iovisor / iovisor/bcc

Fail to check return value

Open
#3,107 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

I have used the master branch `39a2a8f02cc3871ab375b005a00e296aa668d9ec` to build the bcc toolkit. But I found something strange happened when I want to check the retValue with the kprobe.

Here is the sample code,

```python
from bcc import BPF

# define BPF program
bpf_text = """
#include
#include
#include

int kretprobe____nf_conntrack_confirm(struct pt_regs *ctx) {
int ret = PT_REGS_RC(ctx);

bpf_trace_printk("%d\\n", ret);

if (ret == 0) {
bpf_trace_printk("NF_DROP\\n");
} else {
bpf_trace_printk("NF_ACCEPT\\n");
}

return 0;
}
"""

# initialize BPF
b = BPF(text=bpf_text, debug=4)

while 1:
try:
b.trace_print()
except KeyboardInterrupt:
exit()
```

The idea is very simple, just to check the return value of `__nf_contrack_confirm` to decide whether there is a NF_DROP.
But only the first `bpf_trace_printk` works.

Also if I add some text in the format string like `bpf_trace_printk("Ret %d\\n", ret);`, it does not work again.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the Python BCC reproducer and its embedded kretprobe for __nf_conntrack_confirm, then inspect the debug output and the two bpf_trace_printk calls. Reproduce the issue with both "%d\n" and "Ret %d\n" formats; done means the return value and subsequent NF_DROP or NF_ACCEPT message are reported reliably.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux, python
Domain
networking, observability-sre
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.