@@ -384,7 +384,9 @@ int tracepoint__syscalls__sys_exit_bpf(struct trace_event_raw_sys_exit *ctx)
384
384
385
385
// uprobe path buffer for bpf_probe_read_user_str
386
386
char old_uprobe_path [PATH_LENTH ] = "\0" ;
387
- struct perf_event_attr new_attr = {};
387
+ // avoid type mismatch in userspace program
388
+ // struct perf_event_attr new_attr = {}; will result in compile error
389
+ char new_attr_buffer [sizeof (struct perf_event_attr )] = "\0" ;
388
390
389
391
static __always_inline int
390
392
process_perf_event_open_enter (struct trace_event_raw_sys_enter * ctx )
@@ -393,18 +395,18 @@ process_perf_event_open_enter(struct trace_event_raw_sys_enter *ctx)
393
395
if (!attr ) {
394
396
return 0 ;
395
397
}
396
- bpf_probe_read_user (& new_attr , sizeof (new_attr ), attr );
397
-
398
- if (new_attr . type == uprobe_perf_type ) {
398
+ bpf_probe_read_user (& new_attr_buffer , sizeof (new_attr_buffer ), attr );
399
+ struct perf_event_attr * new_attr_pointer = & new_attr_buffer ;
400
+ if (new_attr_pointer -> type == uprobe_perf_type ) {
399
401
// found uprobe
400
402
if (enable_replace_uprobe ) {
401
- if (can_hook_uprobe_at (new_attr . probe_offset )) {
402
- u64 old_offset = new_attr . probe_offset ;
403
- new_attr . probe_offset = 0 ;
403
+ if (can_hook_uprobe_at (new_attr_pointer -> probe_offset )) {
404
+ u64 old_offset = new_attr_pointer -> probe_offset ;
405
+ new_attr_pointer -> probe_offset = 0 ;
404
406
long size = bpf_probe_read_user_str (
405
407
old_uprobe_path ,
406
408
sizeof (old_uprobe_path ),
407
- (void * )new_attr . uprobe_path );
409
+ (void * )new_attr_pointer -> uprobe_path );
408
410
if (size <= 0 ) {
409
411
// no uprobe path
410
412
return 0 ;
@@ -413,10 +415,10 @@ process_perf_event_open_enter(struct trace_event_raw_sys_enter *ctx)
413
415
size = PATH_LENTH ;
414
416
}
415
417
bpf_probe_write_user (
416
- (void * )new_attr . uprobe_path ,
418
+ (void * )new_attr_pointer -> uprobe_path ,
417
419
& new_uprobe_path , (size_t )size );
418
- bpf_probe_write_user (attr , & new_attr ,
419
- sizeof (new_attr ));
420
+ bpf_probe_write_user (attr , new_attr_pointer ,
421
+ sizeof (* new_attr_pointer ));
420
422
// This probe creation request should be
421
423
// executed in userspace
422
424
bpf_printk (
0 commit comments