Loading...
1// SPDX-License-Identifier: GPL-2.0
2/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */
3
4#include <vmlinux.h>
5#include <bpf/bpf_tracing.h>
6#include <bpf/bpf_helpers.h>
7
8#include "bpf_misc.h"
9#include "cgrp_kfunc_common.h"
10
11char _license[] SEC("license") = "GPL";
12
13/* Prototype for all of the program trace events below:
14 *
15 * TRACE_EVENT(cgroup_mkdir,
16 * TP_PROTO(struct cgroup *cgrp, const char *path),
17 * TP_ARGS(cgrp, path)
18 */
19
20static struct __cgrps_kfunc_map_value *insert_lookup_cgrp(struct cgroup *cgrp)
21{
22 int status;
23
24 status = cgrps_kfunc_map_insert(cgrp);
25 if (status)
26 return NULL;
27
28 return cgrps_kfunc_map_value_lookup(cgrp);
29}
30
31SEC("tp_btf/cgroup_mkdir")
32__failure __msg("Possibly NULL pointer passed to trusted arg0")
33int BPF_PROG(cgrp_kfunc_acquire_untrusted, struct cgroup *cgrp, const char *path)
34{
35 struct cgroup *acquired;
36 struct __cgrps_kfunc_map_value *v;
37
38 v = insert_lookup_cgrp(cgrp);
39 if (!v)
40 return 0;
41
42 /* Can't invoke bpf_cgroup_acquire() on an untrusted pointer. */
43 acquired = bpf_cgroup_acquire(v->cgrp);
44 if (acquired)
45 bpf_cgroup_release(acquired);
46
47 return 0;
48}
49
50SEC("tp_btf/cgroup_mkdir")
51__failure __msg("Possibly NULL pointer passed to trusted arg0")
52int BPF_PROG(cgrp_kfunc_acquire_no_null_check, struct cgroup *cgrp, const char *path)
53{
54 struct cgroup *acquired;
55
56 acquired = bpf_cgroup_acquire(cgrp);
57 /*
58 * Can't invoke bpf_cgroup_release() without checking the return value
59 * of bpf_cgroup_acquire().
60 */
61 bpf_cgroup_release(acquired);
62
63 return 0;
64}
65
66SEC("tp_btf/cgroup_mkdir")
67__failure __msg("arg#0 pointer type STRUCT cgroup must point")
68int BPF_PROG(cgrp_kfunc_acquire_fp, struct cgroup *cgrp, const char *path)
69{
70 struct cgroup *acquired, *stack_cgrp = (struct cgroup *)&path;
71
72 /* Can't invoke bpf_cgroup_acquire() on a random frame pointer. */
73 acquired = bpf_cgroup_acquire((struct cgroup *)&stack_cgrp);
74 if (acquired)
75 bpf_cgroup_release(acquired);
76
77 return 0;
78}
79
80SEC("kretprobe/cgroup_destroy_locked")
81__failure __msg("calling kernel function bpf_cgroup_acquire is not allowed")
82int BPF_PROG(cgrp_kfunc_acquire_unsafe_kretprobe, struct cgroup *cgrp)
83{
84 struct cgroup *acquired;
85
86 /* Can't acquire an untrusted struct cgroup * pointer. */
87 acquired = bpf_cgroup_acquire(cgrp);
88 if (acquired)
89 bpf_cgroup_release(acquired);
90
91 return 0;
92}
93
94SEC("tp_btf/cgroup_mkdir")
95__failure __msg("cgrp_kfunc_acquire_trusted_walked")
96int BPF_PROG(cgrp_kfunc_acquire_trusted_walked, struct cgroup *cgrp, const char *path)
97{
98 struct cgroup *acquired;
99
100 /* Can't invoke bpf_cgroup_acquire() on a pointer obtained from walking a trusted cgroup. */
101 acquired = bpf_cgroup_acquire(cgrp->old_dom_cgrp);
102 if (acquired)
103 bpf_cgroup_release(acquired);
104
105 return 0;
106}
107
108SEC("tp_btf/cgroup_mkdir")
109__failure __msg("Possibly NULL pointer passed to trusted arg0")
110int BPF_PROG(cgrp_kfunc_acquire_null, struct cgroup *cgrp, const char *path)
111{
112 struct cgroup *acquired;
113
114 /* Can't invoke bpf_cgroup_acquire() on a NULL pointer. */
115 acquired = bpf_cgroup_acquire(NULL);
116 if (acquired)
117 bpf_cgroup_release(acquired);
