fix(bpf): prctlX correctly read GET_CHILD_SUBREAPER arg2 value

The prctl GET_CHILD_SUBREAPER function stores the PID as `(int *) arg2`. Previously, the arg2 value has been read as `unsigned long` causing endianess issue on s390x resulting in test case failures. Change this to read an integer value similar as in modern BPF. Signed-off-by: Hendrik Brueckner <[email protected]>
falcosecurity · Jun 13, 2023 · 9cfa68c · 9cfa68c
1 parent 9bc4a5b
commit 9cfa68c
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -6676,6 +6676,7 @@ FILLER(sys_prctl_x, true)
 	unsigned long option;
 	unsigned long arg2;
 	unsigned long arg2_int;
+	int reaper_attr;
 	int res;
 	long retval;
 
@@ -6715,8 +6716,9 @@ FILLER(sys_prctl_x, true)
 			/*
 			 * arg2_int
 			 */
-			bpf_probe_read_user(&arg2_int,sizeof(arg2_int),(void*)arg2);
-			res = bpf_push_s64_to_ring(data, (int)arg2_int);
+			reaper_attr = 0;
+			bpf_probe_read_user(&reaper_attr, sizeof(reaper_attr), (void*)arg2);
+			res = bpf_push_s64_to_ring(data, (s64)reaper_attr);
 			CHECK_RES(res);
 			break;
 		case PPM_PR_SET_CHILD_SUBREAPER: