tools/opensnoop: Use bpf_probe_read_user explicitly

drcwr · Dec 17, 2020 · 24f4759 · 24f4759
1 parent 3e00893
commit 24f4759
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/tools/opensnoop.py b/tools/opensnoop.py
@@ -215,8 +215,11 @@
 {
  int dfd = PT_REGS_PARM1(regs);
  const char __user *filename = (char *)PT_REGS_PARM2(regs);
- struct open_how __user *how = (struct open_how *)PT_REGS_PARM3(regs);
- int flags = how->flags;
+ struct open_how __user how;
+ int flags;
+
+ bpf_probe_read_user(&how, sizeof(struct open_how), (struct open_how*)PT_REGS_PARM3(regs));
+ flags = how.flags;
 #else
 KRETFUNC_PROBE(FNNAME, int dfd, const char __user *filename, struct open_how __user *how, int ret)
 {