1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2022 Facebook */
7 #include <bpf/bpf_helpers.h>
10 char _license[] SEC("license") = "GPL";
14 struct bpf_dynptr ptr;
18 __uint(type, BPF_MAP_TYPE_ARRAY);
19 __uint(max_entries, 1);
21 __type(value, struct bpf_dynptr);
22 } array_map1 SEC(".maps");
25 __uint(type, BPF_MAP_TYPE_ARRAY);
26 __uint(max_entries, 1);
28 __type(value, struct test_info);
29 } array_map2 SEC(".maps");
32 __uint(type, BPF_MAP_TYPE_ARRAY);
33 __uint(max_entries, 1);
36 } array_map3 SEC(".maps");
45 __uint(type, BPF_MAP_TYPE_RINGBUF);
46 __uint(max_entries, 4096);
47 } ringbuf SEC(".maps");
51 static int get_map_val_dynptr(struct bpf_dynptr *ptr)
53 __u32 key = 0, *map_val;
55 bpf_map_update_elem(&array_map3, &key, &val, 0);
57 map_val = bpf_map_lookup_elem(&array_map3, &key);
61 bpf_dynptr_from_mem(map_val, sizeof(*map_val), 0, ptr);
66 /* Every bpf_ringbuf_reserve_dynptr call must have a corresponding
67 * bpf_ringbuf_submit/discard_dynptr call
70 __failure __msg("Unreleased reference id=2")
71 int ringbuf_missing_release1(void *ctx)
73 struct bpf_dynptr ptr;
75 bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
77 /* missing a call to bpf_ringbuf_discard/submit_dynptr */
83 __failure __msg("Unreleased reference id=4")
84 int ringbuf_missing_release2(void *ctx)
86 struct bpf_dynptr ptr1, ptr2;
87 struct sample *sample;
89 bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr1);
90 bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr2);
92 sample = bpf_dynptr_data(&ptr1, 0, sizeof(*sample));
94 bpf_ringbuf_discard_dynptr(&ptr1, 0);
95 bpf_ringbuf_discard_dynptr(&ptr2, 0);
99 bpf_ringbuf_submit_dynptr(&ptr1, 0);
101 /* missing a call to bpf_ringbuf_discard/submit_dynptr on ptr2 */
106 static int missing_release_callback_fn(__u32 index, void *data)
108 struct bpf_dynptr ptr;
110 bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
112 /* missing a call to bpf_ringbuf_discard/submit_dynptr */
117 /* Any dynptr initialized within a callback must have bpf_dynptr_put called */
119 __failure __msg("Unreleased reference id")
120 int ringbuf_missing_release_callback(void *ctx)
122 bpf_loop(10, missing_release_callback_fn, NULL, 0);
126 /* Can't call bpf_ringbuf_submit/discard_dynptr on a non-initialized dynptr */
128 __failure __msg("arg 1 is an unacquired reference")
129 int ringbuf_release_uninit_dynptr(void *ctx)
131 struct bpf_dynptr ptr;
133 /* this should fail */
134 bpf_ringbuf_submit_dynptr(&ptr, 0);
139 /* A dynptr can't be used after it has been invalidated */
141 __failure __msg("Expected an initialized dynptr as arg #3")
142 int use_after_invalid(void *ctx)
144 struct bpf_dynptr ptr;
147 bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(read_data), 0, &ptr);
149 bpf_dynptr_read(read_data, sizeof(read_data), &ptr, 0, 0);
151 bpf_ringbuf_submit_dynptr(&ptr, 0);
153 /* this should fail */
154 bpf_dynptr_read(read_data, sizeof(read_data), &ptr, 0, 0);
159 /* Can't call non-dynptr ringbuf APIs on a dynptr ringbuf sample */
161 __failure __msg("type=mem expected=ringbuf_mem")
162 int ringbuf_invalid_api(void *ctx)
164 struct bpf_dynptr ptr;
165 struct sample *sample;
167 bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr);
168 sample = bpf_dynptr_data(&ptr, 0, sizeof(*sample));
174 /* invalid API use. need to use dynptr API to submit/discard */
175 bpf_ringbuf_submit(sample, 0);
178 bpf_ringbuf_discard_dynptr(&ptr, 0);
182 /* Can't add a dynptr to a map */
184 __failure __msg("invalid indirect read from stack")
185 int add_dynptr_to_map1(void *ctx)
187 struct bpf_dynptr ptr;
190 bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
192 /* this should fail */
193 bpf_map_update_elem(&array_map1, &key, &ptr, 0);
195 bpf_ringbuf_submit_dynptr(&ptr, 0);
200 /* Can't add a struct with an embedded dynptr to a map */
202 __failure __msg("invalid indirect read from stack")
203 int add_dynptr_to_map2(void *ctx)
208 bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &x.ptr);
210 /* this should fail */
211 bpf_map_update_elem(&array_map2, &key, &x, 0);
213 bpf_ringbuf_submit_dynptr(&x.ptr, 0);
218 /* A data slice can't be accessed out of bounds */
220 __failure __msg("value is outside of the allowed memory range")
