@@ -72,41 +72,43 @@ static __always_inline void *get_thread_state(void *tls_base, PidData *pidData)
7272 void * thread_state ;
7373 int key ;
7474
75- bpf_probe_read (& key , sizeof (key ), (void * )(long )pidData -> tls_key_addr );
76- bpf_probe_read (& thread_state , sizeof (thread_state ),
77- tls_base + 0x310 + key * 0x10 + 0x08 );
75+ bpf_probe_read_user (& key , sizeof (key ), (void * )(long )pidData -> tls_key_addr );
76+ bpf_probe_read_user (& thread_state , sizeof (thread_state ),
77+ tls_base + 0x310 + key * 0x10 + 0x08 );
7878 return thread_state ;
7979}
8080
8181static __always_inline bool get_frame_data (void * frame_ptr , PidData * pidData ,
8282 FrameData * frame , Symbol * symbol )
8383{
8484 // read data from PyFrameObject
85- bpf_probe_read (& frame -> f_back ,
86- sizeof (frame -> f_back ),
87- frame_ptr + pidData -> offsets .PyFrameObject_back );
88- bpf_probe_read (& frame -> f_code ,
89- sizeof (frame -> f_code ),
90- frame_ptr + pidData -> offsets .PyFrameObject_code );
85+ bpf_probe_read_user (& frame -> f_back ,
86+ sizeof (frame -> f_back ),
87+ frame_ptr + pidData -> offsets .PyFrameObject_back );
88+ bpf_probe_read_user (& frame -> f_code ,
89+ sizeof (frame -> f_code ),
90+ frame_ptr + pidData -> offsets .PyFrameObject_code );
9191
9292 // read data from PyCodeObject
9393 if (!frame -> f_code )
9494 return false;
95- bpf_probe_read (& frame -> co_filename ,
96- sizeof (frame -> co_filename ),
97- frame -> f_code + pidData -> offsets .PyCodeObject_filename );
98- bpf_probe_read (& frame -> co_name ,
99- sizeof (frame -> co_name ),
100- frame -> f_code + pidData -> offsets .PyCodeObject_name );
95+ bpf_probe_read_user (& frame -> co_filename ,
96+ sizeof (frame -> co_filename ),
97+ frame -> f_code + pidData -> offsets .PyCodeObject_filename );
98+ bpf_probe_read_user (& frame -> co_name ,
99+ sizeof (frame -> co_name ),
100+ frame -> f_code + pidData -> offsets .PyCodeObject_name );
101101 // read actual names into symbol
102102 if (frame -> co_filename )
103- bpf_probe_read_str (& symbol -> file ,
104- sizeof (symbol -> file ),
105- frame -> co_filename + pidData -> offsets .String_data );
103+ bpf_probe_read_user_str (& symbol -> file ,
104+ sizeof (symbol -> file ),
105+ frame -> co_filename +
106+ pidData -> offsets .String_data );
106107 if (frame -> co_name )
107- bpf_probe_read_str (& symbol -> name ,
108- sizeof (symbol -> name ),
109- frame -> co_name + pidData -> offsets .String_data );
108+ bpf_probe_read_user_str (& symbol -> name ,
109+ sizeof (symbol -> name ),
110+ frame -> co_name +
111+ pidData -> offsets .String_data );
110112 return true;
111113}
112114
@@ -174,9 +176,9 @@ static __always_inline int __on_event(struct pt_regs *ctx)
174176 event -> kernel_stack_id = bpf_get_stackid (ctx , & stackmap , 0 );
175177
176178 void * thread_state_current = (void * )0 ;
177- bpf_probe_read (& thread_state_current ,
178- sizeof (thread_state_current ),
179- (void * )(long )pidData -> current_state_addr );
179+ bpf_probe_read_user (& thread_state_current ,
180+ sizeof (thread_state_current ),
181+ (void * )(long )pidData -> current_state_addr );
180182
181183 struct task_struct * task = (struct task_struct * )bpf_get_current_task ();
182184 void * tls_base = (void * )task ;
@@ -188,11 +190,13 @@ static __always_inline int __on_event(struct pt_regs *ctx)
188190 if (pidData -> use_tls ) {
189191 uint64_t pthread_created ;
190192 uint64_t pthread_self ;
191- bpf_probe_read (& pthread_self , sizeof (pthread_self ), tls_base + 0x10 );
193+ bpf_probe_read_user (& pthread_self , sizeof (pthread_self ),
194+ tls_base + 0x10 );
192195
193- bpf_probe_read (& pthread_created ,
194- sizeof (pthread_created ),
195- thread_state + pidData -> offsets .PyThreadState_thread );
196+ bpf_probe_read_user (& pthread_created ,
197+ sizeof (pthread_created ),
198+ thread_state +
199+ pidData -> offsets .PyThreadState_thread );
196200 event -> pthread_match = pthread_created == pthread_self ;
197201 } else {
198202 event -> pthread_match = 1 ;
@@ -204,9 +208,10 @@ static __always_inline int __on_event(struct pt_regs *ctx)
204208 Symbol sym = {};
205209 int cur_cpu = bpf_get_smp_processor_id ();
206210
207- bpf_probe_read (& frame_ptr ,
208- sizeof (frame_ptr ),
209- thread_state + pidData -> offsets .PyThreadState_frame );
211+ bpf_probe_read_user (& frame_ptr ,
212+ sizeof (frame_ptr ),
213+ thread_state +
214+ pidData -> offsets .PyThreadState_frame );
210215
211216 int32_t * symbol_counter = bpf_map_lookup_elem (& symbolmap , & sym );
212217 if (symbol_counter == NULL )
0 commit comments