|  | 
|  | 1 | +// SPDX-License-Identifier: GPL-2.0 | 
|  | 2 | +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */ | 
|  | 3 | + | 
|  | 4 | +#include <vmlinux.h> | 
|  | 5 | +#include <string.h> | 
|  | 6 | +#include <stdbool.h> | 
|  | 7 | +#include <bpf/bpf_tracing.h> | 
|  | 8 | +#include "bpf_misc.h" | 
|  | 9 | +#include "errno.h" | 
|  | 10 | + | 
|  | 11 | +char _license[] SEC("license") = "GPL"; | 
|  | 12 | + | 
|  | 13 | +struct { | 
|  | 14 | +	__uint(type, BPF_MAP_TYPE_ARRAY); | 
|  | 15 | +	__uint(max_entries, 1); | 
|  | 16 | +	__type(key, int); | 
|  | 17 | +	__type(value, struct elem); | 
|  | 18 | +} arrmap SEC(".maps"); | 
|  | 19 | + | 
|  | 20 | +struct elem { | 
|  | 21 | +	struct file *file; | 
|  | 22 | +	struct bpf_task_work tw; | 
|  | 23 | +}; | 
|  | 24 | + | 
|  | 25 | +char user_buf[256000]; | 
|  | 26 | +char tmp_buf[256000]; | 
|  | 27 | + | 
|  | 28 | +int pid = 0; | 
|  | 29 | +int err, run_success = 0; | 
|  | 30 | + | 
|  | 31 | +static int validate_file_read(struct file *file); | 
|  | 32 | +static int task_work_callback(struct bpf_map *map, void *key, void *value); | 
|  | 33 | + | 
|  | 34 | +SEC("lsm/file_open") | 
|  | 35 | +int on_open_expect_fault(void *c) | 
|  | 36 | +{ | 
|  | 37 | +	struct bpf_dynptr dynptr; | 
|  | 38 | +	struct file *file; | 
|  | 39 | +	int local_err = 1; | 
|  | 40 | +	__u32 user_buf_sz = sizeof(user_buf); | 
|  | 41 | + | 
|  | 42 | +	if (bpf_get_current_pid_tgid() >> 32 != pid) | 
|  | 43 | +		return 0; | 
|  | 44 | + | 
|  | 45 | +	file = bpf_get_task_exe_file(bpf_get_current_task_btf()); | 
|  | 46 | +	if (!file) | 
|  | 47 | +		return 0; | 
|  | 48 | + | 
|  | 49 | +	if (bpf_dynptr_from_file(file, 0, &dynptr)) | 
|  | 50 | +		goto out; | 
|  | 51 | + | 
|  | 52 | +	local_err = bpf_dynptr_read(tmp_buf, user_buf_sz, &dynptr, 0, 0); | 
|  | 53 | +	if (local_err == -EFAULT) { /* Expect page fault */ | 
|  | 54 | +		local_err = 0; | 
|  | 55 | +		run_success = 1; | 
|  | 56 | +	} | 
|  | 57 | +out: | 
|  | 58 | +	bpf_dynptr_file_discard(&dynptr); | 
|  | 59 | +	if (local_err) | 
|  | 60 | +		err = local_err; | 
|  | 61 | +	bpf_put_file(file); | 
|  | 62 | +	return 0; | 
|  | 63 | +} | 
|  | 64 | + | 
|  | 65 | +SEC("lsm/file_open") | 
|  | 66 | +int on_open_validate_file_read(void *c) | 
|  | 67 | +{ | 
|  | 68 | +	struct task_struct *task = bpf_get_current_task_btf(); | 
|  | 69 | +	struct elem *work; | 
|  | 70 | +	int key = 0; | 
|  | 71 | + | 
|  | 72 | +	if (bpf_get_current_pid_tgid() >> 32 != pid) | 
|  | 73 | +		return 0; | 
|  | 74 | + | 
|  | 75 | +	work = bpf_map_lookup_elem(&arrmap, &key); | 
|  | 76 | +	if (!work) { | 
|  | 77 | +		err = 1; | 
|  | 78 | +		return 0; | 
|  | 79 | +	} | 
|  | 80 | +	bpf_task_work_schedule_signal(task, &work->tw, &arrmap, task_work_callback, NULL); | 
