update(bpf): read upper_layer from kernel space

Signed-off-by: Hendrik Brueckner <brueckner@de.ibm.com>
falcosecurity · Dec 21, 2022 · adcdd65 · adcdd65
1 parent b470f9b
commit adcdd65
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -2256,7 +2256,7 @@ static __always_inline bool get_exe_upper_layer(struct inode *inode)
 
 		// Pointer arithmetics due to unexported ovl_inode struct
 		// warning: this works if and only if the dentry pointer is placed right after the inode struct
-		bpf_probe_read(&upper_dentry, sizeof(upper_dentry), vfs_inode + sizeof(struct inode));
+		bpf_probe_read_kernel(&upper_dentry, sizeof(upper_dentry), vfs_inode + sizeof(struct inode));
 
 		if(upper_dentry)
 		{