Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error when using bpf_strncmp #5137

Open
BrianBaboch opened this issue Nov 7, 2024 · 1 comment
Open

Error when using bpf_strncmp #5137

BrianBaboch opened this issue Nov 7, 2024 · 1 comment

Comments

@BrianBaboch
Copy link

BrianBaboch commented Nov 7, 2024

Hello,

I'm having problems when using bpf_strncmp, I have a simple ebpf program using BCC, that program uses bpf_strncmp to compare the task name to a string.
So I do the following:

    char my_com[] = "cat";
    struct task_struct *task = (struct task_struct *)bpf_get_current_task_btf();
    if (bpf_strncmp(comm, sizeof(my_com), my_com) == 0){
        bpf_trace_printk("Cat");
    }

If I use this I get a permission denied error that I can't seem to understand while, if I use strncmp it works as expected

    char my_com[] = "cat";
    struct task_struct *task = (struct task_struct *)bpf_get_current_task_btf();
    if (strncmp(comm, my_com, sizeof(my_com) -1) == 0){
        bpf_trace_printk("Cat");
    }

The error:

    b.attach_raw_tracepoint(tp="sys_enter", fn_name="hello")
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 1061, in attach_raw_tracepoint
    fn = self.load_func(fn_name, BPF.RAW_TRACEPOINT)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 526, in load_func
    raise Exception("Failed to load BPF program %s: %s" %
Exception: Failed to load BPF program b'hello': Permission denied

In the ebpf compiled code I have the following:

R3 type=fp expected=map_value

However, the bpf_strncmp takes char * as mentioned in the doc so I don't understand the problem

@yonghong-song
Copy link
Collaborator

yonghong-song commented Nov 9, 2024

See error

   R3 type=fp expected=map_value

Here,

  char my_com[] = "cat";

has my_com in stack (fp) and verifier does not like it.

The kernel specification:

static const struct bpf_func_proto bpf_strncmp_proto = {
        .func           = bpf_strncmp,
        .gpl_only       = false,
        .ret_type       = RET_INTEGER,
        .arg1_type      = ARG_PTR_TO_MEM | MEM_RDONLY,
        .arg2_type      = ARG_CONST_SIZE,
        .arg3_type      = ARG_PTR_TO_CONST_STR,
};

The third argument needs to be a ptr to const str.

Try

    char my_com = "cat";

to see whether it works or not.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants