From 6bcaf04b3b5504af678b871592254f4334f352ea Mon Sep 17 00:00:00 2001
From: Christopher Paplham <36825497+cpaplham@users.noreply.github.com>
Date: Mon, 18 Sep 2023 13:09:44 -0700
Subject: [PATCH] Reconstruct BTF types more accurately in getKernelType

This fixes warnings for struct/pointer-based types (e.g. file) that the
spec type doesn't align with the BPF-identified type.

This issue was previously identified (with a fix written) in
https://github.com/cilium/tetragon/pull/850. However, that fix was never
merged, and changes validation logic instead of just type identification.

Signed-off-by: Christopher Paplham <36825497+cpaplham@users.noreply.github.com>
---
 pkg/btf/validation.go | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkg/btf/validation.go b/pkg/btf/validation.go
index 87c32da7d89..b574abc0eae 100644
--- a/pkg/btf/validation.go
+++ b/pkg/btf/validation.go
@@ -159,20 +159,22 @@ func ValidateKprobeSpec(bspec *btf.Spec, kspec *v1alpha1.KProbeSpec) error {
 }
 
 func getKernelType(arg btf.Type) string {
+	suffix := ""
 	ptr, ok := arg.(*btf.Pointer)
 	if ok {
 		arg = ptr.Target
+		suffix = suffix + " *"
 	}
 	num, ok := arg.(*btf.Int)
 	if ok {
-		return num.Name
+		return num.Name + suffix
 	}
 	strct, ok := arg.(*btf.Struct)
 	if ok {
-		return strct.Name
+		return "struct " + strct.Name + suffix
 	}
 	// TODO - add more types, above is enough to make validation_test pass
-	return arg.TypeName()
+	return arg.TypeName() + suffix
 }
 
 func typesCompatible(specTy string, kernelTy string) bool {