search

anakryiko / retsnoop

Investigate kernel error call stacks
BSD 2-Clause "Simplified" License
186 stars 32 forks source link

retsnoop: fix coredump when without -T #39

Closed zf1575192187 closed 1 year ago

zf1575192187 commented 1 year ago

Without the -T option, init_func_traces initialization func_traces_hash is not invoked, and handle_func_trace_entry is not controlled by env.emit_func_trace.

Signed-off-by: Feng Zhou zhoufeng.zf@bytedance.com

anakryiko commented 1 year ago

What confuses me a bit is that handle_func_trace_entry shouldn't be called unless env.emit_func_trace is enabled, because BPF-side code won't emit REC_FUNC_TRACE_EXIT and REC_FUNC_TRACE_ENTRY records. So how did you get that crash?

zf1575192187 commented 1 year ago

I reconfirmed that it was my own branch (adapted to a lower version of the kernel), which missed some code, resulting in BPF-side code will emit REC_FUNC_TRACE_EXIT and REC_FUNC_TRACE_ENTRY records. I close Pr.