bpf_override_return error from kprobe

[panzhenyu12]

SEC("kprobe/vfs_mkdir")
int kprobe_mkdir(struct pt_regs *ctx) {
    u32 key = 0;
    u64 initval = 1, *valp;
    
    // struct inode *dir = (struct inode *)PT_REGS_PARM1(ctx);
    // struct dentry *dentry = (struct dentry *)PT_REGS_PARM2(ctx);

    valp = bpf_map_lookup_elem(&kprobe_map, &key);
    if (!valp) {
        bpf_map_update_elem(&kprobe_map, &key, &initval, BPF_ANY);
        return 0;
    }
    
    bpf_override_return(ctx,1);
    __sync_fetch_and_add(valp, 1);
    return 0;
}

I add bpf_override_return code this,and doesn't work with error 2022/05/09 16:37:47 opening kprobe: setting perf event bpf program: invalid argument.

What I want todo ? I want use eBFP to inject hook to terminating some operation, May I use bpf_override_return to do this ?
Is there any other way to achieve it ?

Can u help me ?

Looking forward to your reply

[cheneytianx]

Two prerequisites to use bpf_override_return:

1.The kernel was compiled with the following two configurations

CONFIG_FUNCTION_ERROR_INJECTION=y
CONFIG_BPF_KPROBE_OVERRIDE=y

2.The hooked function was whitelisted to allow error injections. Please refer to iovisor/bcc#2485 (comment)