fixes. (#3422) (#3434)

fix.

docs/eBpfExtensions.md

@@ -59,8 +59,7 @@ When registering itself to the NMR, the Program Information NPI Provider should
 initialized as follows:
 * `NpiId`: This should be set to `EBPF_PROGRAM_INFO_EXTENSION_IID` defined in `ebpf_extension_uuids.h`.
 * `ModuleId`: This should be set to the eBPF program type GUID.
-* `NpiSpecificCharacteristics`: Pointer to structure of type `ebpf_extension_data_t`.
-  * The `data` field of this structure should point to a structure of type `ebpf_program_data_t`.
+* `NpiSpecificCharacteristics`: Pointer to structure of type `ebpf_program_data_t`.
 
 #### `ebpf_extension_header_t` Struct
 This is a mandatory header that is common to all data structures needed by eBPF extensions to register with the eBPF framework.
@@ -233,8 +232,7 @@ When registering itself to the NMR, the Hook NPI provider should have the
 initialized as follows:
 * `NpiId`: This should be set to `EBPF_HOOK_EXTENSION_IID` defined in `ebpf_extension_uuids.h`.
 * `ModuleId`: This should be set to the attach type GUID.
-* `NpiSpecificCharacteristics`: Pointer to structure of type `ebpf_extension_data_t`.
-  * The `data` field of this structure should point to a structure of type `ebpf_attach_provider_data_t`.
+* `NpiSpecificCharacteristics`: Pointer to structure of type `ebpf_attach_provider_data_t`.
 
 #### `ebpf_attach_provider_data_t` Struct
 This structure is used to specify the attach type supported by the extension for the given Hook NPI provider. It

include/ebpf_structs.h

@@ -245,6 +245,7 @@ enum bpf_link_type
     BPF_LINK_TYPE_PLAIN,  ///< No union members are used in bpf_link_info.
     BPF_LINK_TYPE_CGROUP, ///< cgroup struct is present in bpf_link_info.
     BPF_LINK_TYPE_XDP,    ///< xdp struct is present in bpf_link_info.
+    BPF_LINK_TYPE_MAX
 };
 
 static const char* const _ebpf_link_display_names[] = {

include/ebpf_windows.h

@@ -2,6 +2,10 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
+#define EBPF_OFFSET_OF(s, m) (((size_t) & ((s*)0)->m))
+#define EBPF_FIELD_SIZE(s, m) (sizeof(((s*)0)->m))
+#define EBPF_SIZE_INCLUDING_FIELD(s, m) (EBPF_OFFSET_OF(s, m) + EBPF_FIELD_SIZE(s, m))
+
 #ifdef _MSC_VER
 #include <guiddef.h>
 #else
@@ -64,11 +68,13 @@ typedef enum _ebpf_helper_function
 
 #define EBPF_MAX_GENERAL_HELPER_FUNCTION 0xFFFF
 
-// Version 1 of the eBPF extension data structures and their lengths.
 #define EBPF_ATTACH_CLIENT_DATA_CURRENT_VERSION 1
-#define EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION 1
 #define EBPF_PROGRAM_INFORMATION_CLIENT_DATA_CURRENT_VERSION 1
 
+// Version 1 of the eBPF extension data structures and their lengths.
+#define EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION 1
+#define EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(ebpf_attach_provider_data_t, link_type)
+
 #define EBPF_PROGRAM_TYPE_DESCRIPTOR_CURRENT_VERSION 1
 #define EBPF_PROGRAM_TYPE_DESCRIPTOR_CURRENT_VERSION_SIZE \
     EBPF_SIZE_INCLUDING_FIELD(ebpf_program_type_descriptor_t, is_privileged)
@@ -82,6 +88,8 @@ typedef enum _ebpf_helper_function
     EBPF_SIZE_INCLUDING_FIELD(ebpf_program_info_t, global_helper_prototype)
 
 #define EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION 1
+#define EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE \
+    EBPF_SIZE_INCLUDING_FIELD(ebpf_helper_function_addresses_t, helper_function_address)
 
 #define EBPF_PROGRAM_DATA_CURRENT_VERSION 1
 #define EBPF_PROGRAM_DATA_CURRENT_VERSION_SIZE EBPF_SIZE_INCLUDING_FIELD(ebpf_program_data_t, required_irql)

libs/execution_context/ebpf_core.c

@@ -151,7 +151,7 @@ static const void* _ebpf_general_helpers[] = {
 };
 
 static const ebpf_helper_function_addresses_t _ebpf_global_helper_function_dispatch_table = {
-    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, sizeof(ebpf_helper_function_addresses_t)},
+    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
     EBPF_COUNT_OF(_ebpf_general_helpers),
     (uint64_t*)_ebpf_general_helpers};
 static const ebpf_program_data_t _ebpf_global_helper_function_program_data = {

libs/execution_context/ebpf_link.c

@@ -133,8 +133,7 @@ _ebpf_link_client_attach_provider(
     UNREFERENCED_PARAMETER(nmr_binding_handle);
 
