1 // SPDX-License-Identifier: GPL-2.0 2 3 #include "vmlinux.h" 4 #include <bpf/bpf_helpers.h> 5 #include <bpf/bpf_tracing.h> 6 7 extern const int bpf_prog_active __ksym; 8 9 struct { 10 __uint(type, BPF_MAP_TYPE_RINGBUF); 11 __uint(max_entries, 1 << 12); 12 } ringbuf SEC(".maps"); 13 14 SEC("fentry/security_inode_getattr") 15 int BPF_PROG(d_path_check_rdonly_mem, struct path *path, struct kstat *stat, 16 __u32 request_mask, unsigned int query_flags) 17 { 18 void *active; 19 u32 cpu; 20 21 cpu = bpf_get_smp_processor_id(); 22 active = (void *)bpf_per_cpu_ptr(&bpf_prog_active, cpu); 23 if (active) { 24 /* FAIL here! 'active' points to 'regular' memory. It 25 * cannot be submitted to ring buffer. 26 */ 27 bpf_ringbuf_submit(active, 0); 28 } 29 return 0; 30 } 31 32 char _license[] SEC("license") = "GPL"; 33