pathtrace: fix fanotify_mark path tracing on 32-bit architectures

The fanotify_mark syscall takes a 64-bit mask, and on 32-bit
architectures it is split up into two syscall arguments.

* pathtrace.c (pathtrace_match_set): Use getllval to properly decode
arguments after mask.

diff --git a/pathtrace.c b/pathtrace.c
index 9f3674a46640f93a81f866b59f0e3b02566da315..26a52fecd6034a9838985aa0f4d13b17c12fac4c 100644 (file)
--- a/pathtrace.c
+++ b/pathtrace.c
@@ -241,10 +241,13 @@ pathtrace_match_set(struct tcb *tcp, struct path_set *set)
 
 
        case SEN_fanotify_mark:
-               /* x, x, x, fd, path */
-               return fdmatch(tcp, tcp->u_arg[3], set) ||
-                       upathmatch(tcp, tcp->u_arg[4], set);
-
+       {
+               /* x, x, mask (64 bit), fd, path */
+               unsigned long long mask = 0;
+               int argn = getllval(tcp, &mask, 2);
+               return fdmatch(tcp, tcp->u_arg[argn], set) ||
+                       upathmatch(tcp, tcp->u_arg[argn + 1], set);
+       }
        case SEN_oldselect:
        case SEN_pselect6:
        case SEN_select: