uprobe attached to functions defined in self-compiled binary doesn't fire
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
Consider the following program. It goes into `/tmp/bin.c` and the corresponding executable is built with `gcc -o bin bin.c`.
```c
#include
void foo();
int main(int argc, char **argv) {
foo();
}
void foo() {
puts("hello");
}
```
The bcc script `do_main.py` contains the following
```python
#!/usr/bin/python
from __future__ import print_function
import bcc
b = bcc.BPF(text="""
int do_libc_main(void *ctx) {
bpf_trace_printk("libc main\\n");
return 0;
};
int do_binary_main(void *ctx) {
bpf_trace_printk("binary main\\n");
return 0;
};
""")
b.attach_uprobe(name="/usr/lib64/libc.so.6",
sym="__libc_start_main",
fn_name="do_libc_main")
b.attach_uprobe(name="/tmp/bin",
sym="main",
fn_name="do_binary_main")
while True:
print(b.trace_fields())
```
Then I execute `sudo python do_main.py` and run `/tmp/bin` from another terminal. As you can see below, only the probe attached to the library function `__libc_start_main` fires.
```
$ sudo python do_main.py
('bin', 8103, 2, '....', 607583.867852, 'libc main')
```
The issue can be reproduced with `bpftrace`.
```
$ sudo bpftrace -e 'uprobe:/usr/lib64/libc.so.6:__libc_start_main { printf("main called\n"); }' -c /tmp/bin
Attaching 1 probe...
hello
main called
$ sudo bpftrace -e 'uprobe:/tmp/bin:main { printf("main called\n"); }' -c /tmp/bin
Attaching 1 probe...
hello
```
To make things more complicated, the probe attached to certain binaries shipped with the system does fire!
```
$ sudo bpftrace -e 'uprobe:/bin/bash:main { printf("main called\n"); }' -c /bin/bash
Attaching 1 probe...
main called
main called
```
------
System information:
```
$ lsb_release -a
LSB Version: :core-4.1-amd64:core-4.1-noarch
Distributor ID: n/a
Description: NAME="Red Hat Enterprise Linux Server"
Release: n/a
Codename: n/a
$ uname -a
Linux mwfsh 3.10.0-1160.6.1.el7.x86_64 #1 SMP Tue Nov 17 13:59:11 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
$ gcc --version
gcc (GCC) 7.3.1 20180303 (Red Hat 7.3.1-5)
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
$ sudo python -c 'import bcc; print(bcc.__version__)'
0.18.0-b1ab8690
$ bpftrace --version
bpftrace v0.11.0-118-gf543-dirty
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.