Resolve bpf issue 515

Signed-off-by: Everett Badeaux <[email protected]>
falcosecurity · Oct 3, 2023 · 9e6def4 · 9e6def4
1 parent 98d7df6
commit 9e6def4
Show file tree

Hide file tree

Showing 7 changed files with 11 additions and 11 deletions.
diff --git a/driver/SCHEMA_VERSION b/driver/SCHEMA_VERSION
@@ -1 +1 @@
-2.11.1
+2.12.1
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -5730,9 +5730,9 @@ FILLER(sys_ptrace_x, true)
 
 FILLER(sys_bpf_e, true)
 {
-	/* Parameter 1: cmd (type: PT_INT64) */
+	/* Parameter 1: cmd (type: PT_INT32) */
 	s32 cmd = (s32)bpf_syscall_get_argument(data, 0);
-	return bpf_push_s64_to_ring(data, (s64)cmd);
+	return bpf_push_s32_to_ring(data, (s32)cmd);
 }
 
 FILLER(sys_bpf_x, true)

diff --git a/driver/event_table.c b/driver/event_table.c
@@ -417,7 +417,7 @@ const struct ppm_event_info g_event_info[] = {
 	[PPME_SYSCALL_DUP3_X] = {"dup3", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 4, {{"res", PT_FD, PF_DEC}, {"oldfd", PT_FD, PF_DEC}, {"newfd", PT_FD, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, file_flags} } },
 	[PPME_SYSCALL_DUP_1_E] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 1, {{"fd", PT_FD, PF_DEC} } },
 	[PPME_SYSCALL_DUP_1_X] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 2, {{"res", PT_FD, PF_DEC}, {"oldfd", PT_FD, PF_DEC} } },
-	[PPME_SYSCALL_BPF_2_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 1, {{"cmd", PT_INT64, PF_DEC} } },
+	[PPME_SYSCALL_BPF_2_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 1, {{"cmd",  PT_INT32, PF_DEC} } },
 	[PPME_SYSCALL_BPF_2_X] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 1, { {"fd", PT_FD, PF_DEC} } },
 	[PPME_SYSCALL_MLOCK2_E] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 0},
 	[PPME_SYSCALL_MLOCK2_X] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"addr", PT_UINT64, PF_HEX}, {"len", PT_UINT64, PF_DEC}, {"flags", PT_UINT32, PF_HEX, mlock2_flags}}},

diff --git a/driver/modern_bpf/definitions/events_dimensions.h b/driver/modern_bpf/definitions/events_dimensions.h
@@ -103,7 +103,7 @@
 #define RENAMEAT2_E_SIZE HEADER_LEN
 #define PIPE_E_SIZE HEADER_LEN
 #define PIPE_X_SIZE HEADER_LEN + sizeof(int64_t) * 3 + sizeof(uint64_t) + PARAM_LEN * 4
-#define BPF_E_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
+#define BPF_E_SIZE HEADER_LEN + sizeof(int32_t) + PARAM_LEN
 #define BPF_X_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
 #define FLOCK_E_SIZE HEADER_LEN + sizeof(int64_t) + sizeof(uint32_t) + PARAM_LEN * 2
 #define FLOCK_X_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c
@@ -24,9 +24,9 @@ int BPF_PROG(bpf_e,
 
 	/*=============================== COLLECT PARAMETERS  ===========================*/
 
-	/* Parameter 1: cmd (type: PT_INT64) */
+	/* Parameter 1: cmd (type: PT_INT32) */
 	s32 cmd = (s32)extract__syscall_argument(regs, 0);
-	ringbuf__store_s64(&ringbuf, (s64)cmd);
+	ringbuf__store_s32(&ringbuf, (s32)cmd);
 
 	/*=============================== COLLECT PARAMETERS  ===========================*/
 

diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
@@ -7006,9 +7006,9 @@ int f_sys_bpf_e(struct event_filler_arguments *args)
 	unsigned long val = 0;
 	syscall_get_arguments_deprecated(args, 0, 1, &val);
 
-	/* Parameter 1: cmd (type: PT_INT64) */
+	/* Parameter 1: cmd (type: PT_INT32) */
 	cmd = (int32_t)val;
-	res = val_to_ring(args, (int64_t)cmd, 0, false, 0);
+	res = val_to_ring(args, (int32_t)cmd, 0, false, 0);
 	CHECK_RES(res);
 	return add_sentinel(args);
 }

diff --git a/test/drivers/test_suites/syscall_enter_suite/bpf_e.cpp b/test/drivers/test_suites/syscall_enter_suite/bpf_e.cpp
@@ -66,8 +66,8 @@ TEST(SyscallEnter, bpfE)
 
 	/*=============================== ASSERT PARAMETERS  ===========================*/
 
-	/* Parameter 1: cmd (type: PT_INT64) */
-	evt_test->assert_numeric_param(1, (int64_t)cmd);
+	/* Parameter 1: cmd (type: int32_t) */
+	evt_test->assert_numeric_param(1, (int32_t)cmd);
 
 	/*=============================== ASSERT PARAMETERS  ===========================*/