fix: failed byte off relocation (iov_iter.iov)

elastic · Oct 10, 2023 · e67c716 · e67c716
1 parent f2581d8
commit e67c716
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/GPL/Events/Process/Probe.bpf.c b/GPL/Events/Process/Probe.bpf.c
@@ -18,6 +18,7 @@
 #include "Varlen.h"
 
 /* tty_write */
+DECL_FIELD_OFFSET(iov_iter, iov);
 DECL_FIELD_OFFSET(iov_iter, __iov);
 
 // Limits on large things we send up as variable length parameters.
@@ -374,8 +375,10 @@ static int tty_write__enter(struct kiocb *iocb, struct iov_iter *from)
     const struct iovec *iov;
     if (FIELD_OFFSET(iov_iter, __iov)) {
         iov = (const struct iovec *)((char *)from + FIELD_OFFSET(iov_iter, __iov));
+    } else if (FIELD_OFFSET(iov_iter, iov)) {
+        iov = (const struct iovec *)((char *)from + FIELD_OFFSET(iov_iter, iov));
     } else {
-        iov = BPF_CORE_READ(from, iov);
+        goto out;
     }
 
     u64 nr_segs = BPF_CORE_READ(from, nr_segs);

diff --git a/non-GPL/Events/Lib/EbpfEvents.c b/non-GPL/Events/Lib/EbpfEvents.c
@@ -278,8 +278,11 @@ static int probe_fill_relos(struct btf *btf, struct EventProbe_bpf *obj)
     }
     err = err ?: FILL_FUNC_RET_IDX(obj, btf, vfs_rename);
 
-    if (BTF_FIELD_EXISTS(btf, iov_iter, __iov))
+    if (BTF_FIELD_EXISTS(btf, iov_iter, __iov)) {
         err = err ?: FILL_FIELD_OFFSET(obj, btf, iov_iter, __iov);
+    } else {
+        err = err ?: FILL_FIELD_OFFSET(obj, btf, iov_iter, iov);
+    }
 
     return err;
 }