[SOLVED] why do I keep getting 0 from the pid field of the return value of bpf_get_current_task()

Issue

#!/usr/bin/python3

from bcc import BPF

program = '''
#include <linux/sched.h>
int hello_world(void* ctx){
    struct task_struct* task;
    task = (struct task_struct*)bpf_get_current_task();
    if (task){
        pid_t pid;
        pid = task->pid;
        bpf_trace_printk("pid is %d\\n", pid);
    }
    return 0;
}
'''

p = BPF(text=program)
syscall = p.get_syscall_fnname("execve")
p.attach_kprobe(event=syscall, fn_name="hello_world")
p.trace_print()

I am new to ebpf, this is my hello world program, I tried to get the pid of the process calling execvp syscall, but everytime I got 0, is there any mistake in my code?

Solution

I managed to solve the problem by changing pid = task->pid to ebpf_probe_read_kernel(&pid, sizeof(pid), (void*)&(task->pid))

Answered By - SolskGaer

Answer Checked By - Marie Seifert (WPSolving Admin)