From a59034b3d53300401433b8b5f2743f2f08e8f2d2 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Wed, 3 Jun 2026 07:50:57 +0300 Subject: fix(classify): assign file_setattr to FamilyFS, not Misc file_setattr(2) (Linux 6.13+) is the write counterpart of file_getattr: it sets a file's extended attributes (struct file_attr) given dirfd@arg0 + pathname@arg1 + attr-buffer + size + at_flags, and returns 0/-1 (not a byte count). Its name matches none of the fsNameMarkers substrings ("stat"/"xattr"/"chmod"/"chown") and it is absent from the fsSyscalls set, so it was falling through to FamilyMisc -- the same alarm/fanotify/file_getattr-style misclassification. Add it to the explicit family map for sibling consistency with file_getattr. This also completes the file_getattr regeneration: the prior fix (96de9ef) was generated with a partial target that updated generated_tracepoints.go but did not propagate file_getattr into the traceId2Family map in generated_types.go; a full `mage generate` here reconciles both file_getattr (1058/1059) and file_setattr (1056/1057) to FamilyFS. mage build, generate idempotency, and the internal/generate, /tracepoints, /types unit tests (incl. docs-drift sync) all pass. Co-Authored-By: Claude Opus 4.8 --- internal/generate/family.go | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'internal/generate') diff --git a/internal/generate/family.go b/internal/generate/family.go index 6a63dbb..112a48f 100644 --- a/internal/generate/family.go +++ b/internal/generate/family.go @@ -259,6 +259,17 @@ var syscallFamilies = map[string]SyscallFamily{ // live tracepoint (pathname@args[1] -> KindPathname) and the return is // 0/-1, hence UNCLASSIFIED (not a byte count). "file_getattr": FamilyFS, + + // file_setattr(2) (Linux 6.13+) is the write counterpart of file_getattr: + // it sets a file's extended attributes (struct file_attr) given + // dirfd@args[0] + pathname@args[1] + attr-buffer + size + at_flags. Like + // file_getattr it is a filesystem operation, its name ("setattr") matches + // none of the fsNameMarkers substrings ("stat"/"xattr"/"chmod"/"chown"), + // and it is absent from the fsSyscalls set, so without this explicit entry + // it falls through to FamilyMisc (the same alarm/fanotify-style + // misclassification). KIND is data-driven (pathname@args[1] -> KindPathname) + // and the return is 0/-1, hence UNCLASSIFIED. + "file_setattr": FamilyFS, } // ClassifySyscallFamily returns the high-level syscall family for a tracepoint. -- cgit v1.2.3