[CWS] fix few fentry bugs (#18674)

DataDog · Aug 8, 2023 · 59ff4f6 · 59ff4f6
1 parent 955ddcf
commit 59ff4f6
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/pkg/security/ebpf/c/include/hooks/dentry_resolver.h b/pkg/security/ebpf/c/include/hooks/dentry_resolver.h
@@ -377,6 +377,15 @@ int kprobe_dentry_resolver_segment_erpc_write_user(struct pt_regs *ctx) {
     return dentry_resolver_segment_erpc_write_user(ctx);
 }
 
+#ifdef USE_FENTRY
+
+TAIL_CALL_TARGET("dentry_resolver_segment_erpc_write_user")
+int fentry_dentry_resolver_segment_erpc_write_user(ctx_t *ctx) {
+    return dentry_resolver_segment_erpc_write_user(ctx);
+}
+
+#endif // USE_FENTRY
+
 int __attribute__((always_inline)) dentry_resolver_segment_erpc_mmap(void *ctx) {
     u32 key = 0;
     u32 resolution_err = 0;

diff --git a/pkg/security/ebpf/probes/all.go b/pkg/security/ebpf/probes/all.go
@@ -263,6 +263,9 @@ func AllBPFProbeWriteUserProgramFunctions() []string {
 		"kprobe_dentry_resolver_erpc_write_user",
 		"kprobe_dentry_resolver_parent_erpc_write_user",
 		"kprobe_dentry_resolver_segment_erpc_write_user",
+		"fentry_dentry_resolver_erpc_write_user",
+		"fentry_dentry_resolver_parent_erpc_write_user",
+		"fentry_dentry_resolver_segment_erpc_write_user",
 	}
 }