@@ -937,11 +937,10 @@ statfunc int find_modules_from_module_kset_list(program_data_t *p)
937
937
938
938
#pragma unroll
939
939
for (int i = 0 ; i < MAX_NUM_MODULES ; i ++ ) {
940
- if ( BPF_CORE_READ ( n , name ) ==
941
- NULL ) { // Without this the list seems infinite. Also, using pos
942
- // here seems incorrect as it starts from a weird member
940
+ // Without this the list seems infinite.
941
+ // Also, using pos here seems incorrect as it starts from a weird member.
942
+ if ( BPF_CORE_READ ( n , name ) == NULL )
943
943
return 0 ;
944
- }
945
944
946
945
struct module_kobject * mod_kobj =
947
946
(struct module_kobject * ) container_of (n , struct module_kobject , kobj );
@@ -1033,8 +1032,8 @@ int lkm_seeker_modtree_loop(struct pt_regs *ctx)
1033
1032
break ;
1034
1033
}
1035
1034
1036
- /* We have visited the node and its left subtree.
1037
- Now, it's right subtree's turn */
1035
+ // We have visited the node and its left subtree.
1036
+ // Now, it's right subtree's turn.
1038
1037
curr = BPF_CORE_READ (curr , rb_right );
1039
1038
}
1040
1039
}
@@ -1220,9 +1219,9 @@ int uprobe_lkm_seeker_submitter(struct pt_regs *ctx)
1220
1219
if (p .config -> tracee_pid != trigger_pid )
1221
1220
return 0 ;
1222
1221
1223
- u32 flags =
1224
- (( u32 ) received_flags ) | HIDDEN_MODULE ; // Convert to 32bit and turn on the bit that will
1225
- // cause it to be sent as an event to the user
1222
+ // Convert to 32bit and turn on the bit that will cause it to be sent as an
1223
+ // event to the user.
1224
+ u32 flags = (( u32 ) received_flags ) | HIDDEN_MODULE ;
1226
1225
lkm_seeker_send_to_userspace ((struct module * ) mod_address , & flags , & p );
1227
1226
1228
1227
return 0 ;
@@ -1287,8 +1286,9 @@ int lkm_seeker_kset_tail(struct pt_regs *ctx)
1287
1286
if (ret < 0 ) {
1288
1287
tracee_log (ctx , BPF_LOG_LVL_WARN , BPF_LOG_ID_HID_KER_MOD , ret );
1289
1288
u32 flags = HISTORY_SCAN_FINISHED ;
1290
- lkm_seeker_send_to_userspace (
1291
- (struct module * ) HISTORY_SCAN_FAILURE , & flags , & p ); // Report failure of history scan
1289
+
1290
+ // Report failure of history scan
1291
+ lkm_seeker_send_to_userspace ((struct module * ) HISTORY_SCAN_FAILURE , & flags , & p );
1292
1292
return -1 ;
1293
1293
}
1294
1294
@@ -1362,8 +1362,8 @@ int lkm_seeker_new_mod_only_tail(struct pt_regs *ctx)
1362
1362
return -1 ;
1363
1363
}
1364
1364
1365
- struct module * mod =
1366
- (struct module * ) start_scan_time ; // Use the module address field as the start_scan_time
1365
+ // Use the module address field as the start_scan_time
1366
+ struct module * mod = (struct module * ) start_scan_time ;
1367
1367
u32 flags = NEW_MOD ;
1368
1368
lkm_seeker_send_to_userspace (mod , & flags , & p );
1369
1369
@@ -2737,8 +2737,8 @@ int BPF_KPROBE(trace_security_socket_connect)
2737
2737
break ;
2738
2738
case SYSCALL_SOCKETCALL :
2739
2739
arr_addr = (void * ) get_syscall_arg2 (p .event -> task , task_regs , false);
2740
- bpf_probe_read_user (
2741
- & sockfd , sizeof (int ), arr_addr ); // fd is the first entry in the array
2740
+ // fd is the first entry in the array
2741
+ bpf_probe_read_user ( & sockfd , sizeof (int ), arr_addr );
2742
2742
stsb (args_buf , & sockfd , sizeof (int ), 0 );
2743
2743
break ;
2744
2744
}
@@ -3195,12 +3195,8 @@ statfunc bool
3195
3195
filter_file_write_capture (program_data_t * p , struct file * file , io_data_t io_data , off_t start_pos )
3196
3196
{
3197
3197
return filter_file_path (p -> ctx , & file_write_path_filter , file ) ||
3198
- filter_file_type (p -> ctx ,
3199
- & file_type_filter ,
3200
- CAPTURE_WRITE_TYPE_FILTER_IDX ,
3201
- file ,
3202
- io_data ,
3203
- start_pos ) ||
3198
+ filter_file_type (
3199
+ p -> ctx , & file_type_filter , CAPTURE_WRITE_TYPE_FILTER_IDX , file , io_data , start_pos ) ||
3204
3200
filter_file_fd (p -> ctx , & file_type_filter , CAPTURE_WRITE_TYPE_FILTER_IDX , file );
3205
3201
}
3206
3202
0 commit comments