fix(bpf): Match pname as long as 16 bytes #769
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background
之前为了修复 #736, #738 相当于把 dae pname 缩减到 15 字节了,但稍作修改也可让 dae 正确匹配 16 字节 pname。
核心 bug 出在 bpf_core_read_str (bpf_probe_read_user_str),内核的实现是强行在最后一个字节设为 \0:
https://elixir.bootlin.com/linux/v6.6/source/mm/maccess.c#L177
解决办法就是不用 bpf_probe_read_user_str,两处内存都在 bpf 内核态栈里,手动拷贝一下就行了。不能直接用 __builtin_memcpy 是因为 verifier 要安全检查,手动 for 循环里加上
if (ctx.l + i < MAX_ARG_LEN)
糊弄一下即可。(性能也应该更快一点点点)
Checklist
Full Changelogs
Issue Reference
Closes #[issue number]
Test Result