Bcc openat tracepoint can not get correct filename.

Hi, I want to monitor the openat syscall. Therefore I write the ebpf code as follows:
```
from __future__ import print_function
from bcc import BPF

# load BPF program
b = BPF(text="""
TRACEPOINT_PROBE(syscalls, sys_enter_openat) {
char comm[16];
bpf_get_current_comm(&comm, sizeof(comm));
//filter, only output my program named cp
if (comm[0] == 'c' && comm[1] == 'p') {
bpf_trace_printk("%s\\n", args->filename);
bpf_trace_printk("%s\\n", comm);

}
return 0;
}
""")

# format output
while 1:
try:
(task, pid, cpu, flags, ts, msg) = b.trace_fields()
except ValueError:
continue
print("%-18.9f %-16s %-6d %s" % (ts, task, pid, msg))
```

To test the code, I write a simple C code as follows, and the compiled binary is named as cp.
```
#include
#include
#include

int main() {
pid_t pid;
char buf[100];
int fd = open("/etc/passwd", O_RDONLY);
read(fd, buf, 100);
printf("read %s\n", buf);
}
```
However, the output is as follows:
```
32413165.403320000 <...> 2664527 /etc/ld.so.cache
32413165.403326001 <...> 2664527 cp
32413165.403344002 <...> 2664527 /lib/x86_64-linux-gnu/libc.so.6
32413165.403345998 <...> 2664527 cp
32413165.403499000 <...> 2664527
32413165.403499000 <...> 2664527 cp
```
BPF program does not extract the /etc/passwd. Why does this happens? What is more strange is that, when I execute `strace ./cp` the bpf program outputs `/etc/passwd`. I also use `cat /etc/passwd` to test the ebpf code, It extract the correct filename.

Start with the supplied BCC Python reproducer and its TRACEPOINT_PROBE(syscalls, sys_enter_openat) handler, then compare its output for the C cp program, strace ./cp, and cat /etc/passwd. Trace the filename argument through the openat tracepoint and document the cause of the differing results, or identify the BCC or kernel component requiring a fix.

Written by the indexing model from the issue text.