iovisor / iovisor/bcc

failed to read task_struct by `BPF_PROBE_READ`

Open
#4,806 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
5d 13h
Merged PRs (30d)
3

Description

Hi, does anyone know the difference between the functions BPF_CORE_READ and BPF_PROBE_READ? I wrote the following code to get the name of the cgroup from the task_struct. Using BPF_CORE_READ, I can successfully extract the name, but using BPF_PROBE_READ failed.
Here is my code snippet:
```
static __always_inline int get_cgroup_name(char *buf, size_t sz) {
struct task_struct *cur_tsk = (struct task_struct *)bpf_get_current_task();
if (cur_tsk == NULL) {
bpf_printk("failed to get cur task\n");
return -1;
}

int cgrp_id = memory_cgrp_id;

// failed when use BPF_PROBE_READ
const char *name = BPF_CORE_READ(cur_tsk, cgroups, subsys[cgrp_id], cgroup, kn, name);
bpf_printk("name: %s\n", name);
if (bpf_probe_read_kernel_str(buf, sz, name) < 0) {
bpf_printk("failed to get kernfs node name: %s\n", buf);
return -1;
}
bpf_printk("cgroup name: %s\n", buf);

return 0;
}
```
Check the trace_pipe log:
When using BPF_CORE_READ:
```
main-145531 [000] .... 153971.113199: 0: name: 644feac00b6d02c4e6ae083fbd7f354ac9911e4b77711aa4034694f081520c8
main-145531 [000] .... 153971.113214: 0: cgroup name: 644feac00b6d02c4e6ae083fbd7f354ac9911e4b77711aa4034694f081520c8
```
When using BPF_PROBE_READ:
```
main-146433 [001] .... 154578.547447: 0: name:
main-146433 [001] .... 154578.547459: 0: failed to get kernfs node name:
```
Some of my machines have low version of Linux and cannot enable btf, so is there any way for me to use the probe_read function to get the cgroup name?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the get_cgroup_name entry point and compare the BPF_CORE_READ and BPF_PROBE_READ paths shown in the issue. Reproduce the two outcomes using the trace_pipe logs, then determine whether probe_read can retrieve the cgroup name on kernels without BTF and define the supported behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
operating-systems, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.