[BUG] failed to start example/malloc/victim

[liyan-ah]

Describe the bug

Failed to start example. Seems to be shared library path error.

To Reproduce

make release && make install && bpftime start ./example/malloc/victim Expected behavior

Screenshots

$ bpftime start ./example/malloc/victim
[2023-11-07 06:32:03.859] [info] Entering bpftime agent
[2023-11-07 06:32:03.859] [info] Global shm constructed. shm_open_type 1 for bpftime_maps_shm
[2023-11-07 06:32:03.859] [info] Initializing agent..
[2023-11-07 06:32:03][info][422426] Executable path: /home/pdliyan/bpftime/example/malloc/victim
[2023-11-07 06:32:03][error][422426] Failed to find module base address for /lib/x86_64-linux-gnu/libc.so.6
[2023-11-07 06:32:03][info][422426] Attached 0 uprobe programs to function 0
Error: Exited with code: None

Desktop (please complete the following information):

• OS: Centos
• Version 8 CentOS Linux release 8.4.2105

Additional context

My local libc.so.6 located in

$ whereis libc
libc: /usr/lib/libc.so /usr/lib64/libc.so

Something wrong with build configs?

[Officeyutong]

Could you please examine the output of nm /usr/lib64/libc.so and check if there is a symbol malloc?

• Seems to be related with release-diversity. All of the maintainers develop using Debian or Ubuntu. We are sorry that we haven't tested on redhat releases

[liyan-ah]

Could you please examine the output of nm /usr/lib64/libc.so and check if there is a symbol malloc?

• Seems to be related with release-diversity. All of the maintainers develop using Debian or Ubuntu. We are sorry that we haven't tested on redhat releases

There is malloc symbol.

$ nm /usr/lib64/libc.so.6 | grep "malloc"
00000000003c09c0 b cache_malloced
000000000009b780 t __GI___libc_malloc
0000000000099b00 t _int_malloc
000000000009b780 T __libc_malloc
00000000003bf284 d __libc_malloc_initialized
000000000009b780 t __malloc
000000000009b780 T malloc
000000000009bf20 t __malloc_arena_thread_freeres
0000000000097140 t __malloc_assert
000000000009a990 t malloc_check
000000000009b720 t __malloc_check_init
0000000000097890 t malloc_consolidate
000000000009b540 t __malloc_fork_lock_parent
000000000009b680 t __malloc_fork_unlock_child
000000000009b5f0 t __malloc_fork_unlock_parent
000000000009d310 T malloc_get_state@GLIBC_2.2.5
00000000003bfbb0 V __malloc_hook
000000000009d720 t mallochook
000000000009baa0 t malloc_hook_ini
000000000009d2d0 t __malloc_info
000000000009d2d0 W malloc_info
0000000000098230 t __malloc_info.part.10
00000000003c2048 V __malloc_initialize_hook@GLIBC_2.2.5
0000000000096e90 t malloc_init_state
0000000000096fb0 t malloc_printerr
000000000009d330 T malloc_set_state@GLIBC_2.2.5
000000000009ce80 t __malloc_stats
000000000009ce80 W malloc_stats
000000000009c9a0 t __malloc_trim
000000000009c9a0 W malloc_trim
000000000009cc70 t __malloc_usable_size
000000000009cc70 W malloc_usable_size
00000000003c20d0 b old_malloc_hook
00000000000977a0 t ptmalloc_init
0000000000097570 t ptmalloc_init.part.0
0000000000099290 t sysmalloc
000000000009e0b0 t tr_mallochook
00000000003c20f8 b tr_old_malloc_hook
00000000003c2068 b using_malloc_checking

[yunwei37]

If you run malloc with kernel eBPF, could it load and attach success?

[liyan-ah]

If you run malloc with kernel eBPF, could it load and attach success?

@yunwei37 It doesn't work.

$ sudo ./malloc
libbpf: loading object 'malloc_bpf' from buffer
libbpf: elf: section(2) .symtab, size 192, link 1, flags 0, type=2
libbpf: elf: section(3) uprobe/libc.so.6:malloc, size 440, link 0, flags 6, type=1
libbpf: sec 'uprobe/libc.so.6:malloc': found program 'do_count' at insn offset 0 (0 bytes), code size 55 insns (440 bytes)
libbpf: elf: section(4) .rodata.str1.1, size 27, link 0, flags 32, type=1
libbpf: elf: section(5) .maps, size 32, link 0, flags 3, type=1
libbpf: elf: section(6) license, size 4, link 0, flags 3, type=1
libbpf: license of malloc_bpf is GPL
libbpf: elf: section(7) .reluprobe/libc.so.6:malloc, size 64, link 2, flags 40, type=9
libbpf: elf: section(8) .BTF, size 1442, link 0, flags 0, type=1
libbpf: elf: section(9) .BTF.ext, size 384, link 0, flags 0, type=1
libbpf: looking for externs among 8 symbols...
libbpf: collected 0 externs total
libbpf: map 'libc_malloc_calls_total': at sec_idx 5, offset 0.
libbpf: map 'libc_malloc_calls_total': found type = 1.
libbpf: map 'libc_malloc_calls_total': found key [8], sz = 4.
libbpf: map 'libc_malloc_calls_total': found value [12], sz = 8.
libbpf: map 'libc_malloc_calls_total': found max_entries = 1024.
libbpf: map '.rodata.str1.1' (global data): at sec_idx 4, offset 0, flags 80.
libbpf: map 1 is ".rodata.str1.1"
libbpf: sec '.reluprobe/libc.so.6:malloc': collecting relocation for section(3) 'uprobe/libc.so.6:malloc'
libbpf: sec '.reluprobe/libc.so.6:malloc': relo #0: insn #24 against 'libc_malloc_calls_total'
libbpf: prog 'do_count': found map 0 (libc_malloc_calls_total, sec 5, off 0) for insn #24
libbpf: sec '.reluprobe/libc.so.6:malloc': relo #1: insn #32 against 'libc_malloc_calls_total'
libbpf: prog 'do_count': found map 0 (libc_malloc_calls_total, sec 5, off 0) for insn #32
libbpf: sec '.reluprobe/libc.so.6:malloc': relo #2: insn #37 against 'libc_malloc_calls_total'
libbpf: prog 'do_count': found map 0 (libc_malloc_calls_total, sec 5, off 0) for insn #37
libbpf: sec '.reluprobe/libc.so.6:malloc': relo #3: insn #49 against 'libc_malloc_calls_total'
libbpf: prog 'do_count': found map 0 (libc_malloc_calls_total, sec 5, off 0) for insn #49
libbpf: map 'libc_malloc_calls_total': created successfully, fd=4
libbpf: map '.rodata.str1.1': failed to create: Invalid argument(-22)
libbpf: failed to load object 'malloc_bpf'
libbpf: failed to load BPF skeleton 'malloc_bpf': -22
Failed to load and verify BPF skeleton

[yunwei37]

Thanks for your information! This is because our malloc example is a simple uprobe program, the sample may not suitable for all systems.

Our goal is to provide compatible with kernel eBPF. Maybe you can try other examples on your system : )

[liyan-ah]

Thanks for your information! This is because our malloc example is a simple uprobe program, the sample may not suitable for all systems.

Our goal is to provide compatible with kernel eBPF. Maybe you can try other examples on your system : )

Got it.