diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index 329f0bcaa7..27dac483d4 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -7312,12 +7312,7 @@ FILLER(sys_newfstatat_x, true) res = bpf_val_to_ring(data, val); CHECK_RES(res); - /* Parameter 4: stat (type: PT_BYTEBUF) */ - /*val = bpf_syscall_get_argument(data, 2); - res = bpf_push_u32_to_ring(data, val); - CHECK_RES(res);*/ - - /* Parameter 5: flags (type: PT_FLAGS32) */ + /* Parameter 4: flags (type: PT_FLAGS32) */ uint32_t flags = bpf_syscall_get_argument(data, 3); return bpf_push_u32_to_ring(data, newfstatat_flags_to_scap(flags)); } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/newfstatat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/newfstatat.bpf.c index ffd9e27187..9f63846190 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/newfstatat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/newfstatat.bpf.c @@ -71,11 +71,7 @@ int BPF_PROG(newfstatat_x, unsigned long path_pointer = extract__syscall_argument(regs, 1); auxmap__store_charbuf_param(auxmap, path_pointer, MAX_PATH, USER); - /* Parameter 4: path (type: PT_BYTEBUF) */ - /*unsigned long buf_pointer = extract__syscall_argument(regs, 2); - auxmap__store_charbuf_param(auxmap, buf_pointer);*/ - - /* Parameter 5: dev (type: PT_FLAGS32) */ + /* Parameter 4: dev (type: PT_FLAGS32) */ uint32_t flags = (uint32_t)extract__syscall_argument(regs, 3); auxmap__store_u32_param(auxmap, newfstatat_flags_to_scap(flags)); diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c index de33fd2e82..7f88746a4e 100644 --- a/driver/ppm_fillers.c +++ b/driver/ppm_fillers.c @@ -8101,12 +8101,7 @@ int f_sys_newfstatat_x(struct event_filler_arguments *args) res = val_to_ring(args, val, 0, true, 0); CHECK_RES(res); - /* Parameter 4: stat (type: PT_BYTEBUF) */ - /*syscall_get_arguments_deprecated(args, 2, 1, &val); - res = val_to_ring(args, val, 0, true, 0); - CHECK_RES(res);*/ - - /* Parameter 5: flags (type: PT_FLAGS32) */ + /* Parameter 4: flags (type: PT_FLAGS32) */ syscall_get_arguments_deprecated(args, 3, 1, &val); res = val_to_ring(args, newfstatat_flags_to_scap(val), 0, true, 0); CHECK_RES(res); diff --git a/test/drivers/test_suites/syscall_exit_suite/newfstatat_x.cpp b/test/drivers/test_suites/syscall_exit_suite/newfstatat_x.cpp index c4c8e44d73..ad72ba7b58 100644 --- a/test/drivers/test_suites/syscall_exit_suite/newfstatat_x.cpp +++ b/test/drivers/test_suites/syscall_exit_suite/newfstatat_x.cpp @@ -43,9 +43,6 @@ TEST(SyscallExit, newfstatatX_success) /* Parameter 3: name (type: PT_FSPATH) */ evt_test->assert_charbuf_param(3, pathname); - /* Parameter 4: stat (type: PT_BYTEBUF) */ - //evt_test->assert_numeric_param(4, ); - /* Parameter 4: flags (type: PT_FLAGS32) */ evt_test->assert_numeric_param(4, (uint32_t)PPM_AT_NO_AUTOMOUNT | PPM_AT_SYMLINK_NOFOLLOW); @@ -97,9 +94,6 @@ TEST(SyscallExit, newfstatatX_failure) /* Parameter 3: name (type: PT_FSPATH) */ evt_test->assert_charbuf_param(3, pathname); - /* Parameter 4: stat (type: PT_BYTEBUF) */ - //evt_test->assert_numeric_param(4, ); - /* Parameter 4: flags (type: PT_FLAGS32) */ evt_test->assert_numeric_param(4, (uint32_t)PPM_AT_NO_AUTOMOUNT | PPM_AT_SYMLINK_NOFOLLOW);