1// SPDX-License-Identifier: GPL-2.0
  2/* Copyright (c) 2024 Google LLC. */
  3
  4#include <vmlinux.h>
  5#include <bpf/bpf_helpers.h>
  6#include <bpf/bpf_tracing.h>
  7#include <linux/limits.h>
  8
  9#include "bpf_misc.h"
 10#include "bpf_experimental.h"
 11
 12static char buf[PATH_MAX];
 13
 14SEC("lsm.s/file_open")
 15__failure __msg("Possibly NULL pointer passed to trusted arg0")
 16int BPF_PROG(get_task_exe_file_kfunc_null)
 17{
 18	struct file *acquired;
 19
 20	/* Can't pass a NULL pointer to bpf_get_task_exe_file(). */
 21	acquired = bpf_get_task_exe_file(NULL);
 22	if (!acquired)
 23		return 0;
 24
 25	bpf_put_file(acquired);
 26	return 0;
 27}
 28
 29SEC("lsm.s/inode_getxattr")
 30__failure __msg("arg#0 pointer type STRUCT task_struct must point to scalar, or struct with scalar")
 31int BPF_PROG(get_task_exe_file_kfunc_fp)
 32{
 33	u64 x;
 34	struct file *acquired;
 35	struct task_struct *task;
 36
 37	task = (struct task_struct *)&x;
 38	/* Can't pass random frame pointer to bpf_get_task_exe_file(). */
 39	acquired = bpf_get_task_exe_file(task);
 40	if (!acquired)
 41		return 0;
 42
 43	bpf_put_file(acquired);
 44	return 0;
 45}
 46
 47SEC("lsm.s/file_open")
 48__failure __msg("R1 must be referenced or trusted")
 49int BPF_PROG(get_task_exe_file_kfunc_untrusted)
 50{
 51	struct file *acquired;
 52	struct task_struct *parent;
 53
 54	/* Walking a trusted struct task_struct returned from
 55	 * bpf_get_current_task_btf() yields an untrusted pointer.
 56	 */
 57	parent = bpf_get_current_task_btf()->parent;
 58	/* Can't pass untrusted pointer to bpf_get_task_exe_file(). */
 59	acquired = bpf_get_task_exe_file(parent);
 60	if (!acquired)
 61		return 0;
 62
 63	bpf_put_file(acquired);
 64	return 0;
 65}
 66
 67SEC("lsm.s/file_open")
 68__failure __msg("Unreleased reference")
 69int BPF_PROG(get_task_exe_file_kfunc_unreleased)
 70{
 71	struct file *acquired;
 72
 73	acquired = bpf_get_task_exe_file(bpf_get_current_task_btf());
 74	if (!acquired)
 75		return 0;
 76
 77	/* Acquired but never released. */
 78	return 0;
 79}
 80
 81SEC("lsm.s/file_open")
 82__failure __msg("release kernel function bpf_put_file expects")
 83int BPF_PROG(put_file_kfunc_unacquired, struct file *file)
 84{
 85	/* Can't release an unacquired pointer. */
 86	bpf_put_file(file);
 87	return 0;
 88}
 89
 90SEC("lsm.s/file_open")
 91__failure __msg("Possibly NULL pointer passed to trusted arg0")
 92int BPF_PROG(path_d_path_kfunc_null)
 93{
 94	/* Can't pass NULL value to bpf_path_d_path() kfunc. */
 95	bpf_path_d_path(NULL, buf, sizeof(buf));
 96	return 0;
 97}
 98
 99SEC("lsm.s/task_alloc")
100__failure __msg("R1 must be referenced or trusted")
101int BPF_PROG(path_d_path_kfunc_untrusted_from_argument, struct task_struct *task)
102{
103	struct path *root;
104
105	/* Walking a trusted argument typically yields an untrusted
106	 * pointer. This is one example of that.
107	 */
108	root = &task->fs->root;
109	bpf_path_d_path(root, buf, sizeof(buf));
110	return 0;
111}
112
113SEC("lsm.s/file_open")
114__failure __msg("R1 must be referenced or trusted")
115int BPF_PROG(path_d_path_kfunc_untrusted_from_current)
116{
117	struct path *pwd;
118	struct task_struct *current;
119
120	current = bpf_get_current_task_btf();
121	/* Walking a trusted pointer returned from bpf_get_current_task_btf()
122	 * yields an untrusted pointer.
123	 */
124	pwd = &current->fs->pwd;
125	bpf_path_d_path(pwd, buf, sizeof(buf));
126	return 0;
127}
128
129SEC("lsm.s/file_open")
130__failure __msg("kernel function bpf_path_d_path args#0 expected pointer to STRUCT path but R1 has a pointer to STRUCT file")
131int BPF_PROG(path_d_path_kfunc_type_mismatch, struct file *file)
132{
133	bpf_path_d_path((struct path *)&file->f_task_work, buf, sizeof(buf));
134	return 0;
135}
136
137SEC("lsm.s/file_open")
138__failure __msg("invalid access to map value, value_size=4096 off=0 size=8192")
139int BPF_PROG(path_d_path_kfunc_invalid_buf_sz, struct file *file)
140{
141	/* bpf_path_d_path() enforces a constraint on the buffer size supplied
142	 * by the BPF LSM program via the __sz annotation. buf here is set to
143	 * PATH_MAX, so let's ensure that the BPF verifier rejects BPF_PROG_LOAD
144	 * attempts if the supplied size and the actual size of the buffer
145	 * mismatches.
146	 */
147	bpf_path_d_path(&file->f_path, buf, PATH_MAX * 2);
148	return 0;
149}
150
151SEC("fentry/vfs_open")
152__failure __msg("calling kernel function bpf_path_d_path is not allowed")
153int BPF_PROG(path_d_path_kfunc_non_lsm, struct path *path, struct file *f)
154{
155	/* Calling bpf_path_d_path() from a non-LSM BPF program isn't permitted.
156	 */
157	bpf_path_d_path(path, buf, sizeof(buf));
158	return 0;
159}
160
161char _license[] SEC("license") = "GPL";