iovisor / iovisor/bcc

How to detach uprobes with invalid `/proc/fs` binary path after process terminates?

Open
#4,843 5 comments 1 reaction 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

Say we have a uprobe attached to a binary accessed via `/proc//root/normal/path/to/binary`. When the program terminates, the pid gets cleaned up so that the `/proc/fs` filepath is no longer valid. To clean up the dangling FD, we need to call `detach_uprobe`, but this fails because [`check_binary_symbol`](https://github.com/iovisor/bcc/blob/8bc151f94e10be5e922f2972ceb1e319a1ec9d38/src/cc/api/BPF.cc#L516C7-L516C7) can't read the file.

Is there a way to make the detach API work with proc/fs binary paths after the pid is deleted?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/cc/api/BPF.cc at check_binary_symbol and trace how detach_uprobe handles the binary path. Reproduce the case using a /proc//root/normal/path/to/binary path after the process exits, then determine what API behavior is expected when the path is no longer readable. Done means the dangling uprobe can be detached through the API or the limitation is clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
operating-systems, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.