118
119 return 0;
120}
121
122SEC("tp_btf/cgroup_mkdir")
123__failure __msg("Unreleased reference")
124int BPF_PROG(cgrp_kfunc_acquire_unreleased, struct cgroup *cgrp, const char *path)
125{
126 struct cgroup *acquired;
127
128 acquired = bpf_cgroup_acquire(cgrp);
129
130 /* Acquired cgroup is never released. */
131 __sink(acquired);
132
133 return 0;
134}
135
136SEC("tp_btf/cgroup_mkdir")
137__failure __msg("Unreleased reference")
138int BPF_PROG(cgrp_kfunc_xchg_unreleased, struct cgroup *cgrp, const char *path)
139{
140 struct cgroup *kptr;
141 struct __cgrps_kfunc_map_value *v;
142
143 v = insert_lookup_cgrp(cgrp);
144 if (!v)
145 return 0;
146
147 kptr = bpf_kptr_xchg(&v->cgrp, NULL);
148 if (!kptr)
149 return 0;
150
151 /* Kptr retrieved from map is never released. */
152
153 return 0;
154}
155
156SEC("tp_btf/cgroup_mkdir")
157__failure __msg("must be referenced or trusted")
158int BPF_PROG(cgrp_kfunc_rcu_get_release, struct cgroup *cgrp, const char *path)
159{
160 struct cgroup *kptr;
161 struct __cgrps_kfunc_map_value *v;
162
163 v = insert_lookup_cgrp(cgrp);
164 if (!v)
165 return 0;
166
167 bpf_rcu_read_lock();
168 kptr = v->cgrp;
169 if (kptr)
170 /* Can't release a cgroup kptr stored in a map. */
171 bpf_cgroup_release(kptr);
172 bpf_rcu_read_unlock();
173
174 return 0;
175}
176
177SEC("tp_btf/cgroup_mkdir")
178__failure __msg("Possibly NULL pointer passed to trusted arg0")
179int BPF_PROG(cgrp_kfunc_release_untrusted, struct cgroup *cgrp, const char *path)
180{
181 struct __cgrps_kfunc_map_value *v;
182
183 v = insert_lookup_cgrp(cgrp);
184 if (!v)
185 return 0;
186
187 /* Can't invoke bpf_cgroup_release() on an untrusted pointer. */
188 bpf_cgroup_release(v->cgrp);
189
190 return 0;
191}
192
193SEC("tp_btf/cgroup_mkdir")
194__failure __msg("arg#0 pointer type STRUCT cgroup must point")
195int BPF_PROG(cgrp_kfunc_release_fp, struct cgroup *cgrp, const char *path)
196{
197 struct cgroup *acquired = (struct cgroup *)&path;
198
199 /* Cannot release random frame pointer. */
200 bpf_cgroup_release(acquired);
201
202 return 0;
203}
204
205SEC("tp_btf/cgroup_mkdir")
206__failure __msg("Possibly NULL pointer passed to trusted arg0")
207int BPF_PROG(cgrp_kfunc_release_null, struct cgroup *cgrp, const char *path)
208{
209 struct __cgrps_kfunc_map_value local, *v;
210 long status;
211 struct cgroup *acquired, *old;
212 s32 id;
213
214 status = bpf_probe_read_kernel(&id, sizeof(id), &cgrp->self.id);
215 if (status)
216 return 0;
217
218 local.cgrp = NULL;
219 status = bpf_map_update_elem(&__cgrps_kfunc_map, &id, &local, BPF_NOEXIST);
220 if (status)
221 return status;
222
223 v = bpf_map_lookup_elem(&__cgrps_kfunc_map, &id);
224 if (!v)
225 return -ENOENT;
226
227 acquired = bpf_cgroup_acquire(cgrp);
228 if (!acquired)
229 return -ENOENT;
230
231 old = bpf_kptr_xchg(&v->cgrp, acquired);
232
233 /* old cannot be passed to bpf_cgroup_release() without a NULL check. */
234 bpf_cgroup_release(old);
235
236 return 0;
237}
238
239SEC("tp_btf/cgroup_mkdir")
240__failure __msg("release kernel function bpf_cgroup_release expects")
241int BPF_PROG(cgrp_kfunc_release_unacquired, struct cgroup *cgrp, const char *path)
242{
243 /* Cannot release trusted cgroup pointer which was not acquired. */
244 bpf_cgroup_release(cgrp);
245
246 return 0;
