Dealing with long path names
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
I need to ensure my tracer captures full paths passed by users into some system calls. Paths can be pretty long, up-to PATH_MAX chars. In cases when path is longer than some (~255-400 chars) value I would like putting several data structures carrying different parts of the long paths into BPF_PERF_OUTPUT buffer. So I need to find a length of a null-terminated string in a bpf program. The problem is maximum string I can iterate (using “if … goto” trick) is ~500 chars. An attempt to have a longer unrolled loop results in errors like:
bpf: Invalid argument. Program too large (4739 insns), at most 4096 insns
If I try to read 4095 bytes with bpf_probe_read() into a buffer allocated on the stack of bpf function (so all 4095 bytes could be passed to the user afterwards) then I get an error:
…
73: (b7) r2 = 2048
74: (85) call 4
invalid stack type R1 off=-2352 access_size=2048
Do you have any suggestions on how to find length of a long string (up-to PATH_MAX chars) in bpf program or how to pass long paths into user space? String lives in user space. A pointer to the string is passed as an argument into a system call. BPF program which needs string length is attached to the corresponding system call.
I added bpf_strnlen function to the kernel and bcc toolkit (which calls strnlen_user(buf,size)) and that is working as expected, but it would be great to be able to do that on an unmodified kernel. Any chance bpf/bcc will be getting something like bpf_strnlen() anytime soon? bpf_strnlen seems to be straightforward, but if you are interested I could make a pull request.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.