From 7fb497c435596a36c0fb0bd0ecae2a84793bcc70 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Mon, 18 May 2026 14:30:26 +0300 Subject: j6: account bytes for ret-classified syscalls --- internal/eventloop_exit.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'internal/eventloop_exit.go') diff --git a/internal/eventloop_exit.go b/internal/eventloop_exit.go index 79c1b5b..a0cc675 100644 --- a/internal/eventloop_exit.go +++ b/internal/eventloop_exit.go @@ -109,9 +109,6 @@ func (e *eventLoop) handleFdExit(ep *event.Pair, fdEv *types.FdEvent) bool { if ok := e.applyFdTransferOp(ep, fdEv); !ok { return false } - if retEv, ok := ep.ExitEv.(*types.RetEvent); ok { - ep.Bytes = bytesFromRet(retEv) - } return true } @@ -315,6 +312,14 @@ func (e *eventLoop) recyclePair(ep *event.Pair, warning string) { ep.Recycle() } +func applyRetBytes(ep *event.Pair) { + retEv, ok := ep.ExitEv.(*types.RetEvent) + if !ok { + return + } + ep.Bytes = bytesFromRet(retEv) +} + // dropMalformedRawEvent records a warning when a raw BPF event cannot be // decoded, keeping the error visible without crashing the event loop. func (e *eventLoop) dropMalformedRawEvent(evType types.EventType, raw []byte) { -- cgit v1.2.3