iovisor / iovisor/bcc

Failed to load BPF program trace_connect_v4_return: Permission denied

Open
#1,236 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
5d 13h
Merged PRs (30d)
3

Description

I'm trying to trace tcp connection using `tools/tcptracer.py`. But following error messages appears. I found some similar problem, #382 #1007 #829 ..., but I don't know how to fix it.

`uname -r` : `4.4.0-75-generic`

root@iovisor-node:~/bcc/tools# ./tcptracer.py
bpf: Permission denied
0: (79) r7 = *(u64 *)(r1 +80)
1: (85) call 14
2: (7b) *(u64 *)(r10 -24) = r0
3: (18) r1 = 0x7a61e780
5: (bf) r2 = r10
6: (07) r2 += -24
7: (85) call 1
8: (bf) r6 = r0
9: (15) if r6 == 0x0 goto pc+88
R0=map_value_or_null(ks=8,vs=8) R6=map_value(ks=8,vs=8) R7=inv R10=fp
10: (18) r1 = 0x7a61e780
12: (bf) r2 = r10
13: (07) r2 += -24
14: (85) call 3
15: (67) r7 <<= 32
16: (77) r7 >>= 32
17: (55) if r7 != 0x0 goto pc+80
R0=inv R6=map_value(ks=8,vs=8) R7=imm0 R10=fp
18: (79) r6 = *(u64 *)(r6 +0)
19: (b7) r1 = 0
20: (63) *(u32 *)(r10 -32) = r1
21: (7b) *(u64 *)(r10 -40) = r1
22: (63) *(u32 *)(r10 -4) = r1
23: (63) *(u32 *)(r10 -8) = r1
24: (63) *(u32 *)(r10 -12) = r1
25: (6b) *(u16 *)(r10 -14) = r1
26: (6b) *(u16 *)(r10 -16) = r1
27: (bf) r3 = r6
28: (07) r3 += 4
29: (bf) r1 = r10
30: (07) r1 += -4
31: (b7) r2 = 4
32: (85) call 4
33: (bf) r1 = r10
34: (07) r1 += -8
35: (b7) r2 = 4
36: (bf) r3 = r6
37: (85) call 4
38: (bf) r3 = r6
39: (07) r3 += 720
40: (bf) r1 = r10
41: (07) r1 += -14
42: (b7) r2 = 2
43: (85) call 4
44: (bf) r3 = r6
45: (07) r3 += 12
46: (bf) r1 = r10
47: (07) r1 += -16
48: (b7) r2 = 2
49: (85) call 4
50: (07) r6 += 48
51: (bf) r1 = r10
52: (07) r1 += -64
53: (b7) r2 = 8
54: (bf) r3 = r6
55: (85) call 4
invalid indirect read from stack off -64+0 size 8

Traceback (most recent call last):
File "./tcptracer.py", line 530, in
b.attach_kretprobe(event="tcp_v4_connect", fn_name="trace_connect_v4_return")
File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 551, in attach_kretprobe
fn = self.load_func(fn_name, BPF.KPROBE)
File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 345, in load_func
(func_name, errstr))
Exception: Failed to load BPF program trace_connect_v4_return: Permission denied

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the failure with tools/tcptracer.py on the reported 4.4.0-75-generic kernel, then inspect the attach_kretprobe call at line 530 and the verifier output. Compare the failing trace_connect_v4_return program with the related issues #382, #1007, and #829. Done means tcptracer.py loads the BPF program and traces TCP connections without the verifier error.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
networking, observability, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.