SEC("kprobe/vfs_mkdir")
int kprobe_mkdir(struct pt_regs *ctx) {
u32 key = 0;
u64 initval = 1, *valp;
// struct inode *dir = (struct inode *)PT_REGS_PARM1(ctx);
// struct dentry *dentry = (struct dentry *)PT_REGS_PARM2(ctx);
valp = bpf_map_lookup_elem(&kprobe_map, &key);
if (!valp) {
bpf_map_update_elem(&kprobe_map, &key, &initval, BPF_ANY);
return 0;
}
bpf_override_return(ctx,1);
__sync_fetch_and_add(valp, 1);
return 0;
}
I add bpf_override_return code this,and doesn't work with error 2022/05/09 16:37:47 opening kprobe: setting perf event bpf program: invalid argument.
What I want todo ? I want use eBFP to inject hook to terminating some operation, May I use bpf_override_return to do this ?
Is there any other way to achieve it ?
Can u help me ?
Looking forward to your reply
I add bpf_override_return code this,and doesn't work with error 2022/05/09 16:37:47 opening kprobe: setting perf event bpf program: invalid argument.
What I want todo ? I want use eBFP to inject hook to terminating some operation, May I use bpf_override_return to do this ?
Is there any other way to achieve it ?
Can u help me ?
Looking forward to your reply