Fail to check return value
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
I have used the master branch `39a2a8f02cc3871ab375b005a00e296aa668d9ec` to build the bcc toolkit. But I found something strange happened when I want to check the retValue with the kprobe.
Here is the sample code,
```python
from bcc import BPF
# define BPF program
bpf_text = """
#include
#include
#include
int kretprobe____nf_conntrack_confirm(struct pt_regs *ctx) {
int ret = PT_REGS_RC(ctx);
bpf_trace_printk("%d\\n", ret);
if (ret == 0) {
bpf_trace_printk("NF_DROP\\n");
} else {
bpf_trace_printk("NF_ACCEPT\\n");
}
return 0;
}
"""
# initialize BPF
b = BPF(text=bpf_text, debug=4)
while 1:
try:
b.trace_print()
except KeyboardInterrupt:
exit()
```
The idea is very simple, just to check the return value of `__nf_contrack_confirm` to decide whether there is a NF_DROP.
But only the first `bpf_trace_printk` works.
Also if I add some text in the format string like `bpf_trace_printk("Ret %d\\n", ret);`, it does not work again.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the Python BCC reproducer and its embedded kretprobe for __nf_conntrack_confirm, then inspect the debug output and the two bpf_trace_printk calls. Reproduce the issue with both "%d\n" and "Ret %d\n" formats; done means the return value and subsequent NF_DROP or NF_ACCEPT message are reported reliably.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux, python
- Domain
- networking, observability-sre
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100