Skip to content

Commit 355a51a

Browse files
Rohith-RajuRohith-Raju
committed
update: seperate getrlimit and setrlimit
Signed-off-by: rohith-raju <rohithraju488@gmail.com>
1 parent 8acaba9 commit 355a51a

4 files changed

Lines changed: 113 additions & 9 deletions

File tree

‎driver/bpf/fillers.h‎

Lines changed: 44 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1035,7 +1035,48 @@ FILLER(sys_getrlimit_setrlimit_e, true)
10351035
return bpf_push_u8_to_ring(data, rlimit_resource_to_scap(resource));
10361036
}
10371037

1038-
FILLER(sys_getrlimit_setrlrimit_x, true)
1038+
FILLER(sys_getrlimit_x, true)
1039+
{
1040+
unsigned long val;
1041+
long retval;
1042+
s64 cur;
1043+
s64 max;
1044+
int res;
1045+
1046+
/* Parameter 1: ret (type: PT_ERRNO) */
1047+
retval = bpf_syscall_get_retval(data->ctx);
1048+
res = bpf_push_s64_to_ring(data, retval);
1049+
CHECK_RES(res);
1050+
1051+
/*
1052+
* Copy the user structure and extract cur and max
1053+
*/
1054+
if(retval >= 0 || data->state->tail_ctx.evt_type == PPME_SYSCALL_SETRLIMIT_X)
1055+
{
1056+
struct rlimit rl;
1057+
1058+
val = bpf_syscall_get_argument(data, 1);
1059+
if(bpf_probe_read_user(&rl, sizeof(rl), (void *)val))
1060+
return PPM_FAILURE_INVALID_USER_MEMORY;
1061+
1062+
cur = rl.rlim_cur;
1063+
max = rl.rlim_max;
1064+
}
1065+
else
1066+
{
1067+
cur = -1;
1068+
max = -1;
1069+
}
1070+
1071+
/* Parameter 2: cur (type: PT_ERRNO) */
1072+
res = bpf_push_s64_to_ring(data, cur);
1073+
CHECK_RES(res);
1074+
1075+
/* Parameter 3: max (type: PT_ERRNO) */
1076+
return bpf_push_s64_to_ring(data, max);
1077+
}
1078+
1079+
FILLER(sys_setrlrimit_x, true)
10391080
{
10401081
unsigned long val;
10411082
long retval;
@@ -1071,11 +1112,11 @@ FILLER(sys_getrlimit_setrlrimit_x, true)
10711112
max = -1;
10721113
}
10731114

1074-
/* Parameter 3: resource (type: PT_ERRNO) */
1115+
/* Parameter 3: cur (type: PT_ERRNO) */
10751116
res = bpf_push_s64_to_ring(data, cur);
10761117
CHECK_RES(res);
10771118

1078-
/* Parameter 4: resource (type: PT_ERRNO) */
1119+
/* Parameter 4: max (type: PT_ERRNO) */
10791120
return bpf_push_s64_to_ring(data, max);
10801121
}
10811122

‎driver/fillers_table.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,9 @@ const struct ppm_event_entry g_ppm_events[PPM_EVENT_MAX] = {
145145
[PPME_SYSCALL_INOTIFY_INIT_E] = {FILLER_REF(sys_inotify_init_e)},
146146
[PPME_SYSCALL_INOTIFY_INIT_X] = {FILLER_REF(sys_single_x)},
147147
[PPME_SYSCALL_GETRLIMIT_E] = {FILLER_REF(sys_getrlimit_setrlimit_e)},
148-
[PPME_SYSCALL_GETRLIMIT_X] = {FILLER_REF(sys_getrlimit_setrlrimit_x)},
148+
[PPME_SYSCALL_GETRLIMIT_X] = {FILLER_REF(sys_getrlimit_x)},
149149
[PPME_SYSCALL_SETRLIMIT_E] = {FILLER_REF(sys_getrlimit_setrlimit_e)},
150-
[PPME_SYSCALL_SETRLIMIT_X] = {FILLER_REF(sys_getrlimit_setrlrimit_x)},
150+
[PPME_SYSCALL_SETRLIMIT_X] = {FILLER_REF(sys_setrlrimit_x)},
151151
[PPME_SYSCALL_PRLIMIT_E] = {FILLER_REF(sys_prlimit_e)},
152152
[PPME_SYSCALL_PRLIMIT_X] = {FILLER_REF(sys_prlimit_x)},
153153
[PPME_DROP_E] = {FILLER_REF(sched_drop)},

