tetragon: Set flags early in processing

so filter tail call can change it Signed-off-by: Jiri Olsa <[email protected]>
cilium · Jan 21, 2025 · 3bd159e · 3bd159e
1 parent 2ef2da5
commit 3bd159e
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/bpf/process/bpf_generic_tracepoint.c b/bpf/process/bpf_generic_tracepoint.c
@@ -212,6 +212,7 @@ generic_tracepoint_event(struct generic_tracepoint_event_arg *ctx)
 #ifdef __CAP_CHANGES_FILTER
 	msg->sel.match_cap = 0;
 #endif
+	msg->common.flags = 0;
 	tail_call(ctx, &tp_calls, TAIL_CALL_FILTER);
 	return 0;
 }

diff --git a/bpf/process/generic_calls.h b/bpf/process/generic_calls.h
@@ -56,6 +56,7 @@ generic_start_process_filter(void *ctx, struct bpf_map_def *calls)
 #endif
 
 	msg->lsm.post = false;
+	msg->common.flags = 0;
 
 	/* Tail call into filters. */
 	tail_call(ctx, calls, TAIL_CALL_FILTER);
@@ -126,7 +127,6 @@ generic_process_init(struct msg_generic_kprobe *e, u8 op, struct event_config *c
 {
 	e->common.op = op;
 
-	e->common.flags = 0;
 	e->common.pad[0] = 0;
 	e->common.pad[1] = 0;
 	e->common.size = 0;
@@ -525,7 +525,7 @@ FUNC_INLINE int generic_retkprobe(void *ctx, struct bpf_map_def *calls, unsigned
 	enter = event_find_curr(&ppid, &walker);
 
 	e->common.op = MSG_OP_GENERIC_KPROBE;
-	e->common.flags |= MSG_COMMON_FLAG_RETURN;
+	e->common.flags = MSG_COMMON_FLAG_RETURN;
 	e->common.pad[0] = 0;
 	e->common.pad[1] = 0;
 	e->common.size = size;