|
@@ -24,7 +24,7 @@ int bpf_prog1(struct pt_regs *ctx)
|
|
|
{
|
|
|
struct seccomp_data sd = {};
|
|
|
|
|
|
- bpf_probe_read(&sd, sizeof(sd), (void *)ctx->di);
|
|
|
+ bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM1(ctx));
|
|
|
|
|
|
/* dispatch into next BPF program depending on syscall number */
|
|
|
bpf_tail_call(ctx, &progs, sd.nr);
|
|
@@ -42,7 +42,7 @@ PROG(__NR_write)(struct pt_regs *ctx)
|
|
|
{
|
|
|
struct seccomp_data sd = {};
|
|
|
|
|
|
- bpf_probe_read(&sd, sizeof(sd), (void *)ctx->di);
|
|
|
+ bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM1(ctx));
|
|
|
if (sd.args[2] == 512) {
|
|
|
char fmt[] = "write(fd=%d, buf=%p, size=%d)\n";
|
|
|
bpf_trace_printk(fmt, sizeof(fmt),
|
|
@@ -55,7 +55,7 @@ PROG(__NR_read)(struct pt_regs *ctx)
|
|
|
{
|
|
|
struct seccomp_data sd = {};
|
|
|
|
|
|
- bpf_probe_read(&sd, sizeof(sd), (void *)ctx->di);
|
|
|
+ bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM1(ctx));
|
|
|
if (sd.args[2] > 128 && sd.args[2] <= 1024) {
|
|
|
char fmt[] = "read(fd=%d, buf=%p, size=%d)\n";
|
|
|
bpf_trace_printk(fmt, sizeof(fmt),
|