diff --git a/driver/modern_bpf/definitions/struct_flavors.h b/driver/modern_bpf/definitions/struct_flavors.h index 1b39552e8f3..341a2b05973 100644 --- a/driver/modern_bpf/definitions/struct_flavors.h +++ b/driver/modern_bpf/definitions/struct_flavors.h @@ -72,12 +72,6 @@ struct modern_bpf__kernel_timespec long int tv_nsec; }; -struct modern_bpf__kernel_timespec_ia32 -{ - int tv_sec; - int tv_nsec; -}; - /* We use this as a fallback for kernels where `struct __kernel_timex_timeval` is not defined. */ struct modern_bpf__kernel_timex_timeval { diff --git a/driver/modern_bpf/helpers/store/auxmap_store_params.h b/driver/modern_bpf/helpers/store/auxmap_store_params.h index 59a843fb820..424e952c5f3 100644 --- a/driver/modern_bpf/helpers/store/auxmap_store_params.h +++ b/driver/modern_bpf/helpers/store/auxmap_store_params.h @@ -620,24 +620,18 @@ static __always_inline void auxmap__store_sockaddr_param(struct auxiliary_map *a { /* This is an abstract socket address, we need to skip the initial `\0`. */ start_reading_point = (unsigned long)sockaddr_un->sun_path + 1; - addrlen -= 1; } else { start_reading_point = (unsigned long)sockaddr_un->sun_path; } - // The addrlen is used has hard limit. So we should use add 1 for the `\0` - addrlen -= (FAMILY_SIZE + 1); - if(sockaddr_un->sun_path[addrlen-1] != '\0') - addrlen += 1; - /* Pack the sockaddr info: * - socket family. * - socket_unix_path (sun_path). */ push__u8(auxmap->data, &auxmap->payload_pos, socket_family_to_scap(socket_family)); - uint16_t written_bytes = push__charbuf(auxmap->data, &auxmap->payload_pos, start_reading_point, addrlen, KERNEL); + uint16_t written_bytes = push__charbuf(auxmap->data, &auxmap->payload_pos, start_reading_point, MAX_UNIX_SOCKET_PATH, KERNEL); final_param_len = FAMILY_SIZE + written_bytes; break; } @@ -811,7 +805,8 @@ static __always_inline void auxmap__store_socktuple_param(struct auxiliary_map * } unsigned long start_reading_point; - if(path[0] == '\0' && path[1] != '\0') + char first_path_byte = *(char *)path; + if(first_path_byte == '\0') { /* Please note exceptions in the `sun_path`: * Taken from: https://man7.org/linux/man-pages/man7/unix.7.html @@ -824,13 +819,6 @@ static __always_inline void auxmap__store_socktuple_param(struct auxiliary_map * */ start_reading_point = (unsigned long)path + 1; } - else if(path[0] == '\0' && path[1] == '\0') - { - // If no path is retrived from kernel, try to read from userspace. - bpf_probe_read_user_str(path, UNIX_PATH_MAX, - ((struct sockaddr_un *)usrsockaddr)->sun_path); - start_reading_point = (unsigned long)path; - } else { start_reading_point = (unsigned long)path; diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ppoll.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ppoll.bpf.c index 12359d568bb..17d24b4689a 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ppoll.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ppoll.bpf.c @@ -55,7 +55,7 @@ int BPF_PROG(ppoll_e, } else { - struct modern_bpf__kernel_timespec_ia32 ts = {0}; + struct old_timespec32 ts = {0}; bpf_probe_read_user(&ts, sizeof(ts), (void *)ts_pointer); nanosec = ((uint32_t)ts.tv_sec) * SECOND_TO_NS + ts.tv_nsec; }