Re: [PATCH bpf] bpf: Force kprobe multi expected_attach_type for kprobe_multi link

[Jiri Olsa <olsajiri@gmail.com>]

On Fri, Jun 16, 2023 at 09:53:00AM -0700, Andrii Nakryiko wrote:
> On Tue, Jun 13, 2023 at 4:31 AM Jiri Olsa <jolsa@kernel.org> wrote:
> >
> > We currently allow to create perf link for program with
> > expected_attach_type == BPF_TRACE_KPROBE_MULTI.
> >
> > This will cause crash when we call helpers like get_attach_cookie or
> > get_func_ip in such program, because it will call the kprobe_multi's
> > version (current->bpf_ctx context setup) of those helpers while it
> > expects perf_link's current->bpf_ctx context setup.
> >
> > Making sure that we use BPF_TRACE_KPROBE_MULTI expected_attach_type
> > only for programs attaching through kprobe_multi link.
> >
> > Fixes: ca74823c6e16 ("bpf: Add cookie support to programs attached with kprobe multi link")
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
> >  kernel/bpf/syscall.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> > index 0c21d0d8efe4..e8fe04a5db93 100644
> > --- a/kernel/bpf/syscall.c
> > +++ b/kernel/bpf/syscall.c
> > @@ -4675,6 +4675,11 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
> >                 ret = bpf_perf_link_attach(attr, prog);
> >                 break;
> >         case BPF_PROG_TYPE_KPROBE:
> > +               if (prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI &&
> > +                   attr->link_create.attach_type != BPF_TRACE_KPROBE_MULTI) {
> > +                       ret = -EINVAL;
> > +                       goto out;
> > +               }
> 
> there is a separate expected attach type validation switch above this,
> shouldn't this go there? We also have
> bpf_prog_attach_check_attach_type() call above as well, and tbh by now
> I'm not sure why we have like three places to check conditions like
> this... But I'd put this check in either
> bpf_prog_attach_check_attach_type() or in the dedicated switch for
> attach_type checks.
> 

bpf_prog_attach_check_attach_type looks good, will move it there

thanks,
jirka