247}
1// SPDX-License-Identifier: GPL-2.0
2/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */
3
4#include <vmlinux.h>
5#include <bpf/bpf_tracing.h>
6#include <bpf/bpf_helpers.h>
7
8#include "bpf_misc.h"
9#include "cgrp_kfunc_common.h"
10
11char _license[] SEC("license") = "GPL";
12
13/* Prototype for all of the program trace events below:
14 *
15 * TRACE_EVENT(cgroup_mkdir,
16 * TP_PROTO(struct cgroup *cgrp, const char *path),
17 * TP_ARGS(cgrp, path)
18 */
19
20static struct __cgrps_kfunc_map_value *insert_lookup_cgrp(struct cgroup *cgrp)
21{
22 int status;
23
24 status = cgrps_kfunc_map_insert(cgrp);
25 if (status)
26 return NULL;
27
28 return cgrps_kfunc_map_value_lookup(cgrp);
29}
30
31SEC("tp_btf/cgroup_mkdir")
32__failure __msg("Possibly NULL pointer passed to trusted arg0")
33int BPF_PROG(cgrp_kfunc_acquire_untrusted, struct cgroup *cgrp, const char *path)
34{
35 struct cgroup *acquired;
36 struct __cgrps_kfunc_map_value *v;
37
38 v = insert_lookup_cgrp(cgrp);
39 if (!v)
40 return 0;
41
42 /* Can't invoke bpf_cgroup_acquire() on an untrusted pointer. */
43 acquired = bpf_cgroup_acquire(v->cgrp);
44 if (acquired)
45 bpf_cgroup_release(acquired);
46
47 return 0;
48}
49
50SEC("tp_btf/cgroup_mkdir")
51__failure __msg("Possibly NULL pointer passed to trusted arg0")
52int BPF_PROG(cgrp_kfunc_acquire_no_null_check, struct cgroup *cgrp, const char *path)
53{
54 struct cgroup *acquired;
55
56 acquired = bpf_cgroup_acquire(cgrp);
57 /*
58 * Can't invoke bpf_cgroup_release() without checking the return value
59 * of bpf_cgroup_acquire().
60 */
61 bpf_cgroup_release(acquired);
62
63 return 0;
64}
65
66SEC("tp_btf/cgroup_mkdir")
67__failure __msg("arg#0 pointer type STRUCT cgroup must point")
68int BPF_PROG(cgrp_kfunc_acquire_fp, struct cgroup *cgrp, const char *path)
69{
70 struct cgroup *acquired, *stack_cgrp = (struct cgroup *)&path;
71
72 /* Can't invoke bpf_cgroup_acquire() on a random frame pointer. */
73 acquired = bpf_cgroup_acquire((struct cgroup *)&stack_cgrp);
74 if (acquired)
75 bpf_cgroup_release(acquired);
76
77 return 0;
78}
79
80SEC("kretprobe/cgroup_destroy_locked")
81__failure __msg("calling kernel function bpf_cgroup_acquire is not allowed")
82int BPF_PROG(cgrp_kfunc_acquire_unsafe_kretprobe, struct cgroup *cgrp)
83{
84 struct cgroup *acquired;
85
86 /* Can't acquire an untrusted struct cgroup * pointer. */
87 acquired = bpf_cgroup_acquire(cgrp);
88 if (acquired)
89 bpf_cgroup_release(acquired);
90
91 return 0;
92}
93
94SEC("tp_btf/cgroup_mkdir")
95__failure __msg("cgrp_kfunc_acquire_trusted_walked")
96int BPF_PROG(cgrp_kfunc_acquire_trusted_walked, struct cgroup *cgrp, const char *path)
97{
98 struct cgroup *acquired;
99
100 /* Can't invoke bpf_cgroup_acquire() on a pointer obtained from walking a trusted cgroup. */
101 acquired = bpf_cgroup_acquire(cgrp->old_dom_cgrp);
102 if (acquired)
103 bpf_cgroup_release(acquired);
104
105 return 0;
106}
107
108SEC("tp_btf/cgroup_mkdir")
109__failure __msg("Possibly NULL pointer passed to trusted arg0")
110int BPF_PROG(cgrp_kfunc_acquire_null, struct cgroup *cgrp, const char *path)
111{
112 struct cgroup *acquired;
113
114 /* Can't invoke bpf_cgroup_acquire() on a NULL pointer. */
115 acquired = bpf_cgroup_acquire(NULL);
116 if (acquired)
117 bpf_cgroup_release(acquired);
