On Fri, Jun 26, 2020 at 02:55:34PM -0700, Andrii Nakryiko wrote:
SNIP
> > + if (cnt_stat >= MAX_EVENT_NUM)
> > + return 0;
> > +
> > + bpf_d_path(path, paths_stat[cnt_stat], MAX_PATH_LEN);
> > + cnt_stat++;
> > + return 0;
> > +}
> > +
> > +SEC("fentry/filp_close")
> > +int BPF_PROG(prog_close, struct file *file, void *id)
> > +{
> > + pid_t pid = bpf_get_current_pid_tgid() >> 32;
> > +
> > + if (pid != my_pid)
> > + return 0;
> > +
> > + if (cnt_close >= MAX_EVENT_NUM)
> > + return 0;
> > +
> > + bpf_d_path((struct path *) &file->f_path,
> > + paths_close[cnt_close], MAX_PATH_LEN);
>
> Can you please capture the return result of bpf_d_path() (here and
> above) and validate that it's correct? That will help avoid future
> breakages if anyone changes this.
right, good idea, will add
thanks,
jirka
