Inspection of known types should also inspect the returned value.
A function could take the same type as the input and as the returned value. A simple solution is to prioritize the returned value in such case (and a kprobe can be used to get the parameter one).
BPF helpers needs some refactoring to not only act on parameters.
This is also maybe related to a bigger issue when a function has access to a known type more than once. Should all be reported? How to differentiate those? etc.
This contains a few sub-tasks:
This is also maybe related to a bigger issue when a function has access to a known type more than once. Should all be reported? How to differentiate those? etc.