@@ -72,41 +72,43 @@ static __always_inline void *get_thread_state(void *tls_base, PidData *pidData)
7272	void *  thread_state ;
7373	int  key ;
7474
75- 	bpf_probe_read (& key , sizeof (key ), (void * )(long )pidData -> tls_key_addr );
76- 	bpf_probe_read (& thread_state , sizeof (thread_state ),
77- 		        tls_base  +  0x310  +  key  *  0x10  +  0x08 );
75+ 	bpf_probe_read_user (& key , sizeof (key ), (void * )(long )pidData -> tls_key_addr );
76+ 	bpf_probe_read_user (& thread_state , sizeof (thread_state ),
77+ 			     tls_base  +  0x310  +  key  *  0x10  +  0x08 );
7878	return  thread_state ;
7979}
8080
8181static  __always_inline  bool  get_frame_data (void  * frame_ptr , PidData  * pidData ,
8282					   FrameData  * frame , Symbol  * symbol )
8383{
8484	// read data from PyFrameObject 
85- 	bpf_probe_read (& frame -> f_back ,
86- 		        sizeof (frame -> f_back ),
87- 		        frame_ptr  +  pidData -> offsets .PyFrameObject_back );
88- 	bpf_probe_read (& frame -> f_code ,
89- 		        sizeof (frame -> f_code ),
90- 		        frame_ptr  +  pidData -> offsets .PyFrameObject_code );
85+ 	bpf_probe_read_user (& frame -> f_back ,
86+ 			     sizeof (frame -> f_back ),
87+ 			     frame_ptr  +  pidData -> offsets .PyFrameObject_back );
88+ 	bpf_probe_read_user (& frame -> f_code ,
89+ 			     sizeof (frame -> f_code ),
90+ 			     frame_ptr  +  pidData -> offsets .PyFrameObject_code );
9191
9292	// read data from PyCodeObject 
9393	if  (!frame -> f_code )
9494		return  false;
95- 	bpf_probe_read (& frame -> co_filename ,
96- 		        sizeof (frame -> co_filename ),
97- 		        frame -> f_code  +  pidData -> offsets .PyCodeObject_filename );
98- 	bpf_probe_read (& frame -> co_name ,
99- 		        sizeof (frame -> co_name ),
100- 		        frame -> f_code  +  pidData -> offsets .PyCodeObject_name );
95+ 	bpf_probe_read_user (& frame -> co_filename ,
96+ 			     sizeof (frame -> co_filename ),
97+ 			     frame -> f_code  +  pidData -> offsets .PyCodeObject_filename );
98+ 	bpf_probe_read_user (& frame -> co_name ,
99+ 			     sizeof (frame -> co_name ),
100+ 			     frame -> f_code  +  pidData -> offsets .PyCodeObject_name );
101101	// read actual names into symbol 
102102	if  (frame -> co_filename )
103- 		bpf_probe_read_str (& symbol -> file ,
104- 				   sizeof (symbol -> file ),
105- 				   frame -> co_filename  +  pidData -> offsets .String_data );
103+ 		bpf_probe_read_user_str (& symbol -> file ,
104+ 					sizeof (symbol -> file ),
105+ 					frame -> co_filename  + 
106+ 					pidData -> offsets .String_data );
106107	if  (frame -> co_name )
107- 		bpf_probe_read_str (& symbol -> name ,
108- 				   sizeof (symbol -> name ),
109- 				   frame -> co_name  +  pidData -> offsets .String_data );
108+ 		bpf_probe_read_user_str (& symbol -> name ,
109+ 					sizeof (symbol -> name ),
110+ 					frame -> co_name  + 
111+ 					pidData -> offsets .String_data );
110112	return  true;
111113}
112114
@@ -174,9 +176,9 @@ static __always_inline int __on_event(struct pt_regs *ctx)
174176	event -> kernel_stack_id  =  bpf_get_stackid (ctx , & stackmap , 0 );
175177
176178	void *  thread_state_current  =  (void * )0 ;
177- 	bpf_probe_read (& thread_state_current ,
178- 		        sizeof (thread_state_current ),
179- 		        (void * )(long )pidData -> current_state_addr );
179+ 	bpf_probe_read_user (& thread_state_current ,
180+ 			     sizeof (thread_state_current ),
181+ 			     (void * )(long )pidData -> current_state_addr );
180182
181183	struct  task_struct *  task  =  (struct  task_struct * )bpf_get_current_task ();
182184	void *  tls_base  =  (void * )task ;
@@ -188,11 +190,13 @@ static __always_inline int __on_event(struct pt_regs *ctx)
188190	if  (pidData -> use_tls ) {
189191		uint64_t  pthread_created ;
190192		uint64_t  pthread_self ;
191- 		bpf_probe_read (& pthread_self , sizeof (pthread_self ), tls_base  +  0x10 );
193+ 		bpf_probe_read_user (& pthread_self , sizeof (pthread_self ),
194+ 				    tls_base  +  0x10 );
192195
193- 		bpf_probe_read (& pthread_created ,
194- 			       sizeof (pthread_created ),
195- 			       thread_state  +  pidData -> offsets .PyThreadState_thread );
196+ 		bpf_probe_read_user (& pthread_created ,
197+ 				    sizeof (pthread_created ),
198+ 				    thread_state  + 
199+ 				    pidData -> offsets .PyThreadState_thread );
196200		event -> pthread_match  =  pthread_created  ==  pthread_self ;
197201	} else  {
198202		event -> pthread_match  =  1 ;
@@ -204,9 +208,10 @@ static __always_inline int __on_event(struct pt_regs *ctx)
204208		Symbol  sym  =  {};
205209		int  cur_cpu  =  bpf_get_smp_processor_id ();
206210
207- 		bpf_probe_read (& frame_ptr ,
208- 			       sizeof (frame_ptr ),
209- 			       thread_state  +  pidData -> offsets .PyThreadState_frame );
211+ 		bpf_probe_read_user (& frame_ptr ,
212+ 				    sizeof (frame_ptr ),
213+ 				    thread_state  + 
214+ 				    pidData -> offsets .PyThreadState_frame );
210215
211216		int32_t *  symbol_counter  =  bpf_map_lookup_elem (& symbolmap , & sym );
212217		if  (symbol_counter  ==  NULL )
0 commit comments