fix: delete syscall data on socket dup (aquasecurity#1720)

if dup failed, we returned without deleting syscall data from map.
EBWi11 · May 2, 2022 · ecf7a95 · ecf7a95
1 parent 7bf266c
commit ecf7a95
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/pkg/ebpf/c/tracee.bpf.c b/pkg/ebpf/c/tracee.bpf.c
@@ -2577,7 +2577,7 @@ int sys_dup_exit_tail(void *ctx)
 
     if (sys->ret < 0) {
         // dup failed
-        return 0;
+        goto out;
     }
 
     if (sys->id == SYS_DUP) {
@@ -2592,9 +2592,9 @@ int sys_dup_exit_tail(void *ctx)
         send_socket_dup(&data, sys->args.args[0], sys->args.args[1]);
     }
 
+out:
     // delete syscall data before return
     bpf_map_delete_elem(&syscall_data_map, &data.context.host_tid);
-
     return 0;
 }