opensnoop: can't get the filename in some specific cases
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 5d 13h
- Merged PRs (30d)
- 3
Description
If the filename string happens to be, for example, near the border of a page and the next page is not mapped, we'll try to read the full buffer and `bpf_probe_read()` will return `-EFAULT`.
Here's an example (courtesy of @alban):
`open_buffer_border.c`:
```
#include
#include
#include
#include
#include
#include
#include
#include
char *big_buffer;
#define FILENAME "/tmp/test1.txt"
char *filename1;
char *filename2;
int main() {
int fd;
printf("pid\n%d\n", getpid());
big_buffer = mmap((void*)0x05000000, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
memset(big_buffer, 0, sizeof(4096));
filename1 = big_buffer;
strcpy(filename1, FILENAME);
filename2 = big_buffer + 4096 - strlen(FILENAME) - 2;
strcpy(filename2, FILENAME);
printf("filename1: %s\n", filename1);
printf("filename2: %s\n", filename2);
sleep(3);
fd = open(filename1, O_RDONLY, 0);
printf("open %s: fd %d\n", filename1, fd);
close(fd);
fd = open(filename2, O_RDONLY, 0);
printf("open %s: fd %d\n", filename2, fd);
close(fd);
sleep(1);
return 0;
}
```
Let's run it:
```
$ ./open_buffer_border
pid
31188
filename1: /tmp/test1.txt
filename2: /tmp/test1.txt
open /tmp/test1.txt: fd 3
open /tmp/test1.txt: fd 3
```
But running opensnoop:
```
$ sudo ./tools/opensnoop.py
...
31188 open_buffer_bor 3 0 /tmp/test1.txt
31188 open_buffer_bor 3 0
```
The filename in the second open doesn't appear.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by compiling and running the reported open_buffer_border.c reproducer, then inspect tools/opensnoop.py and the filename-reading path that calls bpf_probe_read(). Compare the output for both opens. Done means opensnoop reports the filename for the page-boundary case as well as the ordinary case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux, python
- Domain
- cli, observability, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100