From c5ef17c2b728eae057fae43db020d1023e5cc634 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 30 May 2026 22:16:33 +0300 Subject: test(pipe): lock in pipe/pipe2 IPC classification and fd-pair exit reads Audit of pipe(2)/pipe2(2) (task dx) confirmed the tracing implementation is correct: KindPipe (not KindFd, since args[0] is an output ptr to int[2], not an fd), FamilyIPC, and an UNCLASSIFIED int return. Enter stashes the output ptr (flags=0 for pipe, args[1] for pipe2); exit reads the fd pair via bpf_probe_read_user guarded by ret==0, mirroring the socketpair pipe-like pattern. The only gaps were missing lock-in tests, now added: - codegen: assert the exit handler reads the fd pair from the stashed output buffer (ret==0 guard, bpf_probe_read_user, fd0/fd1) and that the flag-less pipe variant hardcodes flags=0 and never reads args[1]. - classify: pipe/pipe2 are never KindFd and stay UNCLASSIFIED on ret. - runtime: a failed pipe (ret==-1) tracks no descriptors and attaches no file. Co-Authored-By: Claude Opus 4.8 --- internal/generate/classify_test.go | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) (limited to 'internal/generate/classify_test.go') diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go index 3aea4fe..514c2e8 100644 --- a/internal/generate/classify_test.go +++ b/internal/generate/classify_test.go @@ -890,6 +890,41 @@ func TestClassifyExitPipe2(t *testing.T) { } } +// TestClassifyPipeNotFd locks in that pipe(2) is NOT classified as KindFd. +// pipe's args[0] is an OUTPUT pointer to int[2] (the two created fds are written +// there by the kernel and are only valid AFTER the syscall returns), NOT an fd +// argument. Capturing args[0] as an fd would attribute the pipe to a bogus +// descriptor; pipe must use the pipe-specific KindPipe path that reads the fd +// pair from the userspace buffer at exit. Same pitfall as socketpair (task c00). +func TestClassifyPipeNotFd(t *testing.T) { + for _, name := range []string{"pipe", "pipe2"} { + r := classifyFromData(t, map[string]string{ + "pipe": FormatPipe, + "pipe2": FormatPipe2, + }[name]) + if r.Kind == KindFd { + t.Fatalf("%s classified as KindFd: args[0] is an output ptr, not an fd", name) + } + if r.Kind != KindPipe { + t.Errorf("%s: got kind %d, want KindPipe", name, r.Kind) + } + } +} + +// TestClassifyPipeUnclassifiedRet locks in that the pipe and pipe2 exit +// tracepoints stay UNCLASSIFIED. pipe(2)/pipe2(2) return int (0 on success, +// -1 on error) — a status code, NOT a transferred byte count. They must not be +// in retClassifications and must never map to READ/WRITE/TRANSFER, which would +// misreport phantom bytes. The created fds are surfaced via fd0/fd1 in the +// pipe_event, not via the return value. +func TestClassifyPipeUnclassifiedRet(t *testing.T) { + for _, name := range []string{"sys_exit_pipe", "sys_exit_pipe2"} { + if got := ClassifyRet(name); got != Unclassified { + t.Errorf("ClassifyRet(%s) = %q, want UNCLASSIFIED", name, got) + } + } +} + func TestClassifyEventfd(t *testing.T) { r := classifyFromData(t, FormatEventfd) if r.Kind != KindEventfd { -- cgit v1.2.3