[nd_]syscall.execve: use user_string_quoted

diff --git a/tapset/linux/nd_syscalls.stp b/tapset/linux/nd_syscalls.stp
index 5df794db439838442391bb375a4380512c4124bd..bf6abdddcb923c96ac978fa165dbc8654a245797 100644 (file)
--- a/tapset/linux/nd_syscalls.stp
+++ b/tapset/linux/nd_syscalls.stp
@@ -945,7 +945,7 @@ probe nd_syscall.execve = kprobe.function("sys_execve")
        // args = __get_argv($argv, 0)
        // argstr = sprintf("%s %s", filename, __get_argv($argv, 1))
        asmlinkage()
-       filename = user_string(pointer_arg(1))
+       filename = user_string_quoted(pointer_arg(1))
        args = __get_argv(pointer_arg(2), 0)
        argstr = sprintf("%s %s", filename, __get_argv(pointer_arg(2), 1))
 }
@@ -991,7 +991,7 @@ probe nd_syscall.compat_execve = kprobe.function("compat_sys_execve").call ?
        // args = __get_compat_argv($argv, 0)
        // argstr = sprintf("%s %s", filename, __get_compat_argv($argv, 1))
        asmlinkage()
-       filename = user_string(pointer_arg(1))
+       filename = user_string_quoted(pointer_arg(1))
        args = __get_compat_argv(pointer_arg(2), 0)
        argstr = sprintf("%s %s", filename,
                         __get_compat_argv(pointer_arg(2), 1))

diff --git a/tapset/linux/syscalls.stp b/tapset/linux/syscalls.stp
index 4f45e22e5cfc018c0afa05964078975e1c8a7183..613640d05e32502c7a6948a8ceac27229be4f7b0 100644 (file)
--- a/tapset/linux/syscalls.stp
+++ b/tapset/linux/syscalls.stp
@@ -727,7 +727,7 @@ probe syscall.eventfd.return = kernel.function("sys_eventfd2").return !,
 probe syscall.execve = kernel.function("sys_execve").call
 {
        name = "execve"
-       filename = user_string(@choose_defined($filename, $name))
+       filename = user_string_quoted(@choose_defined($filename, $name))
        # kernel 3.0 changed the pointer's name to __argv
        __argv = @choose_defined($__argv, $argv)
        args = __get_argv(__argv, 0)
@@ -773,7 +773,7 @@ probe syscall.execve.return = kernel.function("do_execve").return
 probe syscall.compat_execve = kernel.function("compat_sys_execve").call ?
 {
        name = "compat_execve"
-       filename = user_string($filename)
+       filename = user_string_quoted($filename)
        # kernel 3.0 changed the pointer's name to __argv
        __argv = @choose_defined($__argv, $argv)
        args = __get_compat_argv(__argv, 0)