fix(driver/modern_bpf): avoid type confusion setting snaplen

Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
falcosecurity · Mar 25, 2024 · 04d4cb7 · 04d4cb7
1 parent b3eb1ef
commit 04d4cb7
Show file tree

Hide file tree

Showing 5 changed files with 9 additions and 9 deletions.
diff --git a/driver/SCHEMA_VERSION b/driver/SCHEMA_VERSION
@@ -1 +1 @@
-2.19.1
+2.19.2
diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwrite64.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwrite64.bpf.c
@@ -70,10 +70,10 @@ int BPF_PROG(pwrite64_x,
 	/* If the syscall doesn't fail we use the return value as `size`
 	 * otherwise we need to rely on the syscall parameter provided by the user.
 	 */
-	uint16_t bytes_to_read = ret > 0 ? ret : extract__syscall_argument(regs, 2);
+	int64_t bytes_to_read = ret > 0 ? ret : extract__syscall_argument(regs, 2);
 	uint16_t snaplen = maps__get_snaplen();
 	apply_dynamic_snaplen(regs, &snaplen, false);
-	if(snaplen > bytes_to_read)
+	if((int64_t)snaplen > bytes_to_read)
 	{
 		snaplen = bytes_to_read;
 	}

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/send.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/send.bpf.c
@@ -71,10 +71,10 @@ int BPF_PROG(send_x,
 	unsigned long args[3];
 	extract__network_args(args, 3, regs);
 
-	uint16_t bytes_to_read = ret > 0 ? ret : args[2];
+	int64_t bytes_to_read = ret > 0 ? ret : args[2];
 	uint16_t snaplen = maps__get_snaplen();
 	apply_dynamic_snaplen(regs, &snaplen, false);
-	if(snaplen > bytes_to_read)
+	if((int64_t)snaplen > bytes_to_read)
 	{
 		snaplen = bytes_to_read;
 	}

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendto.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendto.bpf.c
@@ -91,10 +91,10 @@ int BPF_PROG(sendto_x,
 	/* If the syscall doesn't fail we use the return value as `size`
 	 * otherwise we need to rely on the syscall parameter provided by the user.
 	 */
-	uint16_t bytes_to_read = ret > 0 ? ret : args[2];
+	int64_t bytes_to_read = ret > 0 ? ret : args[2];
 	uint16_t snaplen = maps__get_snaplen();
 	apply_dynamic_snaplen(regs, &snaplen, false);
-	if(snaplen > bytes_to_read)
+	if((int64_t)snaplen > bytes_to_read)
 	{
 		snaplen = bytes_to_read;
 	}

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/write.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/write.bpf.c
@@ -66,10 +66,10 @@ int BPF_PROG(write_x,
 	/* If the syscall doesn't fail we use the return value as `size`
 	 * otherwise we need to rely on the syscall parameter provided by the user.
 	 */
-	uint16_t bytes_to_read = ret > 0 ? ret : extract__syscall_argument(regs, 2);
+	int64_t bytes_to_read = ret > 0 ? ret : extract__syscall_argument(regs, 2);
 	uint16_t snaplen = maps__get_snaplen();
 	apply_dynamic_snaplen(regs, &snaplen, false);
-	if(snaplen > bytes_to_read)
+	if((int64_t)snaplen > bytes_to_read)
 	{
 		snaplen = bytes_to_read;
 	}