From dc09fcecccc26b37679492360a81e9601e7643cb Mon Sep 17 00:00:00 2001 From: Paul Chaignon Date: Wed, 6 Sep 2023 15:36:33 +0200 Subject: sys/linux: cover multi-kprobes in BPF_LINK_CREATE Commit [1] upstream added support for multi-kprobes to BPF link, to allow attaching many kprobes BPF programs at once. In doing so, the BPF_LINK_CREATE command was extended with attachment information for kprobes. This commit covers this in syzkaller's description. We have two cases to cover: kprobes are either attached by symbols (resolved by the kernel) or directly by kernel addresses. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0dcac272540613d41 Signed-off-by: Paul Chaignon --- sys/linux/bpf.txt.const | 1 + 1 file changed, 1 insertion(+) (limited to 'sys/linux/bpf.txt.const') diff --git a/sys/linux/bpf.txt.const b/sys/linux/bpf.txt.const index ced4f2134..18e669d7a 100644 --- a/sys/linux/bpf.txt.const +++ b/sys/linux/bpf.txt.const @@ -69,6 +69,7 @@ BPF_F_BEFORE = 8 BPF_F_CLONE = 512 BPF_F_ID = 32 BPF_F_INNER_MAP = 4096 +BPF_F_KPROBE_MULTI_RETURN = 1 BPF_F_LINK = 8192 BPF_F_LOCK = 4 BPF_F_MMAPABLE = 1024 -- cgit mrf-deployment