fix: use get_syscall_return_value when allowed

Signed-off-by: Andrea Terzolo <[email protected]>
falcosecurity · Nov 8, 2024 · 7cb90b6 · 7cb90b6
1 parent a5a387a
commit 7cb90b6
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 8 deletions.
diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp
@@ -706,10 +706,12 @@ bool sinsp_parser::reset(sinsp_evt *evt) {
 		                                  (evt->get_info()->params[0].name[0] == 'f' &&
 		                                   evt->get_info()->params[0].name[1] == 'd' &&
 		                                   evt->get_info()->params[0].name[2] == '\0'))) {
-			int64_t res = evt->get_syscall_return_value();
+			if(evt->has_return_value()) {
+				int64_t res = evt->get_syscall_return_value();
 
-			if(res < 0) {
-				evt->set_errorcode(-(int32_t)res);
+				if(res < 0) {
+					evt->set_errorcode(-(int32_t)res);
+				}
 			}
 		}
 
@@ -4384,7 +4386,7 @@ void sinsp_parser::parse_prlimit_exit(sinsp_evt *evt) {
 				//
 				// Extract the tid and look for its process info
 				//
-				tid = enter_evt->get_syscall_return_value();
+				tid = enter_evt->get_param(0)->as<int64_t>();
 
 				if(tid == 0) {
 					tid = evt->get_tid();
@@ -5238,7 +5240,6 @@ void sinsp_parser::parse_memfd_create_exit(sinsp_evt *evt, scap_fd_type type) {
 	}
 
 	/* ret (fd) */
-	ASSERT(evt->get_param_info(0)->type == PT_FD);
 	fd = evt->get_syscall_return_value();
 
 	/* name */
@@ -5271,7 +5272,6 @@ void sinsp_parser::parse_pidfd_open_exit(sinsp_evt *evt) {
 	}
 
 	/* ret (fd) */
-	ASSERT(evt->get_param_info(0)->type == PT_FD);
 	fd = evt->get_syscall_return_value();
 
 	/* pid (fd) */
@@ -5305,7 +5305,6 @@ void sinsp_parser::parse_pidfd_getfd_exit(sinsp_evt *evt) {
 	}
 
 	/* ret (fd) */
-	ASSERT(evt->get_param_info(0)->type == PT_FD);
 	fd = evt->get_syscall_return_value();
 
 	/* pidfd */

diff --git a/userspace/libsinsp/sinsp_filtercheck_event.cpp b/userspace/libsinsp/sinsp_filtercheck_event.cpp
@@ -1649,7 +1649,7 @@ uint8_t* sinsp_filter_check_event::extract_single(sinsp_evt* evt,
 				}
 
 				// If PPM_O_TMPFILE is set and syscall is successful the file is created
-				if(flags & PPM_O_TMPFILE) {
+				if((flags & PPM_O_TMPFILE) && evt->has_return_value()) {
 					int64_t retval = evt->get_syscall_return_value();
 
 					if(retval >= 0) {