cleanup(dup3): fix flags param

Signed-off-by: Everett Badeaux <everettc1810@gmail.com>
falcosecurity · Nov 13, 2023 · aa3a955 · aa3a955
1 parent 047bc33
commit aa3a955
Show file tree

Hide file tree

Showing 9 changed files with 15 additions and 13 deletions.
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -6257,8 +6257,9 @@ FILLER(sys_dup3_x, true)
 {
 	unsigned long val;
 	unsigned long retval;
-	unsigned long flags;
+	int flags;
 	unsigned long res;
+	unsigned int scap_flags;
 
 	retval = bpf_syscall_get_retval(data->ctx);
 	res = bpf_push_s64_to_ring(data, retval);
@@ -6280,8 +6281,8 @@ FILLER(sys_dup3_x, true)
 	/*
 	 * flags
 	 */
-	val = bpf_syscall_get_argument(data, 2);
-	flags = dup3_flags_to_scap(val);
+	flags = bpf_syscall_get_argument(data, 2);
+	scap_flags = dup3_flags_to_scap(flags);
 	return bpf_push_u32_to_ring(data, flags);
 }
 

diff --git a/driver/modern_bpf/definitions/events_dimensions.h b/driver/modern_bpf/definitions/events_dimensions.h
@@ -49,7 +49,7 @@
 #define DUP2_E_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
 #define DUP2_X_SIZE HEADER_LEN + sizeof(int64_t) * 3 + PARAM_LEN * 3
 #define DUP3_E_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
-#define DUP3_X_SIZE HEADER_LEN + sizeof(int64_t) * 3 + sizeof(uint32_t) + PARAM_LEN * 4
+#define DUP3_X_SIZE HEADER_LEN + sizeof(int64_t) * 3 + sizeof(int32_t) + PARAM_LEN * 4
 #define CHDIR_E_SIZE HEADER_LEN
 #define CHMOD_E_SIZE HEADER_LEN
 #define CHOWN_E_SIZE HEADER_LEN

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup3.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup3.bpf.c
@@ -67,7 +67,7 @@ int BPF_PROG(dup3_x,
 	ringbuf__store_s64(&ringbuf, (int64_t)newfd);
 
 	/* Parameter 4: flags (type: PT_FLAGS32) */
-	unsigned long flags = extract__syscall_argument(regs, 2);
+	int flags = extract__syscall_argument(regs, 2);
 	ringbuf__store_u32(&ringbuf, dup3_flags_to_scap(flags));
 
 	/*=============================== COLLECT PARAMETERS  ===========================*/

diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
@@ -5779,6 +5779,7 @@ int f_sys_dup3_x(struct event_filler_arguments *args)
 {
 	int res;
 	unsigned long val;
+	int flags;
 
 
 	int64_t retval = (int64_t)syscall_get_return_value(current, args->regs);
@@ -5802,8 +5803,8 @@ int f_sys_dup3_x(struct event_filler_arguments *args)
 	/*
 	 * flags
 	 */
-	syscall_get_arguments_deprecated(args, 2, 1, &val);
-	res = val_to_ring(args, dup3_flags_to_scap(val), 0, false, 0);
+	syscall_get_arguments_deprecated(args, 2, 1, &flags);
+	res = val_to_ring(args, dup3_flags_to_scap(flags), 0, false, 0);
 	CHECK_RES(res);
 
 	return add_sentinel(args);

diff --git a/driver/ppm_flag_helpers.h b/driver/ppm_flag_helpers.h
@@ -2044,7 +2044,7 @@ static __always_inline uint64_t capabilities_to_scap(unsigned long caps)
 	return res;
 }
 
-static __always_inline u32 dup3_flags_to_scap(unsigned long flags)
+static __always_inline u32 dup3_flags_to_scap(int flags)
 {
 	u32 res = 0;
 #ifdef O_CLOEXEC

diff --git a/test/drivers/test_suites/syscall_enter_suite/dup3_e.cpp b/test/drivers/test_suites/syscall_enter_suite/dup3_e.cpp
@@ -14,7 +14,7 @@ TEST(SyscallEnter, dup3E)
 
 	/* If `oldfd` equals `newfd`, then dup3() fails with the error `EINVAL`. */
 	int32_t new_fd = old_fd;
-	uint32_t flags = O_CLOEXEC;
+	int32_t flags = O_CLOEXEC;
 	int32_t res = syscall(__NR_dup3, old_fd, new_fd, flags);
 	assert_syscall_state(SYSCALL_FAILURE, "dup3", res);
 

diff --git a/userspace/libscap/engine/gvisor/fillers.cpp b/userspace/libscap/engine/gvisor/fillers.cpp
@@ -1086,7 +1086,7 @@ fill_event_dup3_x(scap_sized_buffer scap_buf, size_t* event_size, char* scap_err
                   int64_t res,
                   int64_t oldfd,
                   int64_t newfd,
-                  uint32_t flags)
+                  int32_t flags)
 {
 	return scap_event_encode_params(
 	           scap_buf, event_size, scap_err,

diff --git a/userspace/libscap/engine/gvisor/fillers.h b/userspace/libscap/engine/gvisor/fillers.h
@@ -349,7 +349,7 @@ fill_event_dup3_x(scap_sized_buffer scap_buf, size_t* event_size, char* scap_err
                   int64_t res,
                   int64_t oldfd,
                   int64_t newfd,
-                  uint32_t flags);
+                  int32_t flags);
 
 int32_t
 fill_event_signalfd_e(scap_sized_buffer scap_buf, size_t* event_size, char* scap_err,

diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp
@@ -5376,14 +5376,14 @@ void sinsp_parser::parse_dup_exit(sinsp_evt *evt)
 		// If we are handling the dup3() event exit then we add the flags to the new file descriptor.
 		//
 		if (evt->get_type() == PPME_SYSCALL_DUP3_X){
-			uint32_t flags;
+			int32_t flags;
 
 			//
 			// Get the flags parameter.
 			//
 			parinfo = evt->get_param(3);
 			ASSERT(parinfo->m_len == sizeof(uint32_t));
-			flags = *(uint32_t *)parinfo->m_val;
+			flags = *(int32_t *)parinfo->m_val;
 
 			//
 			// We keep the previously flags that has been set on the original file descriptor and