int bytes;
};
-BPF_HASH(g_message, struct data_t, unsigned long *)
-BPF_HASH(msg_size, struct data_t, struct bytes_t)
-BPF_HISTOGRAM(msg_size_hist)
+BPF_HASH(g_message, struct data_t, unsigned long *);
+BPF_HASH(msg_size, struct data_t, struct bytes_t);
+BPF_HISTOGRAM(msg_size_hist);
static int get_process_data(struct data_t *data) {
data->pid = bpf_get_current_pid_tgid();
if (ptr_gsize == 0) {
return 0;
}
- unsigned long *gsize = *ptr_gsize;
+ unsigned long *gsize = 0;
+ bpf_probe_read(&gsize, sizeof(gsize), ptr_gsize);
unsigned long size = 0;
bpf_probe_read(&size, sizeof(size), gsize);
if(size > 0 && size < 1000000) {
int dbus_message_size(struct pt_regs *ctx, void *conn, struct DBusMessage *message) {
unsigned long size = 0;
- if (message->header.data.len > 0) {
- size += message->header.data.len;
+ int header_len = 0;
+ int body_len = 0;
+
+ bpf_probe_read(&header_len, sizeof(header_len), (char*)message + offsetof(struct DBusMessage, header.data.len));
+ if (header_len > 0) {
+ size += header_len;
}
- if (message->body.len > 0) {
- size += message->body.len;
+ bpf_probe_read(&body_len, sizeof(body_len), (char*)message + offsetof(struct DBusMessage, body.len));
+ if (body_len > 0) {
+ size += body_len;
}
if (size != 0) {
message_size(size);