In some cases the ID for a syscall read thru the raw_syscalls tracepoint
is bogus, still needs to be investigated why, but to make the tool more
robust first try to resolve the ID to a name via libaudit and if it
fails, don't grow the table.
Cc: David Ahern <dsahern@gmail.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Namhyung Kim <namhyung@gmail.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lkml.kernel.org/n/tip-0lsokw3xor7c4ijo45u6bauh@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
{
char tp_name[128];
struct syscall *sc;
+ const char *name = audit_syscall_to_name(id, trace->audit_machine);
+
+ if (name == NULL)
+ return -1;
if (id > trace->syscalls.max) {
struct syscall *nsyscalls = realloc(trace->syscalls.table, (id + 1) * sizeof(*sc));
}
sc = trace->syscalls.table + id;
- sc->name = audit_syscall_to_name(id, trace->audit_machine);
- if (sc->name == NULL)
- return -1;
-
- sc->fmt = syscall_fmt__find(sc->name);
+ sc->name = name;
+ sc->fmt = syscall_fmt__find(sc->name);
snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name);
sc->tp_format = event_format__new("syscalls", tp_name);