3 files changed, 35 insertions, 5 deletions

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index c1c0b60d3f2f..8730b24ed540 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -545,7 +545,7 @@ int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
 EXPORT_SYMBOL(__cgroup_bpf_check_dev_permission);
 
 static const struct bpf_func_proto *
-cgroup_dev_func_proto(enum bpf_func_id func_id)
+cgroup_dev_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_map_lookup_elem:
@@ -566,6 +566,7 @@ cgroup_dev_func_proto(enum bpf_func_id func_id)
 
 static bool cgroup_dev_is_valid_access(int off, int size,
                                        enum bpf_access_type type,
+                                       const struct bpf_prog *prog,
                                        struct bpf_insn_access_aux *info)
 {
         const int size_default = sizeof(__u32);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 95ca2523fa6e..9d3b572d4dec 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1171,8 +1171,27 @@ struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, enum bpf_prog_type type,
 }
 EXPORT_SYMBOL_GPL(bpf_prog_get_type_dev);
 
+static int
+bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type,
+                                enum bpf_attach_type expected_attach_type)
+{
+        /* There are currently no prog types that require specifying
+         * attach_type at load time.
+         */
+        return 0;
+}
+
+static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
+                                             enum bpf_attach_type attach_type)
+{
+        /* There are currently no prog types that require specifying
+         * attach_type at load time.
+         */
+        return 0;
+}
+
 /* last field in 'union bpf_attr' used by this command */
-#define BPF_PROG_LOAD_LAST_FIELD prog_ifindex
+#define BPF_PROG_LOAD_LAST_FIELD expected_attach_type
 
 static int bpf_prog_load(union bpf_attr *attr)
 {
@@ -1209,11 +1228,16 @@ static int bpf_prog_load(union bpf_attr *attr)
             !capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        if (bpf_prog_load_check_attach_type(type, attr->expected_attach_type))
+                return -EINVAL;
+
         /* plain bpf_prog allocation */
         prog = bpf_prog_alloc(bpf_prog_size(attr->insn_cnt), GFP_USER);
         if (!prog)
                 return -ENOMEM;
 
+        prog->expected_attach_type = attr->expected_attach_type;
+
         prog->aux->offload_requested = !!attr->prog_ifindex;
 
         err = security_bpf_prog_alloc(prog->aux);
@@ -1474,6 +1498,11 @@ static int bpf_prog_attach(const union bpf_attr *attr)
         if (IS_ERR(prog))
                 return PTR_ERR(prog);
 
+        if (bpf_prog_attach_check_attach_type(prog, attr->attach_type)) {
+                bpf_prog_put(prog);
+                return -EINVAL;
+        }
+
         cgrp = cgroup_get_from_fd(attr->target_fd);
         if (IS_ERR(cgrp)) {
                 bpf_prog_put(prog);
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8acd2207e412..10024323031d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1323,7 +1323,7 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off,
         };
 
         if (env->ops->is_valid_access &&
-            env->ops->is_valid_access(off, size, t, &info)) {
+            env->ops->is_valid_access(off, size, t, env->prog, &info)) {
                 /* A non zero info.ctx_field_size indicates that this field is a
                  * candidate for later verifier transformation to load the whole
                  * field and then apply a mask when accessed with a narrower
@@ -2349,7 +2349,7 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
         }
 
         if (env->ops->get_func_proto)
-                fn = env->ops->get_func_proto(func_id);
+                fn = env->ops->get_func_proto(func_id, env->prog);
         if (!fn) {
                 verbose(env, "unknown func %s#%d\n", func_id_name(func_id),
                         func_id);
@@ -5572,7 +5572,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
                         insn      = new_prog->insnsi + i + delta;
                 }
 patch_call_imm:
-                fn = env->ops->get_func_proto(insn->imm);
+                fn = env->ops->get_func_proto(insn->imm, env->prog);
                 /* all functions that have prototype and verifier allowed
                  * programs to call them, must be real in-kernel functions
                  */