tools/testing/selftests/bpf/progs/linked_list_fail.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <vmlinux.h>
   3 #include <bpf/bpf_tracing.h>
   4 #include <bpf/bpf_helpers.h>
   5 #include <bpf/bpf_core_read.h>
   6 #include "bpf_experimental.h"
   7
   8 #include "linked_list.h"
   9
  10 #define INIT                                                  \
  11         struct map_value *v, *v2, *iv, *iv2;                  \
  12         struct foo *f, *f1, *f2;                              \
  13         struct bar *b;                                        \
  14         void *map;                                            \
  15                                                               \
  16         map = bpf_map_lookup_elem(&map_of_maps, &(int){ 0 }); \
  17         if (!map)                                             \
  18                 return 0;                                     \
  19         v = bpf_map_lookup_elem(&array_map, &(int){ 0 });     \
  20         if (!v)                                               \
  21                 return 0;                                     \
  22         v2 = bpf_map_lookup_elem(&array_map, &(int){ 0 });    \
  23         if (!v2)                                              \
  24                 return 0;                                     \
  25         iv = bpf_map_lookup_elem(map, &(int){ 0 });           \
  26         if (!iv)                                              \
  27                 return 0;                                     \
  28         iv2 = bpf_map_lookup_elem(map, &(int){ 0 });          \
  29         if (!iv2)                                             \
  30                 return 0;                                     \
  31         f = bpf_obj_new(typeof(*f));                          \
  32         if (!f)                                               \
  33                 return 0;                                     \
  34         f1 = f;                                               \
  35         f2 = bpf_obj_new(typeof(*f2));                        \
  36         if (!f2) {                                            \
  37                 bpf_obj_drop(f1);                             \
  38                 return 0;                                     \
  39         }                                                     \
  40         b = bpf_obj_new(typeof(*b));                          \
  41         if (!b) {                                             \
  42                 bpf_obj_drop(f2);                             \
  43                 bpf_obj_drop(f1);                             \
  44                 return 0;                                     \
  45         }
  46
  47 #define CHECK(test, op, hexpr)                              \
  48         SEC("?tc")                                          \
  49         int test##_missing_lock_##op(void *ctx)             \
  50         {                                                   \
  51                 INIT;                                       \
  52                 void (*p)(void *) = (void *)&bpf_list_##op; \
  53                 p(hexpr);                                   \
  54                 return 0;                                   \
  55         }
  56
  57 CHECK(kptr, pop_front, &f->head);
  58 CHECK(kptr, pop_back, &f->head);
  59
  60 CHECK(global, pop_front, &ghead);
  61 CHECK(global, pop_back, &ghead);
  62
  63 CHECK(map, pop_front, &v->head);
  64 CHECK(map, pop_back, &v->head);
  65
  66 CHECK(inner_map, pop_front, &iv->head);
  67 CHECK(inner_map, pop_back, &iv->head);
  68
  69 #undef CHECK
  70
  71 #define CHECK(test, op, hexpr, nexpr)                                   \
  72         SEC("?tc")                                                      \
  73         int test##_missing_lock_##op(void *ctx)                         \
  74         {                                                               \
