| 
 | 1 | +// SPDX-License-Identifier: GPL-2.0  | 
 | 2 | +/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */  | 
 | 3 | + | 
 | 4 | +#include <vmlinux.h>  | 
 | 5 | +#include <string.h>  | 
 | 6 | +#include <stdbool.h>  | 
 | 7 | +#include <bpf/bpf_tracing.h>  | 
 | 8 | +#include "bpf_misc.h"  | 
 | 9 | +#include "errno.h"  | 
 | 10 | + | 
 | 11 | +char _license[] SEC("license") = "GPL";  | 
 | 12 | + | 
 | 13 | +struct {  | 
 | 14 | +	__uint(type, BPF_MAP_TYPE_ARRAY);  | 
 | 15 | +	__uint(max_entries, 1);  | 
 | 16 | +	__type(key, int);  | 
 | 17 | +	__type(value, struct elem);  | 
 | 18 | +} arrmap SEC(".maps");  | 
 | 19 | + | 
 | 20 | +struct elem {  | 
 | 21 | +	struct file *file;  | 
 | 22 | +	struct bpf_task_work tw;  | 
 | 23 | +};  | 
 | 24 | + | 
 | 25 | +char user_buf[256000];  | 
 | 26 | +char tmp_buf[256000];  | 
 | 27 | + | 
 | 28 | +int pid = 0;  | 
 | 29 | +int err, run_success = 0;  | 
 | 30 | + | 
 | 31 | +static int validate_file_read(struct file *file);  | 
 | 32 | +static int task_work_callback(struct bpf_map *map, void *key, void *value);  | 
 | 33 | + | 
 | 34 | +SEC("lsm/file_open")  | 
 | 35 | +int on_open_expect_fault(void *c)  | 
 | 36 | +{  | 
 | 37 | +	struct bpf_dynptr dynptr;  | 
 | 38 | +	struct file *file;  | 
 | 39 | +	int local_err = 1;  | 
 | 40 | +	__u32 user_buf_sz = sizeof(user_buf);  | 
 | 41 | + | 
 | 42 | +	if (bpf_get_current_pid_tgid() >> 32 != pid)  | 
 | 43 | +		return 0;  | 
 | 44 | + | 
 | 45 | +	file = bpf_get_task_exe_file(bpf_get_current_task_btf());  | 
 | 46 | +	if (!file)  | 
 | 47 | +		return 0;  | 
 | 48 | + | 
 | 49 | +	if (bpf_dynptr_from_file(file, 0, &dynptr))  | 
 | 50 | +		goto out;  | 
 | 51 | + | 
 | 52 | +	local_err = bpf_dynptr_read(tmp_buf, user_buf_sz, &dynptr, 0, 0);  | 
 | 53 | +	if (local_err == -EFAULT) { /* Expect page fault */  | 
 | 54 | +		local_err = 0;  | 
 | 55 | +		run_success = 1;  | 
 | 56 | +	}  | 
 | 57 | +out:  | 
 | 58 | +	bpf_dynptr_file_discard(&dynptr);  | 
 | 59 | +	if (local_err)  | 
 | 60 | +		err = local_err;  | 
 | 61 | +	bpf_put_file(file);  | 
 | 62 | +	return 0;  | 
 | 63 | +}  | 
 | 64 | + | 
 | 65 | +SEC("lsm/file_open")  | 
 | 66 | +int on_open_validate_file_read(void *c)  | 
 | 67 | +{  | 
 | 68 | +	struct task_struct *task = bpf_get_current_task_btf();  | 
 | 69 | +	struct elem *work;  | 
 | 70 | +	int key = 0;  | 
 | 71 | + | 
 | 72 | +	if (bpf_get_current_pid_tgid() >> 32 != pid)  | 
 | 73 | +		return 0;  | 
 | 74 | + | 
 | 75 | +	work = bpf_map_lookup_elem(&arrmap, &key);  | 
 | 76 | +	if (!work) {  | 
 | 77 | +		err = 1;  | 
 | 78 | +		return 0;  | 
 | 79 | +	}  | 
 | 80 | +	bpf_task_work_schedule_signal(task, &work->tw, &arrmap, task_work_callback, NULL);  | 
 | 81 | +	return 0;  | 
