fix(modern_bpf): fix wrong sign when getting quotactl cmd arg

Signed-off-by: Roberto Scolaro <[email protected]>
falcosecurity · Jan 29, 2024 · ceda218 · ceda218
1 parent eb09ef2
commit ceda218
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/quotactl.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/quotactl.bpf.c
@@ -94,7 +94,7 @@ int BPF_PROG(quotactl_x,
 	unsigned long special_pointer = extract__syscall_argument(regs, 1);
 	auxmap__store_charbuf_param(auxmap, special_pointer, MAX_PATH, USER);
 
-	int32_t cmd = (int32_t)extract__syscall_argument(regs, 0);
+	uint32_t cmd = (uint32_t)extract__syscall_argument(regs, 0);
 	uint16_t scap_cmd = quotactl_cmd_to_scap(cmd);
 
 	/* The `addr` argument is the address of an optional, command-