lazy ksymbols: fix address search

helpers/kernel_symbols.go

@@ -233,8 +233,9 @@ func (k *lazyKernelSymbols) GetSymbolByAddr(addr uint64) (*KernelSymbol, error)
  err error
  )
 
- // since kallsyms is sorted in address ascending order, use binary search
- i := sort.Search(len(k.fileContent), func(i int) bool {
+ fileLen := len(k.fileContent)
+ // kallsyms are almost sorted by address, start search with binary search
+ i := sort.Search(fileLen, func(i int) bool {
  line := strings.Fields(k.fileContent[i])
  if len(line) < 3 {
  return false
@@ -267,9 +268,40 @@ func (k *lazyKernelSymbols) GetSymbolByAddr(addr uint64) (*KernelSymbol, error)
 
  if i < len(k.fileContent) && symbolAddr == addr {
  return symbol, nil
- } else {
- return nil, SymbolNotFoundAtAddress(addr)
  }
+
+ // symbols may be out of order near the end of the ksymbols, search linearly in reverse
+ for i := fileLen - 1; i > 0; i-- {
+ line := strings.Fields(k.fileContent[i])
+ if len(line) < 3 {
+ continue
+ }
+ symbolAddr, err = strconv.ParseUint(line[0], 16, 64)
+ if err != nil {
+ continue
+ }
+ if symbolAddr == addr {
+ symbolType := strings.Clone(line[1])
+ symbolName := strings.Clone(line[2])
+
+ symbolOwner := "system"
+ if len(line) > 3 {
+ // When a symbol is contained in a kernel module, it will be specified
+ // within square brackets, otherwise it's part of the system
+ symbolOwner = strings.Clone(line[3])
+ symbolOwner = strings.TrimPrefix(symbolOwner, "[")
+ symbolOwner = strings.TrimSuffix(symbolOwner, "]")
+ }
+
+ symbolKey := symbolKey(symbolOwner, symbolName)
+ symbol := &KernelSymbol{symbolName, symbolType, symbolAddr, symbolOwner}
+ k.symbolMap[symbolKey] = symbol
+ k.symbolAddrMap[symbolAddr] = symbol
+ return symbol, nil
+ }
+ }
+
+ return nil, SymbolNotFoundAtAddress(addr)
 }
 
 func (k *lazyKernelSymbols) Refresh() error {