selftests/bpf: Test using file dynptr after the reference on file is dropped

File dynptr and slice should be invalidated when the parent file's
reference is dropped in the program. Without the verifier tracking
dyntpr's parent referenced object, the dynptr would continute to be
incorrectly used even if the underlying file is being tear down or gone.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260529014936.2811085-13-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/progs/file_reader_fail.c b/tools/testing/selftests/bpf/progs/file_reader_fail.c
index 0739620dea8a76e640923868c0ee85d16f83c6bc..d5fae5e4cf9adbe5ef7edec2e4714ff40d47045e 100644 (file)
--- a/tools/testing/selftests/bpf/progs/file_reader_fail.c
+++ b/tools/testing/selftests/bpf/progs/file_reader_fail.c
@@ -50,3 +50,63 @@ int xdp_no_dynptr_type(struct xdp_md *xdp)
        bpf_dynptr_file_discard(&dynptr);
        return 0;
 }
+
+SEC("lsm/file_open")
+__failure
+__msg("Leaking reference id={{[0-9]+}} alloc_insn={{[0-9]+}}. Release it first.")
+int use_file_dynptr_after_put_file(void *ctx)
+{
+       struct task_struct *task = bpf_get_current_task_btf();
+       struct file *file = bpf_get_task_exe_file(task);
+       struct bpf_dynptr dynptr;
+       char buf[64];
+
+       if (!file)
+               return 0;
+
+       if (bpf_dynptr_from_file(file, 0, &dynptr))
+               goto out;
+
+       /* this should fail - file dynptr should be discarded first to prevent resource leak */
+       bpf_put_file(file);
+
+       bpf_dynptr_read(buf, sizeof(buf), &dynptr, 0, 0);
+       return 0;
+
+out:
+       bpf_dynptr_file_discard(&dynptr);
+       bpf_put_file(file);
+       return 0;
+}
+
+SEC("lsm/file_open")
+__failure
+__msg("Leaking reference id={{[0-9]+}} alloc_insn={{[0-9]+}}. Release it first.")
+int use_file_dynptr_slice_after_put_file(void *ctx)
+{
+       struct task_struct *task = bpf_get_current_task_btf();
+       struct file *file = bpf_get_task_exe_file(task);
+       struct bpf_dynptr dynptr;
+       char *data;
+
+       if (!file)
+               return 0;
+
+       if (bpf_dynptr_from_file(file, 0, &dynptr))
+               goto out;
+
+       data = bpf_dynptr_data(&dynptr, 0, 1);
+       if (!data)
+               goto out;
+
+       /* this should fail - file dynptr should be discarded first to prevent resource leak */
+       bpf_put_file(file);
+
+       *data = 'x';
+       return 0;
+
+out:
+       bpf_dynptr_file_discard(&dynptr);
+       bpf_put_file(file);
+       return 0;
+}