221 int data_slice_out_of_bounds_ringbuf(void *ctx)
223 struct bpf_dynptr ptr;
226 bpf_ringbuf_reserve_dynptr(&ringbuf, 8, 0, &ptr);
228 data = bpf_dynptr_data(&ptr, 0, 8);
232 /* can't index out of bounds of the data slice */
233 val = *((char *)data + 8);
236 bpf_ringbuf_submit_dynptr(&ptr, 0);
241 __failure __msg("value is outside of the allowed memory range")
242 int data_slice_out_of_bounds_map_value(void *ctx)
244 __u32 key = 0, map_val;
245 struct bpf_dynptr ptr;
248 get_map_val_dynptr(&ptr);
250 data = bpf_dynptr_data(&ptr, 0, sizeof(map_val));
254 /* can't index out of bounds of the data slice */
255 val = *((char *)data + (sizeof(map_val) + 1));
260 /* A data slice can't be used after it has been released */
262 __failure __msg("invalid mem access 'scalar'")
263 int data_slice_use_after_release1(void *ctx)
265 struct bpf_dynptr ptr;
266 struct sample *sample;
268 bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr);
269 sample = bpf_dynptr_data(&ptr, 0, sizeof(*sample));
275 bpf_ringbuf_submit_dynptr(&ptr, 0);
277 /* this should fail */
283 bpf_ringbuf_discard_dynptr(&ptr, 0);
287 /* A data slice can't be used after it has been released.
289 * This tests the case where the data slice tracks a dynptr (ptr2)
290 * that is at a non-zero offset from the frame pointer (ptr1 is at fp,
291 * ptr2 is at fp - 16).
294 __failure __msg("invalid mem access 'scalar'")
295 int data_slice_use_after_release2(void *ctx)
297 struct bpf_dynptr ptr1, ptr2;
298 struct sample *sample;
300 bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr1);
301 bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr2);
303 sample = bpf_dynptr_data(&ptr2, 0, sizeof(*sample));
309 bpf_ringbuf_submit_dynptr(&ptr2, 0);
311 /* this should fail */
314 bpf_ringbuf_submit_dynptr(&ptr1, 0);
319 bpf_ringbuf_discard_dynptr(&ptr2, 0);
320 bpf_ringbuf_discard_dynptr(&ptr1, 0);
324 /* A data slice must be first checked for NULL */
326 __failure __msg("invalid mem access 'mem_or_null'")
327 int data_slice_missing_null_check1(void *ctx)
329 struct bpf_dynptr ptr;
332 bpf_ringbuf_reserve_dynptr(&ringbuf, 8, 0, &ptr);
334 data = bpf_dynptr_data(&ptr, 0, 8);
336 /* missing if (!data) check */
338 /* this should fail */
341 bpf_ringbuf_submit_dynptr(&ptr, 0);
345 /* A data slice can't be dereferenced if it wasn't checked for null */
347 __failure __msg("invalid mem access 'mem_or_null'")
348 int data_slice_missing_null_check2(void *ctx)
350 struct bpf_dynptr ptr;
351 __u64 *data1, *data2;
353 bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &ptr);
355 data1 = bpf_dynptr_data(&ptr, 0, 8);
356 data2 = bpf_dynptr_data(&ptr, 0, 8);
358 /* this should fail */
362 bpf_ringbuf_discard_dynptr(&ptr, 0);
366 /* Can't pass in a dynptr as an arg to a helper function that doesn't take in a
370 __failure __msg("invalid indirect read from stack")
371 int invalid_helper1(void *ctx)
373 struct bpf_dynptr ptr;
375 get_map_val_dynptr(&ptr);
377 /* this should fail */
378 bpf_strncmp((const char *)&ptr, sizeof(ptr), "hello!");
383 /* A dynptr can't be passed into a helper function at a non-zero offset */
385 __failure __msg("cannot pass in dynptr at an offset=-8")
386 int invalid_helper2(void *ctx)
388 struct bpf_dynptr ptr;
391 get_map_val_dynptr(&ptr);
393 /* this should fail */
394 bpf_dynptr_read(read_data, sizeof(read_data), (void *)&ptr + 8, 0, 0);
399 /* A bpf_dynptr is invalidated if it's been written into */
401 __failure __msg("Expected an initialized dynptr as arg #1")
402 int invalid_write1(void *ctx)
404 struct bpf_dynptr ptr;
408 get_map_val_dynptr(&ptr);
410 memcpy(&ptr, &x, sizeof(x));
412 /* this should fail */
413 data = bpf_dynptr_data(&ptr, 0, 1);
419 * A bpf_dynptr can't be used as a dynptr if it has been written into at a fixed
423 __failure __msg("cannot overwrite referenced dynptr")
424 int invalid_write2(void *ctx)
426 struct bpf_dynptr ptr;
430 bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
432 memcpy((void *)&ptr + 8, &x, sizeof(x));
434 /* this should fail */
435 bpf_dynptr_read(read_data, sizeof(read_data), &ptr, 0, 0);
437 bpf_ringbuf_submit_dynptr(&ptr, 0);
443 * A bpf_dynptr can't be used as a dynptr if it has been written into at a
