iovisor / iovisor/bcc

usdt does not handle probe parameter strings properly

Open
#1,249 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
5d 13h
Merged PRs (30d)
3

Description

```
/home/yhs/work/bcc/tests/python
-bash-4.3$ cat t.c
#include
#include

int main() {
char s[100];
const char *tmp = "abcdefgj";
int i, a = 200, b = 40;
for (i = 0; i < 100; i++) s[i] = (i & 7) + (i & 6);
while (1) {
FOLLY_SDT(test, probe_point_1, s[7], b);
FOLLY_SDT(test, probe_point_3, "abcdefghij", b);
FOLLY_SDT(test, probe_point_1, s[4], a);
FOLLY_SDT(test, probe_point_2, 5, s[10]);
FOLLY_SDT(test, probe_point_3, tmp, s[7]);
sleep(1);
}
return 1;
}
-bash-4.3$ gcc -I./include -c t.c -S
-bash-4.3$ cat t.s
.file "t.c"
.section .rodata
.LC0:
.string "abcdefgj"
.LC1:
.string "abcdefghij"
.text
.globl main
.type main, @function
main:
.LFB0:
.cfi_startproc
pushq %rbp
.cfi_def_cfa_offset 16
.cfi_offset 6, -16
movq %rsp, %rbp
.cfi_def_cfa_register 6
addq $-128, %rsp
movq $.LC0, -16(%rbp)
movl $200, -20(%rbp)
movl $40, -24(%rbp)
movl $0, -4(%rbp)
jmp .L2
.L3:
movl -4(%rbp), %eax
andl $7, %eax
movl %eax, %edx
movl -4(%rbp), %eax
andl $6, %eax
addl %edx, %eax
movl %eax, %edx
movl -4(%rbp), %eax
cltq
movb %dl, -128(%rbp,%rax)
addl $1, -4(%rbp)
.L2:
cmpl $99, -4(%rbp)
jle .L3
.L4:
movzbl -121(%rbp), %eax
#APP
# 10 "t.c" 1
990: nop
.pushsection .note.stapsdt,"","note"
.balign 4
.4byte 992f-991f,994f-993f,3
991: .asciz "stapsdt"
992: .balign 4
993: .8byte 990b
.8byte 0
.8byte 0
.asciz "test"
.asciz "probe_point_1"
.asciz "-1@%al -4@-24(%rbp)"
994: .balign 4
.popsection

# 0 "" 2
#NO_APP
movl $.LC1, %eax
#APP
# 11 "t.c" 1
990: nop
.pushsection .note.stapsdt,"","note"
.balign 4
.4byte 992f-991f,994f-993f,3
991: .asciz "stapsdt"
992: .balign 4
993: .8byte 990b
.8byte 0
.8byte 0
.asciz "test"
.asciz "probe_point_3"
.asciz "-11@%rax -4@-24(%rbp)"
994: .balign 4
.popsection
......
```
Look at the above, we have:
```
.asciz "-11@%rax -4@-24(%rbp)"
```
Basically, load the pointer from `%rax`, and the length is 11 for the probe value.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the issue with the C program in t.c and inspect the generated assembly and USDT probe metadata shown in the report. Trace how BCC handles string-valued USDT probe parameters, including the pointer and length encoding. Done means probe parameter strings are interpreted correctly for the demonstrated calls and the behavior is covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
observability, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.