrp_kfunc_get_null, struct cgroup *cgrp, const char *path)
154 {
155 struct cgroup *kptr;
156
157 /* Cannot use bpf_cgroup_kptr_get() on a NULL pointer. */
158 kptr = bpf_cgroup_kptr_get(NULL);
159 if (!kptr)
160 return 0;
161
162 bpf_cgroup_release(kptr);
163
164 return 0;
165 }
166
167 SEC("tp_btf/cgroup_mkdir")
168 __failure __msg("Unreleased reference")
BPF_PROG(cgrp_kfunc_xchg_unreleased,struct cgroup * cgrp,const char * path)169 int BPF_PROG(cgrp_kfunc_xchg_unreleased, struct cgroup *cgrp, const char *path)
170 {
171 struct cgroup *kptr;
172 struct __cgrps_kfunc_map_value *v;
173
174 v = insert_lookup_cgrp(cgrp);
175 if (!v)
176 return 0;
177
178 kptr = bpf_kptr_xchg(&v->cgrp, NULL);
179 if (!kptr)
180 return 0;
181
182 /* Kptr retrieved from map is never released. */
183
184 return 0;
185 }
186
187 SEC("tp_btf/cgroup_mkdir")
188 __failure __msg("Unreleased reference")
BPF_PROG(cgrp_kfunc_get_unreleased,struct cgroup * cgrp,const char * path)189 int BPF_PROG(cgrp_kfunc_get_unreleased, struct cgroup *cgrp, const char *path)
190 {
191 struct cgroup *kptr;
192 struct __cgrps_kfunc_map_value *v;
193
194 v = insert_lookup_cgrp(cgrp);
195 if (!v)
196 return 0;
197
198 kptr = bpf_cgroup_kptr_get(&v->cgrp);
199 if (!kptr)
200 return 0;
201
202 /* Kptr acquired above is never released. */
203
204 return 0;
205 }
206
207 SEC("tp_btf/cgroup_mkdir")
208 __failure __msg("arg#0 is untrusted_ptr_or_null_ expected ptr_ or socket")
BPF_PROG(cgrp_kfunc_release_untrusted,struct cgroup * cgrp,const char * path)209 int BPF_PROG(cgrp_kfunc_release_untrusted, struct cgroup *cgrp, const char *path)
210 {
211 struct __cgrps_kfunc_map_value *v;
212
213 v = insert_lookup_cgrp(cgrp);
214 if (!v)
215 return 0;
216
217 /* Can't invoke bpf_cgroup_release() on an untrusted pointer. */
218 bpf_cgroup_release(v->cgrp);
219
220 return 0;
221 }
222
223 SEC("tp_btf/cgroup_mkdir")
224 __failure __msg("arg#0 pointer type STRUCT cgroup must point")
BPF_PROG(cgrp_kfunc_release_fp,struct cgroup * cgrp,const char * path)225 int BPF_PROG(cgrp_kfunc_release_fp, struct cgroup *cgrp, const char *path)
226 {
227 struct cgroup *acquired = (struct cgroup *)&path;
228
229 /* Cannot release random frame pointer. */
230 bpf_cgroup_release(acquired);
231
232 return 0;
233 }
234
235 SEC("tp_btf/cgroup_mkdir")
236 __failure __msg("arg#0 is ptr_or_null_ expected ptr_ or socket")
BPF_PROG(cgrp_kfunc_release_null,struct cgroup * cgrp,const char * path)237 int BPF_PROG(cgrp_kfunc_release_null, struct cgroup *cgrp, const char *path)
238 {
239 struct __cgrps_kfunc_map_value local, *v;
240 long status;
241 struct cgroup *acquired, *old;
242 s32 id;
243
244 status = bpf_probe_read_kernel(&id, sizeof(id), &cgrp->self.id);
245 if (status)
246 return 0;
247
248 local.cgrp = NULL;
249 status = bpf_map_update_elem(&__cgrps_kfunc_map, &id, &local, BPF_NOEXIST);
250 if (status)
251 return status;
252
253 v = bpf_map_lookup_elem(&__cgrps_kfunc_map, &id);
254 if (!v)
255 return -ENOENT;
256
257 acquired = bpf_cgroup_acquire(cgrp);
258
259 old = bpf_kptr_xchg(&v->cgrp, acquired);
260
261 /* old cannot be passed to bpf_cgroup_release() without a NULL check. */
262 bpf_cgroup_release(old);
263
264 return 0;
265 }
266
267 SEC("tp_btf/cgroup_mkdir")
268 __failure __msg("release kernel function bpf_cgroup_release expects")
BPF_PROG(cgrp_kfunc_release_unacquired,struct cgroup * cgrp,const char * path)269 int BPF_PROG(cgrp_kfunc_release_unacquired, struct cgroup *cgrp, const char *path)
270 {
271 /* Cannot release trusted cgroup pointer which was not acquired. */
272 bpf_cgroup_release(cgrp);
273
274 return 0;
275 }
276