1 // SPDX-License-Identifier: GPL-2.0 2 #include <vmlinux.h> 3 #include <bpf/bpf_tracing.h> 4 #include <bpf/bpf_helpers.h> 5 #include <bpf/bpf_core_read.h> 6 #include "bpf_experimental.h" 7 #include "bpf_misc.h" 8 9 struct node_acquire { 10 long key; 11 long data; 12 struct bpf_rb_node node; 13 struct bpf_refcount refcount; 14 }; 15 16 struct node_refcounted { 17 long key; 18 struct bpf_list_node list; 19 struct bpf_refcount refcount; 20 }; 21 22 extern void bpf_rcu_read_lock(void) __ksym; 23 extern void bpf_rcu_read_unlock(void) __ksym; 24 25 #define private(name) SEC(".data." #name) __hidden __attribute__((aligned(8))) 26 private(A) struct bpf_spin_lock glock; 27 private(A) struct bpf_rb_root groot __contains(node_acquire, node); 28 private(B) struct bpf_spin_lock lock; 29 private(B) struct bpf_list_head head __contains(node_refcounted, list); 30 31 static bool less(struct bpf_rb_node *a, const struct bpf_rb_node *b) 32 { 33 struct node_acquire *node_a; 34 struct node_acquire *node_b; 35 36 node_a = container_of(a, struct node_acquire, node); 37 node_b = container_of(b, struct node_acquire, node); 38 39 return node_a->key < node_b->key; 40 } 41 42 SEC("?tc") 43 __failure __msg("Unreleased reference id=4 alloc_insn={{[0-9]+}}") 44 long rbtree_refcounted_node_ref_escapes(void *ctx) 45 { 46 struct node_acquire *n, *m; 47 48 n = bpf_obj_new(typeof(*n)); 49 if (!n) 50 return 1; 51 52 bpf_spin_lock(&glock); 53 bpf_rbtree_add(&groot, &n->node, less); 54 /* m becomes an owning ref but is never drop'd or added to a tree */ 55 m = bpf_refcount_acquire(n); 56 bpf_spin_unlock(&glock); 57 if (!m) 58 return 2; 59 60 m->key = 2; 61 return 0; 62 } 63 64 SEC("?tc") 65 __failure __msg("Possibly NULL pointer passed to trusted R1") 66 __msg("requires a non-NULL value of type (void *)") 67 long refcount_acquire_maybe_null(void *ctx) 68 { 69 struct node_acquire *n, *m; 70 71 n = bpf_obj_new(typeof(*n)); 72 /* Intentionally not testing !n 73 * it's MAYBE_NULL for refcount_acquire 74 */ 75 m = bpf_refcount_acquire(n); 76 if (m) 77 bpf_obj_drop(m); 78 if (n) 79 bpf_obj_drop(n); 80 81 return 0; 82 } 83 84 SEC("?tc") 85 __failure __msg("R1 is neither owning or non-owning ref") 86 __msg("expects a pointer to a BPF-managed refcounted object, but R1 is a context pointer") 87 long refcount_acquire_non_object(void *ctx) 88 { 89 return bpf_refcount_acquire(ctx) != NULL; 90 } 91 92 SEC("?tc") 93 __failure __msg("Unreleased reference id=3 alloc_insn={{[0-9]+}}") 94 long rbtree_refcounted_node_ref_escapes_owning_input(void *ctx) 95 { 96 struct node_acquire *n, *m; 97 98 n = bpf_obj_new(typeof(*n)); 99 if (!n) 100 return 1; 101 102 /* m becomes an owning ref but is never drop'd or added to a tree */ 103 m = bpf_refcount_acquire(n); 104 m->key = 2; 105 106 bpf_spin_lock(&glock); 107 bpf_rbtree_add(&groot, &n->node, less); 108 bpf_spin_unlock(&glock); 109 110 return 0; 111 } 112 113 SEC("?tc") 114 __failure __msg("dereference of modified ptr_ ptr R1") 115 long refcount_acquire_list_node_offset(void *ctx) 116 { 117 struct node_refcounted *node, *base, *ref; 118 struct bpf_list_node *list_node; 119 120 node = bpf_obj_new(typeof(*node)); 121 if (!node) 122 return 1; 123 124 bpf_spin_lock(&lock); 125 bpf_list_push_front(&head, &node->list); 126 list_node = bpf_list_pop_front(&head); 127 bpf_spin_unlock(&lock); 128 if (!list_node) 129 return 2; 130 131 base = container_of(list_node, struct node_refcounted, list); 132 ref = bpf_refcount_acquire(list_node); 133 if (ref) 134 bpf_obj_drop(ref); 135 bpf_obj_drop(base); 136 return 0; 137 } 138 139 SEC("?fentry.s/" SYS_PREFIX "sys_getpgid") 140 __failure __msg("function calls are not allowed while holding a lock") 141 int BPF_PROG(rbtree_fail_sleepable_lock_across_rcu, 142 struct file *file, struct kobject *kobj, 143 struct bin_attribute *bin_attr, char *buf, loff_t off, size_t len) 144 { 145 struct node_acquire *n; 146 147 n = bpf_obj_new(typeof(*n)); 148 if (!n) 149 return 0; 150 151 /* spin_{lock,unlock} are in different RCU CS */ 152 bpf_rcu_read_lock(); 153 bpf_spin_lock(&glock); 154 bpf_rbtree_add(&groot, &n->node, less); 155 bpf_rcu_read_unlock(); 156 157 bpf_rcu_read_lock(); 158 bpf_spin_unlock(&glock); 159 bpf_rcu_read_unlock(); 160 161 return 0; 162 } 163 164 char _license[] SEC("license") = "GPL"; 165