From 4fa55b9c73ffa0ca3b83100e49f91927bd85b11a Mon Sep 17 00:00:00 2001
From: Mattia Meleleo <mattia.meleleo@elastic.co>
Date: Fri, 29 Sep 2023 18:50:27 +0200
Subject: [PATCH] get the right iov field

---
 .gitignore                      |  1 +
 GPL/Events/Process/Probe.bpf.c  | 33 +++++++++++++++++++++++++++++----
 testing/kernel_builder/build.sh | 15 ++++++++++-----
 3 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/.gitignore b/.gitignore
index 32257dbe..b320c581 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,6 +22,7 @@ testing/testrunner/testrunner
 testing/test_bins/bin/*
 testing/init/bin/*
 testing/kernels
+testing/kernel_builder/kernels
 testing/virtme
 
 *.swp
diff --git a/GPL/Events/Process/Probe.bpf.c b/GPL/Events/Process/Probe.bpf.c
index bdc5364a..dd5e7861 100644
--- a/GPL/Events/Process/Probe.bpf.c
+++ b/GPL/Events/Process/Probe.bpf.c
@@ -332,9 +332,24 @@ static int output_tty_event(struct ebpf_tty_dev *slave, const void *base, size_t
     return ret;
 }
 
+struct iov_iter____new {
+    union {
+        struct iovec __ubuf_iovec;
+        struct {
+            union {
+                const struct iovec *__iov;
+                const struct kvec *kvec;
+                const struct bio_vec *bvec;
+                struct xarray *xarray;
+                void *ubuf;
+            };
+            size_t count;
+        };
+    };
+} __attribute__((preserve_access_index));
+
 static int tty_write__enter(struct kiocb *iocb, struct iov_iter *from)
 {
-
     if (is_consumer()) {
         goto out;
     }
@@ -369,9 +384,19 @@ static int tty_write__enter(struct kiocb *iocb, struct iov_iter *from)
         goto out;
     }
 
-    u64 nr_segs             = BPF_CORE_READ(from, nr_segs);
-    nr_segs                 = nr_segs > MAX_NR_SEGS ? MAX_NR_SEGS : nr_segs;
-    const struct iovec *iov = BPF_CORE_READ(from, iov);
+    u64 nr_segs = BPF_CORE_READ(from, nr_segs);
+    nr_segs     = nr_segs > MAX_NR_SEGS ? MAX_NR_SEGS : nr_segs;
+
+    const struct iovec *iov;
+    if (bpf_core_field_exists(struct iov_iter____new, __iov)) {
+        u64 iov_off = offsetof(struct iov_iter____new, __iov);
+        bpf_core_read(&iov, bpf_core_type_size(struct iov_iter), (void *)from + iov_off);
+    } else if (bpf_core_field_exists(from->iov)) {
+        iov = BPF_CORE_READ(from, iov);
+    } else {
+        bpf_printk("tty_write__enter: error reading iov\n");
+        goto out;
+    }
 
     if (nr_segs == 0) {
         u64 count = BPF_CORE_READ(from, count);
diff --git a/testing/kernel_builder/build.sh b/testing/kernel_builder/build.sh
index ca010903..62fc1289 100755
--- a/testing/kernel_builder/build.sh
+++ b/testing/kernel_builder/build.sh
@@ -21,21 +21,26 @@ readonly BUILD_ARCHES=(
 readonly BUILD_VERSIONS=(
     "5.10.16" # Oldest we support
     "5.10.50"
-    "5.10.100"
-    "5.10.120"
     "5.10.130"
     "5.11"
     "5.12"
     "5.13"
     "5.14"
     "5.15"
-    "5.15.10"
-    "5.15.40"
-    "5.15.60"
+    "5.15.50"
+    "5.15.133"
     "5.16"
     "5.17"
     "5.18"
     "5.19"
+    "6.0"
+    "6.1"
+    "6.1.55"
+    "6.2"
+    "6.3"
+    "6.4"
+    "6.4.16"
+    "6.5"
 )
 
 exit_error() {