Messages in this thread | | | From | Francis Laniel <> | Subject | [RFC PATCH v1 0/1] Return ENAMESVRLSYMS when func matches several symbols during PMU kprobe creation | Date | Wed, 23 Aug 2023 18:14:09 +0200 |
| |
Hi.
In the kernel source code, it exists different functions which share the same name but which have, of course, different addresses as they can be defined in different modules: root@vm-amd64:~# grep ntfs_file_write_iter /proc/kallsyms ffffffff814ce3c0 t __pfx_ntfs_file_write_iter ffffffff814ce3d0 t ntfs_file_write_iter ffffffff814fc8a0 t __pfx_ntfs_file_write_iter ffffffff814fc8b0 t ntfs_file_write_iter This can be source of troubles when you create a PMU kprobe for such a function, as it will only install one for the first address (e.g. 0xffffffff814ce3d0 in the above). This could lead to some troubles were BPF based tools does not report any event because the second function is not called: root@vm-amd64:/mnt# mount | grep /mnt /foo.img on /mnt type ntfs3 (rw,relatime,uid=0,gid=0,iocharset=utf8) # ig is a tool which installs a PMU kprobe on ntfs_file_write_iter(). root@vm-amd64:/mnt# ig trace fsslower -m 0 -f ntfs3 --host &> /tmp/foo & [1] 207 root@vm-amd64:/mnt# dd if=./foo of=./bar count=3 3+0 records in 3+0 records out 1536 bytes (1.5 kB, 1.5 KiB) copied, 0.00543323 s, 283 kB/s root@vm-amd64:/mnt# fg ig trace fsslower -m 0 -f ntfs3 --host &> /tmp/foo ^Croot@vm-amd64:/mnt# more /tmp/foo RUNTIME.CONTAINERNAME RUNTIME.CONTAIN… PID COMM T BYTES OFFSET LAT FILE 214 dd R 512 0 766 foo 214 dd R 512 512 9 foo 214 dd As you can see in the above, only read events are reported and no write because the kprobe is installed for the old ntfs_file_write_iter() and not the ntfs3 one.
In this contribution, I modified create_local_trace_kprobe() to test if the function name given as argument matches several symbols. If this is the case ENAMESVRLSYMS, a new error code, is returned to indicate the user to use addr and offs to remove this ambiguity. So, when the above BPF tool is run, the following error message is printed: root@vm-amd64:~# ig trace fsslower -m 0 -f ntfs3 --host &> /tmp/foo root@vm-amd64:~# more /tmp/foo RUNTIME.CONTAINERNAME RUNTIME.CONTAIN… PID COMM T BYTES OFFSET LAT FILE Error: running gadget: running gadget: installing tracer: attaching kprobe: crea ting perf_kprobe PMU (arch-specific fallback for "ntfs_file_write_iter"): token ntfs_file_write_iter: opening perf event: errno 134
Note that, this contribution is the conclusion of a previous RFC which intended to install a PMU kprobe for all matching symbols [1, 2].
If you see any way to improve this contribution, particularly if you have an idea to add a test for this behavior, please share your feedback.
Francis Laniel (1): tracing/kprobes: Return ENAMESVRLSYMS when func matches several symbols
arch/alpha/include/uapi/asm/errno.h | 2 ++ arch/mips/include/uapi/asm/errno.h | 2 ++ arch/parisc/include/uapi/asm/errno.h | 2 ++ arch/sparc/include/uapi/asm/errno.h | 2 ++ include/uapi/asm-generic/errno.h | 2 ++ kernel/trace/trace_kprobe.c | 26 ++++++++++++++++++++++ tools/arch/alpha/include/uapi/asm/errno.h | 2 ++ tools/arch/mips/include/uapi/asm/errno.h | 2 ++ tools/arch/parisc/include/uapi/asm/errno.h | 2 ++ tools/arch/sparc/include/uapi/asm/errno.h | 2 ++ tools/include/uapi/asm-generic/errno.h | 2 ++ 11 files changed, 46 insertions(+)
Best regards and thank you in advance. --- [1]: https://lore.kernel.org/lkml/20230816163517.112518-1-flaniel@linux.microsoft.com/ [2]: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel.org/ -- 2.34.1
| |