447 __failure __msg("cannot overwrite referenced dynptr")
448 int invalid_write3(void *ctx)
450 struct bpf_dynptr ptr;
455 bpf_ringbuf_reserve_dynptr(&ringbuf, 8, 0, &ptr);
457 memcpy(stack_buf, &val, sizeof(val));
458 len = stack_buf[0] & 0xf;
460 memcpy((void *)&ptr + len, &x, sizeof(x));
462 /* this should fail */
463 bpf_ringbuf_submit_dynptr(&ptr, 0);
468 static int invalid_write4_callback(__u32 index, void *data)
470 *(__u32 *)data = 123;
475 /* If the dynptr is written into in a callback function, it should
476 * be invalidated as a dynptr
479 __failure __msg("cannot overwrite referenced dynptr")
480 int invalid_write4(void *ctx)
482 struct bpf_dynptr ptr;
484 bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
486 bpf_loop(10, invalid_write4_callback, &ptr, 0);
488 /* this should fail */
489 bpf_ringbuf_submit_dynptr(&ptr, 0);
494 /* A globally-defined bpf_dynptr can't be used (it must reside as a stack frame) */
495 struct bpf_dynptr global_dynptr;
498 __failure __msg("type=map_value expected=fp")
499 int global(void *ctx)
501 /* this should fail */
502 bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &global_dynptr);
504 bpf_ringbuf_discard_dynptr(&global_dynptr, 0);
509 /* A direct read should fail */
511 __failure __msg("invalid read from stack")
512 int invalid_read1(void *ctx)
514 struct bpf_dynptr ptr;
516 bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
518 /* this should fail */
521 bpf_ringbuf_discard_dynptr(&ptr, 0);
526 /* A direct read at an offset should fail */
528 __failure __msg("cannot pass in dynptr at an offset")
529 int invalid_read2(void *ctx)
531 struct bpf_dynptr ptr;
534 get_map_val_dynptr(&ptr);
536 /* this should fail */
537 bpf_dynptr_read(read_data, sizeof(read_data), (void *)&ptr + 1, 0, 0);
542 /* A direct read at an offset into the lower stack slot should fail */
544 __failure __msg("invalid read from stack")
545 int invalid_read3(void *ctx)
547 struct bpf_dynptr ptr1, ptr2;
549 bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &ptr1);
550 bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &ptr2);
552 /* this should fail */
553 memcpy(&val, (void *)&ptr1 + 8, sizeof(val));
555 bpf_ringbuf_discard_dynptr(&ptr1, 0);
556 bpf_ringbuf_discard_dynptr(&ptr2, 0);
561 static int invalid_read4_callback(__u32 index, void *data)
563 /* this should fail */
564 val = *(__u32 *)data;
569 /* A direct read within a callback function should fail */
571 __failure __msg("invalid read from stack")
572 int invalid_read4(void *ctx)
574 struct bpf_dynptr ptr;
576 bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
578 bpf_loop(10, invalid_read4_callback, &ptr, 0);
580 bpf_ringbuf_submit_dynptr(&ptr, 0);
585 /* Initializing a dynptr on an offset should fail */
587 __failure __msg("cannot pass in dynptr at an offset=0")
588 int invalid_offset(void *ctx)
590 struct bpf_dynptr ptr;
592 /* this should fail */
593 bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr + 1);
595 bpf_ringbuf_discard_dynptr(&ptr, 0);
600 /* Can't release a dynptr twice */
602 __failure __msg("arg 1 is an unacquired reference")
603 int release_twice(void *ctx)
605 struct bpf_dynptr ptr;
607 bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &ptr);
609 bpf_ringbuf_discard_dynptr(&ptr, 0);
611 /* this second release should fail */
612 bpf_ringbuf_discard_dynptr(&ptr, 0);
617 static int release_twice_callback_fn(__u32 index, void *data)
619 /* this should fail */
620 bpf_ringbuf_discard_dynptr(data, 0);
625 /* Test that releasing a dynptr twice, where one of the releases happens
626 * within a calback function, fails
629 __failure __msg("arg 1 is an unacquired reference")
630 int release_twice_callback(void *ctx)
632 struct bpf_dynptr ptr;
634 bpf_ringbuf_reserve_dynptr(&ringbuf, 32, 0, &ptr);
636 bpf_ringbuf_discard_dynptr(&ptr, 0);
638 bpf_loop(10, release_twice_callback_fn, &ptr, 0);
643 /* Reject unsupported local mem types for dynptr_from_mem API */
645 __failure __msg("Unsupported reg type fp for bpf_dynptr_from_mem data")
646 int dynptr_from_mem_invalid_api(void *ctx)
648 struct bpf_dynptr ptr;
651 /* this should fail */
652 bpf_dynptr_from_mem(&x, sizeof(x), 0, &ptr);