From 6973941721b0cdec62a09e5f116602e8375d94d8 Mon Sep 17 00:00:00 2001 From: Zhong Yinjie <34571885+Tim-xiaofan@users.noreply.github.com> Date: Wed, 23 Jul 2025 12:15:29 +0800 Subject: [PATCH] fix(tp/syscalls): detach handle_getdents_patch on sys_exit_getdents64 (#176) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 确保 handle_getdents_patch 仅通过尾调用执行。 移除在 sys_exit_getdents64 上的 attach，避免非尾调用路径被意外触发。 Signed-off-by: zyj Co-authored-by: zyj --- src/24-hide/pidhide.bpf.c | 2 +- src/24-hide/pidhide.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/24-hide/pidhide.bpf.c b/src/24-hide/pidhide.bpf.c index 4e02290..e5246a1 100644 --- a/src/24-hide/pidhide.bpf.c +++ b/src/24-hide/pidhide.bpf.c @@ -174,7 +174,7 @@ int handle_getdents_exit(struct trace_event_raw_sys_exit *ctx) return 0; } -SEC("tp/syscalls/sys_exit_getdents64") +SEC("tp/unused") int handle_getdents_patch(struct trace_event_raw_sys_exit *ctx) { // Only patch if we've already checked and found our pid's folder to hide diff --git a/src/24-hide/pidhide.c b/src/24-hide/pidhide.c index 4da32ed..9cf1dc7 100644 --- a/src/24-hide/pidhide.c +++ b/src/24-hide/pidhide.c @@ -180,6 +180,9 @@ int main(int argc, char **argv) goto cleanup; } + // 禁用 patch 程序的自动 attach，因为它只能通过尾调用执行 + bpf_program__set_autoattach(skel->progs.handle_getdents_patch, false); + // Setup Maps for tail calls int index = PROG_01; int prog_fd = bpf_program__fd(skel->progs.handle_getdents_exit);