fix(driver): unify behavior of kmod and old bpf probe to the new one …

…when reading clone3 clone_args. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
falcosecurity · May 8, 2024 · b2adf00 · b2adf00
1 parent afd7d80
commit b2adf00
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 4 deletions.
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -2600,9 +2600,12 @@ FILLER(proc_startupdate_3, true)
 			flags = bpf_syscall_get_argument(data, 0);
 			if (bpf_probe_read_user(&cl_args, sizeof(struct clone_args), (void *)flags)) 
 			{
-				return PPM_FAILURE_INVALID_USER_MEMORY;
+				flags = 0;
+			}
+			else
+			{
+				flags = cl_args.flags;
 			}
-			flags = cl_args.flags;
 #else
 		flags = 0;
 #endif

diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
@@ -1207,9 +1207,12 @@ int f_proc_startupdate(struct event_filler_arguments *args)
 			res = ppm_copy_from_user(&cl_args, (void *)val, sizeof(struct clone_args));
 			if (unlikely(res != 0))
 			{
-				return PPM_FAILURE_INVALID_USER_MEMORY;
+				val = 0;
+			}
+			else
+			{
+				val = cl_args.flags;
 			}
-			val = cl_args.flags;
 #else
 			val = 0;
 #endif