     // Verify that that the provider is using the same version of the extension as the client.
-    if (attach_provider_data->header.version > EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION ||
-        attach_provider_data->header.size < sizeof(ebpf_attach_provider_data_t)) {
+    if (!ebpf_validate_attach_provider_data(attach_provider_data)) {
         EBPF_LOG_MESSAGE_UINT64_UINT64(
             EBPF_TRACELOG_LEVEL_ERROR,
             EBPF_TRACELOG_KEYWORD_LINK,

libs/execution_context/unit/execution_context_unit_test.cpp

@@ -761,7 +761,7 @@ TEST_CASE("program", "[execution_context]")
     uint32_t test_function_ids[] = {(EBPF_MAX_GENERAL_HELPER_FUNCTION + 1)};
     const void* helper_functions[] = {(void*)function_pointer1};
     ebpf_helper_function_addresses_t helper_function_addresses = {
-        {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, sizeof(ebpf_helper_function_addresses_t)},
+        {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
         EBPF_COUNT_OF(helper_functions),
         (uint64_t*)helper_functions};
 

libs/runtime/unit/platform_unit_test.cpp

@@ -621,15 +621,15 @@ TEST_CASE("trampoline_test", "[platform]")
     const void* helper_functions1[] = {(void*)function_pointer1};
     const uint32_t provider_helper_function_ids[] = {(uint32_t)(EBPF_MAX_GENERAL_HELPER_FUNCTION + 1)};
     ebpf_helper_function_addresses_t helper_function_addresses1 = {
-        {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, sizeof(ebpf_helper_function_addresses_t)},
+        {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
         EBPF_COUNT_OF(helper_functions1),
         (uint64_t*)helper_functions1};
 
     auto provider_function2 = []() { return EBPF_OBJECT_ALREADY_EXISTS; };
     ebpf_result_t (*function_pointer2)() = provider_function2;
     const void* helper_functions2[] = {(void*)function_pointer2};
     ebpf_helper_function_addresses_t helper_function_addresses2 = {
-        {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, sizeof(ebpf_helper_function_addresses_t)},
+        {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
         EBPF_COUNT_OF(helper_functions1),
         (uint64_t*)helper_functions2};
     ebpf_trampoline_table_t* local_table = nullptr;

libs/shared/ebpf_shared_framework.h

@@ -3,8 +3,10 @@
 
 #pragma once
 #include "cxplat.h"
+#include "ebpf_extension.h"
 #include "ebpf_program_types.h"
 #include "ebpf_result.h"
+#include "ebpf_windows.h"
 #include "shared_context.h"
 
 #include <specstrings.h>
@@ -13,9 +15,6 @@
 CXPLAT_EXTERN_C_BEGIN
 
 #define EBPF_COUNT_OF(arr) (sizeof(arr) / sizeof(arr[0]))
-#define EBPF_OFFSET_OF(s, m) (((size_t) & ((s*)0)->m))
-#define EBPF_FIELD_SIZE(s, m) (sizeof(((s*)0)->m))
-#define EBPF_SIZE_INCLUDING_FIELD(s, m) (EBPF_OFFSET_OF(s, m) + EBPF_FIELD_SIZE(s, m))
 #define EBPF_FROM_FIELD(s, m, o) (s*)((uint8_t*)o - EBPF_OFFSET_OF(s, m))
 
 #define EBPF_CACHE_LINE_SIZE 64
@@ -95,6 +94,9 @@ __forceinline __drv_allocatesMem(Mem) _Must_inspect_result_
 ebpf_result_t
 ebpf_result_from_cxplat_status(cxplat_status_t status);
 
+bool
+ebpf_validate_attach_provider_data(_In_ const ebpf_attach_provider_data_t* attach_provider_data);
+
 bool
 ebpf_validate_program_data(_In_ const ebpf_program_data_t* program_data);
 

libs/shared/shared_common.c

@@ -6,23 +6,31 @@
 
 enum _extension_object_type
 {
-    EBPF_PROGRAM_TYPE_DESCRIPTOR = 0,
+    EBPF_ATTACH_PROVIDER_DATA = 0,
+    EBPF_PROGRAM_TYPE_DESCRIPTOR,
     EBPF_HELPER_FUNCTION_PROTOTYPE,
     EBPF_PROGRAM_INFO,
+    EBPF_HELPER_FUNCTION_ADDRESSES,
     EBPF_PROGRAM_DATA,
     EBPF_PROGRAM_SECTION,
 };
 
