failed to read task_struct by `BPF_PROBE_READ`
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 5d 13h
- Merged PRs (30d)
- 3
Description
Hi, does anyone know the difference between the functions BPF_CORE_READ and BPF_PROBE_READ? I wrote the following code to get the name of the cgroup from the task_struct. Using BPF_CORE_READ, I can successfully extract the name, but using BPF_PROBE_READ failed.
Here is my code snippet:
```
static __always_inline int get_cgroup_name(char *buf, size_t sz) {
struct task_struct *cur_tsk = (struct task_struct *)bpf_get_current_task();
if (cur_tsk == NULL) {
bpf_printk("failed to get cur task\n");
return -1;
}
int cgrp_id = memory_cgrp_id;
// failed when use BPF_PROBE_READ
const char *name = BPF_CORE_READ(cur_tsk, cgroups, subsys[cgrp_id], cgroup, kn, name);
bpf_printk("name: %s\n", name);
if (bpf_probe_read_kernel_str(buf, sz, name) < 0) {
bpf_printk("failed to get kernfs node name: %s\n", buf);
return -1;
}
bpf_printk("cgroup name: %s\n", buf);
return 0;
}
```
Check the trace_pipe log:
When using BPF_CORE_READ:
```
main-145531 [000] .... 153971.113199: 0: name: 644feac00b6d02c4e6ae083fbd7f354ac9911e4b77711aa4034694f081520c8
main-145531 [000] .... 153971.113214: 0: cgroup name: 644feac00b6d02c4e6ae083fbd7f354ac9911e4b77711aa4034694f081520c8
```
When using BPF_PROBE_READ:
```
main-146433 [001] .... 154578.547447: 0: name:
main-146433 [001] .... 154578.547459: 0: failed to get kernfs node name:
```
Some of my machines have low version of Linux and cannot enable btf, so is there any way for me to use the probe_read function to get the cgroup name?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the get_cgroup_name entry point and compare the BPF_CORE_READ and BPF_PROBE_READ paths shown in the issue. Reproduce the two outcomes using the trace_pipe logs, then determine whether probe_read can retrieve the cgroup name on kernels without BTF and define the supported behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- operating-systems, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100