  75                 INIT;                                                   \
  76                 bpf_list_##op(hexpr, nexpr);                            \
  77                 return 0;                                               \
  78         }
  79
  80 CHECK(kptr, push_front, &f->head, &b->node);
  81 CHECK(kptr, push_back, &f->head, &b->node);
  82
  83 CHECK(global, push_front, &ghead, &f->node2);
  84 CHECK(global, push_back, &ghead, &f->node2);
  85
  86 CHECK(map, push_front, &v->head, &f->node2);
  87 CHECK(map, push_back, &v->head, &f->node2);
  88
  89 CHECK(inner_map, push_front, &iv->head, &f->node2);
  90 CHECK(inner_map, push_back, &iv->head, &f->node2);
  91
  92 #undef CHECK
  93
  94 #define CHECK(test, op, lexpr, hexpr)                       \
  95         SEC("?tc")                                          \
  96         int test##_incorrect_lock_##op(void *ctx)           \
  97         {                                                   \
  98                 INIT;                                       \
  99                 void (*p)(void *) = (void *)&bpf_list_##op; \
 100                 bpf_spin_lock(lexpr);                       \
 101                 p(hexpr);                                   \
 102                 return 0;                                   \
 103         }
 104
 105 #define CHECK_OP(op)                                           \
 106         CHECK(kptr_kptr, op, &f1->lock, &f2->head);            \
 107         CHECK(kptr_global, op, &f1->lock, &ghead);             \
 108         CHECK(kptr_map, op, &f1->lock, &v->head);              \
 109         CHECK(kptr_inner_map, op, &f1->lock, &iv->head);       \
 110                                                                \
 111         CHECK(global_global, op, &glock2, &ghead);             \
 112         CHECK(global_kptr, op, &glock, &f1->head);             \
 113         CHECK(global_map, op, &glock, &v->head);               \
 114         CHECK(global_inner_map, op, &glock, &iv->head);        \
 115                                                                \
 116         CHECK(map_map, op, &v->lock, &v2->head);               \
 117         CHECK(map_kptr, op, &v->lock, &f2->head);              \
 118         CHECK(map_global, op, &v->lock, &ghead);               \
 119         CHECK(map_inner_map, op, &v->lock, &iv->head);         \
 120                                                                \
 121         CHECK(inner_map_inner_map, op, &iv->lock, &iv2->head); \
 122         CHECK(inner_map_kptr, op, &iv->lock, &f2->head);       \
 123         CHECK(inner_map_global, op, &iv->lock, &ghead);        \
 124         CHECK(inner_map_map, op, &iv->lock, &v->head);
 125
 126 CHECK_OP(pop_front);
 127 CHECK_OP(pop_back);
 128
 129 #undef CHECK
 130 #undef CHECK_OP
 131
 132 #define CHECK(test, op, lexpr, hexpr, nexpr)                            \
 133         SEC("?tc")                                                      \
 134         int test##_incorrect_lock_##op(void *ctx)                       \
 135         {                                                               \
 136                 INIT;                                                   \
 137                 bpf_spin_lock(lexpr);                                   \
 138                 bpf_list_##op(hexpr, nexpr);                            \
 139                 return 0;                                               \
 140         }
 141
 142 #define CHECK_OP(op)                                                    \
 143         CHECK(kptr_kptr, op, &f1->lock, &f2->head, &b->node);           \
 144         CHECK(kptr_global, op, &f1->lock, &ghead, &f->node2);           \
 145         CHECK(kptr_map, op, &f1->lock, &v->head, &f->node2);            \
 146         CHECK(kptr_inner_map, op, &f1->lock, &iv->head, &f->node2);     \
