diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp index d047ceb1cc..1c119dad7e 100644 --- a/userspace/libsinsp/parsers.cpp +++ b/userspace/libsinsp/parsers.cpp @@ -706,10 +706,12 @@ bool sinsp_parser::reset(sinsp_evt *evt) { (evt->get_info()->params[0].name[0] == 'f' && evt->get_info()->params[0].name[1] == 'd' && evt->get_info()->params[0].name[2] == '\0'))) { - int64_t res = evt->get_syscall_return_value(); + if(evt->has_return_value()) { + int64_t res = evt->get_syscall_return_value(); - if(res < 0) { - evt->set_errorcode(-(int32_t)res); + if(res < 0) { + evt->set_errorcode(-(int32_t)res); + } } } @@ -4384,7 +4386,7 @@ void sinsp_parser::parse_prlimit_exit(sinsp_evt *evt) { // // Extract the tid and look for its process info // - tid = enter_evt->get_syscall_return_value(); + tid = enter_evt->get_param(0)->as(); if(tid == 0) { tid = evt->get_tid(); @@ -5238,7 +5240,6 @@ void sinsp_parser::parse_memfd_create_exit(sinsp_evt *evt, scap_fd_type type) { } /* ret (fd) */ - ASSERT(evt->get_param_info(0)->type == PT_FD); fd = evt->get_syscall_return_value(); /* name */ @@ -5271,7 +5272,6 @@ void sinsp_parser::parse_pidfd_open_exit(sinsp_evt *evt) { } /* ret (fd) */ - ASSERT(evt->get_param_info(0)->type == PT_FD); fd = evt->get_syscall_return_value(); /* pid (fd) */ @@ -5305,7 +5305,6 @@ void sinsp_parser::parse_pidfd_getfd_exit(sinsp_evt *evt) { } /* ret (fd) */ - ASSERT(evt->get_param_info(0)->type == PT_FD); fd = evt->get_syscall_return_value(); /* pidfd */ diff --git a/userspace/libsinsp/sinsp_filtercheck_event.cpp b/userspace/libsinsp/sinsp_filtercheck_event.cpp index 78889b6120..dbb376ee1d 100644 --- a/userspace/libsinsp/sinsp_filtercheck_event.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_event.cpp @@ -1649,7 +1649,7 @@ uint8_t* sinsp_filter_check_event::extract_single(sinsp_evt* evt, } // If PPM_O_TMPFILE is set and syscall is successful the file is created - if(flags & PPM_O_TMPFILE) { + if((flags & PPM_O_TMPFILE) && evt->has_return_value()) { int64_t retval = evt->get_syscall_return_value(); if(retval >= 0) {