Edit File: cve-2013-2094.stp
%{ #include <linux/perf_event.h> %} function sanitize_config:long (event:long) %{ struct perf_event *event; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) event = (struct perf_event *) (unsigned long) STAP_ARG_event; #else event = (struct perf_event *) (unsigned long) THIS->event; #endif event->attr.config &= INT_MAX; %} probe kernel.function("perf_swevent_init").call { sanitize_config($event); }