fix(kmod): fix signedness on fd of dup syscalls

Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
falcosecurity · Mar 22, 2024 · 459b65c · 459b65c
1 parent 413b7a6
commit 459b65c
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 10 deletions.
diff --git a/driver/SCHEMA_VERSION b/driver/SCHEMA_VERSION
@@ -1 +1 @@
-2.19.0
+2.19.1
diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
@@ -5710,12 +5710,14 @@ int f_sys_dup_e(struct event_filler_arguments *args)
 {
 	int res;
 	unsigned long val;
+	int64_t fd = 0;
 
 	/*
 	 * oldfd
 	 */
 	syscall_get_arguments_deprecated(args, 0, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	fd = (int32_t) val;
+	res = val_to_ring(args, (int64_t)fd, 0, false, 0);
 	CHECK_RES(res);
 
 	return add_sentinel(args);
@@ -5725,6 +5727,7 @@ int f_sys_dup_x(struct event_filler_arguments *args)
 {
 	int res;
 	unsigned long val;
+	int64_t fd = 0;
 
 
 	int64_t retval = (int64_t)syscall_get_return_value(current, args->regs);
@@ -5735,7 +5738,8 @@ int f_sys_dup_x(struct event_filler_arguments *args)
 	 * oldfd
 	 */
 	syscall_get_arguments_deprecated(args, 0, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	fd = (int64_t) val;
+	res = val_to_ring(args, (int64_t)fd, 0, false, 0);
 	CHECK_RES(res);
 
 	return add_sentinel(args);
@@ -5745,12 +5749,14 @@ int f_sys_dup2_e(struct event_filler_arguments *args)
 {
 	int res;
 	unsigned long val;
+	int64_t fd = 0;
 
 	/*
 	 * oldfd
 	 */
 	syscall_get_arguments_deprecated(args, 0, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	fd = (int32_t) val;
+	res = val_to_ring(args, (int64_t)fd, 0, false, 0);
 	CHECK_RES(res);
 
 	return add_sentinel(args);
@@ -5760,6 +5766,7 @@ int f_sys_dup2_x(struct event_filler_arguments *args)
 {
 	int res;
 	unsigned long val;
+	int64_t fd = 0;
 
 
 	int64_t retval = (int64_t)syscall_get_return_value(current, args->regs);
@@ -5770,15 +5777,18 @@ int f_sys_dup2_x(struct event_filler_arguments *args)
 	 * oldfd
 	 */
 	syscall_get_arguments_deprecated(args, 0, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	fd = (int64_t) val;
+	res = val_to_ring(args, (int64_t)fd, 0, false, 0);
 	CHECK_RES(res);
 
 	/*
 	 * newfd
 	 */
 	syscall_get_arguments_deprecated(args, 1, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
-	CHECK_RES(res);
+	fd = (int64_t) val;
+	res = val_to_ring(args, (int64_t)fd, 0, false, 0);
+	CHECK_RES(res)
+	;
 
 	return add_sentinel(args);
 }
@@ -5787,12 +5797,14 @@ int f_sys_dup3_e(struct event_filler_arguments *args)
 {
 	int res;
 	unsigned long val;
+	int64_t fd = 0;
 
 	/*
 	 * oldfd
 	 */
 	syscall_get_arguments_deprecated(args, 0, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	fd = (int64_t) val;
+	res = val_to_ring(args, (int64_t)fd, 0, false, 0);
 	CHECK_RES(res);
 
 	return add_sentinel(args);
@@ -5802,6 +5814,7 @@ int f_sys_dup3_x(struct event_filler_arguments *args)
 {
 	int res;
 	unsigned long val;
+	int64_t fd = 0;
 
 	int64_t retval = (int64_t)syscall_get_return_value(current, args->regs);
 	res = val_to_ring(args, retval, 0, false, 0);
@@ -5811,14 +5824,16 @@ int f_sys_dup3_x(struct event_filler_arguments *args)
 	 * oldfd
 	 */
 	syscall_get_arguments_deprecated(args, 0, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	fd = (int64_t) val;
+	res = val_to_ring(args, (int64_t)fd, 0, false, 0);
 	CHECK_RES(res);
 
 	/*
 	 * newfd
 	 */
 	syscall_get_arguments_deprecated(args, 1, 1, &val);
-	res = val_to_ring(args, val, 0, false, 0);
+	fd = (int64_t) val;
+	res = val_to_ring(args, (int64_t)fd, 0, false, 0);
 	CHECK_RES(res);
 
 	/*