1 // SPDX-License-Identifier: GPL-2.0
2 #include <vmlinux.h>
3 #include <bpf/bpf_tracing.h>
4 #include <bpf/bpf_helpers.h>
5 #include <bpf/bpf_core_read.h>
6 #include "bpf_experimental.h"
7 #include "bpf_misc.h"
8
9 struct node_acquire {
10 long key;
11 long data;
12 struct bpf_rb_node node;
13 struct bpf_refcount refcount;
14 };
15
16 extern void bpf_rcu_read_lock(void) __ksym;
17 extern void bpf_rcu_read_unlock(void) __ksym;
18
19 #define private(name) SEC(".data." #name) __hidden __attribute__((aligned(8)))
20 private(A) struct bpf_spin_lock glock;
21 private(A) struct bpf_rb_root groot __contains(node_acquire, node);
22
23 static bool less(struct bpf_rb_node *a, const struct bpf_rb_node *b)
24 {
25 struct node_acquire *node_a;
26 struct node_acquire *node_b;
27
28 node_a = container_of(a, struct node_acquire, node);
29 node_b = container_of(b, struct node_acquire, node);
30
31 return node_a->key < node_b->key;
32 }
33
34 SEC("?tc")
35 __failure __regex("Unreleased reference id=4 alloc_insn=[0-9]+")
36 long rbtree_refcounted_node_ref_escapes(void *ctx)
37 {
38 struct node_acquire *n, *m;
39
40 n = bpf_obj_new(typeof(*n));
41 if (!n)
42 return 1;
43
44 bpf_spin_lock(&glock);
45 bpf_rbtree_add(&groot, &n->node, less);
46 /* m becomes an owning ref but is never drop'd or added to a tree */
47 m = bpf_refcount_acquire(n);
48 bpf_spin_unlock(&glock);
49 if (!m)
50 return 2;
51
52 m->key = 2;
53 return 0;
54 }
55
56 SEC("?tc")
57 __failure __msg("Possibly NULL pointer passed to trusted arg0")
58 long refcount_acquire_maybe_null(void *ctx)
59 {
60 struct node_acquire *n, *m;
61
62 n = bpf_obj_new(typeof(*n));
63 /* Intentionally not testing !n
64 * it's MAYBE_NULL for refcount_acquire
65 */
66 m = bpf_refcount_acquire(n);
67 if (m)
68 bpf_obj_drop(m);
69 if (n)
70 bpf_obj_drop(n);
71
72 return 0;
73 }
74
75 SEC("?tc")
76 __failure __regex("Unreleased reference id=3 alloc_insn=[0-9]+")
77 long rbtree_refcounted_node_ref_escapes_owning_input(void *ctx)
78 {
79 struct node_acquire *n, *m;
80
81 n = bpf_obj_new(typeof(*n));
82 if (!n)
83 return 1;
84
85 /* m becomes an owning ref but is never drop'd or added to a tree */
86 m = bpf_refcount_acquire(n);
87 m->key = 2;
88
89 bpf_spin_lock(&glock);
90 bpf_rbtree_add(&groot, &n->node, less);
91 bpf_spin_unlock(&glock);
92
93 return 0;
94 }
95
96 SEC("?fentry.s/bpf_testmod_test_read")
97 __failure __msg("function calls are not allowed while holding a lock")
98 int BPF_PROG(rbtree_fail_sleepable_lock_across_rcu,
99 struct file *file, struct kobject *kobj,
100 struct bin_attribute *bin_attr, char *buf, loff_t off, size_t len)
101 {
102 struct node_acquire *n;
103
104 n = bpf_obj_new(typeof(*n));
105 if (!n)
106 return 0;
107
108 /* spin_{lock,unlock} are in different RCU CS */
109 bpf_rcu_read_lock();
110 bpf_spin_lock(&glock);
111 bpf_rbtree_add(&groot, &n->node, less);
112 bpf_rcu_read_unlock();
113
114 bpf_rcu_read_lock();
115 bpf_spin_unlock(&glock);
116 bpf_rcu_read_unlock();
117
118 return 0;
119 }
120
121 char _license[] SEC("license") = "GPL";
122
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.