 // Supported version and sizes of the various extension data structures.
 
 uint16_t _supported_ebpf_extension_version[] = {
+    EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION,
     EBPF_PROGRAM_TYPE_DESCRIPTOR_CURRENT_VERSION,
     EBPF_HELPER_FUNCTION_PROTOTYPE_CURRENT_VERSION,
     EBPF_PROGRAM_INFORMATION_CURRENT_VERSION,
+    EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION,
     EBPF_PROGRAM_DATA_CURRENT_VERSION,
     EBPF_PROGRAM_SECTION_INFORMATION_CURRENT_VERSION,
 };
 
+#define EBPF_ATTACH_PROVIDER_DATA_SIZE_0 \
+    EBPF_OFFSET_OF(ebpf_attach_provider_data_t, link_type) + sizeof(enum bpf_link_type)
+size_t _ebpf_attach_provider_data_supported_size[] = {EBPF_ATTACH_PROVIDER_DATA_SIZE_0};
+
 #define EBPF_PROGRAM_TYPE_DESCRIPTOR_SIZE_0 EBPF_OFFSET_OF(ebpf_program_type_descriptor_t, is_privileged) + sizeof(char)
 size_t _ebpf_program_type_descriptor_supported_size[] = {EBPF_PROGRAM_TYPE_DESCRIPTOR_SIZE_0};
 
@@ -34,6 +42,10 @@ size_t _ebpf_helper_function_prototype_supported_size[] = {EBPF_HELPER_FUNCTION_
     EBPF_OFFSET_OF(ebpf_program_info_t, global_helper_prototype) + sizeof(ebpf_helper_function_prototype_t*)
 size_t _ebpf_program_info_supported_size[] = {EBPF_PROGRAM_INFO_SIZE_0};
 
+#define EBPF_HELPER_FUNCTION_ADDRESSES_SIZE_0 \
+    EBPF_OFFSET_OF(ebpf_helper_function_addresses_t, helper_function_address) + sizeof(uint64_t*)
+size_t _ebpf_helper_function_addresses_supported_size[] = {EBPF_HELPER_FUNCTION_ADDRESSES_SIZE_0};
+
 #define EBPF_PROGRAM_DATA_SIZE_0 EBPF_OFFSET_OF(ebpf_program_data_t, required_irql) + sizeof(uint8_t)
 size_t _ebpf_program_data_supported_size[] = {EBPF_PROGRAM_DATA_SIZE_0};
 
@@ -46,9 +58,11 @@ struct _ebpf_extension_data_structure_supported_sizes
     uint16_t count;
 };
 struct _ebpf_extension_data_structure_supported_sizes _ebpf_extension_type_supported_sizes[] = {
+    {_ebpf_attach_provider_data_supported_size, EBPF_COUNT_OF(_ebpf_attach_provider_data_supported_size)},
     {_ebpf_program_type_descriptor_supported_size, EBPF_COUNT_OF(_ebpf_program_type_descriptor_supported_size)},
     {_ebpf_helper_function_prototype_supported_size, EBPF_COUNT_OF(_ebpf_helper_function_prototype_supported_size)},
     {_ebpf_program_info_supported_size, EBPF_COUNT_OF(_ebpf_program_info_supported_size)},
+    {_ebpf_helper_function_addresses_supported_size, EBPF_COUNT_OF(_ebpf_helper_function_addresses_supported_size)},
     {_ebpf_program_data_supported_size, EBPF_COUNT_OF(_ebpf_program_data_supported_size)},
     {_ebpf_program_section_supported_size, EBPF_COUNT_OF(_ebpf_program_section_supported_size)},
 };
@@ -77,6 +91,21 @@ _ebpf_validate_extension_object_header(
         (_ebpf_is_size_supported(supported_sizes, count, header->size)));
 }
 
