eunomia-bpf / bpftime

Userspace eBPF runtime for fast Uprobe & Syscall hook & Extensions with LLVM JIT
https://eunomia.dev/bpftime/
MIT License
699 stars 70 forks source link

[BUG] When `bpftime load` is interrupted or killed, the target process's injected code should be removed #178

Open agentzh opened 6 months ago

agentzh commented 6 months ago

Currently, when I hit Ctrl-C to quit bpftime load, it only destructs the global shm without cleaning up the target process's injected code and data:

^C14:59:56
        pid=622114      malloc calls: 6
INFO [622110]: Global shm destructed

And the target process then goes crazy and emits a lot of errors like these:

continue malloc...
malloc called from pid 622114
[2024-01-27 15:00:10][error][622114] Expected fd 3 to be a map fd (map_ptr_by_fd)
[2024-01-27 15:00:10][error][622114] Expected fd 3 to be a map fd (map_ptr_by_fd)
[2024-01-27 15:00:10][error][622114] Expected fd 3 to be a map fd (map_ptr_by_fd)

Obviously, the injected code and data are still there.

Furthermore, if the bpftime load and its child process are killed abruptly with SIGKILL, we still need a way to clean things up manually. Maybe like something like bpftime detach PID suggested in #166 ?

agentzh commented 6 months ago

BTW, I use bpftime attach PID in this case.

Officeyutong commented 3 months ago

There should be a way for syscall server to notify all agents that it's alive. This may be implemented by writing a timestamp into shared memory each second. Once this timestamp hasn't been updated for a period of seconds, agent should regard syscall server dead, and start to detach

Agent and the server side should have a seperate thread to check this.

I'll take this issue