fix(driver): always retrieve the local iov

Signed-off-by: Roberto Scolaro <[email protected]>
falcosecurity · Feb 6, 2024 · cea9725 · cea9725
1 parent 89d029b
commit cea9725
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 8 deletions.
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -7339,8 +7339,8 @@ FILLER(sys_process_vm_readv_x, true)
 	/* Parameter 3: data (type: PT_BYTEBUF) */
 	if (retval > 0)
 	{
-		iov = (const struct iovec __user *)bpf_syscall_get_argument(data, 3);
-		iovcnt = bpf_syscall_get_argument(data, 4);
+		iov = (const struct iovec __user *)bpf_syscall_get_argument(data, 1);
+		iovcnt = bpf_syscall_get_argument(data, 2);
 
 		res = bpf_parse_readv_writev_bufs(data,
 						iov,

diff --git a/...r/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_readv.bpf.c b/...r/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_readv.bpf.c
@@ -74,8 +74,8 @@ int BPF_PROG(process_vm_readv_x,
 			snaplen = ret;
 		}
 
-		unsigned long iov_pointer = extract__syscall_argument(regs, 3);
-		unsigned long iov_cnt = extract__syscall_argument(regs, 4);
+		unsigned long iov_pointer = extract__syscall_argument(regs, 1);
+		unsigned long iov_cnt = extract__syscall_argument(regs, 2);
 
 		/* Parameter 3: data (type: PT_BYTEBUF) */
 		auxmap__store_iovec_data_param(auxmap, iov_pointer, iov_cnt, snaplen);

diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
@@ -8147,9 +8147,9 @@ int f_sys_process_vm_readv_x(struct event_filler_arguments *args)
 
 	if(retval > 0)
 	{
-		/* We only get the source iov */
-		syscall_get_arguments_deprecated(args, 3, 1, &val);
-		syscall_get_arguments_deprecated(args, 4, 1, &iovcnt);
+		/* We only get the local iov */
+		syscall_get_arguments_deprecated(args, 1, 1, &val);
+		syscall_get_arguments_deprecated(args, 2, 1, &iovcnt);
 
 	#ifdef CONFIG_COMPAT
 		if (unlikely(args->compat)) {
@@ -8196,7 +8196,7 @@ int f_sys_process_vm_writev_x(struct event_filler_arguments *args)
 
 	if(retval > 0)
 	{
-		/* We only get the source iov */
+		/* We only get the local iov */
 		syscall_get_arguments_deprecated(args, 1, 1, &val);
 		syscall_get_arguments_deprecated(args, 2, 1, &iovcnt);