+#ifndef GUID_NULL
+static const GUID GUID_NULL = {0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0}};
+#endif
+
+bool
+ebpf_validate_attach_provider_data(_In_ const ebpf_attach_provider_data_t* attach_provider_data)
+{
+    return (
+        (attach_provider_data != NULL) &&
+        _ebpf_validate_extension_object_header(EBPF_ATTACH_PROVIDER_DATA, &attach_provider_data->header) &&
+        !IsEqualGUID(&attach_provider_data->supported_program_type, &GUID_NULL) &&
+        (attach_provider_data->link_type < BPF_LINK_TYPE_MAX) &&
+        (attach_provider_data->bpf_attach_type < __MAX_BPF_ATTACH_TYPE));
+}
+
 static bool
 _ebpf_validate_helper_function_prototype(const ebpf_helper_function_prototype_t* helper_prototype)
 {
@@ -129,11 +158,25 @@ ebpf_validate_program_info(_In_ const ebpf_program_info_t* program_info)
             program_info->global_helper_prototype, program_info->count_of_global_helpers));
 }
 
+bool
+_ebpf_validate_helper_function_addresses(_In_ const ebpf_helper_function_addresses_t* helper_function_addresses)
+{
+    return (
+        (helper_function_addresses != NULL) &&
+        _ebpf_validate_extension_object_header(EBPF_HELPER_FUNCTION_ADDRESSES, &helper_function_addresses->header) &&
+        (helper_function_addresses->helper_function_count > 0) &&
+        (helper_function_addresses->helper_function_address != NULL));
+}
+
 bool
 ebpf_validate_program_data(_In_ const ebpf_program_data_t* program_data)
 {
     return (
         (program_data != NULL) && _ebpf_validate_extension_object_header(EBPF_PROGRAM_DATA, &program_data->header) &&
+        ((program_data->global_helper_function_addresses == NULL) ||
+         _ebpf_validate_helper_function_addresses(program_data->global_helper_function_addresses)) &&
+        ((program_data->program_type_specific_helper_function_addresses == NULL) ||
+         _ebpf_validate_helper_function_addresses(program_data->program_type_specific_helper_function_addresses)) &&
         ebpf_validate_program_info(program_data->program_info));
 }
 

netebpfext/net_ebpf_ext_bind.c

@@ -74,7 +74,7 @@ static net_ebpf_extension_program_info_provider_t* _ebpf_bind_program_info_provi
 // Bind Hook NPI Provider.
 //
 ebpf_attach_provider_data_t _net_ebpf_bind_hook_provider_data = {
-    {EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION, sizeof(_net_ebpf_bind_hook_provider_data)},
+    {EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION, EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION_SIZE},
     EBPF_PROGRAM_TYPE_BIND_GUID,
     BPF_ATTACH_TYPE_BIND,
     BPF_LINK_TYPE_PLAIN};

netebpfext/net_ebpf_ext_sock_addr.c

@@ -470,15 +470,15 @@ static const void* _ebpf_sock_addr_specific_helper_functions[] = {
     (void*)_ebpf_sock_addr_get_current_pid_tgid, (void*)_ebpf_sock_addr_set_redirect_context};
 
 static ebpf_helper_function_addresses_t _ebpf_sock_addr_specific_helper_function_address_table = {
-    {EBPF_HELPER_FUNCTION_PROTOTYPE_CURRENT_VERSION, EBPF_MAX_GENERAL_HELPER_FUNCTION},
+    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
     EBPF_COUNT_OF(_ebpf_sock_addr_specific_helper_functions),
     (uint64_t*)_ebpf_sock_addr_specific_helper_functions};
 
 static const void* _ebpf_sock_addr_global_helper_functions[] = {
     (void*)_ebpf_sock_addr_get_current_logon_id, (void*)_ebpf_sock_addr_is_current_admin};
 
 static ebpf_helper_function_addresses_t _ebpf_sock_addr_global_helper_function_address_table = {
-    {EBPF_HELPER_FUNCTION_PROTOTYPE_CURRENT_VERSION, EBPF_MAX_GENERAL_HELPER_FUNCTION},
+    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
     EBPF_COUNT_OF(_ebpf_sock_addr_global_helper_functions),
     (uint64_t*)_ebpf_sock_addr_global_helper_functions};
 
@@ -917,7 +917,7 @@ net_ebpf_ext_sock_addr_register_providers()
             &_ebpf_sock_addr_hook_provider_moduleid[i], &_net_ebpf_sock_addr_hook_provider_data[i]};
 
