bpf: Do not attempt to read blob_data if the length is 0

Signed-off-by: Daiki Ueno <[email protected]>
latchset · Oct 2, 2023 · 8836666 · 8836666
1 parent b8afd47
commit 8836666
Showing 1 changed file with 17 additions and 13 deletions.
diff --git a/agent/src/bpf/audit.bpf.c b/agent/src/bpf/audit.bpf.c
@@ -242,14 +242,6 @@ record_blob_data (struct pt_regs *ctx)
       return err;
     }
 
-  long value_ptr;
-  err = bpf_usdt_arg (ctx, 2, &value_ptr);
-  if (err < 0)
-    {
-      DEBUG ("unable to get the third argument: %ld\n", err);
-      return err;
-    }
-
   long value_size;
   err = bpf_usdt_arg (ctx, 3, &value_size);
   if (err < 0)
@@ -281,12 +273,24 @@ record_blob_data (struct pt_regs *ctx)
       goto error;
     }
 
-  value_size &= (VALUE_SIZE - 1);
-  err = bpf_probe_read_user (event->value, value_size, (void *)value_ptr);
-  if (err < 0)
+  if (value_size > 0)
     {
-      DEBUG ("unable to read event data: %ld\n", err);
-      goto error;
+      long value_ptr;
+
+      err = bpf_usdt_arg (ctx, 2, &value_ptr);
+      if (err < 0)
+	{
+	  DEBUG ("unable to get the third argument: %ld\n", err);
+	  goto error;
+	}
+
+      value_size &= (VALUE_SIZE - 1);
+      err = bpf_probe_read_user (event->value, value_size, (void *)value_ptr);
+      if (err < 0)
+	{
+	  DEBUG ("unable to read event data: %ld\n", err);
+	  goto error;
+	}
     }
 
   event->size = value_size;