 | 82 | +}  | 
 | 83 | + | 
 | 84 | +/* Called in a sleepable context, read 256K bytes, cross check with user space read data */  | 
 | 85 | +static int task_work_callback(struct bpf_map *map, void *key, void *value)  | 
 | 86 | +{  | 
 | 87 | +	struct task_struct *task = bpf_get_current_task_btf();  | 
 | 88 | +	struct file *file = bpf_get_task_exe_file(task);  | 
 | 89 | + | 
 | 90 | +	if (!file)  | 
 | 91 | +		return 0;  | 
 | 92 | + | 
 | 93 | +	err = validate_file_read(file);  | 
 | 94 | +	if (!err)  | 
 | 95 | +		run_success = 1;  | 
 | 96 | +	bpf_put_file(file);  | 
 | 97 | +	return 0;  | 
 | 98 | +}  | 
 | 99 | + | 
 | 100 | +static int verify_dynptr_read(struct bpf_dynptr *ptr, u32 off, char *user_buf, u32 len)  | 
 | 101 | +{  | 
 | 102 | +	int i;  | 
 | 103 | + | 
 | 104 | +	if (bpf_dynptr_read(tmp_buf, len, ptr, off, 0))  | 
 | 105 | +		return 1;  | 
 | 106 | + | 
 | 107 | +	/* Verify file contents read from BPF is the same as the one read from userspace */  | 
 | 108 | +	bpf_for(i, 0, len)  | 
 | 109 | +	{  | 
 | 110 | +		if (tmp_buf[i] != user_buf[i])  | 
 | 111 | +			return 1;  | 
 | 112 | +	}  | 
 | 113 | +	return 0;  | 
 | 114 | +}  | 
 | 115 | + | 
 | 116 | +static int validate_file_read(struct file *file)  | 
 | 117 | +{  | 
 | 118 | +	struct bpf_dynptr dynptr;  | 
 | 119 | +	int local_err = 1, off;  | 
 | 120 | +	__u32 user_buf_sz = sizeof(user_buf);  | 
 | 121 | + | 
 | 122 | +	if (bpf_dynptr_from_file(file, 0, &dynptr))  | 
 | 123 | +		goto cleanup;  | 
 | 124 | + | 
 | 125 | +	local_err = verify_dynptr_read(&dynptr, 0, user_buf, user_buf_sz);  | 
 | 126 | +	off = 1;  | 
 | 127 | +	local_err = local_err ?: verify_dynptr_read(&dynptr, off, user_buf + off, user_buf_sz - off);  | 
 | 128 | +	off = user_buf_sz - 1;  | 
 | 129 | +	local_err = local_err ?: verify_dynptr_read(&dynptr, off, user_buf + off, user_buf_sz - off);  | 
 | 130 | +	/* Read file with random offset and length */  | 
 | 131 | +	off = 4097;  | 
 | 132 | +	local_err = local_err ?: verify_dynptr_read(&dynptr, off, user_buf + off, 100);  | 
 | 133 | + | 
 | 134 | +	/* Adjust dynptr, verify read */  | 
 | 135 | +	local_err = local_err ?: bpf_dynptr_adjust(&dynptr, off, off + 1);  | 
 | 136 | +	local_err = local_err ?: verify_dynptr_read(&dynptr, 0, user_buf + off, 1);  | 
 | 137 | +	/* Can't read more than 1 byte */  | 
 | 138 | +	local_err = local_err ?: verify_dynptr_read(&dynptr, 0, user_buf + off, 2) == 0;  | 
 | 139 | +	/* Can't read with far offset */  | 
 | 140 | +	local_err = local_err ?: verify_dynptr_read(&dynptr, 1, user_buf + off, 1) == 0;  | 
 | 141 | + | 
 | 142 | +cleanup:  | 
 | 143 | +	bpf_dynptr_file_discard(&dynptr);  | 
 | 144 | +	return local_err;  | 
 | 145 | +}  | 
0 commit comments