4 files changed, 53 insertions, 14 deletions

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index c1c0b60d3f2f..8730b24ed540 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -545,7 +545,7 @@ int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
 EXPORT_SYMBOL(__cgroup_bpf_check_dev_permission);
 
 static const struct bpf_func_proto *
-cgroup_dev_func_proto(enum bpf_func_id func_id)
+cgroup_dev_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_map_lookup_elem:
@@ -566,6 +566,7 @@ cgroup_dev_func_proto(enum bpf_func_id func_id)
 
 static bool cgroup_dev_is_valid_access(int off, int size,
                                        enum bpf_access_type type,
+                                       const struct bpf_prog *prog,
                                        struct bpf_insn_access_aux *info)
 {
         const int size_default = sizeof(__u32);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 95ca2523fa6e..9d3b572d4dec 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1171,8 +1171,27 @@ struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, enum bpf_prog_type type,
 }
 EXPORT_SYMBOL_GPL(bpf_prog_get_type_dev);
 
+static int
+bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type,
+                                enum bpf_attach_type expected_attach_type)
+{
+        /* There are currently no prog types that require specifying
+         * attach_type at load time.
+         */
+        return 0;
+}
+
+static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
+                                             enum bpf_attach_type attach_type)
+{
+        /* There are currently no prog types that require specifying
+         * attach_type at load time.
+         */
+        return 0;
+}
+
 /* last field in 'union bpf_attr' used by this command */
-#define BPF_PROG_LOAD_LAST_FIELD prog_ifindex
+#define BPF_PROG_LOAD_LAST_FIELD expected_attach_type
 
 static int bpf_prog_load(union bpf_attr *attr)
 {
@@ -1209,11 +1228,16 @@ static int bpf_prog_load(union bpf_attr *attr)
             !capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        if (bpf_prog_load_check_attach_type(type, attr->expected_attach_type))
+                return -EINVAL;
+
         /* plain bpf_prog allocation */
         prog = bpf_prog_alloc(bpf_prog_size(attr->insn_cnt), GFP_USER);
         if (!prog)
                 return -ENOMEM;
 
+        prog->expected_attach_type = attr->expected_attach_type;
+
         prog->aux->offload_requested = !!attr->prog_ifindex;
 
         err = security_bpf_prog_alloc(prog->aux);
@@ -1474,6 +1498,11 @@ static int bpf_prog_attach(const union bpf_attr *attr)
         if (IS_ERR(prog))
                 return PTR_ERR(prog);
 
+        if (bpf_prog_attach_check_attach_type(prog, attr->attach_type)) {
+                bpf_prog_put(prog);
+                return -EINVAL;
+        }
+
         cgrp = cgroup_get_from_fd(attr->target_fd);
         if (IS_ERR(cgrp)) {
                 bpf_prog_put(prog);
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8acd2207e412..10024323031d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1323,7 +1323,7 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off,
         };
 
         if (env->ops->is_valid_access &&
-            env->ops->is_valid_access(off, size, t, &info)) {
+            env->ops->is_valid_access(off, size, t, env->prog, &info)) {
                 /* A non zero info.ctx_field_size indicates that this field is a
                  * candidate for later verifier transformation to load the whole
                  * field and then apply a mask when accessed with a narrower
@@ -2349,7 +2349,7 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
         }
 
         if (env->ops->get_func_proto)
-                fn = env->ops->get_func_proto(func_id);
+                fn = env->ops->get_func_proto(func_id, env->prog);
         if (!fn) {
                 verbose(env, "unknown func %s#%d\n", func_id_name(func_id),
                         func_id);
@@ -5572,7 +5572,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
                         insn      = new_prog->insnsi + i + delta;
                 }
 patch_call_imm:
-                fn = env->ops->get_func_proto(insn->imm);
+                fn = env->ops->get_func_proto(insn->imm, env->prog);
                 /* all functions that have prototype and verifier allowed
                  * programs to call them, must be real in-kernel functions
                  */
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 463e72d18c4c..d88e96d4e12c 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -524,7 +524,8 @@ static const struct bpf_func_proto bpf_probe_read_str_proto = {
         .arg3_type      = ARG_ANYTHING,
 };
 
-static const struct bpf_func_proto *tracing_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_map_lookup_elem:
@@ -568,7 +569,8 @@ static const struct bpf_func_proto *tracing_func_proto(enum bpf_func_id func_id)
         }
 }
 
-static const struct bpf_func_proto *kprobe_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+kprobe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -582,12 +584,13 @@ static const struct bpf_func_proto *kprobe_prog_func_proto(enum bpf_func_id func
                 return &bpf_override_return_proto;
 #endif
         default:
-                return tracing_func_proto(func_id);
+                return tracing_func_proto(func_id, prog);
         }
 }
 
 /* bpf+kprobe programs can access fields of 'struct pt_regs' */
 static bool kprobe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                        const struct bpf_prog *prog,
                                         struct bpf_insn_access_aux *info)
 {
         if (off < 0 || off >= sizeof(struct pt_regs))
@@ -661,7 +664,8 @@ static const struct bpf_func_proto bpf_get_stackid_proto_tp = {
         .arg3_type      = ARG_ANYTHING,
 };
 
-static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+tp_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -669,11 +673,12 @@ static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_get_stackid:
                 return &bpf_get_stackid_proto_tp;
         default:
-                return tracing_func_proto(func_id);
+                return tracing_func_proto(func_id, prog);
         }
 }
 
 static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                    const struct bpf_prog *prog,
                                     struct bpf_insn_access_aux *info)
 {
         if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
@@ -721,7 +726,8 @@ static const struct bpf_func_proto bpf_perf_prog_read_value_proto = {
          .arg3_type      = ARG_CONST_SIZE,
 };
 
-static const struct bpf_func_proto *pe_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+pe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -731,7 +737,7 @@ static const struct bpf_func_proto *pe_prog_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_perf_prog_read_value:
                 return &bpf_perf_prog_read_value_proto;
         default:
-                return tracing_func_proto(func_id);
+                return tracing_func_proto(func_id, prog);
         }
 }
 
@@ -781,7 +787,8 @@ static const struct bpf_func_proto bpf_get_stackid_proto_raw_tp = {
         .arg3_type      = ARG_ANYTHING,
 };
 
-static const struct bpf_func_proto *raw_tp_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *
+raw_tp_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -789,12 +796,13 @@ static const struct bpf_func_proto *raw_tp_prog_func_proto(enum bpf_func_id func
         case BPF_FUNC_get_stackid:
                 return &bpf_get_stackid_proto_raw_tp;
         default:
-                return tracing_func_proto(func_id);
+                return tracing_func_proto(func_id, prog);
         }
 }
 
 static bool raw_tp_prog_is_valid_access(int off, int size,
                                         enum bpf_access_type type,
+                                        const struct bpf_prog *prog,
                                         struct bpf_insn_access_aux *info)
 {
         /* largest tracepoint in the kernel has 12 args */
@@ -816,6 +824,7 @@ const struct bpf_prog_ops raw_tracepoint_prog_ops = {
 };
 
 static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                    const struct bpf_prog *prog,
                                     struct bpf_insn_access_aux *info)
 {
         const int size_u64 = sizeof(u64);