From adcdd658338fb296c74dce4a18cc2b396aaff19c Mon Sep 17 00:00:00 2001 From: Hendrik Brueckner Date: Wed, 21 Dec 2022 12:06:10 +0100 Subject: [PATCH] update(bpf): read upper_layer from kernel space Signed-off-by: Hendrik Brueckner --- driver/bpf/fillers.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index 6eab8c722a..50aac57a40 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -2256,7 +2256,7 @@ static __always_inline bool get_exe_upper_layer(struct inode *inode) // Pointer arithmetics due to unexported ovl_inode struct // warning: this works if and only if the dentry pointer is placed right after the inode struct - bpf_probe_read(&upper_dentry, sizeof(upper_dentry), vfs_inode + sizeof(struct inode)); + bpf_probe_read_kernel(&upper_dentry, sizeof(upper_dentry), vfs_inode + sizeof(struct inode)); if(upper_dentry) {