cleanup(driver): unlinkat & linkat flags

Signed-off-by: Everett Badeaux <everettc1810@gmail.com>
falcosecurity · Dec 11, 2023 · 8eb2fc2 · 8eb2fc2
1 parent 1845bb6
commit 8eb2fc2
Show file tree

Hide file tree

Showing 5 changed files with 8 additions and 8 deletions.
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -5822,7 +5822,7 @@ FILLER(sys_unlinkat_x, true)
 
 	/* Parameter 4: flags (type: PT_FLAGS32) */
 	unsigned long flags = bpf_syscall_get_argument(data, 2);
-	return bpf_push_u32_to_ring(data, unlinkat_flags_to_scap(flags));
+	return bpf_push_u32_to_ring(data, unlinkat_flags_to_scap((int32_t) flags));
 }
 
 FILLER(sys_mkdirat_x, true)
@@ -5899,7 +5899,7 @@ FILLER(sys_linkat_x, true)
 	 * flags
 	 */
 	val = bpf_syscall_get_argument(data, 4);
-	return bpf_push_u32_to_ring(data, linkat_flags_to_scap(val));
+	return bpf_push_u32_to_ring(data, linkat_flags_to_scap((int32_t) val));
 }
 
 FILLER(sys_autofill, true)

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/linkat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/linkat.bpf.c
@@ -83,7 +83,7 @@ int BPF_PROG(linkat_x,
 
 	/* Parameter 6: flags (type: PT_FLAGS32) */
 	unsigned long flags = extract__syscall_argument(regs, 4);
-	auxmap__store_u32_param(auxmap, linkat_flags_to_scap(flags));
+	auxmap__store_u32_param(auxmap, linkat_flags_to_scap((int32_t) flags));
 
 	/*=============================== COLLECT PARAMETERS  ===========================*/
 

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlinkat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlinkat.bpf.c
@@ -71,7 +71,7 @@ int BPF_PROG(unlinkat_x,
 
 	/* Parameter 4: flags (type: PT_FLAGS32) */
 	unsigned long flags = extract__syscall_argument(regs, 2);
-	auxmap__store_u32_param(auxmap, unlinkat_flags_to_scap(flags));
+	auxmap__store_u32_param(auxmap, unlinkat_flags_to_scap((int32_t) flags));
 
 	/*=============================== COLLECT PARAMETERS  ===========================*/
 

diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
@@ -3608,7 +3608,7 @@ int f_sys_unlinkat_x(struct event_filler_arguments *args)
 
 	/* Parameter 4: flags (type: PT_FLAGS32) */
 	syscall_get_arguments_deprecated(args, 2, 1, &val);
-	res = val_to_ring(args, unlinkat_flags_to_scap(val), 0, false, 0);
+	res = val_to_ring(args, unlinkat_flags_to_scap((int32_t) val), 0, false, 0);
 	CHECK_RES(res);
 
 	return add_sentinel(args);
@@ -3666,7 +3666,7 @@ int f_sys_linkat_x(struct event_filler_arguments *args)
 	 * Note that we convert them into the ppm portable representation before pushing them to the ring
 	 */
 	syscall_get_arguments_deprecated(args, 4, 1, &flags);
-	res = val_to_ring(args, linkat_flags_to_scap(flags), 0, false, 0);
+	res = val_to_ring(args, linkat_flags_to_scap((int32_t) flags), 0, false, 0);
 	CHECK_RES(res);
 
 	return add_sentinel(args);

diff --git a/driver/ppm_flag_helpers.h b/driver/ppm_flag_helpers.h
@@ -1756,7 +1756,7 @@ static __always_inline uint32_t memfd_create_flags_to_scap(uint32_t flags)
 return res;
 }
 
-static __always_inline uint32_t unlinkat_flags_to_scap(unsigned long flags)
+static __always_inline uint32_t unlinkat_flags_to_scap(int32_t flags)
 {
 	uint32_t res = 0;
 
@@ -1766,7 +1766,7 @@ static __always_inline uint32_t unlinkat_flags_to_scap(unsigned long flags)
 	return res;
 }
 
-static __always_inline uint32_t linkat_flags_to_scap(unsigned long flags)
+static __always_inline uint32_t linkat_flags_to_scap(int32_t flags)
 {
 	uint32_t res = 0;