kernel/bpf-developer-tutorial
1
0
Fork 0
mirror of https://github.com/eunomia-bpf/bpf-developer-tutorial.git synced 2026-05-08 14:52:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(tp/syscalls): detach handle_getdents_patch on sys_exit_getdents64 (#176)

Browse Source 
确保 handle_getdents_patch 仅通过尾调用执行。
移除在 sys_exit_getdents64 上的 attach，避免非尾调用路径被意外触发。

Signed-off-by: zyj <zhongyinjiebit@sina.com>
Co-authored-by: zyj <zhongyinjiebit@sina.com>
This commit is contained in:
Zhong Yinjie
2025-07-23 12:15:29 +08:00
committed by GitHub
parent 1a2744ff49
commit 6973941721
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/24-hide/pidhide.bpf.c
View File

@@ -174,7 +174,7 @@ int handle_getdents_exit(struct trace_event_raw_sys_exit *ctx)
return 0; return 0;
} }
SEC("tp/syscalls/sys_exit_getdents64") SEC("tp/unused")
int handle_getdents_patch(struct trace_event_raw_sys_exit *ctx) int handle_getdents_patch(struct trace_event_raw_sys_exit *ctx)
{ {
// Only patch if we've already checked and found our pid's folder to hide // Only patch if we've already checked and found our pid's folder to hide

3
src/24-hide/pidhide.c
View File

@@ -180,6 +180,9 @@ int main(int argc, char **argv)
goto cleanup; goto cleanup;
} }
// 禁用 patch 程序的自动 attach，因为它只能通过尾调用执行
bpf_program__set_autoattach(skel->progs.handle_getdents_patch, false);
// Setup Maps for tail calls // Setup Maps for tail calls
int index = PROG_01; int index = PROG_01;
int prog_fd = bpf_program__fd(skel->progs.handle_getdents_exit); int prog_fd = bpf_program__fd(skel->progs.handle_getdents_exit);