 147                                                                         \
 148         CHECK(global_global, op, &glock2, &ghead, &f->node2);           \
 149         CHECK(global_kptr, op, &glock, &f1->head, &b->node);            \
 150         CHECK(global_map, op, &glock, &v->head, &f->node2);             \
 151         CHECK(global_inner_map, op, &glock, &iv->head, &f->node2);      \
 152                                                                         \
 153         CHECK(map_map, op, &v->lock, &v2->head, &f->node2);             \
 154         CHECK(map_kptr, op, &v->lock, &f2->head, &b->node);             \
 155         CHECK(map_global, op, &v->lock, &ghead, &f->node2);             \
 156         CHECK(map_inner_map, op, &v->lock, &iv->head, &f->node2);       \
 157                                                                         \
 158         CHECK(inner_map_inner_map, op, &iv->lock, &iv2->head, &f->node2);\
 159         CHECK(inner_map_kptr, op, &iv->lock, &f2->head, &b->node);      \
 160         CHECK(inner_map_global, op, &iv->lock, &ghead, &f->node2);      \
 161         CHECK(inner_map_map, op, &iv->lock, &v->head, &f->node2);
 162
 163 CHECK_OP(push_front);
 164 CHECK_OP(push_back);
 165
 166 #undef CHECK
 167 #undef CHECK_OP
 168 #undef INIT
 169
 170 SEC("?kprobe/xyz")
 171 int map_compat_kprobe(void *ctx)
 172 {
 173         bpf_list_push_front(&ghead, NULL);
 174         return 0;
 175 }
 176
 177 SEC("?kretprobe/xyz")
 178 int map_compat_kretprobe(void *ctx)
 179 {
 180         bpf_list_push_front(&ghead, NULL);
 181         return 0;
 182 }
 183
 184 SEC("?tracepoint/xyz")
 185 int map_compat_tp(void *ctx)
 186 {
 187         bpf_list_push_front(&ghead, NULL);
 188         return 0;
 189 }
 190
 191 SEC("?perf_event")
 192 int map_compat_perf(void *ctx)
 193 {
 194         bpf_list_push_front(&ghead, NULL);
 195         return 0;
 196 }
 197
 198 SEC("?raw_tp/xyz")
 199 int map_compat_raw_tp(void *ctx)
 200 {
 201         bpf_list_push_front(&ghead, NULL);
 202         return 0;
 203 }
 204
 205 SEC("?raw_tp.w/xyz")
 206 int map_compat_raw_tp_w(void *ctx)
 207 {
 208         bpf_list_push_front(&ghead, NULL);
 209         return 0;
 210 }
 211
 212 SEC("?tc")
 213 int obj_type_id_oor(void *ctx)
 214 {
 215         bpf_obj_new_impl(~0UL, NULL);
 216         return 0;
 217 }
 218
 219 SEC("?tc")
 220 int obj_new_no_composite(void *ctx)
 221 {
 222         bpf_obj_new_impl(bpf_core_type_id_local(int), (void *)42);
 223         return 0;
 224 }
 225
 226 SEC("?tc")
 227 int obj_new_no_struct(void *ctx)
 228 {
 229
 230         bpf_obj_new(union { int data; unsigned udata; });
 231         return 0;
 232 }
 233
 234 SEC("?tc")
 235 int obj_drop_non_zero_off(void *ctx)
 236 {
 237         void *f;
 238
 239         f = bpf_obj_new(struct foo);
 240         if (!f)
 241                 return 0;
 242         bpf_obj_drop(f+1);
 243         return 0;
 244 }
 245
 246 SEC("?tc")
 247 int new_null_ret(void *ctx)
 248 {
 249         return bpf_obj_new(struct foo)->data;
 250 }
 251
 252 SEC("?tc")
 253 int obj_new_acq(void *ctx)
 254 {
 255         bpf_obj_new(struct foo);
 256         return 0;
 257 }
 258
 259 SEC("?tc")
 260 int use_after_drop(void *ctx)
 261 {
 262         struct foo *f;
 263
 264         f = bpf_obj_new(typeof(*f));
 265         if (!f)
 266                 return 0;
 267         bpf_obj_drop(f);
 268         return f->data;
 269 }
 270
 271 SEC("?tc")
 272 int ptr_walk_scalar(void *ctx)
 273 {
 274         struct test1 {
 275                 struct test2 {
 276                         struct test2 *next;
 277                 } *ptr;
 278         } *p;
 279
 280         p = bpf_obj_new(typeof(*p));
 281         if (!p)
 282                 return 0;
 283         bpf_this_cpu_ptr(p->ptr);
 284         return 0;
 285 }
 286
 287 SEC("?tc")
 288 int direct_read_lock(void *ctx)
 289 {
 290         struct foo *f;
 291
