From e67c7160ba994dcfbe64a2d4a83087a86484314c Mon Sep 17 00:00:00 2001
From: Mattia Meleleo <mattia.meleleo@elastic.co>
Date: Tue, 10 Oct 2023 16:05:07 +0200
Subject: [PATCH] fix: failed byte off relocation (iov_iter.iov)

---
 GPL/Events/Process/Probe.bpf.c  | 5 ++++-
 non-GPL/Events/Lib/EbpfEvents.c | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/GPL/Events/Process/Probe.bpf.c b/GPL/Events/Process/Probe.bpf.c
index 557c12e8..d70ddbd5 100644
--- a/GPL/Events/Process/Probe.bpf.c
+++ b/GPL/Events/Process/Probe.bpf.c
@@ -18,6 +18,7 @@
 #include "Varlen.h"
 
 /* tty_write */
+DECL_FIELD_OFFSET(iov_iter, iov);
 DECL_FIELD_OFFSET(iov_iter, __iov);
 
 // Limits on large things we send up as variable length parameters.
@@ -374,8 +375,10 @@ static int tty_write__enter(struct kiocb *iocb, struct iov_iter *from)
     const struct iovec *iov;
     if (FIELD_OFFSET(iov_iter, __iov)) {
         iov = (const struct iovec *)((char *)from + FIELD_OFFSET(iov_iter, __iov));
+    } else if (FIELD_OFFSET(iov_iter, iov)) {
+        iov = (const struct iovec *)((char *)from + FIELD_OFFSET(iov_iter, iov));
     } else {
-        iov = BPF_CORE_READ(from, iov);
+        goto out;
     }
 
     u64 nr_segs = BPF_CORE_READ(from, nr_segs);
diff --git a/non-GPL/Events/Lib/EbpfEvents.c b/non-GPL/Events/Lib/EbpfEvents.c
index b3a2dc21..87e19196 100644
--- a/non-GPL/Events/Lib/EbpfEvents.c
+++ b/non-GPL/Events/Lib/EbpfEvents.c
@@ -278,8 +278,11 @@ static int probe_fill_relos(struct btf *btf, struct EventProbe_bpf *obj)
     }
     err = err ?: FILL_FUNC_RET_IDX(obj, btf, vfs_rename);
 
-    if (BTF_FIELD_EXISTS(btf, iov_iter, __iov))
+    if (BTF_FIELD_EXISTS(btf, iov_iter, __iov)) {
         err = err ?: FILL_FIELD_OFFSET(obj, btf, iov_iter, __iov);
+    } else {
+        err = err ?: FILL_FIELD_OFFSET(obj, btf, iov_iter, iov);
+    }
 
     return err;
 }