From cd3e29248979fb41b6edc34395033726716c5cf5 Mon Sep 17 00:00:00 2001 From: weishu Date: Tue, 20 Jun 2023 18:42:22 +0800 Subject: [PATCH] kernel: use vfs_fstatat on kernel 5.10+, vfs_statx may have cfi. --- kernel/sucompat.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/kernel/sucompat.c b/kernel/sucompat.c index 09e5f501..59209aa9 100644 --- a/kernel/sucompat.c +++ b/kernel/sucompat.c @@ -172,7 +172,14 @@ static struct kprobe faccessat_kp = { }; static struct kprobe newfstatat_kp = { -#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0) + // 5.10: https://elixir.bootlin.com/linux/v5.10/source/include/linux/fs.h#L3115 + // 5.9: https://elixir.bootlin.com/linux/v5.9.16/source/include/linux/fs.h#L3179 + // 4.11: https://elixir.bootlin.com/linux/v4.11/source/include/linux/fs.h#L2931 + // 4.10: https://elixir.bootlin.com/linux/v4.10.17/source/include/linux/fs.h#L2889 + // so, 4.11.0 <= version < 5.10 is vfs_statx, and others are vfs_fstatat +#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0) + .symbol_name = "vfs_fstatat", +#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0) .symbol_name = "vfs_statx", #else .symbol_name = "vfs_fstatat",