Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(driver): avoid sending a NULL tuple in recvfrom syscall #1767

Merged
merged 2 commits into from
Mar 28, 2024

Conversation

mrgian
Copy link
Contributor

@mrgian mrgian commented Mar 27, 2024

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:
The kernel module and the old bpf probe send a NULL tuple to userspace when recvfrom is called with a null sockaddr pointer.
This PR fixes this behavior by getting the tuple info from the socket file descriptor itself.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

fix(driver): avoid sending a NULL tuple in `recvfrom` syscall

Copy link

Please double check driver/API_VERSION file. See versioning.

/hold

Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please double check driver/API_VERSION file. See versioning.

/hold

This is a false positive for the API_VERSION. However, it seems to meet a specific case for the SCHEMA_VERSION 👇

When to increment

major version: increment when the schema becomes incompatible with previous userspace versions

minor version: increment when new features are added but existing features remain compatible (e.g. new event fields or new events)

patch version: increment when code changes don't break compatibility 👉 (e.g. bug fixes in filler code) 👈

@mrgian

So, could you bump the patch number of the schema version, please? 🙏

@mrgian
Copy link
Contributor Author

mrgian commented Mar 27, 2024

So, could you bump the patch number of the schema version, please? 🙏

Bumped!
Forgot about that, sorry! 🤦

@FedeDP
Copy link
Contributor

FedeDP commented Mar 27, 2024

/milestone next-driver

@poiana poiana added this to the next-driver milestone Mar 27, 2024
FedeDP
FedeDP previously approved these changes Mar 27, 2024
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Love this! Common behavior is best behavior :)
/approve

@poiana
Copy link
Contributor

poiana commented Mar 27, 2024

LGTM label has been added.

Git tree hash: a921443494431b0c7b9f851c6c23f41c18d67f49

@mrgian mrgian force-pushed the fix-recvfrom-null-tuple branch from 65f088b to 3fea0c1 Compare March 27, 2024 17:21
@poiana poiana removed the lgtm label Mar 27, 2024
@poiana poiana requested a review from FedeDP March 27, 2024 17:21
@mrgian mrgian force-pushed the fix-recvfrom-null-tuple branch from 3fea0c1 to e3afeb6 Compare March 27, 2024 17:28
@poiana poiana added size/L and removed size/M labels Mar 27, 2024
Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!
/approve

@poiana
Copy link
Contributor

poiana commented Mar 28, 2024

LGTM label has been added.

Git tree hash: b10ed3916654a6e981e068f02b588a45b8afd993

Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Mar 28, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, mrgian

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@FedeDP
Copy link
Contributor

FedeDP commented Mar 28, 2024

/unhold

@poiana poiana merged commit fac10c5 into falcosecurity:master Mar 28, 2024
53 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants