Skip to content

Fix: task_struct backwards-compatibility with kernel versions < 5.14#53

Merged
tanelpoder merged 1 commit intotanelpoder:masterfrom
Christoph-Lutz:master
Dec 11, 2024
Merged

Fix: task_struct backwards-compatibility with kernel versions < 5.14#53
tanelpoder merged 1 commit intotanelpoder:masterfrom
Christoph-Lutz:master

Conversation

@Christoph-Lutz
Copy link

The state field in task_struct has been renamed to __state in kernel version 5.14.

Due to this change, xcapture-bpf.c fails with the following error on kernel versions < 5.14:
/virtual/main.c:178:29: error: no member named '__state' in 'struct task_struct'; did you mean 'state'?

This fix adds a bunch of macros to make xcapture-bpf.c backwards compatible with kernel versions < 5.14.

Example:

#if LINUX_VERSION_MAJOR >= 5 && LINUX_VERSION_PATCHLEVEL >= 14
t->state = curtask->__state;
#else
t->state = curtask->state;
#endif

The state field in task_struct has been renamed to __state in kernel version 5.14.

Due to this change, xcapture-bpf.c fails with the following error on kernel versions < 5.14:
/virtual/main.c:178:29: error: no member named '__state' in 'struct task_struct'; did you mean 'state'?

This fix adds a bunch of macros to make xcapture-bpf.c backwards compatible with kernel versions < 5.14.

Example:

#if LINUX_VERSION_MAJOR >= 5 && LINUX_VERSION_PATCHLEVEL >= 14
        t->state = curtask->__state;
#else
        t->state = curtask->state;
#endif
@tanelpoder tanelpoder merged commit 4927448 into tanelpoder:master Dec 11, 2024
@tanelpoder
Copy link
Owner

Thanks! Yep I had that check in my code in an earlier version, but for some reason lost/removed it when changing things.

@tanelpoder
Copy link
Owner

Hey @Christoph-Lutz, I now remember why I had removed the simple version check, RHEL backports the new __state field to RHEL8's 4.18 kernel (with some other BPF features from 5.x). So, checking for kernel version alone is not enough, got to check if it's RHEL or vanilla:

I just added some comments to this issue - if you have time and a RHEL8 clone around (with RHEL kernel not UEK), feel free to play with this (otherwise I should be able to look into this over the holidays):

#51

Christoph-Lutz added a commit to Christoph-Lutz/0xtools that referenced this pull request Dec 12, 2024
The state field in task_struct has been renamed to __state in kernel version 5.14.

Due to this change, xcapture-bpf.c fails with the following error on kernel versions < 5.14:
/virtual/main.c:178:29: error: no member named '__state' in 'struct task_struct'; did you mean 'state'?

The state field rename has been backported to the RHEL8 4.18 kernels as well, but the fix in
tanelpoder#53 / 55f1e30 did not consider this. Therefore, this fix now also includes a macro that checks
for RHEL8 like so:

#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 14, 0) || RHEL_MAJOR >= 8
#define STATE_FIELD __state
#else
#define STATE_FIELD state
#endif
...
t->state = curtask->STATE_FIELD;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants