wip: iovec copies

aquasecurity · May 7, 2024 · 0dbe6cb · 0dbe6cb
1 parent 7d224a3
commit 0dbe6cb
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 18 deletions.
diff --git a/pkg/ebpf/c/common/filesystem.h b/pkg/ebpf/c/common/filesystem.h
@@ -424,10 +424,15 @@ statfunc void fill_vfs_file_bin_args_io_data(io_data_t io_data, bin_args_t *bin_
         bin_args->vec = io_data.ptr;
         bin_args->iov_len = io_data.len;
         bin_args->iov_idx = 0;
-        struct iovec io_vec;
-        bpf_probe_read_user(&io_vec, bpf_core_type_size(struct iovec), &bin_args->vec[0]);
-        bin_args->ptr = io_vec.iov_base;
-        bin_args->full_size = io_vec.iov_len;
+        // struct iovec io_vec;
+        // bpf_probe_read_user(&io_vec, bpf_core_type_size(struct iovec), &bin_args->vec[0]);
+        // bin_args->ptr = io_vec.iov_base;
+        // bin_args->full_size = io_vec.iov_len;
+        bpf_printk("in fill_vfs_file_bin_args_io_data\n");
+        struct iovec *io_vec;
+        bpf_probe_read_user(&io_vec, sizeof(io_vec), &bin_args->vec[0]);
+        bin_args->ptr = BPF_CORE_READ(io_vec, iov_base);
+        bin_args->full_size = BPF_CORE_READ(io_vec, iov_len);
     }
 }
 
@@ -465,19 +470,21 @@ statfunc void fill_file_header(u8 header[FILE_MAGIC_HDR_SIZE], io_data_t io_data
                      : [size] "r"(len), [max_size] "i"(FILE_MAGIC_HDR_SIZE));
         bpf_probe_read(header, len, io_data.ptr);
     } else {
-        struct iovec io_vec;
-        // NOTE(nadav.str): can't use bpf_core_type_size in memset.
-        // Maybe it only resolves in runtime, although its a macro so it seems unlikely.
-        // Anyway, leaving it with sizeof for now.
-        __builtin_memset(&io_vec, 0, sizeof(io_vec));
-        // Kept as sizeof to be consistent with the above.
-        bpf_probe_read(&io_vec, sizeof(struct iovec), io_data.ptr);
-        // inline bounds check to force compiler to use the register of len
+        // struct iovec io_vec;
+        // __builtin_memset(&io_vec, 0, sizeof(io_vec));
+        // bpf_probe_read(&io_vec, sizeof(struct iovec), io_data.ptr);
+        // // inline bounds check to force compiler to use the register of len
+        // bpf_probe_read(header, len, io_vec.iov_base);
+        bpf_printk("in fill_file_header\n");
+        struct iovec *io_vec = io_data.ptr;
+        if (io_vec == NULL)
+            return;
+        // bpf_probe_read_kernel(&io_vec, sizeof(void *), &io_data.ptr);
         asm volatile("if %[size] < %[max_size] goto +1;\n"
                      "%[size] = %[max_size];\n"
                      :
                      : [size] "r"(len), [max_size] "i"(FILE_MAGIC_HDR_SIZE));
-        bpf_probe_read(header, len, io_vec.iov_base);
+        bpf_core_read(header, len, &io_vec->iov_base);
     }
 }
 

diff --git a/pkg/ebpf/c/tracee.bpf.c b/pkg/ebpf/c/tracee.bpf.c
@@ -2891,11 +2891,11 @@ statfunc u32 send_bin_helper(void *ctx, void *prog_array, int tail_call)
         if (bin_args->iov_idx < bin_args->iov_len) {
             // Handle the rest of write recursively
             bin_args->start_off += bin_args->full_size;
-            struct iovec io_vec;
-            bpf_probe_read(
-                &io_vec, bpf_core_type_size(struct iovec), &bin_args->vec[bin_args->iov_idx]);
-            bin_args->ptr = io_vec.iov_base;
-            bin_args->full_size = io_vec.iov_len;
+            bpf_printk("send_bin_helper\n");
+            struct iovec *io_vec;
+            bpf_probe_read_kernel(&io_vec, sizeof(io_vec), &bin_args->vec[bin_args->iov_idx]);
+            bin_args->ptr = BPF_CORE_READ(io_vec, iov_base);
+            bin_args->full_size = BPF_CORE_READ(io_vec, iov_len);
             bpf_tail_call(ctx, prog_array, tail_call);
         }
         return 0;