fix(bpf): add tail call to sendmmsg filler

Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
falcosecurity · Feb 4, 2025 · 356d27a · 356d27a
1 parent e1637e4
commit 356d27a
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 19 deletions.
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -4529,31 +4529,18 @@ FILLER(sys_sendmmsg_x, true) {
 	uint16_t size = 0;
 	int addrlen;
 	int err = 0;
+	int fd = 0;
 	int res;
 	long retval = bpf_syscall_get_retval(data->ctx);
-	int fd = bpf_syscall_get_argument(data, 0);
 
 	if(retval < 0) {
-		/* Parameter 1: res (type: PT_ERRNO) */
-		res = bpf_push_s64_to_ring(data, retval);
-		CHECK_RES(res);
-
-		/* Parameter 2: fd (type: PT_BYTEBUF) */
-		res = bpf_push_s64_to_ring(data, fd);
-		CHECK_RES(res);
-
-		/* Parameter 3: size (type: PT_UINT32) */
-		bpf_push_u32_to_ring(data, 0);
-		CHECK_RES(res);
-
-		/* Parameter 4: data (type: PT_BYTEBUF) */
-		bpf_push_empty_param(data);
-		CHECK_RES(res);
-
-		/* Parameter 5: tuple (type: PT_SOCKTUPLE) */
-		return bpf_push_empty_param(data);
+		bpf_tail_call(data->ctx, &tail_map, PPM_FILLER_sys_sendmmsg_x_failure);
+		bpf_printk("Can't tail call f_sys_sendmmsg_x_failure filler\n");
+		return PPM_FAILURE_BUG;
 	}
 
+	fd = bpf_syscall_get_argument(data, 0);
+
 	mmh_ptr = (struct mmsghdr *)bpf_syscall_get_argument(data, 1);
 	vlen = bpf_syscall_get_argument(data, 2);
 
@@ -4612,6 +4599,32 @@ FILLER(sys_sendmmsg_x, true) {
 	return res;
 }
 
+FILLER(sys_sendmmsg_x_failure, true) {
+	int res;
+
+	long retval = bpf_syscall_get_retval(data->ctx);
+	int fd = bpf_syscall_get_argument(data, 0);
+
+	/* Parameter 1: res (type: PT_ERRNO) */
+	res = bpf_push_s64_to_ring(data, retval);
+	CHECK_RES(res);
+
+	/* Parameter 2: fd (type: PT_BYTEBUF) */
+	res = bpf_push_s64_to_ring(data, fd);
+	CHECK_RES(res);
+
+	/* Parameter 3: size (type: PT_UINT32) */
+	bpf_push_u32_to_ring(data, 0);
+	CHECK_RES(res);
+
+	/* Parameter 4: data (type: PT_BYTEBUF) */
+	bpf_push_empty_param(data);
+	CHECK_RES(res);
+
+	/* Parameter 5: tuple (type: PT_SOCKTUPLE) */
+	return bpf_push_empty_param(data);
+}
+
 FILLER(sys_creat_e, true) {
 	unsigned long val;
 	unsigned long mode;

diff --git a/driver/ppm_fillers.h b/driver/ppm_fillers.h
@@ -43,6 +43,7 @@ or GPL2.txt for full copies of the license.
 	FN(sys_sendmsg_e)                    \
 	FN(sys_sendmsg_x)                    \
 	FN(sys_sendmmsg_x)                   \
+	FN(sys_sendmmsg_x_failure)           \
 	FN(sys_recv_x)                       \
 	FN(sys_recvfrom_x)                   \
 	FN(sys_recvmsg_x)                    \