 292         f = bpf_obj_new(typeof(*f));
 293         if (!f)
 294                 return 0;
 295         return *(int *)&f->lock;
 296 }
 297
 298 SEC("?tc")
 299 int direct_write_lock(void *ctx)
 300 {
 301         struct foo *f;
 302
 303         f = bpf_obj_new(typeof(*f));
 304         if (!f)
 305                 return 0;
 306         *(int *)&f->lock = 0;
 307         return 0;
 308 }
 309
 310 SEC("?tc")
 311 int direct_read_head(void *ctx)
 312 {
 313         struct foo *f;
 314
 315         f = bpf_obj_new(typeof(*f));
 316         if (!f)
 317                 return 0;
 318         return *(int *)&f->head;
 319 }
 320
 321 SEC("?tc")
 322 int direct_write_head(void *ctx)
 323 {
 324         struct foo *f;
 325
 326         f = bpf_obj_new(typeof(*f));
 327         if (!f)
 328                 return 0;
 329         *(int *)&f->head = 0;
 330         return 0;
 331 }
 332
 333 SEC("?tc")
 334 int direct_read_node(void *ctx)
 335 {
 336         struct foo *f;
 337
 338         f = bpf_obj_new(typeof(*f));
 339         if (!f)
 340                 return 0;
 341         return *(int *)&f->node2;
 342 }
 343
 344 SEC("?tc")
 345 int direct_write_node(void *ctx)
 346 {
 347         struct foo *f;
 348
 349         f = bpf_obj_new(typeof(*f));
 350         if (!f)
 351                 return 0;
 352         *(int *)&f->node2 = 0;
 353         return 0;
 354 }
 355
 356 static __always_inline
 357 int use_after_unlock(bool push_front)
 358 {
 359         struct foo *f;
 360
 361         f = bpf_obj_new(typeof(*f));
 362         if (!f)
 363                 return 0;
 364         bpf_spin_lock(&glock);
 365         f->data = 42;
 366         if (push_front)
 367                 bpf_list_push_front(&ghead, &f->node2);
 368         else
 369                 bpf_list_push_back(&ghead, &f->node2);
 370         bpf_spin_unlock(&glock);
 371
 372         return f->data;
 373 }
 374
 375 SEC("?tc")
 376 int use_after_unlock_push_front(void *ctx)
 377 {
 378         return use_after_unlock(true);
 379 }
 380
 381 SEC("?tc")
 382 int use_after_unlock_push_back(void *ctx)
 383 {
 384         return use_after_unlock(false);
 385 }
 386
 387 static __always_inline
 388 int list_double_add(bool push_front)
 389 {
 390         struct foo *f;
 391
 392         f = bpf_obj_new(typeof(*f));
 393         if (!f)
 394                 return 0;
 395         bpf_spin_lock(&glock);
 396         if (push_front) {
 397                 bpf_list_push_front(&ghead, &f->node2);
 398                 bpf_list_push_front(&ghead, &f->node2);
 399         } else {
 400                 bpf_list_push_back(&ghead, &f->node2);
 401                 bpf_list_push_back(&ghead, &f->node2);
 402         }
 403         bpf_spin_unlock(&glock);
 404
 405         return 0;
 406 }
 407
 408 SEC("?tc")
 409 int double_push_front(void *ctx)
 410 {
 411         return list_double_add(true);
 412 }
 413
 414 SEC("?tc")
 415 int double_push_back(void *ctx)
 416 {
 417         return list_double_add(false);
 418 }
 419
 420 SEC("?tc")
 421 int no_node_value_type(void *ctx)
 422 {
 423         void *p;
 424
 425         p = bpf_obj_new(struct { int data; });
 426         if (!p)
 427                 return 0;
 428         bpf_spin_lock(&glock);
 429         bpf_list_push_front(&ghead, p);
 430         bpf_spin_unlock(&glock);
 431
 432         return 0;
 433 }
 434
 435 SEC("?tc")
 436 int incorrect_value_type(void *ctx)
 437 {
 438         struct bar *b;
 439
 440         b = bpf_obj_new(typeof(*b));
 441         if (!b)
 442                 return 0;
 443         bpf_spin_lock(&glock);
 444         bpf_list_push_front(&ghead, &b->node);
 445         bpf_spin_unlock(&glock);
 446
 447         return 0;
 448 }
 449
 450 SEC("?tc")
 451 int incorrect_node_var_off(struct __sk_buff *ctx)
 452 {
 453         struct foo *f;
 454
 455         f = bpf_obj_new(typeof(*f));
 456         if (!f)
 457                 return 0;
