8 files changed, 88 insertions, 29 deletions

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 819229c80eca..95a7abd0ee92 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -208,12 +208,15 @@ struct bpf_prog_ops {
 
 struct bpf_verifier_ops {
         /* return eBPF function prototype for verification */
-        const struct bpf_func_proto *(*get_func_proto)(enum bpf_func_id func_id);
+        const struct bpf_func_proto *
+        (*get_func_proto)(enum bpf_func_id func_id,
+                          const struct bpf_prog *prog);
 
         /* return true if 'size' wide access at offset 'off' within bpf_context
          * with 'type' (read or write) is allowed
          */
         bool (*is_valid_access)(int off, int size, enum bpf_access_type type,
+                                const struct bpf_prog *prog,
                                 struct bpf_insn_access_aux *info);
         int (*gen_prologue)(struct bpf_insn *insn, bool direct_write,
                             const struct bpf_prog *prog);
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 897ff3d95968..13c044e4832d 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -469,6 +469,7 @@ struct bpf_prog {
                                 is_func:1,      /* program is a bpf function */
                                 kprobe_override:1; /* Do we override a kprobe? */
         enum bpf_prog_type      type;           /* Type of BPF program */
+        enum bpf_attach_type    expected_attach_type; /* For some prog types */
         u32                     len;            /* Number of filter blocks */
         u32                     jited_len;      /* Size of jited insns in bytes */
         u8                      tag[BPF_TAG_SIZE];
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 1878201c2d77..102718624d1e 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -296,6 +296,11 @@ union bpf_attr {
                 __u32           prog_flags;
                 char            prog_name[BPF_OBJ_NAME_LEN];
                 __u32           prog_ifindex;   /* ifindex of netdev to prep for */
+                /* For some prog types expected attach type must be known at
+                 * load time to verify attach type specific parts of prog
+                 * (context accesses, allowed helpers, etc).
+                 */
+                __u32           expected_attach_type;
         };
 
         struct { /* anonymous struct used by BPF_OBJ_* commands */
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index c1c0b60d3f2f..8730b24ed540 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -545,7 +545,7 @@ int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
 EXPORT_SYMBOL(__cgroup_bpf_check_dev_permission);
 
 static const struct bpf_func_proto *
-cgroup_dev_func_proto(enum bpf_func_id func_id)
+cgroup_dev_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_map_lookup_elem:
@@ -566,6 +566,7 @@ cgroup_dev_func_proto(enum bpf_func_id func_id)
 
 static bool cgroup_dev_is_valid_access(int off, int size,
                                        enum bpf_access_type type,
+                                       const struct bpf_prog *prog,
                                        struct bpf_insn_access_aux *info)
 {
         const int size_default = sizeof(__u32);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 95ca2523fa6e..9d3b572d4dec 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1171,8 +1171,27 @@ struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, enum bpf_prog_type type,
 }
 EXPORT_SYMBOL_GPL(bpf_prog_get_type_dev);
 
+static int
+bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type,
+                                enum bpf_attach_type expected_attach_type)
+{
+        /* There are currently no prog types that require specifying
+         * attach_type at load time.
+         */
+        return 0;
+}
+
+static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
+                                             enum bpf_attach_type attach_type)
+{
+        /* There are currently no prog types that require specifying
+         * attach_type at load time.
+         */
+        return 0;
+}
+
 /* last field in 'union bpf_attr' used by this command */
-#define BPF_PROG_LOAD_LAST_FIELD prog_ifindex
+#define BPF_PROG_LOAD_LAST_FIELD expected_attach_type
 
 static int bpf_prog_load(union bpf_attr *attr)
 {
@@ -1209,11 +1228,16 @@ static int bpf_prog_load(union bpf_attr *attr)
             !capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        if (bpf_prog_load_check_attach_type(type, attr->expected_attach_type))
+                return -EINVAL;
+
         /* plain bpf_prog allocation */
         prog = bpf_prog_alloc(bpf_prog_size(attr->insn_cnt), GFP_USER);
         if (!prog)
                 return -ENOMEM;
 