         _net_ebpf_sock_addr_hook_provider_data[i].header.version = EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION;
-        _net_ebpf_sock_addr_hook_provider_data[i].header.size = sizeof(ebpf_attach_provider_data_t);
+        _net_ebpf_sock_addr_hook_provider_data[i].header.size = EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION_SIZE;
         _net_ebpf_sock_addr_hook_provider_data[i].supported_program_type = EBPF_PROGRAM_TYPE_CGROUP_SOCK_ADDR;
         _net_ebpf_sock_addr_hook_provider_data[i].bpf_attach_type =
             (bpf_attach_type_t)_net_ebpf_extension_sock_addr_bpf_attach_types[i];

netebpfext/net_ebpf_ext_sock_ops.c

@@ -97,7 +97,7 @@ static net_ebpf_extension_program_info_provider_t* _ebpf_sock_ops_program_info_p
 //
 
 ebpf_attach_provider_data_t _net_ebpf_sock_ops_hook_provider_data = {
-    {EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION, sizeof(ebpf_attach_provider_data_t)},
+    {EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION, EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION_SIZE},
     EBPF_PROGRAM_TYPE_SOCK_OPS_GUID,
     BPF_CGROUP_SOCK_OPS,
     BPF_LINK_TYPE_CGROUP};

netebpfext/net_ebpf_ext_xdp.c

@@ -83,7 +83,7 @@ _ebpf_xdp_context_delete(
 static const void* _ebpf_xdp_test_helper_functions[] = {(void*)&_net_ebpf_xdp_adjust_head};
 
 static ebpf_helper_function_addresses_t _ebpf_xdp_test_helper_function_address_table = {
-    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, sizeof(ebpf_helper_function_addresses_t)},
+    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
     EBPF_COUNT_OF(_ebpf_xdp_test_helper_functions),
     (uint64_t*)_ebpf_xdp_test_helper_functions};
 
@@ -107,7 +107,7 @@ static net_ebpf_extension_program_info_provider_t* _ebpf_xdp_test_program_info_p
 //
 
 ebpf_attach_provider_data_t _net_ebpf_xdp_test_hook_provider_data = {
-    {EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION, sizeof(ebpf_attach_provider_data_t)},
+    {EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION, EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION_SIZE},
     EBPF_PROGRAM_TYPE_XDP_TEST_GUID,
     BPF_XDP_TEST,
     BPF_LINK_TYPE_XDP};

tests/end_to_end/end_to_end.cpp

@@ -3007,7 +3007,8 @@ extension_reload_test(ebpf_execution_type_t execution_type)
     // Reload the extension provider with missing helper function.
     {
         ebpf_helper_function_addresses_t changed_helper_function_address_table = {
-            .header = {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, sizeof(ebpf_helper_function_addresses_t)},
+            .header =
+                {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
             .helper_function_count = 0,
             .helper_function_address = nullptr};
         ebpf_program_data_t changed_program_data = _test_ebpf_sample_extension_program_data;

tests/end_to_end/helpers.h

@@ -118,7 +118,7 @@ typedef class _single_instance_hook : public _hook_helper
           nmr_binding_handle(nullptr), nmr_provider_handle(nullptr)
     {
         attach_provider_data.header.version = EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION;
-        attach_provider_data.header.size = sizeof(attach_provider_data);
+        attach_provider_data.header.size = EBPF_ATTACH_PROVIDER_DATA_CURRENT_VERSION_SIZE;
         attach_provider_data.supported_program_type = program_type;
         attach_provider_data.bpf_attach_type = get_bpf_attach_type(&attach_type);
         this->attach_type = attach_type;
@@ -621,7 +621,7 @@ _sample_test_context_destroy(
 static const void* _mock_xdp_helper_functions[] = {(void*)&test_xdp_helper_t::adjust_head};
 
 static ebpf_helper_function_addresses_t _mock_xdp_helper_function_address_table = {
-    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, sizeof(ebpf_helper_function_addresses_t)},
+    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
     EBPF_COUNT_OF(_mock_xdp_helper_functions),
     (uint64_t*)_mock_xdp_helper_functions};
 
@@ -675,14 +675,14 @@ static const void* _sample_ebpf_ext_helper_functions[] = {
     test_sample_helper_t::_sample_ebpf_extension_replace};
 
 static ebpf_helper_function_addresses_t _sample_ebpf_ext_helper_function_address_table = {
-    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, sizeof(ebpf_helper_function_addresses_t)},
+    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
     EBPF_COUNT_OF(_sample_ebpf_ext_helper_functions),
     (uint64_t*)_sample_ebpf_ext_helper_functions};
 
 static const void* _test_global_helper_functions[] = {test_global_helper_t::_sample_get_pid_tgid};
 
 static ebpf_helper_function_addresses_t _test_global_helper_function_address_table = {
-    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, sizeof(ebpf_helper_function_addresses_t)},
+    {EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION, EBPF_HELPER_FUNCTION_ADDRESSES_CURRENT_VERSION_SIZE},
     EBPF_COUNT_OF(_test_global_helper_functions),
     (uint64_t*)_test_global_helper_functions};