get the right iov field

elastic · Sep 29, 2023 · 7bddbfc · 7bddbfc
1 parent fe80cd3
commit 7bddbfc
Showing 1 changed file with 40 additions and 3 deletions.
diff --git a/GPL/Events/Process/Probe.bpf.c b/GPL/Events/Process/Probe.bpf.c
@@ -369,9 +369,46 @@ static int tty_write__enter(struct kiocb *iocb, struct iov_iter *from)
         goto out;
     }
 
-    u64 nr_segs             = BPF_CORE_READ(from, nr_segs);
-    nr_segs                 = nr_segs > MAX_NR_SEGS ? MAX_NR_SEGS : nr_segs;
-    const struct iovec *iov = BPF_CORE_READ(from, iov);
+    u64 nr_segs = BPF_CORE_READ(from, nr_segs);
+    nr_segs     = nr_segs > MAX_NR_SEGS ? MAX_NR_SEGS : nr_segs;
+    const struct iovec *iov;
+
+    if (bpf_core_field_exists(from->iov)) {
+        iov = BPF_CORE_READ(from, iov);
+    } else {
+        struct new_iov_iter {
+            u8 iter_type;
+            bool copy_mc;
+            bool nofault;
+            bool data_source;
+            bool user_backed;
+            union {
+                size_t iov_offset;
+                int last_offset;
+            };
+            union {
+                struct iovec __ubuf_iovec;
+                struct {
+                    union {
+                        const struct iovec *__iov;
+                        const struct kvec *kvec;
+                        const struct bio_vec *bvec;
+                        struct xarray *xarray;
+                        void *ubuf;
+                    };
+                    size_t count;
+                };
+            };
+            union {
+                unsigned long nr_segs;
+                loff_t xarray_start;
+            };
+        };
+
+        struct new_iov_iter new;
+        bpf_probe_read_kernel(&new, bpf_core_type_size(struct iov_iter), (void *)from);
+        iov = new.__iov;
+    }
 
     if (nr_segs == 0) {
         u64 count = BPF_CORE_READ(from, count);