Re: [PATCH v2 0/7] tracing/probes: Support function parameter access from return probe

[Google]

On Thu, 29 Feb 2024 15:38:55 +0900
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx> wrote:

> Hmm, this seems arch_rethook_trampoline caused the issue.
> 
> And curiously, it depends on the number of stored data.
> 
> OK:
> /sys/kernel/tracing # echo 'f vfs_read%return $arg1 $arg2 $arg3' >> dynamic_events 
> /sys/kernel/tracing # echo 1 > events/fprobes/enable 
> 
> NG:
> /sys/kernel/tracing # echo 'f vfs_read%return $arg1 $arg2 $arg3 $arg4' >> dynamic_events 
> /sys/kernel/tracing # echo 1 > events/fprobes/enable 
> 
> I also confirmed that on 'vfs_write' caused the same result. 3 arguments(24 bytes) is OK,
> but 4 arguments (32bytes) is NG.

And this may be the fprobe bug. kretprobe events doesn't show this issue.

OK:
/sys/kernel/tracing # echo 'r vfs_read $arg*' >> kprobe_events 
/sys/kernel/tracing # echo 1 > events/kprobes/enable 

But this is strange because both uses same rethook...

Thank you,

-- 
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>