1 files changed, 24 insertions, 0 deletions

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 91800be0c8eb..8607aba1d882 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -915,6 +915,27 @@ const struct bpf_verifier_ops raw_tracepoint_verifier_ops = {
 const struct bpf_prog_ops raw_tracepoint_prog_ops = {
 };
 
+static bool raw_tp_writable_prog_is_valid_access(int off, int size,
+                                                 enum bpf_access_type type,
+                                                 const struct bpf_prog *prog,
+                                                 struct bpf_insn_access_aux *info)
+{
+        if (off == 0) {
+                if (size != sizeof(u64) || type != BPF_READ)
+                        return false;
+                info->reg_type = PTR_TO_TP_BUFFER;
+        }
+        return raw_tp_prog_is_valid_access(off, size, type, prog, info);
+}
+
+const struct bpf_verifier_ops raw_tracepoint_writable_verifier_ops = {
+        .get_func_proto  = raw_tp_prog_func_proto,
+        .is_valid_access = raw_tp_writable_prog_is_valid_access,
+};
+
+const struct bpf_prog_ops raw_tracepoint_writable_prog_ops = {
+};
+
 static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
                                     const struct bpf_prog *prog,
                                     struct bpf_insn_access_aux *info)
@@ -1204,6 +1225,9 @@ static int __bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *
         if (prog->aux->max_ctx_offset > btp->num_args * sizeof(u64))
                 return -EINVAL;
 
+        if (prog->aux->max_tp_access > btp->writable_size)
+                return -EINVAL;
+
         return tracepoint_probe_register(tp, (void *)btp->bpf_func, prog);
 }