Skip to content

Commit

Permalink
Use the proper struct for syscall tracepoint probes (#209)
Browse files Browse the repository at this point in the history
Use the proper struct for tracepoint probes
  • Loading branch information
nicholasberlin authored Oct 23, 2024
1 parent 99cc9df commit cd3d8ea
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions GPL/Events/Process/Probe.bpf.c
Original file line number Diff line number Diff line change
Expand Up @@ -240,7 +240,7 @@ int BPF_KPROBE(kprobe__taskstats_exit, const struct task_struct *task, int group
// tracepoint/syscalls/sys_[enter/exit]_[name] tracepoints are not available
// with BTF type information, so we must use a non-BTF tracepoint
SEC("tracepoint/syscalls/sys_exit_setsid")
int tracepoint_syscalls_sys_exit_setsid(struct trace_event_raw_sys_exit *args)
int tracepoint_syscalls_sys_exit_setsid(struct syscall_trace_exit *args)
{
const struct task_struct *task = (struct task_struct *)bpf_get_current_task();

Expand Down Expand Up @@ -365,7 +365,7 @@ int BPF_KPROBE(kprobe__ptrace_attach,
}

SEC("tracepoint/syscalls/sys_enter_shmget")
int tracepoint_syscalls_sys_enter_shmget(struct trace_event_raw_sys_enter *ctx)
int tracepoint_syscalls_sys_enter_shmget(struct syscall_trace_enter *ctx)
{
if (ebpf_events_is_trusted_pid())
goto out;
Expand Down Expand Up @@ -404,7 +404,7 @@ int tracepoint_syscalls_sys_enter_shmget(struct trace_event_raw_sys_enter *ctx)
}

SEC("tracepoint/syscalls/sys_enter_memfd_create")
int tracepoint_syscalls_sys_enter_memfd_create(struct trace_event_raw_sys_enter *ctx)
int tracepoint_syscalls_sys_enter_memfd_create(struct syscall_trace_enter *ctx)
{
if (ebpf_events_is_trusted_pid())
goto out;
Expand Down

0 comments on commit cd3d8ea

Please sign in to comment.