[PATCH] pathtrace: Fix fanotify_mark path tracing on 32-bit architectures

[Nikolay Marchuk]

The fanotify_mark syscall takes a 64-bit mask, and on 32-bit
architectures it is split up into two syscall arguments.

* pathtrace.c (pathtrace_match_set): Use getllval to properly decode arguments
after mask.
---
 pathtrace.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pathtrace.c b/pathtrace.c
index 9f3674a..26a52fe 100644
--- a/pathtrace.c
+++ b/pathtrace.c
@@ -241,10 +241,13 @@ pathtrace_match_set(struct tcb *tcp, struct path_set *set)
 
 
 	case SEN_fanotify_mark:
-		/* x, x, x, fd, path */
-		return fdmatch(tcp, tcp->u_arg[3], set) ||
-			upathmatch(tcp, tcp->u_arg[4], set);
-
+	{
+		/* x, x, mask (64 bit), fd, path */
+		unsigned long long mask = 0;
+		int argn = getllval(tcp, &mask, 2);
+		return fdmatch(tcp, tcp->u_arg[argn], set) ||
+			upathmatch(tcp, tcp->u_arg[argn + 1], set);
+	}
 	case SEN_oldselect:
 	case SEN_pselect6:
 	case SEN_select:
-- 
2.1.4