+        prog->expected_attach_type = attr->expected_attach_type;
+
         prog->aux->offload_requested = !!attr->prog_ifindex;
 
         err = security_bpf_prog_alloc(prog->aux);
@@ -1474,6 +1498,11 @@ static int bpf_prog_attach(const union bpf_attr *attr)
         if (IS_ERR(prog))
                 return PTR_ERR(prog);
 
+        if (bpf_prog_attach_check_attach_type(prog, attr->attach_type)) {
+                bpf_prog_put(prog);
+                return -EINVAL;
+        }
+
         cgrp = cgroup_get_from_fd(attr->target_fd);
         if (IS_ERR(cgrp)) {
                 bpf_prog_put(prog);
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8acd2207e412..10024323031d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1323,7 +1323,7 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off,
         };
 
         if (env->ops->is_valid_access &&
-            env->ops->is_valid_access(off, size, t, &info)) {
+            env->ops->is_valid_access(off, size, t, env->prog, &info)) {
                 /* A non zero info.ctx_field_size indicates that this field is a
                  * candidate for later verifier transformation to load the whole
                  * field and then apply a mask when accessed with a narrower
@@ -2349,7 +2349,7 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
         }
 
         if (env->ops->get_func_proto)
-                fn = env->ops->get_func_proto(func_id);
+                fn = env->ops->get_func_proto(func_id, env->prog);
         if (!fn) {
                 verbose(env, "unknown func %s#%d\n", func_id_name(func_id),
                         func_id);
@@ -5572,7 +5572,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
                         insn      = new_prog->insnsi + i + delta;
                 }
 patch_call_imm:
-                fn = env->ops->get_func_proto(insn->imm);
+                fn = env->ops->get_func_proto(insn->imm, env->prog);
                 /* all functions that have prototype and verifier allowed
                  * programs to call them, must be real in-kernel functions
                  */
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 463e72d18c4c..d88e96d4e12c 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -524,7 +524,8 @@ static const struct bpf_func_proto bpf_probe_read_str_proto = {
         .arg3_type      = ARG_ANYTHING,
 };
 
-static const struct bpf_func_proto *tracing_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_map_lookup_elem:
@@ -568,7 +569,8 @@ static const struct bpf_func_proto *tracing_func_proto(enum bpf_func_id func_id)
         }
 }
 
-static const struct bpf_func_proto *kprobe_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+kprobe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -582,12 +584,13 @@ static const struct bpf_func_proto *kprobe_prog_func_proto(enum bpf_func_id func
                 return &bpf_override_return_proto;
 #endif
         default:
-                return tracing_func_proto(func_id);
+                return tracing_func_proto(func_id, prog);
         }
 }
 
 /* bpf+kprobe programs can access fields of 'struct pt_regs' */
 static bool kprobe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                        const struct bpf_prog *prog,
                                         struct bpf_insn_access_aux *info)
 {
         if (off < 0 || off >= sizeof(struct pt_regs))
@@ -661,7 +664,8 @@ static const struct bpf_func_proto bpf_get_stackid_proto_tp = {
         .arg3_type      = ARG_ANYTHING,
 };
 
-static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+tp_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -669,11 +673,12 @@ static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_get_stackid:
                 return &bpf_get_stackid_proto_tp;
         default:
-                return tracing_func_proto(func_id);
+                return tracing_func_proto(func_id, prog);
         }
 }
 
 static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                    const struct bpf_prog *prog,
                                     struct bpf_insn_access_aux *info)
 {
         if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
@@ -721,7 +726,8 @@ static const struct bpf_func_proto bpf_perf_prog_read_value_proto = {
          .arg3_type      = ARG_CONST_SIZE,
 };
 
