1 // SPDX-License-Identifier: GPL-2.0
2 #include <vmlinux.h>
3 #include <bpf/bpf_tracing.h>
4 #include <bpf/bpf_helpers.h>
5 #include <bpf/bpf_core_read.h>
6 #include "bpf_experimental.h"
7 #include "bpf_misc.h"
8
9 struct node_acquire {
10 long key;
11 long data;
12 struct bpf_rb_node node;
13 struct bpf_refcount refcount;
14 };
15
16 struct node_refcounted {
17 long key;
18 struct bpf_list_node list;
19 struct bpf_refcount refcount;
20 };
21
22 extern void bpf_rcu_read_lock(void) __ksym;
23 extern void bpf_rcu_read_unlock(void) __ksym;
24
25 #define private(name) SEC(".data." #name) __hidden __attribute__((aligned(8)))
26 private(A) struct bpf_spin_lock glock;
27 private(A) struct bpf_rb_root groot __contains(node_acquire, node);
28 private(B) struct bpf_spin_lock lock;
29 private(B) struct bpf_list_head head __contains(node_refcounted, list);
30
less(struct bpf_rb_node * a,const struct bpf_rb_node * b)31 static bool less(struct bpf_rb_node *a, const struct bpf_rb_node *b)
32 {
33 struct node_acquire *node_a;
34 struct node_acquire *node_b;
35
36 node_a = container_of(a, struct node_acquire, node);
37 node_b = container_of(b, struct node_acquire, node);
38
39 return node_a->key < node_b->key;
40 }
41
42 SEC("?tc")
43 __failure __msg("Unreleased reference id=4 alloc_insn={{[0-9]+}}")
rbtree_refcounted_node_ref_escapes(void * ctx)44 long rbtree_refcounted_node_ref_escapes(void *ctx)
45 {
46 struct node_acquire *n, *m;
47
48 n = bpf_obj_new(typeof(*n));
49 if (!n)
50 return 1;
51
52 bpf_spin_lock(&glock);
53 bpf_rbtree_add(&groot, &n->node, less);
54 /* m becomes an owning ref but is never drop'd or added to a tree */
55 m = bpf_refcount_acquire(n);
56 bpf_spin_unlock(&glock);
57 if (!m)
58 return 2;
59
60 m->key = 2;
61 return 0;
62 }
63
64 SEC("?tc")
65 __failure __msg("Possibly NULL pointer passed to trusted R1")
66 __msg("requires a non-NULL value of type (void *)")
refcount_acquire_maybe_null(void * ctx)67 long refcount_acquire_maybe_null(void *ctx)
68 {
69 struct node_acquire *n, *m;
70
71 n = bpf_obj_new(typeof(*n));
72 /* Intentionally not testing !n
73 * it's MAYBE_NULL for refcount_acquire
74 */
75 m = bpf_refcount_acquire(n);
76 if (m)
77 bpf_obj_drop(m);
78 if (n)
79 bpf_obj_drop(n);
80
81 return 0;
82 }
83
84 SEC("?tc")
85 __failure __msg("R1 is neither owning or non-owning ref")
86 __msg("expects a pointer to a BPF-managed refcounted object, but R1 is a context pointer")
refcount_acquire_non_object(void * ctx)87 long refcount_acquire_non_object(void *ctx)
88 {
89 return bpf_refcount_acquire(ctx) != NULL;
90 }
91
92 SEC("?tc")
93 __failure __msg("Unreleased reference id=3 alloc_insn={{[0-9]+}}")
rbtree_refcounted_node_ref_escapes_owning_input(void * ctx)94 long rbtree_refcounted_node_ref_escapes_owning_input(void *ctx)
95 {
96 struct node_acquire *n, *m;
97
98 n = bpf_obj_new(typeof(*n));
99 if (!n)
100 return 1;
101
102 /* m becomes an owning ref but is never drop'd or added to a tree */
103 m = bpf_refcount_acquire(n);
104 m->key = 2;
105
106 bpf_spin_lock(&glock);
107 bpf_rbtree_add(&groot, &n->node, less);
108 bpf_spin_unlock(&glock);
109
110 return 0;
111 }
112
113 SEC("?tc")
114 __failure __msg("dereference of modified ptr_ ptr R1")
refcount_acquire_list_node_offset(void * ctx)115 long refcount_acquire_list_node_offset(void *ctx)
116 {
117 struct node_refcounted *node, *base, *ref;
118 struct bpf_list_node *list_node;
119
120 node = bpf_obj_new(typeof(*node));
121 if (!node)
122 return 1;
123
124 bpf_spin_lock(&lock);
125 bpf_list_push_front(&head, &node->list);
126 list_node = bpf_list_pop_front(&head);
127 bpf_spin_unlock(&lock);
128 if (!list_node)
129 return 2;
130
131 base = container_of(list_node, struct node_refcounted, list);
132 ref = bpf_refcount_acquire(list_node);
133 if (ref)
134 bpf_obj_drop(ref);
135 bpf_obj_drop(base);
136 return 0;
137 }
138
139 SEC("?fentry.s/" SYS_PREFIX "sys_getpgid")
140 __failure __msg("function calls are not allowed while holding a lock")
BPF_PROG(rbtree_fail_sleepable_lock_across_rcu,struct file * file,struct kobject * kobj,struct bin_attribute * bin_attr,char * buf,loff_t off,size_t len)141 int BPF_PROG(rbtree_fail_sleepable_lock_across_rcu,
142 struct file *file, struct kobject *kobj,
143 struct bin_attribute *bin_attr, char *buf, loff_t off, size_t len)
144 {
145 struct node_acquire *n;
146
147 n = bpf_obj_new(typeof(*n));
148 if (!n)
149 return 0;
150
151 /* spin_{lock,unlock} are in different RCU CS */
152 bpf_rcu_read_lock();
153 bpf_spin_lock(&glock);
154 bpf_rbtree_add(&groot, &n->node, less);
155 bpf_rcu_read_unlock();
156
157 bpf_rcu_read_lock();
158 bpf_spin_unlock(&glock);
159 bpf_rcu_read_unlock();
160
161 return 0;
162 }
163
164 char _license[] SEC("license") = "GPL";
165