Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Userspace kprobe offset verification can now fail #2332

Merged
merged 1 commit into from
Aug 30, 2022

Conversation

BurntBrunch
Copy link

@BurntBrunch BurntBrunch commented Aug 18, 2022

Previously, this logic could only fail in unsafe mode. Unfortunately,
this prevented attachment to module functions with an offset, as
the module binary would never be examined.

This PR makes the logic entirely optional and improves the error
messages to provide a similar user experience.

Fixes #2327

Checklist
  • User-visible and non-trivial changes updated in CHANGELOG.md
  • The new behaviour is covered by runtime tests using the nf_tables module that BTF for kernel modules #2315 uses as well

CHANGELOG.md Outdated Show resolved Hide resolved
tests/runtime/probe Show resolved Hide resolved
@BurntBrunch
Copy link
Author

Thanks @viktormalik. I just fixed the changelog, will wait for #2333 to land, so I can rebase and get clean CI (even though it passed with the partial REQUIRES)

@@ -76,6 +76,23 @@ EXPECT Offset outside the function bounds \('vfs_read' size is*
TIMEOUT 5
WILL_FAIL

NAME kprobe_offset_module
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe add comment that this test relies on lack of module instruction checking support?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@danobi, it's just punting the check to the kernel - if you get the offset wrong, the kernel won't let the program attach. After all, if we implemented module disassembly and offset checking, this test would still pass, so it's clearly not relying on the absence of anything.

@danobi
Copy link
Member

danobi commented Aug 24, 2022

Off by 1 in changelog link?

@BurntBrunch
Copy link
Author

Off by 1 in changelog link?

Sorry, forgot to push.

@viktormalik
Copy link
Contributor

Off by 1 in changelog link?

Sorry, forgot to push.

The description is correct, but the link is still wrong.

Previously, this logic could only fail in unsafe mode. Unfortunately,
this prevented attachment to module functions with an offset, as
the module binary would never be examined.

This PR makes the logic entirely optional and improves the error
messages to provide a similar user experience.

Fixes bpftrace#2327
@danobi danobi merged commit 602425b into bpftrace:master Aug 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

bpftrace cannot attach kprobe to module symbol+offset
3 participants