From 3101fb6a85e3f7534122005877cf5f89844d5ea8 Mon Sep 17 00:00:00 2001 From: Mattia Meleleo Date: Tue, 10 Oct 2023 16:05:07 +0200 Subject: [PATCH] fix: failed byte off relocation (iov_iter.iov) --- GPL/Events/Process/Probe.bpf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/GPL/Events/Process/Probe.bpf.c b/GPL/Events/Process/Probe.bpf.c index 557c12e8..b01f19af 100644 --- a/GPL/Events/Process/Probe.bpf.c +++ b/GPL/Events/Process/Probe.bpf.c @@ -372,11 +372,12 @@ static int tty_write__enter(struct kiocb *iocb, struct iov_iter *from) } const struct iovec *iov; - if (FIELD_OFFSET(iov_iter, __iov)) { + if (FIELD_OFFSET(iov_iter, __iov)) iov = (const struct iovec *)((char *)from + FIELD_OFFSET(iov_iter, __iov)); - } else { + else if (bpf_core_field_exists(from->iov)) iov = BPF_CORE_READ(from, iov); - } + else + goto out; u64 nr_segs = BPF_CORE_READ(from, nr_segs); nr_segs = nr_segs > MAX_NR_SEGS ? MAX_NR_SEGS : nr_segs;