decoding of input/output args ?

Mike Frysinger vapier at
Wed Aug 19 19:17:39 UTC 2015

some syscalls have arguments that are read/write.  for example, getsockopt 
passes in a pointer to a length that has to be set correctly first, and then
the kernel will adjust it when returning.  being able to see both values is
important when getting an error so you can see what the user sent up and what
the kernel sent back.

are there examples in strace to look at ?  perhaps something like:
getsockopt(4, SOL_IP, IPT_SO_GET_ENTRIES, "...", [2900->2804]) = 0
and when you get an error it'd be:
getsockopt(4, SOL_IP, IPT_SO_GET_ENTRIES, 0x12345, [2900->2900]) = EINVAL
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <>

More information about the Strace-devel mailing list