get the right iov field

elastic · Oct 1, 2023 · fcafbfc · fcafbfc
1 parent fe80cd3
commit fcafbfc
Showing 1 changed file with 31 additions and 5 deletions.
diff --git a/GPL/Events/Process/Probe.bpf.c b/GPL/Events/Process/Probe.bpf.c
@@ -332,9 +332,24 @@ static int output_tty_event(struct ebpf_tty_dev *slave, const void *base, size_t
     return ret;
 }
 
+struct iov_iter____new {
+    union {
+        struct iovec __ubuf_iovec;
+        struct {
+            union {
+                const struct iovec *__iov;
+                const struct kvec *kvec;
+                const struct bio_vec *bvec;
+                struct xarray *xarray;
+                void *ubuf;
+            };
+            size_t count;
+        };
+    };
+} __attribute__((preserve_access_index));
+
 static int tty_write__enter(struct kiocb *iocb, struct iov_iter *from)
 {
-
     if (is_consumer()) {
         goto out;
     }
@@ -369,12 +384,23 @@ static int tty_write__enter(struct kiocb *iocb, struct iov_iter *from)
         goto out;
     }
 
-    u64 nr_segs             = BPF_CORE_READ(from, nr_segs);
-    nr_segs                 = nr_segs > MAX_NR_SEGS ? MAX_NR_SEGS : nr_segs;
-    const struct iovec *iov = BPF_CORE_READ(from, iov);
+    u64 nr_segs = BPF_CORE_READ(from, nr_segs);
+    u64 count   = BPF_CORE_READ(from, count);
+
+    const struct iovec *iov;
+    barrier_var(from);
+    if (bpf_core_field_exists(struct iov_iter____new, __iov)) {
+        u64 iov_off = offsetof(struct iov_iter____new, __iov);
+        bpf_core_read(&iov, sizeof(struct iov_iter____new), (void *)from + iov_off);
+    } else if (bpf_core_field_exists(from->iov)) {
+        iov = BPF_CORE_READ(from, iov);
+    } else {
+        bpf_printk("tty_write__enter: error reading iov\n");
+        goto out;
+    }
 
+    nr_segs = nr_segs > MAX_NR_SEGS ? MAX_NR_SEGS : nr_segs;
     if (nr_segs == 0) {
-        u64 count = BPF_CORE_READ(from, count);
         (void)output_tty_event(&slave, (void *)iov, count);
         goto out;
     }