Skip to content

Commit e3d558a

Browse files
committed
Avoid calling detect_syscall_arch in PTRACE_EVENT_EXIT
1 parent dfbf971 commit e3d558a

1 file changed

Lines changed: 6 additions & 2 deletions

File tree

src/RecordSession.cc

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -150,8 +150,12 @@ static bool handle_ptrace_exit_event(RecordTask* t) {
150150
// highly improbable.
151151
// Record the syscall-entry event that we otherwise failed to record.
152152
t->canonicalize_regs(t->arch());
153-
SyscallEvent event(t->regs().original_syscallno(),
154-
t->detect_syscall_arch());
153+
// Assume it's a native-arch syscall. If it isn't, it doesn't matter
154+
// all that much since we aren't actually going to do anything with it
155+
// in this task.
156+
// Avoid calling detect_syscall_arch here since it could fail if the
157+
// task is already completely dead and gone.
158+
SyscallEvent event(t->regs().original_syscallno(), t->arch());
155159
event.state = ENTERING_SYSCALL;
156160
t->record_event(event);
157161
}

0 commit comments

Comments
 (0)