iovisor / iovisor/bcc

bpf_probe_read can't read user space data

Open
#3,898 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
5d 13h
Merged PRs (30d)
3

Description

I am writing a script to fetch user function's argument using uprobe. When I use bpf_probe_read_user in high version linux 5.0+, I succeed. But when I use linux 4.19, I find that there is no bpf_probe_read_user existing. Only bpf_probe_read can use. Then I tried this function, it can read kernel space data, but can't read user space data. Error code is -14. Are there any way to read user space data in 4.19 version linux?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the uprobe use of bpf_probe_read_user and bpf_probe_read on Linux 4.19, then compare helper availability and error -14 with Linux 5.0 behavior. Done means establishing a supported 4.19 approach or documenting that this kernel version cannot read the requested user-space data.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.