‎driver/ppm_fillers.c‎

Lines changed: 65 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4081,7 +4081,69 @@ int f_sys_getrlimit_setrlimit_e(struct event_filler_arguments *args)
40814081
return add_sentinel(args);
40824082
}
40834083

4084-
int f_sys_getrlimit_setrlrimit_x(struct event_filler_arguments *args)
4084+
int f_sys_getrlimit_x(struct event_filler_arguments *args) {
4085+
unsigned long val;
4086+
int res;
4087+
int64_t retval;
4088+
struct rlimit rl;
4089+
#ifdef CONFIG_COMPAT
4090+
struct compat_rlimit compat_rl;
4091+
#endif
4092+
int64_t cur;
4093+
int64_t max;
4094+
4095+
/* Parameter 1: res */
4096+
retval = (int64_t)(long)syscall_get_return_value(current, args->regs);
4097+
res = val_to_ring(args, retval, 0, false, 0);
4098+
CHECK_RES(res);
4099+
4100+
/*
4101+
* Copy the user structure and extract cur and max
4102+
*/
4103+
if(retval >= 0 || args->event_type == PPME_SYSCALL_SETRLIMIT_X)
4104+
{
4105+
syscall_get_arguments_deprecated(args, 1, 1, &val);
4106+
4107+
#ifdef CONFIG_COMPAT
4108+
if(!args->compat)
4109+
{
4110+
#endif
4111+
if(unlikely(ppm_copy_from_user(&rl, (const void __user *)val, sizeof(struct rlimit))))
4112+
return PPM_FAILURE_INVALID_USER_MEMORY;
4113+
cur = rl.rlim_cur;
4114+
max = rl.rlim_max;
4115+
#ifdef CONFIG_COMPAT
4116+
}
4117+
else
4118+
{
4119+
if(unlikely(ppm_copy_from_user(&compat_rl, (const void __user *)compat_ptr(val),
4120+
sizeof(struct compat_rlimit))))
4121+
return PPM_FAILURE_INVALID_USER_MEMORY;
4122+
cur = compat_rl.rlim_cur;
4123+
max = compat_rl.rlim_max;
4124+
}
4125+
#endif
4126+
}
4127+
else
4128+
{
4129+
cur = -1;
4130+
max = -1;
4131+
}
4132+
4133+
/* Parameter 2: cur */
4134+
res = val_to_ring(args, cur, 0, false, 0);
4135+
CHECK_RES(res);
4136+
4137+
/* Parameter 3: max */
4138+
res = val_to_ring(args, max, 0, false, 0);
4139+
CHECK_RES(res);
4140+
4141+
return add_sentinel(args);
4142+
}
4143+
4144+
4145+
4146+
int f_sys_setrlrimit_x(struct event_filler_arguments *args)
40854147
{
40864148
unsigned long val;
40874149
int res;
@@ -4129,11 +4191,11 @@ int f_sys_getrlimit_setrlrimit_x(struct event_filler_arguments *args)
41294191
max = -1;
41304192
}
41314193

4132-
/* Parameter 3: resource */
4194+
/* Parameter 3: cur */
41334195
res = val_to_ring(args, cur, 0, false, 0);
41344196
CHECK_RES(res);
41354197

4136-
/* Parameter 4: resource */
4198+
/* Parameter 4: max */
41374199
res = val_to_ring(args, max, 0, false, 0);
41384200
CHECK_RES(res);
41394201

‎driver/ppm_fillers.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,8 @@ or GPL2.txt for full copies of the license.
6767
FN(sys_pwritev_e) \
6868
FN(sys_nanosleep_e) \
6969
FN(sys_getrlimit_setrlimit_e) \
70-
FN(sys_getrlimit_setrlrimit_x) \
70+
FN(sys_getrlimit_x) \
71+
FN(sys_setrlrimit_x) \
7172
FN(sys_prlimit_e) \
7273
FN(sys_prlimit_x) \
7374
FN(sched_switch_e) \

0 commit comments

Comments
 (0)