-static const struct bpf_func_proto *pe_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+pe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -731,7 +737,7 @@ static const struct bpf_func_proto *pe_prog_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_perf_prog_read_value:
                 return &bpf_perf_prog_read_value_proto;
         default:
-                return tracing_func_proto(func_id);
+                return tracing_func_proto(func_id, prog);
         }
 }
 
@@ -781,7 +787,8 @@ static const struct bpf_func_proto bpf_get_stackid_proto_raw_tp = {
         .arg3_type      = ARG_ANYTHING,
 };
 
-static const struct bpf_func_proto *raw_tp_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+raw_tp_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -789,12 +796,13 @@ static const struct bpf_func_proto *raw_tp_prog_func_proto(enum bpf_func_id func
         case BPF_FUNC_get_stackid:
                 return &bpf_get_stackid_proto_raw_tp;
         default:
-                return tracing_func_proto(func_id);
+                return tracing_func_proto(func_id, prog);
         }
 }
 
 static bool raw_tp_prog_is_valid_access(int off, int size,
                                         enum bpf_access_type type,
+                                        const struct bpf_prog *prog,
                                         struct bpf_insn_access_aux *info)
 {
         /* largest tracepoint in the kernel has 12 args */
@@ -816,6 +824,7 @@ const struct bpf_prog_ops raw_tracepoint_prog_ops = {
 };
 
 static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                    const struct bpf_prog *prog,
                                     struct bpf_insn_access_aux *info)
 {
         const int size_u64 = sizeof(u64);
diff --git a/net/core/filter.c b/net/core/filter.c
index e989bf313195..7790fd128614 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3685,7 +3685,7 @@ bpf_base_func_proto(enum bpf_func_id func_id)
 }
 
 static const struct bpf_func_proto *
-sock_filter_func_proto(enum bpf_func_id func_id)
+sock_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         /* inet and inet6 sockets are created in a process
@@ -3699,7 +3699,7 @@ sock_filter_func_proto(enum bpf_func_id func_id)
 }
 
 static const struct bpf_func_proto *
-sk_filter_func_proto(enum bpf_func_id func_id)
+sk_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_skb_load_bytes:
@@ -3714,7 +3714,7 @@ sk_filter_func_proto(enum bpf_func_id func_id)
 }
 
 static const struct bpf_func_proto *
-tc_cls_act_func_proto(enum bpf_func_id func_id)
+tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_skb_store_bytes:
@@ -3781,7 +3781,7 @@ tc_cls_act_func_proto(enum bpf_func_id func_id)
 }
 
 static const struct bpf_func_proto *
-xdp_func_proto(enum bpf_func_id func_id)
+xdp_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -3804,7 +3804,7 @@ xdp_func_proto(enum bpf_func_id func_id)
 }
 
 static const struct bpf_func_proto *
-lwt_inout_func_proto(enum bpf_func_id func_id)
+lwt_inout_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_skb_load_bytes:
@@ -3831,7 +3831,7 @@ lwt_inout_func_proto(enum bpf_func_id func_id)
 }
 
 static const struct bpf_func_proto *
-        sock_ops_func_proto(enum bpf_func_id func_id)
+sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_setsockopt:
@@ -3847,7 +3847,8 @@ static const struct bpf_func_proto *
         }
 }
 
-static const struct bpf_func_proto *sk_msg_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+sk_msg_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_msg_redirect_map:
@@ -3863,7 +3864,8 @@ static const struct bpf_func_proto *sk_msg_func_proto(enum bpf_func_id func_id)
         }
 }
 