|  | 81 | +	return 0; | 
|  | 82 | +} | 
|  | 83 | + | 
|  | 84 | +/* Called in a sleepable context, read 256K bytes, cross check with user space read data */ | 
|  | 85 | +static int task_work_callback(struct bpf_map *map, void *key, void *value) | 
|  | 86 | +{ | 
|  | 87 | +	struct task_struct *task = bpf_get_current_task_btf(); | 
|  | 88 | +	struct file *file = bpf_get_task_exe_file(task); | 
|  | 89 | + | 
|  | 90 | +	if (!file) | 
|  | 91 | +		return 0; | 
|  | 92 | + | 
|  | 93 | +	err = validate_file_read(file); | 
|  | 94 | +	if (!err) | 
|  | 95 | +		run_success = 1; | 
|  | 96 | +	bpf_put_file(file); | 
|  | 97 | +	return 0; | 
|  | 98 | +} | 
|  | 99 | + | 
|  | 100 | +static int verify_dynptr_read(struct bpf_dynptr *ptr, u32 off, char *user_buf, u32 len) | 
|  | 101 | +{ | 
|  | 102 | +	int i; | 
|  | 103 | + | 
|  | 104 | +	if (bpf_dynptr_read(tmp_buf, len, ptr, off, 0)) | 
|  | 105 | +		return 1; | 
|  | 106 | + | 
|  | 107 | +	/* Verify file contents read from BPF is the same as the one read from userspace */ | 
|  | 108 | +	bpf_for(i, 0, len) | 
|  | 109 | +	{ | 
|  | 110 | +		if (tmp_buf[i] != user_buf[i]) | 
|  | 111 | +			return 1; | 
|  | 112 | +	} | 
|  | 113 | +	return 0; | 
|  | 114 | +} | 
|  | 115 | + | 
|  | 116 | +static int validate_file_read(struct file *file) | 
|  | 117 | +{ | 
|  | 118 | +	struct bpf_dynptr dynptr; | 
|  | 119 | +	int loc_err = 1, off; | 
|  | 120 | +	__u32 user_buf_sz = sizeof(user_buf); | 
|  | 121 | + | 
|  | 122 | +	if (bpf_dynptr_from_file(file, 0, &dynptr)) | 
|  | 123 | +		goto cleanup; | 
|  | 124 | + | 
|  | 125 | +	loc_err = verify_dynptr_read(&dynptr, 0, user_buf, user_buf_sz); | 
|  | 126 | +	off = 1; | 
|  | 127 | +	loc_err = loc_err ?: verify_dynptr_read(&dynptr, off, user_buf + off, user_buf_sz - off); | 
|  | 128 | +	off = user_buf_sz - 1; | 
|  | 129 | +	loc_err = loc_err ?: verify_dynptr_read(&dynptr, off, user_buf + off, user_buf_sz - off); | 
|  | 130 | +	/* Read file with random offset and length */ | 
|  | 131 | +	off = 4097; | 
|  | 132 | +	loc_err = loc_err ?: verify_dynptr_read(&dynptr, off, user_buf + off, 100); | 
|  | 133 | + | 
|  | 134 | +	/* Adjust dynptr, verify read */ | 
|  | 135 | +	loc_err = loc_err ?: bpf_dynptr_adjust(&dynptr, off, off + 1); | 
|  | 136 | +	loc_err = loc_err ?: verify_dynptr_read(&dynptr, 0, user_buf + off, 1); | 
|  | 137 | +	/* Can't read more than 1 byte */ | 
|  | 138 | +	loc_err = loc_err ?: verify_dynptr_read(&dynptr, 0, user_buf + off, 2) == 0; | 
|  | 139 | +	/* Can't read with far offset */ | 
|  | 140 | +	loc_err = loc_err ?: verify_dynptr_read(&dynptr, 1, user_buf + off, 1) == 0; | 
|  | 141 | + | 
|  | 142 | +cleanup: | 
|  | 143 | +	bpf_dynptr_file_discard(&dynptr); | 
|  | 144 | +	return loc_err; | 
|  | 145 | +} | 
0 commit comments