bpf: Attachment verification for BPF_MODIFY_RETURN

[linux-2.6-microblaze.git] / kernel / bpf / btf.c

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 30841fb..50080ad 100644 (file)
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3710,14 +3710,26 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
                nr_args--;
        }
 
-       if ((prog->expected_attach_type == BPF_TRACE_FEXIT ||
-            prog->expected_attach_type == BPF_MODIFY_RETURN) &&
-           arg == nr_args) {
-               if (!t)
-                       /* Default prog with 5 args. 6th arg is retval. */
-                       return true;
-               /* function return type */
-               t = btf_type_by_id(btf, t->type);
+       if (arg == nr_args) {
+               if (prog->expected_attach_type == BPF_TRACE_FEXIT) {
+                       if (!t)
+                               return true;
+                       t = btf_type_by_id(btf, t->type);
+               } else if (prog->expected_attach_type == BPF_MODIFY_RETURN) {
+                       /* For now the BPF_MODIFY_RETURN can only be attached to
+                        * functions that return an int.
+                        */
+                       if (!t)
+                               return false;
+
+                       t = btf_type_skip_modifiers(btf, t->type, NULL);
+                       if (!btf_type_is_int(t)) {
+                               bpf_log(log,
+                                       "ret type %s not allowed for fmod_ret\n",
+                                       btf_kind_str[BTF_INFO_KIND(t->info)]);
+                               return false;
+                       }
+               }
        } else if (arg >= nr_args) {
                bpf_log(log, "func '%s' doesn't have %d-th argument\n",
                        tname, arg + 1);