-static const struct bpf_func_proto *sk_skb_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+sk_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_skb_store_bytes:
@@ -3888,7 +3890,7 @@ static const struct bpf_func_proto *sk_skb_func_proto(enum bpf_func_id func_id)
 }
 
 static const struct bpf_func_proto *
-lwt_xmit_func_proto(enum bpf_func_id func_id)
+lwt_xmit_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_skb_get_tunnel_key:
@@ -3918,11 +3920,12 @@ lwt_xmit_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_set_hash_invalid:
                 return &bpf_set_hash_invalid_proto;
         default:
-                return lwt_inout_func_proto(func_id);
+                return lwt_inout_func_proto(func_id, prog);
         }
 }
 
 static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type,
+                                    const struct bpf_prog *prog,
                                     struct bpf_insn_access_aux *info)
 {
         const int size_default = sizeof(__u32);
@@ -3966,6 +3969,7 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type
 
 static bool sk_filter_is_valid_access(int off, int size,
                                       enum bpf_access_type type,
+                                      const struct bpf_prog *prog,
                                       struct bpf_insn_access_aux *info)
 {
         switch (off) {
@@ -3986,11 +3990,12 @@ static bool sk_filter_is_valid_access(int off, int size,
                 }
         }
 
-        return bpf_skb_is_valid_access(off, size, type, info);
+        return bpf_skb_is_valid_access(off, size, type, prog, info);
 }
 
 static bool lwt_is_valid_access(int off, int size,
                                 enum bpf_access_type type,
+                                const struct bpf_prog *prog,
                                 struct bpf_insn_access_aux *info)
 {
         switch (off) {
@@ -4020,11 +4025,12 @@ static bool lwt_is_valid_access(int off, int size,
                 break;
         }
 
-        return bpf_skb_is_valid_access(off, size, type, info);
+        return bpf_skb_is_valid_access(off, size, type, prog, info);
 }
 
 static bool sock_filter_is_valid_access(int off, int size,
                                         enum bpf_access_type type,
+                                        const struct bpf_prog *prog,
                                         struct bpf_insn_access_aux *info)
 {
         if (type == BPF_WRITE) {
@@ -4096,6 +4102,7 @@ static int tc_cls_act_prologue(struct bpf_insn *insn_buf, bool direct_write,
 
 static bool tc_cls_act_is_valid_access(int off, int size,
                                        enum bpf_access_type type,
+                                       const struct bpf_prog *prog,
                                        struct bpf_insn_access_aux *info)
 {
         if (type == BPF_WRITE) {
@@ -4125,7 +4132,7 @@ static bool tc_cls_act_is_valid_access(int off, int size,
                 return false;
         }
 
-        return bpf_skb_is_valid_access(off, size, type, info);
+        return bpf_skb_is_valid_access(off, size, type, prog, info);
 }
 
 static bool __is_valid_xdp_access(int off, int size)
@@ -4142,6 +4149,7 @@ static bool __is_valid_xdp_access(int off, int size)
 
 static bool xdp_is_valid_access(int off, int size,
                                 enum bpf_access_type type,
+                                const struct bpf_prog *prog,
                                 struct bpf_insn_access_aux *info)
 {
         if (type == BPF_WRITE)
@@ -4174,6 +4182,7 @@ EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_action);
 
 static bool sock_ops_is_valid_access(int off, int size,
                                      enum bpf_access_type type,
+                                     const struct bpf_prog *prog,
                                      struct bpf_insn_access_aux *info)
 {
         const int size_default = sizeof(__u32);
@@ -4220,6 +4229,7 @@ static int sk_skb_prologue(struct bpf_insn *insn_buf, bool direct_write,
 
 static bool sk_skb_is_valid_access(int off, int size,
                                    enum bpf_access_type type,
+                                   const struct bpf_prog *prog,
                                    struct bpf_insn_access_aux *info)
 {
         switch (off) {
@@ -4249,11 +4259,12 @@ static bool sk_skb_is_valid_access(int off, int size,
                 break;
         }
 
-        return bpf_skb_is_valid_access(off, size, type, info);
+        return bpf_skb_is_valid_access(off, size, type, prog, info);
 }
 
 static bool sk_msg_is_valid_access(int off, int size,
                                    enum bpf_access_type type,
+                                   const struct bpf_prog *prog,
                                    struct bpf_insn_access_aux *info)
 {
         if (type == BPF_WRITE)