iovisor / iovisor/bcc

opensnoop: can't get the filename in some specific cases

Open
#1,307 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
5d 13h
Merged PRs (30d)
3

Description

If the filename string happens to be, for example, near the border of a page and the next page is not mapped, we'll try to read the full buffer and `bpf_probe_read()` will return `-EFAULT`.

Here's an example (courtesy of @alban):

`open_buffer_border.c`:

```
#include
#include
#include
#include
#include
#include
#include
#include

char *big_buffer;
#define FILENAME "/tmp/test1.txt"
char *filename1;
char *filename2;

int main() {
int fd;

printf("pid\n%d\n", getpid());

big_buffer = mmap((void*)0x05000000, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
memset(big_buffer, 0, sizeof(4096));

filename1 = big_buffer;
strcpy(filename1, FILENAME);
filename2 = big_buffer + 4096 - strlen(FILENAME) - 2;
strcpy(filename2, FILENAME);

printf("filename1: %s\n", filename1);
printf("filename2: %s\n", filename2);

sleep(3);

fd = open(filename1, O_RDONLY, 0);
printf("open %s: fd %d\n", filename1, fd);
close(fd);

fd = open(filename2, O_RDONLY, 0);
printf("open %s: fd %d\n", filename2, fd);
close(fd);

sleep(1);
return 0;
}
```

Let's run it:

```
$ ./open_buffer_border
pid
31188
filename1: /tmp/test1.txt
filename2: /tmp/test1.txt
open /tmp/test1.txt: fd 3
open /tmp/test1.txt: fd 3
```

But running opensnoop:

```
$ sudo ./tools/opensnoop.py
...
31188 open_buffer_bor 3 0 /tmp/test1.txt
31188 open_buffer_bor 3 0
```

The filename in the second open doesn't appear.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by compiling and running the reported open_buffer_border.c reproducer, then inspect tools/opensnoop.py and the filename-reading path that calls bpf_probe_read(). Compare the output for both opens. Done means opensnoop reports the filename for the page-boundary case as well as the ordinary case.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux, python
Domain
cli, observability, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.