fix(driver/kmod): always send fds to userspace in poll/ppoll syscall exit

driver/ppm_fillers.c

@@ -3294,7 +3294,6 @@ static int poll_parse_fds(struct event_filler_arguments *args, bool enter_event)
 	char *targetbuf;
 	unsigned long val;
 	unsigned long nfds;
-	unsigned long fds_count;
 	uint32_t j;
 	uint32_t pos;
 	uint16_t flags;
@@ -3336,30 +3335,21 @@ static int poll_parse_fds(struct event_filler_arguments *args, bool enter_event)
 
 	pos = 2;
 	targetbuf = args->str_storage + nfds * sizeof(struct pollfd);
-	fds_count = 0;
 
 	/* Copy each fd into the temporary buffer */
 	for (j = 0; j < nfds; j++) {
 		if (enter_event) {
 			flags = poll_events_to_scap(fds[j].events);
 		} else {
-			/*
-			 * If it's an exit event, we copy only the fds that
-			 * returned something
-			 */
-			if (!fds[j].revents)
-				continue;
-
 			flags = poll_events_to_scap(fds[j].revents);
 		}
 
 		*(int64_t *)(targetbuf + pos) = (int64_t)fds[j].fd;
 		*(int16_t *)(targetbuf + pos + 8) = flags;
 		pos += 10;
-		++fds_count;
 	}
 
-	*(uint16_t *)(targetbuf) = (uint16_t)fds_count;
+	*(uint16_t *)(targetbuf) = (uint16_t)nfds;
 
 	return val_to_ring(args, (uint64_t)(unsigned long)targetbuf, pos, false, 0);
 }

driver/ppm_flag_helpers.h

@@ -25,6 +25,7 @@ or GPL2.txt for full copies of the license.
 #include <linux/capability.h>
 #include <linux/eventpoll.h>
 #include <linux/prctl.h>
+#include <linux/splice.h>
 #ifdef __NR_finit_module
 #include <uapi/linux/module.h>
 #endif

test/drivers/test_suites/syscall_exit_suite/poll_x.cpp

@@ -63,17 +63,7 @@ TEST(SyscallExit, pollX_success)
 	evt_test->assert_numeric_param(1, (int64_t)0);
 
 	/* Parameter 2: fds (type: PT_FDLIST) */
-	if(evt_test->is_kmod_engine())
-	{
-		/* The logic in the kmod is slightly different: we collect data only if `revents != 0`
-		 * https://github.com/falcosecurity/libs/blob/master/driver/ppm_fillers.c#L3322-L3326
-		 */
-		evt_test->assert_fd_list(2, NULL, 0);
-	}
-	else
-	{
-		evt_test->assert_fd_list(2, (struct fd_poll *)&expected, 2);
-	}
+	evt_test->assert_fd_list(2, (struct fd_poll *)&expected, 2);
 
 	/*=============================== ASSERT PARAMETERS  ===========================*/
 

test/drivers/test_suites/syscall_exit_suite/process_vm_readv_x.cpp

@@ -14,7 +14,7 @@ TEST(SyscallExit, process_vm_readvX_failure)
 	iovec iov[] = {{buf, 16}};
 	int32_t iovcnt = 7;
 
-	size_t res = syscall(__NR_process_vm_readv, getpid(), iov, iovcnt, iov, iovcnt, 0);
+	size_t res = syscall(__NR_process_vm_readv, getpid(), iov, iovcnt, iov, iovcnt, 1);
 	assert_syscall_state(SYSCALL_FAILURE, "process_vm_readv", res, EQUAL, -1);
 
 	/*=============================== TRIGGER SYSCALL ===========================*/