 458         bpf_spin_lock(&glock);
 459         bpf_list_push_front(&ghead, (void *)&f->node2 + ctx->protocol);
 460         bpf_spin_unlock(&glock);
 461
 462         return 0;
 463 }
 464
 465 SEC("?tc")
 466 int incorrect_node_off1(void *ctx)
 467 {
 468         struct foo *f;
 469
 470         f = bpf_obj_new(typeof(*f));
 471         if (!f)
 472                 return 0;
 473         bpf_spin_lock(&glock);
 474         bpf_list_push_front(&ghead, (void *)&f->node2 + 1);
 475         bpf_spin_unlock(&glock);
 476
 477         return 0;
 478 }
 479
 480 SEC("?tc")
 481 int incorrect_node_off2(void *ctx)
 482 {
 483         struct foo *f;
 484
 485         f = bpf_obj_new(typeof(*f));
 486         if (!f)
 487                 return 0;
 488         bpf_spin_lock(&glock);
 489         bpf_list_push_front(&ghead, &f->node);
 490         bpf_spin_unlock(&glock);
 491
 492         return 0;
 493 }
 494
 495 SEC("?tc")
 496 int no_head_type(void *ctx)
 497 {
 498         void *p;
 499
 500         p = bpf_obj_new(typeof(struct { int data; }));
 501         if (!p)
 502                 return 0;
 503         bpf_spin_lock(&glock);
 504         bpf_list_push_front(p, NULL);
 505         bpf_spin_lock(&glock);
 506
 507         return 0;
 508 }
 509
 510 SEC("?tc")
 511 int incorrect_head_var_off1(struct __sk_buff *ctx)
 512 {
 513         struct foo *f;
 514
 515         f = bpf_obj_new(typeof(*f));
 516         if (!f)
 517                 return 0;
 518         bpf_spin_lock(&glock);
 519         bpf_list_push_front((void *)&ghead + ctx->protocol, &f->node2);
 520         bpf_spin_unlock(&glock);
 521
 522         return 0;
 523 }
 524
 525 SEC("?tc")
 526 int incorrect_head_var_off2(struct __sk_buff *ctx)
 527 {
 528         struct foo *f;
 529
 530         f = bpf_obj_new(typeof(*f));
 531         if (!f)
 532                 return 0;
 533         bpf_spin_lock(&glock);
 534         bpf_list_push_front((void *)&f->head + ctx->protocol, &f->node2);
 535         bpf_spin_unlock(&glock);
 536
 537         return 0;
 538 }
 539
 540 SEC("?tc")
 541 int incorrect_head_off1(void *ctx)
 542 {
 543         struct foo *f;
 544         struct bar *b;
 545
 546         f = bpf_obj_new(typeof(*f));
 547         if (!f)
 548                 return 0;
 549         b = bpf_obj_new(typeof(*b));
 550         if (!b) {
 551                 bpf_obj_drop(f);
 552                 return 0;
 553         }
 554
 555         bpf_spin_lock(&f->lock);
 556         bpf_list_push_front((void *)&f->head + 1, &b->node);
 557         bpf_spin_unlock(&f->lock);
 558
 559         return 0;
 560 }
 561
 562 SEC("?tc")
 563 int incorrect_head_off2(void *ctx)
 564 {
 565         struct foo *f;
 566
 567         f = bpf_obj_new(typeof(*f));
 568         if (!f)
 569                 return 0;
 570
 571         bpf_spin_lock(&glock);
 572         bpf_list_push_front((void *)&ghead + 1, &f->node2);
 573         bpf_spin_unlock(&glock);
 574
 575         return 0;
 576 }
 577
 578 static __always_inline
 579 int pop_ptr_off(void *(*op)(void *head))
 580 {
 581         struct {
 582                 struct bpf_list_head head __contains(foo, node2);
 583                 struct bpf_spin_lock lock;
 584         } *p;
 585         struct bpf_list_node *n;
 586
 587         p = bpf_obj_new(typeof(*p));
 588         if (!p)
 589                 return 0;
 590         bpf_spin_lock(&p->lock);
 591         n = op(&p->head);
 592         bpf_spin_unlock(&p->lock);
 593
 594         if (!n)
 595                 return 0;
 596         bpf_spin_lock((void *)n);
 597         return 0;
 598 }
 599
 600 SEC("?tc")
 601 int pop_front_off(void *ctx)
 602 {
 603         return pop_ptr_off((void *)bpf_list_pop_front);
 604 }
 605
 606 SEC("?tc")
 607 int pop_back_off(void *ctx)
 608 {
 609         return pop_ptr_off((void *)bpf_list_pop_back);
 610 }
 611
 612 char _license[] SEC("license") = "GPL";