Skip to content

bpf_override_return error #664

Description

@panzhenyu12
SEC("kprobe/vfs_mkdir")
int kprobe_mkdir(struct pt_regs *ctx) {
    u32 key = 0;
    u64 initval = 1, *valp;
    
    // struct inode *dir = (struct inode *)PT_REGS_PARM1(ctx);
    // struct dentry *dentry = (struct dentry *)PT_REGS_PARM2(ctx);

    valp = bpf_map_lookup_elem(&kprobe_map, &key);
    if (!valp) {
        bpf_map_update_elem(&kprobe_map, &key, &initval, BPF_ANY);
        return 0;
    }
    
    bpf_override_return(ctx,1);
    __sync_fetch_and_add(valp, 1);
    return 0;
}

I add bpf_override_return code this,and doesn't work with error 2022/05/09 16:37:47 opening kprobe: setting perf event bpf program: invalid argument.

What I want todo ? I want use eBFP to inject hook to terminating some operation, May I use bpf_override_return to do this ?
Is there any other way to achieve it ?

Can u help me ?

Looking forward to your reply

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions