microsoft / microsoft/ebpf-for-windows

Change `EBPF_OPERATION_GET_OBJECT_INFO` implementation to use serialization for getting program info

Open
#3,634 0 comments 0 reactions 0 assignees View on GitHub
P3 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

Currently `EBPF_OPERATION_GET_OBJECT_INFO` passed embedded pointer to a user mode buffer to kernel to get map IDs when getting program info. Since we use `METHOD_BUFFERED`, ideally we should not pass embedded pointers from user mode to kernel. Instead we can serialize the program info (including map IDs) and return to user mode.

Contributor guide

Open the contributing guide

Research direction

Start by locating the implementation of EBPF_OPERATION_GET_OBJECT_INFO and its METHOD_BUFFERED request path. Trace how program info and map IDs currently cross the user/kernel boundary, then verify that the serialized response contains the program information and map IDs without an embedded user-mode pointer.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.