From 32b2aab4f7bfbdb06f63e05c60ef57cb296cdf6a Mon Sep 17 00:00:00 2001 From: Nadav Strahilevitz Date: Tue, 30 Apr 2024 15:10:48 +0000 Subject: [PATCH] chore(ebpf): remove path copy in get_path_str_buf The helper previously copied the path argument into a stack allocated copy. This is an unnecessary copy, and risks copying the wrong size, since the actual kernel specific size may differ from the compiler allocated size. Instead, use CORE_READ to access the necessary fields directly from the argument. --- pkg/ebpf/c/common/filesystem.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/pkg/ebpf/c/common/filesystem.h b/pkg/ebpf/c/common/filesystem.h index 12d567b48b35..9f084b3778a9 100644 --- a/pkg/ebpf/c/common/filesystem.h +++ b/pkg/ebpf/c/common/filesystem.h @@ -170,12 +170,10 @@ statfunc size_t get_path_str_buf(struct path *path, buf_t *out_buf) return 0; } - struct path f_path; - bpf_probe_read_kernel(&f_path, bpf_core_type_size(struct path), path); char slash = '/'; int zero = 0; - struct dentry *dentry = f_path.dentry; - struct vfsmount *vfsmnt = f_path.mnt; + struct dentry *dentry = BPF_CORE_READ(path, dentry); + struct vfsmount *vfsmnt = BPF_CORE_READ(path, mnt); struct mount *mnt_parent_p; struct mount *mnt_p = real_mount(vfsmnt); bpf_core_read(&mnt_parent_p, sizeof(struct mount *), &mnt_p->mnt_parent);