Open gamawangzi opened 2 months ago
`int trace_file_rename(struct pt_regs* ctx){
struct dentry old_dentry = (struct dentry )PT_REGS_PARM1(ctx); struct dentry new_dentry = (struct dentry )PT_REGS_PARM3(ctx);
struct qstr d_name_old = old_dentry->d_name; char filename_old[DNAME_INLINE_LEN]; bpf_probe_read_user(filename_old, sizeof(filename_old), d_name_old.name); bpf_trace_printk("this is d_name_old: %s\n", d_name_old.name); struct qstr d_name_new = new_dentry->d_name; char filename_new[DNAME_INLINE_LEN]; bpf_probe_read_user(filename_new, sizeof(filename_new), d_name_new.name); bpf_trace_printk("this is d_name_new: %s\n", d_name_new.name);
}`
I can get the infomation of "new_dentry = (struct dentry *)PT_REGS_PARM3(ctx)" ,but "the d_name_old print" always is a empty ("")
`int trace_file_rename(struct pt_regs* ctx){
struct dentry old_dentry = (struct dentry )PT_REGS_PARM1(ctx); struct dentry new_dentry = (struct dentry )PT_REGS_PARM3(ctx);
}`
I can get the infomation of "new_dentry = (struct dentry *)PT_REGS_PARM3(ctx)" ,but "the d_name_old print" always is a empty ("")