From e77d9d2b8cb561ad92e7834a43c477623bee1c7d Mon Sep 17 00:00:00 2001
From: sfx <seeflower.dev@gmail.com>
Date: Sat, 10 Dec 2022 08:18:02 -0800
Subject: [PATCH] bug fix !!!

---
 src/raw_syscalls.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/raw_syscalls.c b/src/raw_syscalls.c
index bda3712..badd5b9 100644
--- a/src/raw_syscalls.c
+++ b/src/raw_syscalls.c
@@ -298,6 +298,11 @@ int raw_syscalls_sys_enter(struct bpf_raw_tracepoint_args* ctx) {
             }
         }
     } else {
+        // 可能是展开循环或者处于else分支的原因 这里必须得重新获取一次 arg_mask
+        struct arg_mask_t* arg_mask = bpf_map_lookup_elem(&arg_mask_map, &data->syscall_id);
+        if (arg_mask == NULL) {
+            return 0;
+        }
         // 展开循环
         #pragma unroll
         for (int i = 0; i < 6; i++) {