1// SPDX-License-Identifier: GPL-2.0
2#include <vmlinux.h>
3#include <bpf/bpf_helpers.h>
4#include <bpf/bpf_tracing.h>
5
6const volatile struct {
7	/* thread to activate trace programs for */
8	pid_t tgid;
9	/* return error from __init function */
10	int inject_error;
11	/* uffd monitored range start address */
12	void *fault_addr;
13} bpf_mod_race_config = { -1 };
14
15int bpf_blocking = 0;
16int res_try_get_module = -1;
17
18static __always_inline bool check_thread_id(void)
19{
20	struct task_struct *task = bpf_get_current_task_btf();
21
22	return task->tgid == bpf_mod_race_config.tgid;
23}
24
25/* The trace of execution is something like this:
26 *
27 * finit_module()
28 *   load_module()
29 *     prepare_coming_module()
30 *       notifier_call(MODULE_STATE_COMING)
31 *         btf_parse_module()
32 *         btf_alloc_id()		// Visible to userspace at this point
33 *         list_add(btf_mod->list, &btf_modules)
34 *     do_init_module()
35 *       freeinit = kmalloc()
36 *       ret = mod->init()
37 *         bpf_prog_widen_race()
38 *           bpf_copy_from_user()
39 *             ...<sleep>...
40 *       if (ret < 0)
41 *         ...
42 *         free_module()
43 * return ret
44 *
45 * At this point, module loading thread is blocked, we now load the program:
46 *
47 * bpf_check
48 *   add_kfunc_call/check_pseudo_btf_id
49 *     btf_try_get_module
50 *       try_get_module_live == false
51 *     return -ENXIO
52 *
53 * Without the fix (try_get_module_live in btf_try_get_module):
54 *
55 * bpf_check
56 *   add_kfunc_call/check_pseudo_btf_id
57 *     btf_try_get_module
58 *       try_get_module == true
59 *     <store module reference in btf_kfunc_tab or used_btf array>
60 *   ...
61 * return fd
62 *
63 * Now, if we inject an error in the blocked program, our module will be freed
64 * (going straight from MODULE_STATE_COMING to MODULE_STATE_GOING).
65 * Later, when bpf program is freed, it will try to module_put already freed
66 * module. This is why try_get_module_live returns false if mod->state is not
67 * MODULE_STATE_LIVE.
68 */
69
70SEC("fmod_ret.s/bpf_fentry_test1")
71int BPF_PROG(widen_race, int a, int ret)
72{
73	char dst;
74
75	if (!check_thread_id())
76		return 0;
77	/* Indicate that we will attempt to block */
78	bpf_blocking = 1;
79	bpf_copy_from_user(&dst, 1, bpf_mod_race_config.fault_addr);
80	return bpf_mod_race_config.inject_error;
81}
82
83SEC("fexit/do_init_module")
84int BPF_PROG(fexit_init_module, struct module *mod, int ret)
85{
86	if (!check_thread_id())
87		return 0;
88	/* Indicate that we finished blocking */
89	bpf_blocking = 2;
90	return 0;
91}
92
93SEC("fexit/btf_try_get_module")
94int BPF_PROG(fexit_module_get, const struct btf *btf, struct module *mod)
95{
96	res_try_get_module = !!mod;
97	return 0;
98}
99
100char _license[] SEC("license") = "GPL";
101