118
119 return 0;
120}
121
122SEC("tp_btf/cgroup_mkdir")
123__failure __msg("Unreleased reference")
124int BPF_PROG(cgrp_kfunc_acquire_unreleased, struct cgroup *cgrp, const char *path)
125{
126 struct cgroup *acquired;
127
128 acquired = bpf_cgroup_acquire(cgrp);
129
130 /* Acquired cgroup is never released. */
131 __sink(acquired);
132
133 return 0;
134}
135
136SEC("tp_btf/cgroup_mkdir")
137__failure __msg("Unreleased reference")
138int BPF_PROG(cgrp_kfunc_xchg_unreleased, struct cgroup *cgrp, const char *path)
139{
140 struct cgroup *kptr;
141 struct __cgrps_kfunc_map_value *v;
142
143 v = insert_lookup_cgrp(cgrp);
144 if (!v)
145 return 0;
146
147 kptr = bpf_kptr_xchg(&v->cgrp, NULL);
148 if (!kptr)
149 return 0;
150
151 /* Kptr retrieved from map is never released. */
152
153 return 0;
154}
155
156SEC("tp_btf/cgroup_mkdir")
157__failure __msg("must be referenced or trusted")
158int BPF_PROG(cgrp_kfunc_rcu_get_release, struct cgroup *cgrp, const char *path)
159{
160 struct cgroup *kptr;
161 struct __cgrps_kfunc_map_value *v;
162
163 v = insert_lookup_cgrp(cgrp);
164 if (!v)
165 return 0;
166
167 bpf_rcu_read_lock();
168 kptr = v->cgrp;
169 if (kptr)
170 /* Can't release a cgroup kptr stored in a map. */
171 bpf_cgroup_release(kptr);
172 bpf_rcu_read_unlock();
173
174 return 0;
175}
176
177SEC("tp_btf/cgroup_mkdir")
178__failure __msg("Possibly NULL pointer passed to trusted arg0")
179int BPF_PROG(cgrp_kfunc_release_untrusted, struct cgroup *cgrp, const char *path)
180{
181 struct __cgrps_kfunc_map_value *v;
182
183 v = insert_lookup_cgrp(cgrp);
184 if (!v)
185 return 0;
186
187 /* Can't invoke bpf_cgroup_release() on an untrusted pointer. */
188 bpf_cgroup_release(v->cgrp);
189
190 return 0;
191}
192
193SEC("tp_btf/cgroup_mkdir")
194__failure __msg("arg#0 pointer type STRUCT cgroup must point")
195int BPF_PROG(cgrp_kfunc_release_fp, struct cgroup *cgrp, const char *path)
196{
197 struct cgroup *acquired = (struct cgroup *)&path;
198
199 /* Cannot release random frame pointer. */
200 bpf_cgroup_release(acquired);
201
202 return 0;
203}
204
205SEC("tp_btf/cgroup_mkdir")
206__failure __msg("Possibly NULL pointer passed to trusted arg0")
207int BPF_PROG(cgrp_kfunc_release_null, struct cgroup *cgrp, const char *path)
208{
209 struct __cgrps_kfunc_map_value local, *v;
210 long status;
211 struct cgroup *acquired, *old;
212 s32 id;
213
214 status = bpf_probe_read_kernel(&id, sizeof(id), &cgrp->self.id);
215 if (status)
216 return 0;
217
218 local.cgrp = NULL;
219 status = bpf_map_update_elem(&__cgrps_kfunc_map, &id, &local, BPF_NOEXIST);
220 if (status)
221 return status;
222
223 v = bpf_map_lookup_elem(&__cgrps_kfunc_map, &id);
224 if (!v)
225 return -ENOENT;
226
227 acquired = bpf_cgroup_acquire(cgrp);
228 if (!acquired)
229 return -ENOENT;
230
231 old = bpf_kptr_xchg(&v->cgrp, acquired);
232
233 /* old cannot be passed to bpf_cgroup_release() without a NULL check. */
234 bpf_cgroup_release(old);
235
236 return 0;
237}
238
239SEC("tp_btf/cgroup_mkdir")
240__failure __msg("release kernel function bpf_cgroup_release expects")
241int BPF_PROG(cgrp_kfunc_release_unacquired, struct cgroup *cgrp, const char *path)
242{
243 /* Cannot release trusted cgroup pointer which was not acquired. */
244 bpf_cgroup_release(cgrp);
245
246 return 0;
247}