diff --git a/bpf/lib/bpf_task.h b/bpf/lib/bpf_task.h index 0fbe017763c..43a60778f4e 100644 --- a/bpf/lib/bpf_task.h +++ b/bpf/lib/bpf_task.h @@ -115,7 +115,7 @@ __event_find_parent(struct task_struct *task) int i; #pragma unroll - for (i = 0; i < 4; i++) { + for (i = 0; i < 6; i++) { probe_read_kernel(&task, sizeof(task), _(&task->real_parent)); if (!task) break; @@ -157,7 +157,7 @@ FUNC_INLINE struct execve_map_value *event_find_curr(__u32 *ppid, bool *walked) __u32 pid; #pragma unroll - for (i = 0; i < 4; i++) { + for (i = 0; i < 6; i++) { probe_read_kernel(&pid, sizeof(pid), _(&task->tgid)); value = execve_map_get_noinit(pid); if (value && value->key.ktime != 0)